@yielded/auth-persistence-drizzle 0.1.0-beta.21 → 0.1.0-beta.23

package/dist/drizzle/d1-proofs.d.mts

@@ -6,11 +6,11 @@ import "./d1-planning.mjs";
 import { AnyRelations, SQL, Table } from "drizzle-orm";
 import { Effect } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
+import { Statement } from "effect/sql/Statement";
 import { PrepareProofCommit, ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofCompletionPlan, ProofDeliveryClaim, ProofDeliveryOutcome, ProofPersistence, ProofPolicy, ProofRequestConflict, ProofUnavailable, ProofVersion } from "@yielded/auth/Proofs";
 import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import "drizzle-orm/effect-core";
-import { Statement } from "effect/sql/Statement";
 import { D1Client } from "@effect/sql-d1/D1Client";
 //#region src/drizzle/d1-proofs.d.ts
 type Database = EffectSQLiteD1Database<AnyRelations> & {

package/dist/drizzle/d1-sessions.d.mts

@@ -9,11 +9,11 @@ import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, DateTime, Effect, Schema } from "effect";
 import { HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationAuthority, AuthenticationEvidence, AuthenticationRequirement, AuthenticationRevision, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionConflict, SessionInvalid, SessionRepository, SessionStepUpInvalid, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import { Statement } from "effect/sql/Statement";
 import { SubjectId } from "@yielded/auth/Schema";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import "drizzle-orm/effect-core";
 import "effect/sql/SqlError";
-import { Statement } from "effect/sql/Statement";
 //#region src/drizzle/d1-sessions.d.ts
 type Database = D1PlanningDatabase;
 type D1DomainError = SessionStepUpInvalid | PendingAuthenticationInvalid | SessionConflict | SessionInvalid | SessionUnavailable | StaleAuthentication;

package/dist/drizzle/mysql-password-prepared.d.mts

@@ -11,17 +11,17 @@ import { SqlError } from "effect/sql/SqlError";
 //#region src/drizzle/mysql-password-prepared.d.ts
 type Database = EffectMysql2Database<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
-export declare const makeMySqlPasswordPreparedPersistenceServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable = AnyMySqlTable, PC extends AnyMySqlTable = AnyMySqlTable, PM extends AnyMySqlTable = AnyMySqlTable, PSub extends AnyMySqlTable = AnyMySqlTable, PI extends AnyMySqlTable = AnyMySqlTable, PCr extends AnyMySqlTable = AnyMySqlTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
+export declare const makeMySqlPasswordPreparedPersistenceServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable = AnyMySqlTable, PC extends AnyMySqlTable = AnyMySqlTable, PM extends AnyMySqlTable = AnyMySqlTable, PSub extends AnyMySqlTable = AnyMySqlTable, PI extends AnyMySqlTable = AnyMySqlTable, PCr extends AnyMySqlTable = AnyMySqlTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
   passwordPreparedPersistence: PasswordPreparedPersistence;
 }, PasswordUnavailable, Database$1 | LifecycleHooks>;
-export declare function coordinateMySqlPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable, PC extends AnyMySqlTable, PM extends AnyMySqlTable, PSub extends AnyMySqlTable, PI extends AnyMySqlTable, PCr extends AnyMySqlTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+export declare function coordinateMySqlPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable, PC extends AnyMySqlTable, PM extends AnyMySqlTable, PSub extends AnyMySqlTable, PI extends AnyMySqlTable, PCr extends AnyMySqlTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
   readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
   readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
   readonly transaction?: never;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements>;
-export declare function coordinateMySqlPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable, PC extends AnyMySqlTable, PM extends AnyMySqlTable, PSub extends AnyMySqlTable, PI extends AnyMySqlTable, PCr extends AnyMySqlTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+export declare function coordinateMySqlPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, T extends AnyMySqlTable, B extends AnyMySqlTable, NativeId, PS extends AnyMySqlTable, PC extends AnyMySqlTable, PM extends AnyMySqlTable, PSub extends AnyMySqlTable, PI extends AnyMySqlTable, PCr extends AnyMySqlTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
   readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
   readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;

package/dist/drizzle/mysql-password-prepared.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mysql-password-prepared.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/mysql-password-prepared.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable, PasswordPreparedPersistence } from \"@yielded/auth/Password\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { Database as DatabaseService } from \"./mysql-database\";\nimport { mysqlPasswordConfiguration as configuration } from \"./mysql-passwords\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasswordPreparedPersistenceMapping,\n  PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport {\n  makeTargetPasswordPreparedPersistenceServices,\n  coordinateTargetPasswordPreparedPersistence,\n} from \"./password-prepared-target\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport { acquireTransactionService, transactionService } from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\ntype Database = EffectMysql2Database<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nexport const makeMySqlPasswordPreparedPersistenceServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable = AnyMySqlTable,\n  PC extends AnyMySqlTable = AnyMySqlTable,\n  PM extends AnyMySqlTable = AnyMySqlTable,\n  PSub extends AnyMySqlTable = AnyMySqlTable,\n  PI extends AnyMySqlTable = AnyMySqlTable,\n  PCr extends AnyMySqlTable = AnyMySqlTable,\n  PNativeId = unknown,\n>(\n  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>,\n  proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) =>\n      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n      ) => {\n        const provided = Context.make(options.target, services.passwordPreparedPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n"],"mappings":";;;;;;;;;AA0BA,MAAa,gDAoBX,SACA,iBAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBACC,8CAA8C,SAAS,eAAe,YAAY,CACtF,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AA0FF,SAAgB,2CA6Bd,SACA,SAQA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,4CACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,2BAA2B;EAClF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}
+{"version":3,"file":"mysql-password-prepared.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/mysql-password-prepared.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable, PasswordPreparedPersistence } from \"@yielded/auth/Password\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { Database as DatabaseService } from \"./mysql-database\";\nimport { mysqlPasswordConfiguration as configuration } from \"./mysql-passwords\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasswordPreparedPersistenceMapping,\n  PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport {\n  makeTargetPasswordPreparedPersistenceServices,\n  coordinateTargetPasswordPreparedPersistence,\n} from \"./password-prepared-target\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport { acquireTransactionService, transactionService } from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\ntype Database = EffectMysql2Database<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nexport const makeMySqlPasswordPreparedPersistenceServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable = AnyMySqlTable,\n  PC extends AnyMySqlTable = AnyMySqlTable,\n  PM extends AnyMySqlTable = AnyMySqlTable,\n  PSub extends AnyMySqlTable = AnyMySqlTable,\n  PI extends AnyMySqlTable = AnyMySqlTable,\n  PCr extends AnyMySqlTable = AnyMySqlTable,\n  PNativeId = unknown,\n>(\n  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>,\n  proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) =>\n      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMySqlPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  B extends AnyMySqlTable,\n  NativeId,\n  PS extends AnyMySqlTable,\n  PC extends AnyMySqlTable,\n  PM extends AnyMySqlTable,\n  PSub extends AnyMySqlTable,\n  PI extends AnyMySqlTable,\n  PCr extends AnyMySqlTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n      ) => {\n        const provided = Context.make(options.target, services.passwordPreparedPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n"],"mappings":";;;;;;;;;AA0BA,MAAa,gDAkBX,SACA,iBAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBACC,8CAA8C,SAAS,eAAe,YAAY,CACtF,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AAsFF,SAAgB,2CA2Bd,SACA,SAQA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,4CACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,2BAA2B;EAClF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}

