@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/SqliteWasm.d.mts

@@ -73,16 +73,16 @@ export declare const coordinateEmailAddress: {
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, DrizzleTableModel<any>, any, import("drizzle-orm").SQL<unknown>>) => Effect.Effect<{
   registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Email").EmailUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeEmailSignInServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, NativeId>(mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
   emailSignInTargets: {
     readonly lookup: (input: {
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, import("@yielded/auth/Email").EmailUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Email").EmailUnavailable, Database>;
 export declare const coordinatePasswordPersistence: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<RS>, DrizzleTableModel<CE>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -147,9 +147,9 @@ export declare const coordinatePasswordPersistence: {
       readonly hasMore: boolean;
     }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Password").PasswordUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateProofPersistence: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, Rq extends AnySQLiteTable, S extends AnySQLiteTable, G extends AnySQLiteTable, Cn extends AnySQLiteTable, Rs extends AnySQLiteTable, Aev extends AnySQLiteTable, F extends AnySQLiteTable, C extends AnySQLiteTable, Sub extends AnySQLiteTable, I extends AnySQLiteTable, Cr extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: import("@yielded/auth-persistence/Adapter").ProofPersistenceMapping<DrizzleTableModel<Rq>, DrizzleTableModel<S>, DrizzleTableModel<G>, DrizzleTableModel<Cn>, DrizzleTableModel<Rs>, DrizzleTableModel<Aev>, DrizzleTableModel<F>, DrizzleTableModel<C>, DrizzleTableModel<Sub>, DrizzleTableModel<I>, DrizzleTableModel<Cr>, NativeId, import("drizzle-orm").SQL<unknown>>;
@@ -209,7 +209,7 @@ export declare const coordinateProofPersistence: {
       readonly limit: number;
     }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<import("@yielded/auth/Proofs").ProofCleanupResult, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, import("@yielded/auth/Proofs").ProofUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Proofs").ProofUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const coordinateAuthenticationAuthority: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;
@@ -266,11 +266,11 @@ export declare const coordinateAuthenticationAuthority: {
       readonly pending?: import("@yielded/auth/Sessions").PendingConsumption;
     }, prepare: import("@yielded/auth/Sessions").PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/Sessions").StaleAuthentication | import("@yielded/auth/Sessions").PendingAuthenticationInvalid | import("@yielded/auth/Sessions").SessionUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePendingAuthenticationServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, P extends AnySQLiteTable, F extends AnySQLiteTable, NativeId>(mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>) => Effect.Effect<{
   pendingAuthentication: import("@yielded/auth/Sessions").PendingAuthentication<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeSessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>) => Effect.Effect<{
   sessionStepUpPersistence: import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateSessionStepUp: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
     readonly target: SuppliedService<Id, import("@yielded/auth/Sessions").SessionStepUpPersistence<Claims>>;
@@ -283,10 +283,10 @@ export declare const coordinateAuthenticationAuthority: {
   }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | import("@yielded/auth/Sessions").SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, Id | TxId>>;
 }, makeSignedSessionValidityServices: <S extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>) => Effect.Effect<{
   signedSessionValidity: import("@yielded/auth/Sessions").SignedSessionValidity;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeStatefulSessionServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, Session extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>) => Effect.Effect<{
   readonly statefulSessionPersistence: import("@yielded/auth/Sessions").StatefulSessionPersistence<Claims>;
   readonly sessionRepository: import("@yielded/auth/Sessions").SessionRepository;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
+}, import("@yielded/auth/Sessions").SessionUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>;
 export declare const commitMode: "interactive";
 export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, External extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) => Effect.Effect<{
   subjectProvisioner: {
@@ -295,20 +295,20 @@ export declare const makeIdentityServices: <Subject extends AnySQLiteTable, Iden
   externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
   readonly subjectProvisioner: {
