@yielded/auth-persistence-drizzle 0.1.0-beta.17 → 0.1.0-beta.19

package/dist/drizzle/totp-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = Effect.fnUntraced(function* (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    totpPersistence: TotpPersistence.of({\n      snapshot: Effect.fn(\"TotpNative.snapshot\")(\n        function* (input) {\n          const captured = { ...input };\n\n          invariant(captured.moduleId === mapping.moduleId);\n          yield* execution.admit;\n\n          return yield* execution\n            .run(\n              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n              false,\n            )\n            .pipe(Effect.provideService(LifecycleHooks, hooks));\n        },\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          // Detach caller-owned payloads before any driver or hook can suspend.\n          const codec = Schema.toCodecIso(TotpMutation);\n          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n          return execution.admit.pipe(\n            Effect.andThen(\n              execution.run(\n                Effect.gen(function* () {\n                  const decision = yield* mutateTotp(mapping, input),\n                    owner = yield* CurrentTotpTransaction;\n\n                  owner.guards.push(owner.journal.prepare(undefined));\n                  const receipt = prepare(decision, owner.journal);\n\n                  invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                  owner.guards.push(receipt as any);\n\n                  return receipt;\n                }),\n              ),\n            ),\n            Effect.provideService(LifecycleHooks, hooks),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentTotpTransaction,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return yield* services(mapping, execution);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, TotpCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution),\n      (transaction, acquireServices, append) =>\n        Effect.flatMap(acquireServices, (boundServices) =>\n          body(transaction, boundServices, append),\n        ),\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makeTotpTarget = <\n  DatabaseId,\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services,\n        ): Effect.Effect<A, E, Exclude<R, TotpPersistence>> => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) =>\n      makeTargetTotpPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,gCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,WACkE;CAClE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,iBAAiB,gBAAgB,GAAG;EAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;GAChB,MAAM,WAAW,EAAE,GAAG,MAAM;GAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;GAChD,OAAO,UAAU;GAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACA,SAAS,UAAU,YACjB,OAAO,cAAc;GAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;GAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;GAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;IAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;IAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;IAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;IAC7E,MAAM,OAAO,KAAK,OAAc;IAEhC,OAAO;GACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;CAChE,CAAC,EACH;AACF,CAAC;AAED,MAAa,6BAOX,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,MAAM,YAAY,OAAO,yBACvB,wBACA,eACA,aACA,QACF;CAEA,OAAO,OAAO,SAAS,SAAS,SAAS;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,SAAS,IACzC,aAAa,iBAAiB,WAC7B,OAAO,QAAQ,kBAAkB,kBAC/B,KAAK,aAAa,eAAe,MAAM,CACzC,CACJ;AACF,CAAC;;AAOH,MAAa,kBAOX,iBACA,kBACG;CAyDH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qBACE,UACA,QAAQ,SACR,gBAEE,aACA,aACqD;GACrD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,8BACE,YAEA,0BAA0B,SAAS,aAAa,CAAC,CAAC,KAChD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;CACF;AACF"}
+{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { type Crypto, Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = Effect.fnUntraced(function* (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    totpPersistence: TotpPersistence.of({\n      snapshot: Effect.fn(\"TotpNative.snapshot\")(\n        function* (input) {\n          const captured = { ...input };\n\n          invariant(captured.moduleId === mapping.moduleId);\n          yield* execution.admit;\n\n          return yield* execution\n            .run(\n              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n              false,\n            )\n            .pipe(Effect.provideService(LifecycleHooks, hooks));\n        },\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          // Detach caller-owned payloads before any driver or hook can suspend.\n          const codec = Schema.toCodecIso(TotpMutation);\n          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n          return execution.admit.pipe(\n            Effect.andThen(\n              execution.run(\n                Effect.gen(function* () {\n                  const decision = yield* mutateTotp(mapping, input),\n                    owner = yield* CurrentTotpTransaction;\n\n                  owner.guards.push(owner.journal.prepare(undefined));\n                  const receipt = prepare(decision, owner.journal);\n\n                  invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                  owner.guards.push(receipt as any);\n\n                  return receipt;\n                }),\n              ),\n            ),\n            Effect.provideService(LifecycleHooks, hooks),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentTotpTransaction,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return yield* services(mapping, execution);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  TotpCoordinatorError<E>,\n  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase\n> =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution),\n      (transaction, acquireServices, append) =>\n        Effect.flatMap(acquireServices, (boundServices) =>\n          body(transaction, boundServices, append),\n        ),\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode. */\nexport const makeTotpTarget = <\n  DatabaseId,\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | Crypto.Crypto | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services,\n        ): Effect.Effect<A, E, Exclude<R, TotpPersistence>> => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) =>\n      makeTargetTotpPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,gCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,WACkE;CAClE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,iBAAiB,gBAAgB,GAAG;EAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;GAChB,MAAM,WAAW,EAAE,GAAG,MAAM;GAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;GAChD,OAAO,UAAU;GAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACA,SAAS,UAAU,YACjB,OAAO,cAAc;GAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;GAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;GAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;IAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;IAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;IAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;IAC7E,MAAM,OAAO,KAAK,OAAc;IAEhC,OAAO;GACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;CAChE,CAAC,EACH;AACF,CAAC;AAED,MAAa,6BAOX,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,MAAM,YAAY,OAAO,yBACvB,wBACA,eACA,aACA,QACF;CAEA,OAAO,OAAO,SAAS,SAAS,SAAS;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAUA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,SAAS,IACzC,aAAa,iBAAiB,WAC7B,OAAO,QAAQ,kBAAkB,kBAC/B,KAAK,aAAa,eAAe,MAAM,CACzC,CACJ;AACF,CAAC;;AAOH,MAAa,kBAOX,iBACA,kBACG;CA2DH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qBACE,UACA,QAAQ,SACR,gBAEE,aACA,aACqD;GACrD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,8BACE,YAEA,0BAA0B,SAAS,aAAa,CAAC,CAAC,KAChD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;CACF;AACF"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.17","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.17","@yielded/auth-crypto":"0.1.0-beta.17","@yielded/auth-persistence":"0.1.0-beta.17"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}
+{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.19","dependencies":{"@yielded/auth":"0.1.0-beta.19","@yielded/auth-persistence":"0.1.0-beta.19"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","@yielded/crypto":"0.1.0-beta.19","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}