package/dist/drizzle/mysql-passwords.d.mts

@@ -16,16 +16,16 @@ import { SqlError } from "effect/sql/SqlError";
 //#region src/drizzle/mysql-passwords.d.ts
 type Database = EffectMysql2Database<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
-type Mapping<S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, NativeId> = PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>;
-export declare const makeMysqlPasswordPersistenceServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, NativeId>(mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+type Mapping<S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, NativeId> = PasswordPersistenceMapping<S, I, C, AC, A, M, NativeId>;
+export declare const makeMysqlPasswordPersistenceServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, NativeId>(mapping: Mapping<S, I, C, AC, A, M, NativeId>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
   passwordPersistence: {
-    readonly admitAttempt: <A_1>(input: {
+    readonly prepareAttempt: (input: {
       readonly moduleId: string;
       readonly action: "sign-in" | "change";
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly policy: import("@yielded/auth/Password").PasswordAttemptPolicy;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptAdmission, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+      readonly attemptLifetimeMillis: number;
+    }) => Effect.Effect<import("@yielded/auth/Password").PasswordAttemptPreparation, PasswordUnavailable>;
     readonly settleAttempt: <A_1>(input: {
       readonly moduleId: string;
       readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
@@ -60,13 +60,13 @@ export declare const makeMysqlPasswordPersistenceServices: <S extends AnyMySqlTa
     }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
   };
 }, PasswordUnavailable, Database$1 | LifecycleHooks>;
-export declare function coordinateMysqlPasswordPersistence<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+export declare function coordinateMysqlPasswordPersistence<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: Mapping<S, I, C, AC, A, M, NativeId>;
   readonly proofMapping?: PM;
   readonly transaction?: never;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements>;
-export declare function coordinateMysqlPasswordPersistence<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, RS extends AnyMySqlTable, CE extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+export declare function coordinateMysqlPasswordPersistence<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, A extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: Mapping<S, I, C, AC, A, M, NativeId>;
   readonly proofMapping?: PM;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, PasswordPersistence | TxId> | LifecycleHooks | DatabaseRequirements>;