     readonly provision: (input: import("@yielded/auth/Identity").SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTable, External extends AnySQLiteTable, NativeId>(mapping: ExternalIdentityTables<Subject, External, NativeId>) => Effect.Effect<{
   readonly externalIdentityMutation: {
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
-}, never, Database>;
+}, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
 export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
   passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
+}, import("@yielded/auth/Password").PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
@@ -586,7 +586,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthSignInServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -628,7 +628,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationIntentServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -651,7 +651,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthRegistrationServices: <Registration, S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -667,7 +667,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
   registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -1054,6 +1054,120 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
+      readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
+    }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
@@ -1695,7 +1809,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makeOAuthConnectedRevocationServices: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1803,7 +1917,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
   };
-}, never, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
+}, import("@yielded/auth/OAuth").OAuthUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthConnected: {
   <D extends EffectSQLiteWasmDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{

package/dist/drizzle/d1-emails.d.mts

@@ -24,7 +24,7 @@ export declare const makeD1EmailSignInServices: <S extends AnySQLiteTable, I ext
       readonly identifier: LoginIdentifier;
     }) => Effect.Effect<Option.Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, EmailUnavailable>;
   };
-}, never, Database$1>;
+}, EmailUnavailable, Database$1>;
 export declare const makeD1EmailAddressServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PRq extends AnySQLiteTable, PS extends AnySQLiteTable, PG extends AnySQLiteTable, PCn extends AnySQLiteTable, PRs extends AnySQLiteTable, PAev extends AnySQLiteTable, PF extends AnySQLiteTable, PC extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId>(mapping: D1EmailAddressMapping<S, I, C, AC, M, NativeId>, proofMapping: D1ProofPersistenceMapping<PRq, PS, PG, PCn, PRs, PAev, PF, PC, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
   emailAddressPersistence: {
     readonly target: (input: {
@@ -44,10 +44,10 @@ export declare const makeD1EmailAddressServices: <S extends AnySQLiteTable, I ex
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
   };
-}, never, Database$1 | LifecycleHooks>;
+}, EmailUnavailable, Database$1 | LifecycleHooks>;
 export declare const makeD1EmailRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, PRq extends AnySQLiteTable, PS extends AnySQLiteTable, PG extends AnySQLiteTable, PCn extends AnySQLiteTable, PRs extends AnySQLiteTable, PAev extends AnySQLiteTable, PF extends AnySQLiteTable, PC extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId>(mapping: D1EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: D1ProofPersistenceMapping<PRq, PS, PG, PCn, PRs, PAev, PF, PC, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
   registrationAuthority: EmailRegistrationAuthority<Registration>;
-}, never, Database$1 | LifecycleHooks>;
+}, EmailUnavailable, Database$1 | LifecycleHooks>;
 type CoordinatorError<E> = E | EmailUnavailable | HookConfigurationError;
 export declare function coordinateD1EmailAddress<S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PRq extends AnySQLiteTable, PS extends AnySQLiteTable, PG extends AnySQLiteTable, PCn extends AnySQLiteTable, PRs extends AnySQLiteTable, PAev extends AnySQLiteTable, PF extends AnySQLiteTable, PC extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: D1EmailAddressMapping<S, I, C, AC, M, NativeId>;

package/dist/drizzle/d1-emails.mjs

@@ -1,10 +1,14 @@
 import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints } from "./email-model.mjs";
-import { PersistenceMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { CurrentEmailSql, currentAddress, decodeEmailSnapshot, emailLookupQuery, sameEmailRevision, snapshotEmailMutation, validEmailSignInConstraints, validateEmailAuthority } from "./email-sql.mjs";
+import { readEmailRegistrationTarget } from "./email-registration.mjs";
 import { Database } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { nativeDatabase } from "./native-database.mjs";
 import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { and, eq, inArray, lte, sql } from "drizzle-orm";
 import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
@@ -65,7 +69,7 @@ const driverValues = (values, entries) => ({
 });
 const allocate = (asynchronous, synchronous) => asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
 	try: synchronous,
-	catch: (cause) => new PersistenceMappingError({