package/src/SqliteDo.ts

@@ -1,18 +1,21 @@
 import { SqliteClient } from "@effect/sql-sqlite-do/SqliteClient";
 import { NativeDatabase, PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
 import type { AnyRelations } from "drizzle-orm";
-import { type EffectSQLiteDoDatabase, makeWithDefaults } from "drizzle-orm/effect-sqlite-do";
+import { makeWithDefaults } from "drizzle-orm/effect-sqlite-do";
+
+import { type DatabaseValue, makeDatabase } from "./drizzle/sqlite-do-database";
+export { type DatabaseValue, type Transaction, makeDatabase } from "./drizzle/sqlite-do-database";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Context, Effect, Layer } from "effect";
 
 import { nativeDatabase } from "./drizzle/native-database";
 
-/** The application-owned Drizzle database used to construct persistence services. */
-export class Database extends Context.Service<Database, EffectSQLiteDoDatabase<AnyRelations>>()(
+/** The application-owned Drizzle queries with Effect SQL transaction ownership. */
+export class Database extends Context.Service<Database, DatabaseValue<AnyRelations>>()(
   "effect-auth/persistence-drizzle/SqliteDo/Database",
 ) {}
 
-/** The SQL-client Layer must configure storage so Drizzle owns transactionSync. */
+/** Construct Drizzle with asynchronous transactions owned by Effect SQL. */
 export const databaseLayer = Layer.effect(
   Database,
   Effect.gen(function* () {
@@ -21,19 +24,22 @@ export const databaseLayer = Layer.effect(
 
     if (storage === undefined)
       return yield* PersistenceConfigurationError.make({
-        reason:
-          "SqliteDo requires a SQL client configured with storage for synchronous transactions",
+        reason: "SqliteDo requires a SQL client configured with Durable Object storage",
       });
 
-    return yield* makeWithDefaults({ storage });
+    return yield* makeDatabase(yield* makeWithDefaults({ storage }));
   }),
 );
 
+import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import type {
   ExternalIdentityTables,
   IdentityTables,
   SubjectProvisioningTables,
 } from "./drizzle/model";
+import { sqlClientPasswordStandaloneGuard } from "./drizzle/password-target";
+import { sqlClientProofStandaloneGuard } from "./drizzle/proof-target";
+import { sqlClientSessionStandaloneGuard } from "./drizzle/session-target";
 import { makeSqliteEmailTarget, sqliteEmailConfiguration } from "./drizzle/sqlite-emails";
 import {
   makeSqliteExternalIdentityServices,
@@ -44,31 +50,36 @@ import { makeSqlitePasswordTarget, sqlitePasswordConfiguration } from "./drizzle
 import { makeSqliteProofTarget, sqliteProofConfiguration } from "./drizzle/sqlite-proofs";
 import { makeSqliteSessionTarget, sqliteSessionConfiguration } from "./drizzle/sqlite-sessions";
 
-const sessionTarget = makeSqliteSessionTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const sessionTarget = makeSqliteSessionTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteSessionConfiguration("synchronous", Effect.void),
+  (service) => sqliteSessionConfiguration("interactive", sqlClientSessionStandaloneGuard(service)),
 );
 
-const proofTarget = makeSqliteProofTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const proofTarget = makeSqliteProofTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteProofConfiguration("synchronous", Effect.void),
+  (service) => sqliteProofConfiguration("interactive", sqlClientProofStandaloneGuard(service)),
 );
 
-const passwordTarget = makeSqlitePasswordTarget<
+const passwordTarget = makeSqlitePasswordTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  true
->(Database, sqlitePasswordConfiguration("synchronous", Effect.void, Effect.void));
+  (service) =>
+    sqlitePasswordConfiguration(
+      "interactive",
+      sqlClientPasswordStandaloneGuard(service),
+      sqlClientProofStandaloneGuard(service),
+    ),
+);
 
-const emailTarget = makeSqliteEmailTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const emailTarget = makeSqliteEmailTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteEmailConfiguration("synchronous", Effect.void, Effect.void),
+  (service) =>
+    sqliteEmailConfiguration(
+      "interactive",
+      sqlClientEmailStandaloneGuard(service),
+      sqlClientProofStandaloneGuard(service),
+    ),
 );
 
-/**
- * Email mutations must own their outer transactionSync. Arbitrary raw Drizzle
- * nesting is not detectable; owner bodies and mapping allocators stay runSync-compatible.
- */
 export const {
   coordinateEmailAddress,
   coordinateEmailRegistration,
@@ -77,11 +88,6 @@ export const {
   makeEmailSignInServices,
 } = emailTarget;
 
-/**
- * Password mutations and registration must own their outer transactionSync.
- * Arbitrary raw Drizzle nesting is not detectable; owner bodies must remain
- * runSync-compatible. Detectable Effect commit scopes are rejected pre-write.
- */
 export const {
   coordinatePasswordPersistence,
   coordinatePasswordRegistration,
@@ -89,21 +95,8 @@ export const {
   makePasswordRegistrationServices,
 } = passwordTarget;
 
-/**
- * Proof mutations and coordinateProofPersistence must own their outermost
- * transactionSync call. The installed driver cannot detect an arbitrary raw
- * Drizzle outer transaction; calling either boundary from one is unsupported.
- * The owner body must remain runSync-compatible.
- */
 export const { coordinateProofPersistence, makeProofPersistenceServices } = proofTarget;
 
-/**
- * Session mutation methods and coordinate* functions must own their outermost
- * transactionSync call. The installed Drizzle driver exposes no context marker
- * for an arbitrary raw outer database.transaction call, so invoking either
- * boundary from one is unsupported and cannot be detected. Detectable Effect
- * commit scopes are rejected before writes.
- */
 export const {
   coordinateAuthenticationAuthority,
   coordinatePendingAuthentication,
@@ -117,7 +110,7 @@ export const {
   makeStatefulSessionServices,
 } = sessionTarget;
 
-export const commitMode = "synchronous" as const;
+export const commitMode = "interactive" as const;
 
 export const makeIdentityServices = <
   Subject extends AnySQLiteTable,
@@ -128,7 +121,7 @@ export const makeIdentityServices = <
 >(
   mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,
 ) =>
-  makeSqliteIdentityServices(mapping, "synchronous").pipe(
+  makeSqliteIdentityServices(mapping, "interactive").pipe(
     Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)),
   );
 
@@ -140,7 +133,7 @@ export const makeSubjectProvisioningServices = <
 >(
   mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,
 ) =>
-  makeSqliteSubjectProvisioningServices(mapping, "synchronous").pipe(
+  makeSqliteSubjectProvisioningServices(mapping, "interactive").pipe(
     Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)),
   );
 
@@ -159,9 +152,14 @@ import { makeSqlitePasswordPreparedTarget } from "./drizzle/sqlite-password-prep
 
 const passwordPreparedTarget = makeSqlitePasswordPreparedTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  true
->(Database, sqlitePasswordConfiguration("synchronous", Effect.void, Effect.void));
+  DatabaseValue<AnyRelations>
+>(Database, (service) =>
+  sqlitePasswordConfiguration(
+    "interactive",
+    sqlClientPasswordStandaloneGuard(service),
+    sqlClientProofStandaloneGuard(service),
+  ),
+);
 
 export const { makePasswordPreparedPersistenceServices, coordinatePasswordPreparedPersistence } =
   passwordPreparedTarget;
@@ -169,17 +167,17 @@ export const { makePasswordPreparedPersistenceServices, coordinatePasswordPrepar
 export { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target";
 
 import { makeOAuthTarget } from "./drizzle/oauth-drivers";
+import { sqlClientOAuthStandaloneGuard } from "./drizzle/oauth-target";
 
 const oauthTarget = makeOAuthTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientOAuthStandaloneGuard,
 });
 
 export const {
@@ -198,18 +196,17 @@ export const {
 } = oauthTarget;
 
 import { makePasskeyTarget } from "./drizzle/passkey-drivers";
+import { sqlClientPasskeyStandaloneGuard } from "./drizzle/passkey-target";
 
 const passkeyTarget = makePasskeyTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientPasskeyStandaloneGuard,
 });
 
 export const {
@@ -225,36 +222,32 @@ export const {
   coordinatePasskeyRegistration,
 } = passkeyTarget;
 
-import { makeTotpTarget } from "./drizzle/totp-target";
+import { makeTotpTarget, sqlClientTotpStandaloneGuard } from "./drizzle/totp-target";
 
 const totpTarget = makeTotpTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientTotpStandaloneGuard,
 });
 
 export const { makeTotpPersistenceServices, coordinateTotpPersistence } = totpTarget;
 
-import { makePhoneTarget } from "./drizzle/phone-target";
+import { makePhoneTarget, sqlClientPhoneStandaloneGuard } from "./drizzle/phone-target";
 
 const phoneTarget = makePhoneTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientPhoneStandaloneGuard,
 });
 
 export const { makePhonePersistenceServices, coordinatePhonePersistence } = phoneTarget;

package/src/drizzle/crypto.ts

@@ -0,0 +1,14 @@
+import { TokenDigest } from "@yielded/auth/Schema";
+import { Crypto, Effect } from "effect";
+import { Base64Url } from "effect/encoding";
+
+const encoder = new TextEncoder();
+
+export const randomId = Effect.flatMap(Crypto.Crypto, (crypto) =>
+  crypto.randomBytes(32).pipe(Effect.map(Base64Url.encode)),
+);
+
+export const digest = (value: string) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) => crypto.digest("SHA-256", encoder.encode(value))).pipe(
+    Effect.map((bytes) => TokenDigest.make(Base64Url.encode(bytes))),
+  );

package/src/drizzle/d1-identity.ts

@@ -1,5 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -382,4 +382,4 @@ export const makeD1IdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeD1SubjectProvisioningServices(mapping)),
     ...(yield* makeD1ExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/d1-oauth.ts

@@ -10,7 +10,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -129,7 +129,10 @@ export function coordinateD1OAuthSignIn<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthSignInPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthSignInPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthSignIn<
@@ -189,7 +192,10 @@ export function coordinateD1OAuthRegistrationIntents<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthRegistrationIntents | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthRegistrationIntents | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistrationIntents<
@@ -244,7 +250,10 @@ export function coordinateD1OAuthAccounts<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthAccountsPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthAccountsPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthAccounts<
@@ -312,7 +321,7 @@ export function coordinateD1OAuthRegistration<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  Exclude<R, TargetId | D1BatchStatements> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistration<

package/src/drizzle/d1-passkey.ts

@@ -9,7 +9,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -94,6 +94,7 @@ export function coordinatePasskeyPersistence<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -156,6 +157,7 @@ export function coordinatePasskeyRegistrationCeremony<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -239,6 +241,7 @@ export function coordinatePasskeyManagement<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -328,6 +331,7 @@ export function coordinatePasskeyRegistration<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | AuthorityId | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup

package/src/drizzle/d1-password-prepared.ts

@@ -209,9 +209,13 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
                   statements: planned.statements.map((statement) =>
                     compactD1GeneratedStatement(database.$client, statement, unavailable),
                   ),
-                  postconditions: planned.postconditions?.map((statement) =>
-                    compactD1GeneratedStatement(database.$client, statement, unavailable),
-                  ),
+                  ...(planned.postconditions === undefined
+                    ? {}
+                    : {
+                        postconditions: planned.postconditions.map((statement) =>
+                          compactD1GeneratedStatement(database.$client, statement, unavailable),
+                        ),
+                      }),
                 }),
                 catch: (cause) =>
                   Schema.is(PasswordUnavailable)(cause)
@@ -418,7 +422,9 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
                     ))),
               receipt: receipt ?? prepare("rejected", journal),
               statements: compiled.statements,
-              postconditions: compiled.postconditions,
+              ...(compiled.postconditions === undefined
+                ? {}
+                : { postconditions: compiled.postconditions }),
             };
           }
 
@@ -520,7 +526,7 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
 
             const now = yield* kernel.readEngineNowMillis(p),
               scope = identifierScope({
-                credential: authority.snapshot,
+                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),
                 revision: authority.revision,
               });
 

package/src/drizzle/d1-passwords.ts

@@ -1622,7 +1622,7 @@ const makePasswordPlans = (
             return {
               receipt: prepare(compiled === undefined ? "rejected" : "changed", journal),
               statements: compiled?.statements ?? [],
-              retryable: compiled?.retryable,
+              ...(compiled?.retryable === undefined ? {} : { retryable: compiled.retryable }),
             };
           }),
         );

package/src/drizzle/d1-phone.ts

@@ -10,7 +10,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -59,6 +59,7 @@ export const coordinatePhonePersistence = <
   A,
   PhoneCoordinatorError<E> | DatabaseError,
   | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | RSetup
   | DatabaseRequirements

package/src/drizzle/d1-sessions.ts

@@ -341,7 +341,11 @@ function runPlanned<A, E, GuardE extends D1PlanError = never>(
   recoverGuard?: Effect.Effect<never, GuardE, CurrentD1PlanningDatabase>,
 ) {
   const planned = plan.pipe(
-    Effect.map((value) => ({ ...value, isConstraintConflict, recoverGuard })),
+    Effect.map((value) => ({
+      ...value,
+      ...(isConstraintConflict === undefined ? {} : { isConstraintConflict }),
+      ...(recoverGuard === undefined ? {} : { recoverGuard }),
+    })),
   );
 
   const execution = Effect.gen(function* () {
@@ -1498,9 +1502,11 @@ export const makeD1StatefulSessions = <Claims>(
           Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))),
         );
 
+        const nextCursor = decoded.length <= input.limit ? undefined : sessions.at(-1)?.sessionId;
+
         return {
           sessions,
-          ...(decoded.length <= input.limit ? {} : { nextCursor: sessions.at(-1)?.sessionId }),
+          ...(nextCursor === undefined ? {} : { nextCursor }),
         };
       }).pipe(terminalD1),
   };

package/src/drizzle/d1-totp.ts

@@ -5,7 +5,7 @@ import { TotpUnavailable, TotpPersistence } from "@yielded/auth/Totp";
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -50,7 +50,11 @@ export const coordinateTotpPersistence = <
 ): Effect.Effect<
   A,
   TotpCoordinatorError<E> | DatabaseError,
-  Exclude<R, TotpPersistence | D1BatchStatements> | LifecycleHooks | RSetup | DatabaseRequirements
+  | Exclude<R, TotpPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | RSetup
+  | DatabaseRequirements
 > =>
   Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetTotp(

package/src/drizzle/mysql-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -331,4 +331,4 @@ export const makeMysqlIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeMysqlSubjectProvisioningServices(mapping)),
     ...(yield* makeMysqlExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);