package/dist/drizzle/mysql-passwords.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mysql-passwords.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/mysql-passwords.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport { type PasswordUnavailable, PasswordPersistence } from \"@yielded/auth/Password\";\n/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { Database as DatabaseService } from \"./mysql-database\";\nimport { nativeDatabase } from \"./native-database\";\nimport type { PasswordPersistenceMapping, PasswordRegistrationMapping } from \"./password-model\";\nimport type { PasswordRegistrationAuthority } from \"./password-registration\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport type { PasswordSqlQuery } from \"./password-sql\";\nimport {\n  coordinateTargetPasswordPersistence,\n  coordinateTargetPasswordRegistration,\n  makeTargetPasswordPersistenceServices,\n  makeTargetPasswordRegistrationServices,\n  sqlClientPasswordStandaloneGuard,\n} from \"./password-target\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\nimport type { ProofSqlQuery } from \"./proof-sql\";\nimport { sqlClientProofStandaloneGuard } from \"./proof-target\";\nimport {\n  type TransactionService,\n  acquireTransactionService,\n  transactionService,\n} from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst configuration = (service: TransactionService | undefined) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientPasswordStandaloneGuard(service),\n  insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) =>\n    query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),\n  generatedSubjectRows: (query: PasswordSqlQuery) => query.$returningId(),\n  proof: {\n    mode: \"interactive\" as const,\n    locking: true,\n    standaloneGuard: sqlClientProofStandaloneGuard(service),\n    insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>\n      query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),\n  },\n});\n\ntype Mapping<\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n> = PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>;\n\nexport const makeMysqlPasswordPersistenceServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>,\n  proofMapping?: ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  RS extends AnyMySqlTable,\n  CE extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPersistence: PasswordPersistence[\"Service\"] },\n      ) => {\n        const provided = Context.make(PasswordPersistence, services.passwordPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport const makeMysqlPasswordRegistrationServices = <\n  Registration,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordRegistration<\n      Registration,\n      TransactionOf<D>,\n      Out,\n      E,\n      Exclude<R, TargetId>\n    >(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },\n      ) => {\n        const provided = Context.make(options.target, services.registrationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport { configuration as mysqlPasswordConfiguration };\n"],"mappings":";;;;;;;;;;AAoCA,MAAM,iBAAiB,aAA6C;CAClE,MAAM;CACN,SAAS;CACT,iBAAiB,iCAAiC,OAAO;CACzD,iBAAiB,OAAyB,SAAiB,cACzD,MAAM,qBAAqB,EAAE,KAAK,GAAG,UAAU,UAAU,EAAE,CAAC;CAC9D,uBAAuB,UAA4B,MAAM,aAAa;CACtE,OAAO;EACL,MAAM;EACN,SAAS;EACT,iBAAiB,8BAA8B,OAAO;EACtD,iBAAiB,OAAsB,SAAiB,cACtD,MAAM,qBAAqB,EAAE,KAAK,GAAG,UAAU,UAAU,EAAE,CAAC;CAChE;AACF;AAcA,MAAa,wCAWX,SACA,iBAeA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,sCAAsC,SAAS,eAAe,YAAY,CAC/F,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AAsEF,SAAgB,mCAsBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,oCACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS,mBAAmB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF;AAEA,MAAa,yCASX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,uCAAqD,SAAS,aAAa,CAChG,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AA8DF,SAAgB,oCAkBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qCAOE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}
+{"version":3,"file":"mysql-passwords.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/mysql-passwords.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport { type PasswordUnavailable, PasswordPersistence } from \"@yielded/auth/Password\";\n/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { Database as DatabaseService } from \"./mysql-database\";\nimport { nativeDatabase } from \"./native-database\";\nimport type { PasswordPersistenceMapping, PasswordRegistrationMapping } from \"./password-model\";\nimport type { PasswordRegistrationAuthority } from \"./password-registration\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport type { PasswordSqlQuery } from \"./password-sql\";\nimport {\n  coordinateTargetPasswordPersistence,\n  coordinateTargetPasswordRegistration,\n  makeTargetPasswordPersistenceServices,\n  makeTargetPasswordRegistrationServices,\n  sqlClientPasswordStandaloneGuard,\n} from \"./password-target\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\nimport type { ProofSqlQuery } from \"./proof-sql\";\nimport { sqlClientProofStandaloneGuard } from \"./proof-target\";\nimport {\n  type TransactionService,\n  acquireTransactionService,\n  transactionService,\n} from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst configuration = (service: TransactionService | undefined) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientPasswordStandaloneGuard(service),\n  insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) =>\n    query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),\n  generatedSubjectRows: (query: PasswordSqlQuery) => query.$returningId(),\n  proof: {\n    mode: \"interactive\" as const,\n    locking: true,\n    standaloneGuard: sqlClientProofStandaloneGuard(service),\n    insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>\n      query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),\n  },\n});\n\ntype Mapping<\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n> = PasswordPersistenceMapping<S, I, C, AC, A, M, NativeId>;\n\nexport const makeMysqlPasswordPersistenceServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: Mapping<S, I, C, AC, A, M, NativeId>,\n  proofMapping?: ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordPersistence<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  A extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  PM extends\n    | ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: Mapping<S, I, C, AC, A, M, NativeId>;\n    readonly proofMapping?: PM;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPersistence: PasswordPersistence[\"Service\"] },\n      ) => {\n        const provided = Context.make(PasswordPersistence, services.passwordPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport const makeMysqlPasswordRegistrationServices = <\n  Registration,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPasswordRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordRegistration<\n      Registration,\n      TransactionOf<D>,\n      Out,\n      E,\n      Exclude<R, TargetId>\n    >(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },\n      ) => {\n        const provided = Context.make(options.target, services.registrationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport { configuration as mysqlPasswordConfiguration };\n"],"mappings":";;;;;;;;;;AAoCA,MAAM,iBAAiB,aAA6C;CAClE,MAAM;CACN,SAAS;CACT,iBAAiB,iCAAiC,OAAO;CACzD,iBAAiB,OAAyB,SAAiB,cACzD,MAAM,qBAAqB,EAAE,KAAK,GAAG,UAAU,UAAU,EAAE,CAAC;CAC9D,uBAAuB,UAA4B,MAAM,aAAa;CACtE,OAAO;EACL,MAAM;EACN,SAAS;EACT,iBAAiB,8BAA8B,OAAO;EACtD,iBAAiB,OAAsB,SAAiB,cACtD,MAAM,qBAAqB,EAAE,KAAK,GAAG,UAAU,UAAU,EAAE,CAAC;CAChE;AACF;AAYA,MAAa,wCASX,SACA,iBAeA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,sCAAsC,SAAS,eAAe,YAAY,CAC/F,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AAkEF,SAAgB,mCAoBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,oCACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS,mBAAmB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF;AAEA,MAAa,yCASX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,uCAAqD,SAAS,aAAa,CAChG,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AA8DF,SAAgB,oCAkBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qCAOE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}