+	catch: (cause) => new PersistenceMappingError$1({
 		operation: "mapping",
 		cause
 	})
@@ -314,6 +318,12 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* (mappin
 		receipt: prepare({ _tag: "Rejected" }, journal),
 		statements: []
 	};
+	const target = mapping.mode === "atomic" ? yield* readEmailRegistrationTarget(mapping, input.identifier, false) : void 0;
+	if (target?._tag === "Rejected") return {
+		receipt: prepare({ _tag: "Rejected" }, journal),
+		statements: []
+	};
+	if (target?._tag === "Reserved" && (allocated.displacedSecurityRevision === void 0 || allocated.displacedSecurityRevision === target.securityRevision || allocated.identifierRevision === target.bindingRevision)) return yield* unavailable();
 	const intent = {
 		moduleId: input.moduleId,
 		commandId: input.commandId,
@@ -358,15 +368,30 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* (mappin
 		};
 		const nativeSubjectId = allocated.nativeSubjectId;
 		desired = { _tag: "Registered" };
+		const i = mapping.identifier;
+		const s = mapping.subject;
+		const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
+		if (target?._tag === "Reserved") statements.push(yield* assertion(and(existsSql(sql`select 1 from ${i.table} where
+          ${column(i.table, i.namespace)}=${sql.param(input.identifier.namespace, column(i.table, i.namespace))}
+          and ${column(i.table, i.value)}=${sql.param(input.identifier.value, column(i.table, i.value))}
+          and ${column(i.table, i.subjectId)}=${sql.param(target.nativeSubjectId, column(i.table, i.subjectId))}
+          and ${column(i.table, i.bindingRevision)}=${sql.param(target.bindingRevision, column(i.table, i.bindingRevision))}
+          and ${column(i.table, i.verifiedAt)} is null`), existsSql(sql`select 1 from ${s.table} where
+          ${column(s.table, s.id)}=${sql.param(target.nativeSubjectId, column(s.table, s.id))}
+          and ${column(s.table, s.securityRevision)}=${sql.param(target.securityRevision, column(s.table, s.securityRevision))}`)), marker));
 		statements.push(yield* statement(database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
 			nativeSubjectId,
 			securityRevision: allocated.securityRevision
-		}))), yield* statement(database.insert(mapping.identifier.table).values(driverValues(mapping.identifier.encodeVerifiedInsert({
+		}))), ...target?._tag === "Reserved" ? [yield* statement(database.update(i.table).set(updateValues([
+			[i.subjectId, nativeSubjectId],
+			[i.verifiedAt, mapping.encodeInstant(transitionMillis)],
+			[i.bindingRevision, allocated.identifierRevision]
+		])).where(and(eq(column(i.table, i.namespace), input.identifier.namespace), eq(column(i.table, i.value), input.identifier.value), eq(column(i.table, i.subjectId), target.nativeSubjectId), eq(column(i.table, i.bindingRevision), target.bindingRevision), sql`${column(i.table, i.verifiedAt)} is null`))), yield* statement(database.update(s.table).set(updateValues([[s.securityRevision, allocated.displacedSecurityRevision]])).where(and(eq(column(s.table, s.id), target.nativeSubjectId), eq(column(s.table, s.securityRevision), target.securityRevision))))] : [yield* statement(database.insert(i.table).values(driverValues(i.encodeVerifiedInsert({
 			identifier: input.identifier,
 			subjectId: nativeSubjectId,
 			verifiedAtMillis: transitionMillis,
 			bindingRevision: allocated.identifierRevision
-		}), [[mapping.identifier.verifiedAt, mapping.encodeInstant(transitionMillis)]]))), yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
+		}), [[i.verifiedAt, mapping.encodeInstant(transitionMillis)]])))], yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
 			moduleId: input.moduleId,
 			subjectId: nativeSubjectId,
 			credentialId: allocated.credentialId,
@@ -398,7 +423,9 @@ const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* (mappin
 		const aSubject = column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId);
 		const aId = column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId);
 		const aRevision = column(mapping.authorityCredential.table, mapping.authorityCredential.revision);
-		applied = and(existsSql(sql`select 1 from ${mapping.subject.table} where ${sId}=${sql.param(nativeSubjectId, sId)} and ${sStatus}=${sql.param(mapping.subject.d1ActiveStatusValue, sStatus)} and ${sRevision}=${sql.param(allocated.securityRevision, sRevision)}`), existsSql(sql`select 1 from ${mapping.identifier.table} where ${iNamespace}=${sql.param(input.identifier.namespace, iNamespace)} and ${iValue}=${sql.param(input.identifier.value, iValue)} and ${iSubject}=${sql.param(nativeSubjectId, iSubject)} and ${iVerifiedAt}=${sql.param(mapping.encodeInstant(transitionMillis), iVerifiedAt)} and ${iRevision}=${sql.param(allocated.identifierRevision, iRevision)} and ${mapping.identifier.d1CurrentCondition({
+		applied = and(target?._tag === "Reserved" ? existsSql(sql`select 1 from ${s.table} where
+            ${sId}=${sql.param(target.nativeSubjectId, sId)}