package/dist/drizzle/native-sql-table.mjs

@@ -0,0 +1,110 @@
+import { PersistenceMappingError, makeNativeSqlTables, nativeSqlAlias } from "@yielded/auth-persistence/Adapter";
+import { Param, Placeholder, Table, getTableColumns, is, sql } from "drizzle-orm";
+import { Predicate } from "effect";
+import * as Statement$1 from "effect/sql/Statement";
+//#region src/drizzle/native-sql-table.ts
+const invalid = (cause) => {
+	throw PersistenceMappingError.make({
+		operation: "mapping",
+		cause
+	});
+};
+const capture = (database) => {
+	if (!Predicate.hasProperty(database, "select") || typeof database.select !== "function" || !Predicate.hasProperty(database, "insert") || typeof database.insert !== "function" || !Predicate.hasProperty(database, "update") || typeof database.update !== "function") return invalid("Expected a captured Drizzle database");
+	const selection = database.select();
+	if (!Predicate.hasProperty(selection, "dialect")) return invalid("Expected a captured Drizzle dialect");
+	const dialect = selection.dialect;
+	if (!Predicate.hasProperty(dialect, "escapeName") || typeof dialect.escapeName !== "function" || !Predicate.hasProperty(dialect, "escapeString") || typeof dialect.escapeString !== "function") return invalid("Expected Drizzle dialect escaping methods");
+	if (Predicate.hasProperty(dialect, "codecs") && dialect.codecs !== void 0 && (!Predicate.hasProperty(dialect.codecs, "apply") || typeof dialect.codecs.apply !== "function")) return invalid("Expected Drizzle dialect codecs");
+	return {
+		database,
+		dialect
+	};
+};
+const compileWith = (dialect) => (expression) => {
+	const slots = [];
+	const query = expression.toQuery({
+		escapeName: (name) => {
+			if (name.includes("\0")) return invalid("NUL in SQL identifier");
+			return dialect.escapeName(name);
+		},
+		escapeString: (value) => {
+			if (value.includes("\0")) return invalid("NUL in SQL literal");
+			return dialect.escapeString(value);
+		},
+		escapeParam: (index) => {
+			if (index !== slots.length) return invalid("Invalid Drizzle parameter order");
+			const slot = `yielded_parameter_${index}`;
+			slots.push(slot);
+			return `\0${slot}\0`;
+		},
+		...dialect.codecs === void 0 ? {} : { codecs: dialect.codecs }
+	});
+	const parts = query.sql.split("\0");
+	if (parts.length !== slots.length * 2 + 1 || query.params.length !== slots.length) return invalid("NUL or parameter marker collision in Drizzle SQL");
+	const segments = [];
+	const consumed = /* @__PURE__ */ new Set();
+	for (let offset = 0; offset < parts.length; offset += 2) {
+		segments.push(Statement$1.literal(parts[offset]));
+		if (offset + 1 === parts.length) break;
+		const index = slots.indexOf(parts[offset + 1]);
+		if (index < 0 || consumed.has(index)) return invalid("NUL or parameter marker collision in Drizzle SQL");
+		consumed.add(index);
+		const value = query.params[index];
+		if (is(value, Placeholder) || is(value, Param)) return invalid("Unbound Drizzle placeholder");
+		if (Statement$1.isFragment(value)) segments.push(...value.segments);
+		else segments.push(Statement$1.parameter(value));
+	}
+	return Statement$1.fragment(segments);
+};
+/** Preserve native Statement expressions in writes without applying a column
+* codec to them. Ordinary values still pass through Drizzle's own builders. */
+const writeValues = (values) => Object.fromEntries(Object.entries(values).map(([key, value]) => [key, Statement$1.isFragment(value) ? sql`${sql.param(value)}` : value]));
+/** Capture the root database's compiler, not a later transaction object's
+* client. Call insert/update inside the operation to materialize hooks once. */
+const makeDrizzleSqlTables = (client, capturedDatabase) => {
+	const { database, dialect } = capture(capturedDatabase);
+	const compile = compileWith(dialect);
+	return makeNativeSqlTables(client, (_client, physical) => {
+		if (!is(physical, Table)) return invalid("Expected a Drizzle table");
+		const columns = getTableColumns(physical);
+		const entries = Object.entries(columns);
+		const getColumn = (key) => {
+			const column = Object.hasOwn(columns, key) ? columns[key] : void 0;
+			if (column === void 0) return invalid("Missing Drizzle column");
+			return column;
+		};
+		const bind = (alias) => {
+			const reference = (key) => {
+				const column = getColumn(key);
+				return alias === void 0 ? sql`${column}` : sql`${sql.identifier(alias)}.${sql.identifier(column.name)}`;
+			};
+			return {
+				name: compile(alias === void 0 ? sql`${physical}` : sql`${physical} AS ${sql.identifier(alias)}`),
+				as: bind,
+				column: (key) => compile(reference(key)),
+				fields: (prefix) => compile(sql.join(entries.map(([key, column], index) => {
+					const selection = dialect.codecs === void 0 ? reference(key) : dialect.codecs.apply(column, "cast", reference(key));
+					return sql`${selection} as ${sql.identifier(nativeSqlAlias(prefix, index))}`;
+				}), sql`, `)),
+				decode: (row, prefix) => Object.fromEntries(entries.map(([key, column], index) => {
+					const alias = nativeSqlAlias(prefix, index);
+					if (!Object.hasOwn(row, alias)) return invalid("Missing SQL projection field");
+					const value = row[alias];
+					return [key, value === null ? null : column.mapFromDriverValue(dialect.codecs === void 0 ? value : dialect.codecs.apply(column, "normalize", value))];
+				})),
+				value: (key, value) => {
+					const column = getColumn(key);
+					return Statement$1.isFragment(value) ? value : compile(sql`${sql.param(value, column)}`);
+				},
+				insert: (values) => compile(database.insert(physical).values(writeValues(values)).getSQL()),
+				update: (values) => compile(database.update(physical).set(writeValues(values)).getSQL())
+			};
+		};
+		return bind();
+	});
+};
+//#endregion
+export { makeDrizzleSqlTables };
+
+//# sourceMappingURL=native-sql-table.mjs.map

package/dist/drizzle/native-sql-table.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sql-table.mjs","names":["Statement"],"sources":["../../src/drizzle/native-sql-table.ts"],"sourcesContent":["import {\n  PersistenceMappingError,\n  makeNativeSqlTables,\n  nativeSqlAlias,\n  type NativeSqlTables,\n  type SqlTable,\n} from \"@yielded/auth-persistence/Adapter\";\nimport {\n  getTableColumns,\n  is,\n  Param,\n  Placeholder,\n  type SQL,\n  Table,\n  sql,\n  type BuildQueryConfig,\n  type SQLWrapper,\n} from \"drizzle-orm\";\nimport { Predicate } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport * as Statement from \"effect/sql/Statement\";\n\ntype CapturedDialect = Pick<BuildQueryConfig, \"escapeName\" | \"escapeString\" | \"codecs\">;\n\n/** Foreign compiler boundary only: builders are used to materialize SQL, never\n * executed. The select builder exposes the original dialect even through the\n * Durable Object database projection, which retains bound query methods. */\ninterface CapturedDatabase {\n  readonly select: () => { readonly dialect: CapturedDialect };\n  readonly insert: (table: Table) => {\n    readonly values: (values: Record<string, unknown>) => SQLWrapper;\n  };\n  readonly update: (table: Table) => {\n    readonly set: (values: Record<string, unknown>) => SQLWrapper;\n  };\n}\n\nconst invalid = (cause: string): never => {\n  throw PersistenceMappingError.make({ operation: \"mapping\", cause });\n};\n\nconst capture = (\n  database: object,\n): { readonly database: CapturedDatabase; readonly dialect: CapturedDialect } => {\n  if (\n    !Predicate.hasProperty(database, \"select\") ||\n    typeof database.select !== \"function\" ||\n    !Predicate.hasProperty(database, \"insert\") ||\n    typeof database.insert !== \"function\" ||\n    !Predicate.hasProperty(database, \"update\") ||\n    typeof database.update !== \"function\"\n  )\n    return invalid(\"Expected a captured Drizzle database\");\n\n  const selection: unknown = database.select();\n\n  if (!Predicate.hasProperty(selection, \"dialect\"))\n    return invalid(\"Expected a captured Drizzle dialect\");\n  const dialect = selection.dialect;\n\n  if (\n    !Predicate.hasProperty(dialect, \"escapeName\") ||\n    typeof dialect.escapeName !== \"function\" ||\n    !Predicate.hasProperty(dialect, \"escapeString\") ||\n    typeof dialect.escapeString !== \"function\"\n  )\n    return invalid(\"Expected Drizzle dialect escaping methods\");\n\n  if (\n    Predicate.hasProperty(dialect, \"codecs\") &&\n    dialect.codecs !== undefined &&\n    (!Predicate.hasProperty(dialect.codecs, \"apply\") || typeof dialect.codecs.apply !== \"function\")\n  )\n    return invalid(\"Expected Drizzle dialect codecs\");\n\n  // Drizzle's private dialect and generic query builders are erased only here.\n  return { database: database as CapturedDatabase, dialect: dialect as CapturedDialect };\n};\n\nconst compileWith =\n  (dialect: CapturedDialect) =>\n  (expression: SQL): Statement.Fragment => {\n    const slots: string[] = [];\n\n    const query = expression.toQuery({\n      escapeName: (name) => {\n        if (name.includes(\"\\0\")) return invalid(\"NUL in SQL identifier\");\n\n        return dialect.escapeName(name);\n      },\n      escapeString: (value) => {\n        if (value.includes(\"\\0\")) return invalid(\"NUL in SQL literal\");\n\n        return dialect.escapeString(value);\n      },\n      escapeParam: (index) => {\n        if (index !== slots.length) return invalid(\"Invalid Drizzle parameter order\");\n        const slot = `yielded_parameter_${index}`;\n\n        slots.push(slot);\n\n        return `\\0${slot}\\0`;\n      },\n      ...(dialect.codecs === undefined ? {} : { codecs: dialect.codecs }),\n    });\n\n    // Only compiler-emitted slots are translated. Native Statement parameters\n    // receive their final positions when composed; SQL literals containing $1 or\n    // ? are never inspected or rewritten. NUL is reserved for this compilation.\n    const parts = query.sql.split(\"\\0\");\n\n    if (parts.length !== slots.length * 2 + 1 || query.params.length !== slots.length)\n      return invalid(\"NUL or parameter marker collision in Drizzle SQL\");\n\n    const segments: Statement.Segment[] = [];\n    const consumed = new Set<number>();\n\n    for (let offset = 0; offset < parts.length; offset += 2) {\n      segments.push(Statement.literal(parts[offset]));\n      if (offset + 1 === parts.length) break;\n      const index = slots.indexOf(parts[offset + 1]);\n\n      if (index < 0 || consumed.has(index))\n        return invalid(\"NUL or parameter marker collision in Drizzle SQL\");\n      consumed.add(index);\n      const value: unknown = query.params[index];\n\n      if (is(value, Placeholder) || is(value, Param)) return invalid(\"Unbound Drizzle placeholder\");\n      if (Statement.isFragment(value)) segments.push(...value.segments);\n      else segments.push(Statement.parameter(value));\n    }\n\n    return Statement.fragment(segments);\n  };\n\n/** Preserve native Statement expressions in writes without applying a column\n * codec to them. Ordinary values still pass through Drizzle's own builders. */\nconst writeValues = (values: Readonly<Record<string, unknown>>) =>\n  Object.fromEntries(\n    Object.entries(values).map(([key, value]) => [\n      key,\n      Statement.isFragment(value) ? sql`${sql.param(value)}` : value,\n    ]),\n  );\n\n/** Capture the root database's compiler, not a later transaction object's\n * client. Call insert/update inside the operation to materialize hooks once. */\nexport const makeDrizzleSqlTables = (\n  client: SqlClient,\n  capturedDatabase: object,\n): NativeSqlTables => {\n  const { database, dialect } = capture(capturedDatabase);\n  const compile = compileWith(dialect);\n\n  return makeNativeSqlTables(client, (_client, physical): SqlTable => {\n    if (!is(physical, Table)) return invalid(\"Expected a Drizzle table\");\n    const columns = getTableColumns(physical);\n    const entries = Object.entries(columns);\n\n    const getColumn = (key: string) => {\n      const column = Object.hasOwn(columns, key) ? columns[key] : undefined;\n\n      if (column === undefined) return invalid(\"Missing Drizzle column\");\n\n      return column;\n    };\n\n    const bind = (alias?: string): SqlTable => {\n      const reference = (key: string) => {\n        const column = getColumn(key);\n\n        return alias === undefined\n          ? sql`${column}`\n          : sql`${sql.identifier(alias)}.${sql.identifier(column.name)}`;\n      };\n\n      return {\n        name: compile(\n          alias === undefined ? sql`${physical}` : sql`${physical} AS ${sql.identifier(alias)}`,\n        ),\n        as: bind,\n        column: (key) => compile(reference(key)),\n        fields: (prefix) =>\n          compile(\n            sql.join(\n              entries.map(([key, column], index) => {\n                const selection =\n                  dialect.codecs === undefined\n                    ? reference(key)\n                    : dialect.codecs.apply(column, \"cast\", reference(key));\n\n                return sql`${selection} as ${sql.identifier(nativeSqlAlias(prefix, index))}`;\n              }),\n              sql`, `,\n            ),\n          ),\n        decode: (row, prefix) =>\n          Object.fromEntries(\n            entries.map(([key, column], index) => {\n              const alias = nativeSqlAlias(prefix, index);\n\n              if (!Object.hasOwn(row, alias)) return invalid(\"Missing SQL projection field\");\n              const value = row[alias];\n\n              return [\n                key,\n                value === null\n                  ? null\n                  : column.mapFromDriverValue(\n                      dialect.codecs === undefined\n                        ? value\n                        : dialect.codecs.apply(column, \"normalize\", value),\n                    ),\n              ];\n            }),\n          ),\n        value: (key, value) => {\n          const column = getColumn(key);\n\n          return Statement.isFragment(value) ? value : compile(sql`${sql.param(value, column)}`);\n        },\n        insert: (values) => compile(database.insert(physical).values(writeValues(values)).getSQL()),\n        update: (values) => compile(database.update(physical).set(writeValues(values)).getSQL()),\n      };\n    };\n\n    return bind();\n  });\n};\n"],"mappings":";;;;;AAqCA,MAAM,WAAW,UAAyB;CACxC,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW;CAAM,CAAC;AACpE;AAEA,MAAM,WACJ,aAC+E;CAC/E,IACE,CAAC,UAAU,YAAY,UAAU,QAAQ,KACzC,OAAO,SAAS,WAAW,cAC3B,CAAC,UAAU,YAAY,UAAU,QAAQ,KACzC,OAAO,SAAS,WAAW,cAC3B,CAAC,UAAU,YAAY,UAAU,QAAQ,KACzC,OAAO,SAAS,WAAW,YAE3B,OAAO,QAAQ,sCAAsC;CAEvD,MAAM,YAAqB,SAAS,OAAO;CAE3C,IAAI,CAAC,UAAU,YAAY,WAAW,SAAS,GAC7C,OAAO,QAAQ,qCAAqC;CACtD,MAAM,UAAU,UAAU;CAE1B,IACE,CAAC,UAAU,YAAY,SAAS,YAAY,KAC5C,OAAO,QAAQ,eAAe,cAC9B,CAAC,UAAU,YAAY,SAAS,cAAc,KAC9C,OAAO,QAAQ,iBAAiB,YAEhC,OAAO,QAAQ,2CAA2C;CAE5D,IACE,UAAU,YAAY,SAAS,QAAQ,KACvC,QAAQ,WAAW,KAAA,MAClB,CAAC,UAAU,YAAY,QAAQ,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,UAAU,aAEpF,OAAO,QAAQ,iCAAiC;CAGlD,OAAO;EAAY;EAAuC;CAA2B;AACvF;AAEA,MAAM,eACH,aACA,eAAwC;CACvC,MAAM,QAAkB,CAAC;CAEzB,MAAM,QAAQ,WAAW,QAAQ;EAC/B,aAAa,SAAS;GACpB,IAAI,KAAK,SAAS,IAAI,GAAG,OAAO,QAAQ,uBAAuB;GAE/D,OAAO,QAAQ,WAAW,IAAI;EAChC;EACA,eAAe,UAAU;GACvB,IAAI,MAAM,SAAS,IAAI,GAAG,OAAO,QAAQ,oBAAoB;GAE7D,OAAO,QAAQ,aAAa,KAAK;EACnC;EACA,cAAc,UAAU;GACtB,IAAI,UAAU,MAAM,QAAQ,OAAO,QAAQ,iCAAiC;GAC5E,MAAM,OAAO,qBAAqB;GAElC,MAAM,KAAK,IAAI;GAEf,OAAO,KAAK,KAAK;EACnB;EACA,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CACnE,CAAC;CAKD,MAAM,QAAQ,MAAM,IAAI,MAAM,IAAI;CAElC,IAAI,MAAM,WAAW,MAAM,SAAS,IAAI,KAAK,MAAM,OAAO,WAAW,MAAM,QACzE,OAAO,QAAQ,kDAAkD;CAEnE,MAAM,WAAgC,CAAC;CACvC,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,IAAI,SAAS,GAAG,SAAS,MAAM,QAAQ,UAAU,GAAG;EACvD,SAAS,KAAKA,YAAU,QAAQ,MAAM,OAAO,CAAC;EAC9C,IAAI,SAAS,MAAM,MAAM,QAAQ;EACjC,MAAM,QAAQ,MAAM,QAAQ,MAAM,SAAS,EAAE;EAE7C,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,GACjC,OAAO,QAAQ,kDAAkD;EACnE,SAAS,IAAI,KAAK;EAClB,MAAM,QAAiB,MAAM,OAAO;EAEpC,IAAI,GAAG,OAAO,WAAW,KAAK,GAAG,OAAO,KAAK,GAAG,OAAO,QAAQ,6BAA6B;EAC5F,IAAIA,YAAU,WAAW,KAAK,GAAG,SAAS,KAAK,GAAG,MAAM,QAAQ;OAC3D,SAAS,KAAKA,YAAU,UAAU,KAAK,CAAC;CAC/C;CAEA,OAAOA,YAAU,SAAS,QAAQ;AACpC;;;AAIF,MAAM,eAAe,WACnB,OAAO,YACL,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAC3C,KACAA,YAAU,WAAW,KAAK,IAAI,GAAG,GAAG,IAAI,MAAM,KAAK,MAAM,KAC3D,CAAC,CACH;;;AAIF,MAAa,wBACX,QACA,qBACoB;CACpB,MAAM,EAAE,UAAU,YAAY,QAAQ,gBAAgB;CACtD,MAAM,UAAU,YAAY,OAAO;CAEnC,OAAO,oBAAoB,SAAS,SAAS,aAAuB;EAClE,IAAI,CAAC,GAAG,UAAU,KAAK,GAAG,OAAO,QAAQ,0BAA0B;EACnE,MAAM,UAAU,gBAAgB,QAAQ;EACxC,MAAM,UAAU,OAAO,QAAQ,OAAO;EAEtC,MAAM,aAAa,QAAgB;GACjC,MAAM,SAAS,OAAO,OAAO,SAAS,GAAG,IAAI,QAAQ,OAAO,KAAA;GAE5D,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,wBAAwB;GAEjE,OAAO;EACT;EAEA,MAAM,QAAQ,UAA6B;GACzC,MAAM,aAAa,QAAgB;IACjC,MAAM,SAAS,UAAU,GAAG;IAE5B,OAAO,UAAU,KAAA,IACb,GAAG,GAAG,WACN,GAAG,GAAG,IAAI,WAAW,KAAK,EAAE,GAAG,IAAI,WAAW,OAAO,IAAI;GAC/D;GAEA,OAAO;IACL,MAAM,QACJ,UAAU,KAAA,IAAY,GAAG,GAAG,aAAa,GAAG,GAAG,SAAS,MAAM,IAAI,WAAW,KAAK,GACpF;IACA,IAAI;IACJ,SAAS,QAAQ,QAAQ,UAAU,GAAG,CAAC;IACvC,SAAS,WACP,QACE,IAAI,KACF,QAAQ,KAAK,CAAC,KAAK,SAAS,UAAU;KACpC,MAAM,YACJ,QAAQ,WAAW,KAAA,IACf,UAAU,GAAG,IACb,QAAQ,OAAO,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAAC;KAEzD,OAAO,GAAG,GAAG,UAAU,MAAM,IAAI,WAAW,eAAe,QAAQ,KAAK,CAAC;IAC3E,CAAC,GACD,GAAG,IACL,CACF;IACF,SAAS,KAAK,WACZ,OAAO,YACL,QAAQ,KAAK,CAAC,KAAK,SAAS,UAAU;KACpC,MAAM,QAAQ,eAAe,QAAQ,KAAK;KAE1C,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,GAAG,OAAO,QAAQ,8BAA8B;KAC7E,MAAM,QAAQ,IAAI;KAElB,OAAO,CACL,KACA,UAAU,OACN,OACA,OAAO,mBACL,QAAQ,WAAW,KAAA,IACf,QACA,QAAQ,OAAO,MAAM,QAAQ,aAAa,KAAK,CACrD,CACN;IACF,CAAC,CACH;IACF,QAAQ,KAAK,UAAU;KACrB,MAAM,SAAS,UAAU,GAAG;KAE5B,OAAOA,YAAU,WAAW,KAAK,IAAI,QAAQ,QAAQ,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,GAAG;IACvF;IACA,SAAS,WAAW,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1F,SAAS,WAAW,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,IAAI,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;GACzF;EACF;EAEA,OAAO,KAAK;CACd,CAAC;AACH"}

package/dist/drizzle/oauth-connected-target.d.mts

@@ -1,9 +1,9 @@
 import { OAuthTargetConfiguration } from "./oauth-target.mjs";
 import { Mapping, Revocations, oauth_connected_state_d_exports } from "./oauth-connected-state.mjs";
 import { Crypto, Effect, Layer, Schema } from "effect";
+import { Statement } from "effect/sql/Statement";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
-import { Statement } from "effect/sql/Statement";
 //#region src/drizzle/oauth-connected-target.d.ts
 export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedPersistence: {
@@ -21,10 +21,10 @@ export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, config
       readonly outcome: M.OAuthSignInAccessOutcome;
     }, prepare: PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -477,10 +477,10 @@ export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, config
       readonly nowMillis: number;
     }, prepare: PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/drizzle/oauth-target.d.mts

@@ -6,8 +6,8 @@ import { TransactionCoordinatorError, TransactionTargetConfiguration } from "./t
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, Crypto, Effect, Layer } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Statement } from "effect/sql/Statement";
+import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-target.d.ts
 export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
 export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;

package/dist/drizzle/password-model.d.mts

@@ -1,6 +1,6 @@
 import { DrizzleTableModel } from "./table-model.mjs";
 import * as Shared from "@yielded/auth-persistence/Adapter";
-import { PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordConstraintClassifier, PasswordRateScopeKind, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationState, PasswordScopeKeys, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
+import { PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordConstraintClassifier, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationState, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/password-model.d.ts
 export type PasswordSubjectTable<Subject extends Table, _NativeSubjectId> = Shared.PasswordSubjectTable<DrizzleTableModel<Subject>, _NativeSubjectId>;
@@ -8,17 +8,15 @@ export type PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> =
 export type PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> = Shared.PasswordAuthorityCredentialTable<DrizzleTableModel<Credential>, NativeSubjectId>;
 export type PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.PasswordCredentialTable<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId>;
 export type PasswordAttemptTable<Attempt extends Table, NativeSubjectId> = Shared.PasswordAttemptTable<DrizzleTableModel<Attempt>, NativeSubjectId>;
-export type PasswordRateScopeTable<RateScope extends Table> = Shared.PasswordRateScopeTable<DrizzleTableModel<RateScope>>;
-export type PasswordChargeTable<Charge extends Table> = Shared.PasswordChargeTable<DrizzleTableModel<Charge>>;
 export type PasswordCommandTable<Command extends Table> = Shared.PasswordCommandTable<DrizzleTableModel<Command>>;
 export type PasswordD1Clock = Shared.PasswordD1Clock<SQL>;
-export type PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
-export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.D1PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, NativeSubjectId> = Shared.PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, NativeSubjectId> = Shared.D1PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
 export type PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationTable<Registration, DrizzleTableModel<Request>, NativeSubjectId>;
 export type PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> = Shared.PasswordRegistrationProvisioning<Registration, DrizzleTableModel<Subject>, NativeSubjectId>;
 export type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationMapping<Registration, DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Request>, NativeSubjectId, SQL>;
-export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, unknown>;
 export type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
 //#endregion
-export { type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordConstraintClassifier, type PasswordRateScopeKind, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationState, type PasswordScopeKeys, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+export { type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordConstraintClassifier, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationState, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
 //# sourceMappingURL=password-model.d.mts.map

package/dist/drizzle/password-prepared-model.d.mts

@@ -63,8 +63,8 @@ export declare const requiredPasswordPreparedConstraints: {
   readonly digest: "unique(intent.digest)";
 };
 export type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
-export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
-  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
+  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, NativeSubjectId>;
   readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
   readonly admission: PasswordPreparedAdmissionTable<Admission>;
   readonly constraints: RequiredPasswordPreparedConstraints;
@@ -72,12 +72,12 @@ export interface PasswordPreparedPersistenceMapping<Subject extends Table, Ident
   /** Required by synchronous owners, invoked inside their actual transactionSync. */
   readonly allocateVersionSync?: () => PasswordPreparedVersion;
 }
-export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, Intent, Admission, NativeSubjectId> & {
+export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, Intent, Admission, NativeSubjectId> & {
   /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
   readonly admissionClock: {
     readonly toMillis: (instant: SQL) => SQL;
   };
-  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, NativeSubjectId>;
 };
 /** Optional real proof completion authority. Request/delivery/abuse capabilities
  * are not required to complete the original continuation. */
@@ -87,6 +87,6 @@ export type PasswordPreparedProofMapping<Series extends Table, Continuation exte
 export type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
   readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
 };
-export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
 //#endregion
 //# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}
+{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}

package/dist/drizzle/password-sql.mjs

@@ -1,8 +1,9 @@
+import { makeDrizzleSqlTables } from "./native-sql-table.mjs";
 import { drizzleQueryOperations } from "./query-operations.mjs";
 import { completeProofPlanIn } from "./proof-sql.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "@yielded/auth-persistence/Adapter";
 //#region src/drizzle/password-sql.ts
-const { makeSqlPasswordPersistence, passwordSqlKernel } = makePasswordKernel(drizzleQueryOperations, { completeProofPlanIn });
+const { makeSqlPasswordPersistence, passwordSqlKernel } = makePasswordKernel(drizzleQueryOperations, { completeProofPlanIn }, makeDrizzleSqlTables);
 //#endregion
 export { CurrentPasswordSql, makeSqlPasswordPersistence, passwordSqlKernel };
 

package/dist/drizzle/password-sql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-sql.mjs","names":[],"sources":["../../src/drizzle/password-sql.ts"],"sourcesContent":["import { makePasswordKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { completeProofPlanIn } from \"./proof-sql\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { PasswordSqlQuery } from \"@yielded/auth-persistence/Adapter\";\nexport type { PasswordSqlDatabase } from \"@yielded/auth-persistence/Adapter\";\nexport { CurrentPasswordSql } from \"@yielded/auth-persistence/Adapter\";\nexport type { PasswordSqlConfiguration } from \"@yielded/auth-persistence/Adapter\";\n\nexport const { makeSqlPasswordPersistence, passwordSqlKernel } = makePasswordKernel(\n  drizzleQueryOperations,\n  { completeProofPlanIn },\n);\n"],"mappings":";;;;AASA,MAAa,EAAE,4BAA4B,sBAAsB,mBAC/D,wBACA,EAAE,oBAAoB,CACxB"}
+{"version":3,"file":"password-sql.mjs","names":[],"sources":["../../src/drizzle/password-sql.ts"],"sourcesContent":["import { makePasswordKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { makeDrizzleSqlTables } from \"./native-sql-table\";\nimport { completeProofPlanIn } from \"./proof-sql\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { PasswordSqlQuery } from \"@yielded/auth-persistence/Adapter\";\nexport type { PasswordSqlDatabase } from \"@yielded/auth-persistence/Adapter\";\nexport { CurrentPasswordSql } from \"@yielded/auth-persistence/Adapter\";\n\nexport type { PasswordSqlConfiguration } from \"@yielded/auth-persistence/Adapter\";\n\nexport const { makeSqlPasswordPersistence, passwordSqlKernel } = makePasswordKernel(\n  drizzleQueryOperations,\n  { completeProofPlanIn },\n  makeDrizzleSqlTables,\n);\n"],"mappings":";;;;;AAWA,MAAa,EAAE,4BAA4B,sBAAsB,mBAC/D,wBACA,EAAE,oBAAoB,GACtB,oBACF"}

package/dist/drizzle/password-target.mjs

@@ -2,7 +2,8 @@ import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
 import { CurrentPasswordSql, makeSqlPasswordPersistence } from "./password-sql.mjs";
 import { makeSqlPasswordRegistrationAuthority } from "./password-registration.mjs";
-import { Effect, Layer } from "effect";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "@yielded/auth-persistence/Adapter";
+import { Cause, Effect, Layer } from "effect";
 import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 //#region src/drizzle/password-target.ts
@@ -47,7 +48,17 @@ const coordinateTargetPasswordPersistence = (database, mapping, configuration, p
 		proof: proofMapping
 	}).pipe(Effect.mapError(() => PasswordUnavailable.make({})));
 	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
-		return yield* owner(transaction, { passwordPersistence: yield* makeSqlPasswordPersistence(mapping, passwordOptions(configuration, proofMapping, true)).pipe(Effect.provideService(CurrentPasswordSql, transaction)) });
+		const postconditions = [];
+		let acceptingPostconditions = true;
+		const value = yield* owner(transaction, { passwordPersistence: yield* makeSqlPasswordPersistence(mapping, passwordOptions(configuration, proofMapping, true)).pipe(Effect.provideService(CurrentPasswordSql, transaction)) }).pipe(Effect.provideService(PasswordPreparedPostconditions, { register: (check) => {
+			if (!acceptingPostconditions) return false;
+			postconditions.push(check);
+			return true;
+		} }), Effect.ensuring(Effect.sync(() => {
+			acceptingPostconditions = false;
+		})));
+		for (const check of postconditions) yield* check.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, transaction), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({})))));
+		return value;
 	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
 });
 const coordinateTargetPasswordRegistration = (database, mapping, configuration, owner) => Effect.gen(function* () {