+            and ${sRevision}=${sql.param(allocated.displacedSecurityRevision, sRevision)}`) : sql`true`, existsSql(sql`select 1 from ${mapping.subject.table} where ${sId}=${sql.param(nativeSubjectId, sId)} and ${sStatus}=${sql.param(mapping.subject.d1ActiveStatusValue, sStatus)} and ${sRevision}=${sql.param(allocated.securityRevision, sRevision)}`), existsSql(sql`select 1 from ${mapping.identifier.table} where ${iNamespace}=${sql.param(input.identifier.namespace, iNamespace)} and ${iValue}=${sql.param(input.identifier.value, iValue)} and ${iSubject}=${sql.param(nativeSubjectId, iSubject)} and ${iVerifiedAt}=${sql.param(mapping.encodeInstant(transitionMillis), iVerifiedAt)} and ${iRevision}=${sql.param(allocated.identifierRevision, iRevision)} and ${mapping.identifier.d1CurrentCondition({
 			identifier: input.identifier,
 			nativeSubjectId,
 			bindingRevision: allocated.identifierRevision
@@ -436,6 +463,7 @@ const makeRegistrationPlans = (mapping, proofMapping) => ({
 		const atomic = mapping.mode === "atomic";
 		const credentialId = atomic ? yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync) : void 0;
 		const securityRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
+		const displacedSecurityRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
 		const identifierRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
 		const credentialRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
 		const nativeSubjectId = atomic && mapping.provisioning.idMode !== "generated" ? yield* allocate(mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync) : void 0;
@@ -443,6 +471,7 @@ const makeRegistrationPlans = (mapping, proofMapping) => ({
 		return yield* registrationPlan(mapping, proofMapping, input, inspected, {
 			...credentialId === void 0 ? {} : { credentialId },
 			...securityRevision === void 0 ? {} : { securityRevision },
+			...displacedSecurityRevision === void 0 ? {} : { displacedSecurityRevision },
 			...identifierRevision === void 0 ? {} : { identifierRevision },
 			...credentialRevision === void 0 ? {} : { credentialRevision },
 			...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
@@ -450,16 +479,20 @@ const makeRegistrationPlans = (mapping, proofMapping) => ({
 		}, prepare);
 	})
 });
-const makeD1EmailSignInServices = (mapping) => Effect.map(Database, (database) => ({ emailSignInTargets: EmailSignInTargets.of({ lookup: (input) => {
+const makeD1EmailSignInServices = (mapping) => Effect.flatMap(nativeDatabase(Database), (database) => validateDrizzleStorage(mapping).pipe(Effect.provideService(NativeDatabase, database), Effect.mapError(unavailable), Effect.as({ emailSignInTargets: EmailSignInTargets.of({ lookup: (input) => {
 	if (!validEmailSignInConstraints(mapping)) return Effect.fail(unavailable());
 	return emailLookupRows(mapping, input.moduleId, input.identifier).pipe(Effect.flatMap((rows) => {
 		const row = rows[0];
 		if (row === void 0) return Effect.succeed(Option.none());
 		return decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row).pipe(Effect.map((snapshot) => snapshot === void 0 ? Option.none() : Option.some(snapshot)));
 	}), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure);
-} }) }));
+} }) })));
 const makeD1EmailAddressServices = Effect.fnUntraced(function* (mapping, proofMapping) {
 	const database = yield* Database;
+	yield* validateDrizzleStorage({
+		...mapping,
+		proof: proofMapping
+	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const plans = makeAddressPlans(mapping, proofMapping);
 	const run = (plan) => Effect.gen(function* () {
@@ -476,6 +509,10 @@ const makeD1EmailAddressServices = Effect.fnUntraced(function* (mapping, proofMa
 });
 const makeD1EmailRegistrationServices = Effect.fnUntraced(function* (mapping, proofMapping) {
 	const database = yield* Database;
+	yield* validateDrizzleStorage({
+		...mapping,
+		proof: proofMapping
+	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const plans = makeRegistrationPlans(mapping, proofMapping);
 	const run = (plan) => Effect.gen(function* () {
@@ -488,7 +525,11 @@ const makeD1EmailRegistrationServices = Effect.fnUntraced(function* (mapping, pr
 	} };
 });
 function coordinateD1EmailAddress(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
+		yield* validateDrizzleStorage({
+			...options.mapping,
+			proof: options.proofMapping
+		}).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		if (yield* hasCommitScope) return yield* unavailable();
 		return (yield* coordinateCommit(() => Effect.gen(function* () {
@@ -525,10 +566,14 @@ function coordinateD1EmailAddress(acquire, options, body) {
 			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
 			return value;
 		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 function coordinateD1EmailRegistration(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
+		yield* validateDrizzleStorage({
+			...options.mapping,
+			proof: options.proofMapping
+		}).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		if (yield* hasCommitScope) return yield* unavailable();
 		return (yield* coordinateCommit(() => Effect.gen(function* () {
@@ -562,7 +607,7 @@ function coordinateD1EmailRegistration(acquire, options, body) {
 			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
 			return value;
 		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
 const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {