@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/README.md

@@ -20,6 +20,9 @@ Drizzle Kit generates migrations from managed or application-declared tables.
 Provide `AuthPersistence.migrationsLayer({ migrationsFolder })` explicitly to
 apply those files before starting auth.
 
+SQLite/D1 and PostgreSQL driver modules also expose `OAuthProxyPersistence` for
+[callback proxy storage](../../docs/src/content/docs/reference/oauth.md#callback-server).
+
 Durable Object SQLite uses Effect SQL’s asynchronous transaction owner. Use
 `SqliteDo.databaseLayer` or `SqliteDo.makeDatabase(existingDrizzle)` so cryptography
 can suspend inside the owned transaction; arbitrary raw Drizzle outer

package/dist/D1.d.mts

@@ -1,9 +1,9 @@
 import { D1ExternalIdentityMapping, D1GeneratedIdentityMapping, D1SubjectProvisioningMapping } from "./drizzle/model.mjs";
 import { OAuthD1Mapping } from "./drizzle/oauth-model.mjs";
 import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./drizzle/oauth-connected-model.mjs";
-import { OAuthCoordinatorError } from "./drizzle/oauth-target.mjs";
 import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
 import "./index.mjs";
+import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
 import { Database } from "./drizzle/d1-database.mjs";
 import { D1BatchStatements } from "./drizzle/D1BatchStatements.mjs";
 import { coordinateTotpPersistence, makeTotpPersistenceServices } from "./drizzle/d1-totp.mjs";
@@ -17,8 +17,8 @@ import { coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePa
 import { coordinatePhonePersistence, makePhonePersistenceServices } from "./drizzle/d1-phone.mjs";
 import "./D1.mjs";
 import { Effect, Layer } from "effect";
-import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { D1Client } from "@effect/sql-d1/D1Client";
 //#region src/D1.d.ts
 export declare const makeSubjectProvisioningServices: <Subject extends AnySQLiteTable, Identifier extends AnySQLiteTable, Request extends AnySQLiteTable, NativeId>(mapping: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>) => Effect.Effect<{
@@ -82,6 +82,8 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -151,8 +153,6 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -542,6 +542,8 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -611,8 +613,6 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -1166,7 +1166,7 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
   readonly $client: D1Client;
 }, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & OAuthD1Mapping;
-}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, D1BatchStatements | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>, coordinateOAuthConnectedRevocations: <T extends AnySQLiteTable<{
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, D1BatchStatements | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>, coordinateOAuthConnectedRevocations: <T extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, O extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -1184,9 +1184,9 @@ export declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
   readonly $client: D1Client;
 }, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & OAuthD1Mapping;
-}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, D1BatchStatements | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, D1BatchStatements | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
 /** Construct Drizzle from the driver's SQL-client Layer. */
 export declare const databaseLayer: Layer.Layer<Database, never, D1Client>;
 //#endregion
-export { D1BatchStatements, Database, coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority, coordinateD1EmailAddress as coordinateEmailAddress, coordinateD1EmailRegistration as coordinateEmailRegistration, coordinateD1OAuthAccounts as coordinateOAuthAccounts, coordinateD1OAuthRegistration as coordinateOAuthRegistration, coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents, coordinateD1OAuthSignIn as coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinateD1PasswordPersistence as coordinatePasswordPersistence, coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence, coordinateD1PasswordRegistration as coordinatePasswordRegistration, coordinateD1PendingAuthentication as coordinatePendingAuthentication, coordinatePhonePersistence, coordinateD1ProofPersistence as coordinateProofPersistence, coordinateD1SessionStepUp as coordinateSessionStepUp, coordinateD1SignedSessionValidity as coordinateSignedSessionValidity, coordinateD1StatefulSessions as coordinateStatefulSessions, coordinateTotpPersistence, makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices, makeD1EmailAddressServices as makeEmailAddressServices, makeD1EmailRegistrationServices as makeEmailRegistrationServices, makeD1EmailSignInServices as makeEmailSignInServices, makeD1OAuthAccountsServices as makeOAuthAccountsServices, makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices, makeD1OAuthRegistrationServices as makeOAuthRegistrationServices, makeD1OAuthSignInServices as makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makeD1PasswordPersistenceServices as makePasswordPersistenceServices, makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices, makeD1PasswordRegistrationServices as makePasswordRegistrationServices, makeD1PendingAuthenticationServices as makePendingAuthenticationServices, makePhonePersistenceServices, makeD1ProofPersistenceServices as makeProofPersistenceServices, makeD1SessionStepUpServices as makeSessionStepUpServices, makeD1SignedSessionValidityServices as makeSignedSessionValidityServices, makeD1StatefulSessionServices as makeStatefulSessionServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
+export { D1BatchStatements, Database, OAuthProxyPersistence, coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority, coordinateD1EmailAddress as coordinateEmailAddress, coordinateD1EmailRegistration as coordinateEmailRegistration, coordinateD1OAuthAccounts as coordinateOAuthAccounts, coordinateD1OAuthRegistration as coordinateOAuthRegistration, coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents, coordinateD1OAuthSignIn as coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinateD1PasswordPersistence as coordinatePasswordPersistence, coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence, coordinateD1PasswordRegistration as coordinatePasswordRegistration, coordinateD1PendingAuthentication as coordinatePendingAuthentication, coordinatePhonePersistence, coordinateD1ProofPersistence as coordinateProofPersistence, coordinateD1SessionStepUp as coordinateSessionStepUp, coordinateD1SignedSessionValidity as coordinateSignedSessionValidity, coordinateD1StatefulSessions as coordinateStatefulSessions, coordinateTotpPersistence, makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices, makeD1EmailAddressServices as makeEmailAddressServices, makeD1EmailRegistrationServices as makeEmailRegistrationServices, makeD1EmailSignInServices as makeEmailSignInServices, makeD1OAuthAccountsServices as makeOAuthAccountsServices, makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices, makeD1OAuthRegistrationServices as makeOAuthRegistrationServices, makeD1OAuthSignInServices as makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makeD1PasswordPersistenceServices as makePasswordPersistenceServices, makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices, makeD1PasswordRegistrationServices as makePasswordRegistrationServices, makeD1PendingAuthenticationServices as makePendingAuthenticationServices, makePhonePersistenceServices, makeD1ProofPersistenceServices as makeProofPersistenceServices, makeD1SessionStepUpServices as makeSessionStepUpServices, makeD1SignedSessionValidityServices as makeSignedSessionValidityServices, makeD1StatefulSessionServices as makeStatefulSessionServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
 //# sourceMappingURL=D1.d.mts.map

package/dist/D1.mjs

@@ -1,4 +1,5 @@
 import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
+import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
 import { Database } from "./drizzle/d1-database.mjs";
 import { D1BatchStatements } from "./drizzle/D1BatchStatements.mjs";
 import { coordinateTotpPersistence, makeTotpPersistenceServices } from "./drizzle/d1-totp.mjs";
@@ -28,6 +29,6 @@ const { makeOAuthConnectedServices, makeOAuthConnectedRevocationServices, coordi
 /** Construct Drizzle from the driver's SQL-client Layer. */
 const databaseLayer = Layer.effect(Database, makeWithDefaults({}));
 //#endregion
-export { D1BatchStatements, Database, commitMode, coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority, coordinateD1EmailAddress as coordinateEmailAddress, coordinateD1EmailRegistration as coordinateEmailRegistration, coordinateD1OAuthAccounts as coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateD1OAuthRegistration as coordinateOAuthRegistration, coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents, coordinateD1OAuthSignIn as coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinateD1PasswordPersistence as coordinatePasswordPersistence, coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence, coordinateD1PasswordRegistration as coordinatePasswordRegistration, coordinateD1PendingAuthentication as coordinatePendingAuthentication, coordinatePhonePersistence, coordinateD1ProofPersistence as coordinateProofPersistence, coordinateD1SessionStepUp as coordinateSessionStepUp, coordinateD1SignedSessionValidity as coordinateSignedSessionValidity, coordinateD1StatefulSessions as coordinateStatefulSessions, coordinateTotpPersistence, databaseLayer, makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices, makeD1EmailAddressServices as makeEmailAddressServices, makeD1EmailRegistrationServices as makeEmailRegistrationServices, makeD1EmailSignInServices as makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeD1OAuthAccountsServices as makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices, makeD1OAuthRegistrationServices as makeOAuthRegistrationServices, makeD1OAuthSignInServices as makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makeD1PasswordPersistenceServices as makePasswordPersistenceServices, makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices, makeD1PasswordRegistrationServices as makePasswordRegistrationServices, makeD1PendingAuthenticationServices as makePendingAuthenticationServices, makePhonePersistenceServices, makeD1ProofPersistenceServices as makeProofPersistenceServices, makeD1SessionStepUpServices as makeSessionStepUpServices, makeD1SignedSessionValidityServices as makeSignedSessionValidityServices, makeD1StatefulSessionServices as makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
+export { D1BatchStatements, Database, OAuthProxyPersistence, commitMode, coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority, coordinateD1EmailAddress as coordinateEmailAddress, coordinateD1EmailRegistration as coordinateEmailRegistration, coordinateD1OAuthAccounts as coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateD1OAuthRegistration as coordinateOAuthRegistration, coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents, coordinateD1OAuthSignIn as coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinateD1PasswordPersistence as coordinatePasswordPersistence, coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence, coordinateD1PasswordRegistration as coordinatePasswordRegistration, coordinateD1PendingAuthentication as coordinatePendingAuthentication, coordinatePhonePersistence, coordinateD1ProofPersistence as coordinateProofPersistence, coordinateD1SessionStepUp as coordinateSessionStepUp, coordinateD1SignedSessionValidity as coordinateSignedSessionValidity, coordinateD1StatefulSessions as coordinateStatefulSessions, coordinateTotpPersistence, databaseLayer, makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices, makeD1EmailAddressServices as makeEmailAddressServices, makeD1EmailRegistrationServices as makeEmailRegistrationServices, makeD1EmailSignInServices as makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeD1OAuthAccountsServices as makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices, makeD1OAuthRegistrationServices as makeOAuthRegistrationServices, makeD1OAuthSignInServices as makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makeD1PasswordPersistenceServices as makePasswordPersistenceServices, makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices, makeD1PasswordRegistrationServices as makePasswordRegistrationServices, makeD1PendingAuthenticationServices as makePendingAuthenticationServices, makePhonePersistenceServices, makeD1ProofPersistenceServices as makeProofPersistenceServices, makeD1SessionStepUpServices as makeSessionStepUpServices, makeD1SignedSessionValidityServices as makeSignedSessionValidityServices, makeD1StatefulSessionServices as makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
 
 //# sourceMappingURL=D1.mjs.map

package/dist/D1.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"D1.mjs","names":[],"sources":["../src/D1.ts"],"sourcesContent":["import type { D1Client } from \"@effect/sql-d1/D1Client\";\nexport { makeTotpPersistenceServices, coordinateTotpPersistence } from \"./drizzle/d1-totp\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport { type EffectSQLiteD1Database, makeWithDefaults } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\n\nimport { Database } from \"./drizzle/d1-database\";\nexport { Database } from \"./drizzle/d1-database\";\n\nexport {\n  makeD1OAuthAccountsServices as makeOAuthAccountsServices,\n  makeD1OAuthSignInServices as makeOAuthSignInServices,\n  makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices,\n  makeD1OAuthRegistrationServices as makeOAuthRegistrationServices,\n  coordinateD1OAuthRegistration as coordinateOAuthRegistration,\n  coordinateD1OAuthSignIn as coordinateOAuthSignIn,\n  coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents,\n  coordinateD1OAuthAccounts as coordinateOAuthAccounts,\n} from \"./drizzle/d1-oauth\";\n\nimport {\n  makeD1ExternalIdentityServices,\n  makeD1IdentityServices,\n  makeD1SubjectProvisioningServices,\n} from \"./drizzle/d1-identity\";\n\nexport {\n  coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority,\n  coordinateD1PendingAuthentication as coordinatePendingAuthentication,\n  coordinateD1SignedSessionValidity as coordinateSignedSessionValidity,\n  coordinateD1StatefulSessions as coordinateStatefulSessions,\n  makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices,\n  makeD1PendingAuthenticationServices as makePendingAuthenticationServices,\n  makeD1SignedSessionValidityServices as makeSignedSessionValidityServices,\n  makeD1StatefulSessionServices as makeStatefulSessionServices,\n} from \"./drizzle/d1-sessions\";\n\nexport {\n  coordinateD1ProofPersistence as coordinateProofPersistence,\n  makeD1ProofPersistenceServices as makeProofPersistenceServices,\n} from \"./drizzle/d1-proofs\";\n\nexport {\n  coordinateD1PasswordPersistence as coordinatePasswordPersistence,\n  coordinateD1PasswordRegistration as coordinatePasswordRegistration,\n  makeD1PasswordPersistenceServices as makePasswordPersistenceServices,\n  makeD1PasswordRegistrationServices as makePasswordRegistrationServices,\n} from \"./drizzle/d1-passwords\";\n\nexport {\n  coordinateD1EmailAddress as coordinateEmailAddress,\n  coordinateD1EmailRegistration as coordinateEmailRegistration,\n  makeD1EmailAddressServices as makeEmailAddressServices,\n  makeD1EmailRegistrationServices as makeEmailRegistrationServices,\n  makeD1EmailSignInServices as makeEmailSignInServices,\n} from \"./drizzle/d1-emails\";\n\nimport type {\n  D1GeneratedIdentityMapping,\n  D1SubjectProvisioningMapping,\n  D1ExternalIdentityMapping,\n} from \"./drizzle/model\";\n\nexport const makeSubjectProvisioningServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>,\n) => makeD1SubjectProvisioningServices(mapping);\n\nexport const makeExternalIdentityServices = <\n  Subject extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1ExternalIdentityMapping<Subject, External, NativeId>,\n) => makeD1ExternalIdentityServices(mapping);\n\nexport const commitMode = \"batch\" as const;\n\nexport const makeIdentityServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1GeneratedIdentityMapping<Subject, Identifier, External, Request, NativeId>,\n) => makeD1IdentityServices(mapping);\n\nexport {\n  makeD1SessionStepUpServices as makeSessionStepUpServices,\n  coordinateD1SessionStepUp as coordinateSessionStepUp,\n} from \"./drizzle/d1-sessions\";\n\nexport {\n  makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices,\n  coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence,\n} from \"./drizzle/d1-password-prepared\";\n\nexport { passwordPreparedPersistenceLayer } from \"./drizzle/password-prepared-target\";\n\nimport { Effect, Layer } from \"effect\";\n\nimport { makeD1OAuthConnectedTarget } from \"./drizzle/oauth-connected-drivers\";\nimport type { OAuthD1Mapping } from \"./drizzle/oauth-model\";\n\nconst connectedTarget = makeD1OAuthConnectedTarget<\n  Database,\n  EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client },\n  AnySQLiteTable<{ dialect: \"sqlite\" }>,\n  OAuthD1Mapping\n>(Database, {\n  mode: \"batch\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: () => Effect.void,\n});\n\nexport const {\n  makeOAuthConnectedServices,\n  makeOAuthConnectedRevocationServices,\n  coordinateOAuthConnected,\n  coordinateOAuthConnectedRevocations,\n} = connectedTarget;\n\nexport {\n  makePasskeyCredentialServices,\n  makePasskeyPersistenceServices,\n  makePasskeyEnrollmentContextServices,\n  makePasskeyRegistrationCeremonyServices,\n  coordinatePasskeyPersistence,\n  coordinatePasskeyRegistrationCeremony,\n  makePasskeyManagementServices,\n  makePasskeyRegistrationServices,\n  coordinatePasskeyManagement,\n  coordinatePasskeyRegistration,\n} from \"./drizzle/d1-passkey\";\n\nexport { D1BatchStatements } from \"./drizzle/D1BatchStatements\";\n\nexport { makePhonePersistenceServices, coordinatePhonePersistence } from \"./drizzle/d1-phone\";\n\n/** Construct Drizzle from the driver's SQL-client Layer. */\nexport const databaseLayer = Layer.effect(Database, makeWithDefaults({}));\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAa,mCAMX,YACG,kCAAkC,OAAO;AAE9C,MAAa,gCAKX,YACG,+BAA+B,OAAO;AAE3C,MAAa,aAAa;AAE1B,MAAa,wBAOX,YACG,uBAAuB,OAAO;AA+BnC,MAAa,EACX,4BACA,sCACA,0BACA,wCAhBsB,2BAKtB,UAAU;CACV,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC,CAOI;;AAoBJ,MAAa,gBAAgB,MAAM,OAAO,UAAU,iBAAiB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"D1.mjs","names":[],"sources":["../src/D1.ts"],"sourcesContent":["export { OAuthProxyPersistence } from \"./internal/drizzle-sqlite-oauth-proxy\";\n\nimport type { D1Client } from \"@effect/sql-d1/D1Client\";\nexport { makeTotpPersistenceServices, coordinateTotpPersistence } from \"./drizzle/d1-totp\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport { type EffectSQLiteD1Database, makeWithDefaults } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\n\nimport { Database } from \"./drizzle/d1-database\";\nexport { Database } from \"./drizzle/d1-database\";\n\nexport {\n  makeD1OAuthAccountsServices as makeOAuthAccountsServices,\n  makeD1OAuthSignInServices as makeOAuthSignInServices,\n  makeD1OAuthRegistrationIntentServices as makeOAuthRegistrationIntentServices,\n  makeD1OAuthRegistrationServices as makeOAuthRegistrationServices,\n  coordinateD1OAuthRegistration as coordinateOAuthRegistration,\n  coordinateD1OAuthSignIn as coordinateOAuthSignIn,\n  coordinateD1OAuthRegistrationIntents as coordinateOAuthRegistrationIntents,\n  coordinateD1OAuthAccounts as coordinateOAuthAccounts,\n} from \"./drizzle/d1-oauth\";\n\nimport {\n  makeD1ExternalIdentityServices,\n  makeD1IdentityServices,\n  makeD1SubjectProvisioningServices,\n} from \"./drizzle/d1-identity\";\n\nexport {\n  coordinateD1AuthenticationAuthority as coordinateAuthenticationAuthority,\n  coordinateD1PendingAuthentication as coordinatePendingAuthentication,\n  coordinateD1SignedSessionValidity as coordinateSignedSessionValidity,\n  coordinateD1StatefulSessions as coordinateStatefulSessions,\n  makeD1AuthenticationAuthorityServices as makeAuthenticationAuthorityServices,\n  makeD1PendingAuthenticationServices as makePendingAuthenticationServices,\n  makeD1SignedSessionValidityServices as makeSignedSessionValidityServices,\n  makeD1StatefulSessionServices as makeStatefulSessionServices,\n} from \"./drizzle/d1-sessions\";\n\nexport {\n  coordinateD1ProofPersistence as coordinateProofPersistence,\n  makeD1ProofPersistenceServices as makeProofPersistenceServices,\n} from \"./drizzle/d1-proofs\";\n\nexport {\n  coordinateD1PasswordPersistence as coordinatePasswordPersistence,\n  coordinateD1PasswordRegistration as coordinatePasswordRegistration,\n  makeD1PasswordPersistenceServices as makePasswordPersistenceServices,\n  makeD1PasswordRegistrationServices as makePasswordRegistrationServices,\n} from \"./drizzle/d1-passwords\";\n\nexport {\n  coordinateD1EmailAddress as coordinateEmailAddress,\n  coordinateD1EmailRegistration as coordinateEmailRegistration,\n  makeD1EmailAddressServices as makeEmailAddressServices,\n  makeD1EmailRegistrationServices as makeEmailRegistrationServices,\n  makeD1EmailSignInServices as makeEmailSignInServices,\n} from \"./drizzle/d1-emails\";\n\nimport type {\n  D1GeneratedIdentityMapping,\n  D1SubjectProvisioningMapping,\n  D1ExternalIdentityMapping,\n} from \"./drizzle/model\";\n\nexport const makeSubjectProvisioningServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>,\n) => makeD1SubjectProvisioningServices(mapping);\n\nexport const makeExternalIdentityServices = <\n  Subject extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1ExternalIdentityMapping<Subject, External, NativeId>,\n) => makeD1ExternalIdentityServices(mapping);\n\nexport const commitMode = \"batch\" as const;\n\nexport const makeIdentityServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1GeneratedIdentityMapping<Subject, Identifier, External, Request, NativeId>,\n) => makeD1IdentityServices(mapping);\n\nexport {\n  makeD1SessionStepUpServices as makeSessionStepUpServices,\n  coordinateD1SessionStepUp as coordinateSessionStepUp,\n} from \"./drizzle/d1-sessions\";\n\nexport {\n  makeD1PasswordPreparedPersistenceServices as makePasswordPreparedPersistenceServices,\n  coordinateD1PasswordPreparedPersistence as coordinatePasswordPreparedPersistence,\n} from \"./drizzle/d1-password-prepared\";\n\nexport { passwordPreparedPersistenceLayer } from \"./drizzle/password-prepared-target\";\n\nimport { Effect, Layer } from \"effect\";\n\nimport { makeD1OAuthConnectedTarget } from \"./drizzle/oauth-connected-drivers\";\nimport type { OAuthD1Mapping } from \"./drizzle/oauth-model\";\n\nconst connectedTarget = makeD1OAuthConnectedTarget<\n  Database,\n  EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client },\n  AnySQLiteTable<{ dialect: \"sqlite\" }>,\n  OAuthD1Mapping\n>(Database, {\n  mode: \"batch\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: () => Effect.void,\n});\n\nexport const {\n  makeOAuthConnectedServices,\n  makeOAuthConnectedRevocationServices,\n  coordinateOAuthConnected,\n  coordinateOAuthConnectedRevocations,\n} = connectedTarget;\n\nexport {\n  makePasskeyCredentialServices,\n  makePasskeyPersistenceServices,\n  makePasskeyEnrollmentContextServices,\n  makePasskeyRegistrationCeremonyServices,\n  coordinatePasskeyPersistence,\n  coordinatePasskeyRegistrationCeremony,\n  makePasskeyManagementServices,\n  makePasskeyRegistrationServices,\n  coordinatePasskeyManagement,\n  coordinatePasskeyRegistration,\n} from \"./drizzle/d1-passkey\";\n\nexport { D1BatchStatements } from \"./drizzle/D1BatchStatements\";\n\nexport { makePhonePersistenceServices, coordinatePhonePersistence } from \"./drizzle/d1-phone\";\n\n/** Construct Drizzle from the driver's SQL-client Layer. */\nexport const databaseLayer = Layer.effect(Database, makeWithDefaults({}));\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiEA,MAAa,mCAMX,YACG,kCAAkC,OAAO;AAE9C,MAAa,gCAKX,YACG,+BAA+B,OAAO;AAE3C,MAAa,aAAa;AAE1B,MAAa,wBAOX,YACG,uBAAuB,OAAO;AA+BnC,MAAa,EACX,4BACA,sCACA,0BACA,wCAhBsB,2BAKtB,UAAU;CACV,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC,CAOI;;AAoBJ,MAAa,gBAAgB,MAAM,OAAO,UAAU,iBAAiB,CAAC,CAAC,CAAC"}

package/dist/Libsql.d.mts

@@ -7,16 +7,16 @@ import { PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping } from
 import { AuthenticationAuthorityMapping, PendingAuthenticationMapping, SignedSessionValidityMapping, StatefulSessionMapping } from "./drizzle/session-model.mjs";
 import { PasskeyCredentialMapping, PasskeyEnrollmentContextMapping, PasskeyPersistenceMapping } from "./drizzle/passkey-model.mjs";
 import { SessionStepUpMapping } from "./drizzle/step-up-model.mjs";
-import { OAuthAccountsMapping, OAuthRegistrationAuthority, OAuthRegistrationIntentMapping, OAuthRegistrationMapping, OAuthSignInMapping } from "./drizzle/oauth-model.mjs";
+import { OAuthAccountsMapping, OAuthRegistrationIntentMapping, OAuthRegistrationMapping, OAuthSignInMapping } from "./drizzle/oauth-model.mjs";
 import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./drizzle/oauth-connected-model.mjs";
 import { PasskeyRegistrationCeremonyMapping } from "./drizzle/passkey-registration-ceremony-model.mjs";
 import { EmailRegistrationAuthority } from "./drizzle/email-registration.mjs";
-import { OAuthCoordinatorError } from "./drizzle/oauth-target.mjs";
 import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
 import { TotpMapping, TotpMappingSource, TotpPersistenceServices } from "./drizzle/totp-model.mjs";
 import { PasskeyManagementMapping, PasskeyRegistrationMapping } from "./drizzle/passkey-write-model.mjs";
 import { PhoneMapping, PhoneMappingSource, PhonePersistenceServices } from "./drizzle/phone-model.mjs";
 import "./index.mjs";
+import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
 import { SuppliedService } from "./drizzle/SuppliedService.mjs";
 import { TotpCoordinatorError } from "./drizzle/totp-target.mjs";
 import { PhoneCoordinatorError } from "./drizzle/phone-target.mjs";
@@ -26,8 +26,8 @@ import { SessionUnavailable } from "@yielded/auth/Sessions";
 import { EmailUnavailable } from "@yielded/auth/Email";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
 import { PasswordUnavailable } from "@yielded/auth/Password";
-import { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 //#region src/Libsql.d.ts
 declare const Database_base: Context.ServiceClass<Database, "effect-auth/persistence-drizzle/Libsql/Database", EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>>;
 /** The application-owned Drizzle database used to construct persistence services. */
@@ -88,13 +88,13 @@ export declare const coordinateEmailAddress: {
   };
 }, EmailUnavailable, Database>;
 export declare const coordinatePasswordPersistence: {
-  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
+  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
     readonly proofMapping?: PM;
     readonly transaction?: never;
   }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/Password").PasswordPersistence>>;
-  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
+  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>;
     readonly proofMapping?: PM;
     readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
   }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/Password").PasswordPersistence>>;
@@ -109,26 +109,17 @@ export declare const coordinatePasswordPersistence: {
     readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>>;
     readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
   }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
-}, makePasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<A>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+}, makePasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(mapping: import("@yielded/auth-persistence/Adapter").PasswordPersistenceMapping<DrizzleTableModel<S>, DrizzleTableModel<I>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<M>, NativeId, import("drizzle-orm").SQL<unknown>>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
   passwordPersistence: {
-    readonly prepareAttempt: (input: {
+    readonly findCredential: (input: {
       readonly moduleId: string;
-      readonly action: "sign-in" | "change";
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly attemptLifetimeMillis: number;
-    }) => Effect.Effect<import("@yielded/auth/Password").PasswordAttemptPreparation, PasswordUnavailable>;
-    readonly settleAttempt: <A_1>(input: {
-      readonly moduleId: string;
-      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
-      readonly captured?: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly outcome: import("@yielded/auth/Password").PasswordAttemptDecision;
-      readonly rehash?: {
-        readonly expectedVersion: import("@yielded/auth/Sessions").SecurityRevision;
-        readonly expectedVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-        readonly nextVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-      };
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly rehashIfCurrent: (input: {
+      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
+      readonly nextVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+    }) => Effect.Effect<void, PasswordUnavailable>;
     readonly readForSubject: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -137,19 +128,12 @@ export declare const coordinatePasswordPersistence: {
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
-    readonly addIfAbsent: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
-    readonly replaceIfCurrent: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly addIfAbsent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
+    readonly replaceIfCurrent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
     readonly checkReset: (input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
-    readonly resetWithProof: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput & {
+    readonly resetWithProof: <A>(input: import("@yielded/auth/Password").PasswordMutationInput & {
       readonly completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
-    readonly cleanupAttempts: <A_1>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
   };
 }, PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, makePasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: import("@yielded/auth-persistence/Adapter").PasswordRegistrationAuthority<Registration>;
@@ -260,7 +244,7 @@ export declare const coordinateAuthenticationAuthority: {
   }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | SessionUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, PersistenceId | RepositoryId | TxId>>;
 }, makeAuthenticationAuthorityServices: <Claims, S extends AnySQLiteTable, C extends AnySQLiteTable, F extends AnySQLiteTable, P extends AnySQLiteTable, NativeId>(mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>) => Effect.Effect<{
   authenticationAuthority: {
-    readonly capture: (subjectId: import("@yielded/auth/Schema").SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRevision, import("@yielded/auth/Sessions").StaleAuthentication | SessionUnavailable>;
+    readonly capture: (subjectId: import("@yielded/auth/Schema").SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationCapture, import("@yielded/auth/Sessions").StaleAuthentication | SessionUnavailable>;
     readonly requirements: (evidence: import("@yielded/auth/Sessions").AuthenticationEvidence) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, import("@yielded/auth/Sessions").StaleAuthentication | SessionUnavailable>;
     readonly approve: <A>(input: {
       readonly evidence: import("@yielded/auth/Sessions").AuthenticationEvidence;
@@ -310,17 +294,17 @@ export declare const makeExternalIdentityServices: <Subject extends AnySQLiteTab
     readonly bind: (subjectId: import("@yielded/auth/Schema").SubjectId, identity: import("@yielded/auth/Identity").ExternalIdentity) => Effect.Effect<void, import("@yielded/auth/Identity").IdentityConflict | import("@yielded/auth/Identity").IdentityUnavailable>;
   };
 }, import("@yielded/auth/Identity").IdentityUnavailable, Database>;
-export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
+export declare const makePasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
   passwordPreparedPersistence: import("@yielded/auth/Password").PasswordPreparedPersistence;
 }, PasswordUnavailable, Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinatePasswordPreparedPersistence: {
-  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
+  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
     readonly target: SuppliedService<TargetId, import("@yielded/auth/Password").PasswordPreparedPersistence>;
     readonly transaction?: never;
   }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, DatabaseError | E | import("@yielded/auth/Hooks").HookConfigurationError | PasswordUnavailable | import("effect/sql/SqlError").SqlError, DatabaseRequirements | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
-  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
+  <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
     readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
     readonly target: SuppliedService<TargetId, import("@yielded/auth/Password").PasswordPreparedPersistence>;
     readonly transaction: SuppliedService<TxId, NoInfer<Parameters<Parameters<Database["transaction"]>[0]>[0]>, TxShape>;
@@ -490,8 +474,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Linked";
       readonly credential: {
@@ -513,6 +495,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -550,7 +534,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
@@ -575,7 +559,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
@@ -670,7 +654,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
 }>, R extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, N>(mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>) => Effect.Effect<{
-  registrationAuthority: OAuthRegistrationAuthority<Registration>;
+  registrationAuthority: import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>;
 }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | Database | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateOAuthRegistration: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -688,9 +672,9 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
-    readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;
+    readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId>>;
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, TargetId, Registration, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -707,11 +691,11 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, N, A, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;
-    readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;
+    readonly target: SuppliedService<TargetId, import("@yielded/auth-persistence/Adapter").OAuthRegistrationAuthority<Registration>>;
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TargetId | TxId>>;
 }, coordinateOAuthSignIn: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -726,7 +710,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -742,7 +726,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthSignInPersistence>>;
 }, coordinateOAuthRegistrationIntents: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -761,7 +745,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -781,7 +765,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthRegistrationIntents>>;
 }, coordinateOAuthAccounts: {
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -800,7 +784,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
   <Database extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -820,7 +804,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<Database extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<Database["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthAccountsPersistence>>;
 }, makeOAuthConnectedServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
 }>, AC extends AnySQLiteTable<{
@@ -863,6 +847,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -932,8 +918,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -1323,6 +1307,8 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -1392,8 +1378,6 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
@@ -1947,7 +1931,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
   <D extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, S extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, AC extends AnySQLiteTable<{
@@ -1975,7 +1959,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<D extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedPersistence>>;
 }, coordinateOAuthConnectedRevocations: {
   <D extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
     dialect: "sqlite";
@@ -1994,7 +1978,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
   }>, N, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
     readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N>;
     readonly transaction?: never;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
   <D extends EffectLibsqlDatabase<import("drizzle-orm").TablesRelationalConfig>, T extends AnySQLiteTable<{
     dialect: "sqlite";
   }>, O extends AnySQLiteTable<{
@@ -2014,7 +1998,7 @@ export declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
     readonly transaction: SuppliedService<TxId, NoInfer<D extends {
       readonly transaction: (...args: any[]) => any;
     } ? Parameters<Parameters<D["transaction"]>[0]>[0] : never>, TxShape>;
-  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
+  }, body: Effect.Effect<A, E, R>): Effect.Effect<A, DatabaseError | import("@yielded/auth-persistence/Adapter").OAuthCoordinatorError<E>, DatabaseRequirements | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | Exclude<R, TxId | import("@yielded/auth/OAuth").OAuthConnectedRevocations>>;
 };
 export declare const makePasskeyCredentialServices: <S extends AnySQLiteTable<{
   dialect: "sqlite";
@@ -2366,5 +2350,5 @@ export declare const AuthPersistence: {
   migrationsLayer: (options: import("drizzle-orm/migrator").MigrationConfig) => Layer.Layer<never, import("drizzle-orm/effect-core").EffectDrizzleQueryError | import("drizzle-orm/effect-core").MigratorInitError | import("@yielded/auth-persistence/Adapter").PersistenceConfigurationError | import("effect/sql/SqlError").SqlError, import("@effect/sql-libsql/LibsqlClient").LibsqlClient>;
 };
 //#endregion
-export { passwordPreparedPersistenceLayer };
+export { OAuthProxyPersistence, passwordPreparedPersistenceLayer };
 //# sourceMappingURL=Libsql.d.mts.map

package/dist/Libsql.mjs

@@ -1,5 +1,6 @@
 import { sqlClientOAuthStandaloneGuard } from "./drizzle/oauth-target.mjs";
 import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
+import { OAuthProxyPersistence } from "./internal/drizzle-sqlite-oauth-proxy.mjs";
 import { nativeDatabase } from "./drizzle/native-database.mjs";
 import { makeTotpTarget, sqlClientTotpStandaloneGuard } from "./drizzle/totp-target.mjs";
 import { sqlClientPasskeyStandaloneGuard } from "./drizzle/passkey-target.mjs";
@@ -71,6 +72,6 @@ const AuthPersistence = {
 	migrationsLayer: drizzleMigrationsLayer(makeWithDefaults({}), Effect.promise(() => import("drizzle-orm/effect-libsql/migrator")).pipe(Effect.map((module) => module.migrate)))
 };
 //#endregion
-export { AuthPersistence, Database, commitMode, coordinateAuthenticationAuthority, coordinateEmailAddress, coordinateEmailRegistration, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinatePasswordPersistence, coordinatePasswordPreparedPersistence, coordinatePasswordRegistration, coordinatePendingAuthentication, coordinatePhonePersistence, coordinateProofPersistence, coordinateSessionStepUp, coordinateSignedSessionValidity, coordinateStatefulSessions, coordinateTotpPersistence, databaseLayer, makeAuthenticationAuthorityServices, makeEmailAddressServices, makeEmailRegistrationServices, makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makePasswordPersistenceServices, makePasswordPreparedPersistenceServices, makePasswordRegistrationServices, makePendingAuthenticationServices, makePhonePersistenceServices, makeProofPersistenceServices, makeSessionStepUpServices, makeSignedSessionValidityServices, makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
+export { AuthPersistence, Database, OAuthProxyPersistence, commitMode, coordinateAuthenticationAuthority, coordinateEmailAddress, coordinateEmailRegistration, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinatePasswordPersistence, coordinatePasswordPreparedPersistence, coordinatePasswordRegistration, coordinatePendingAuthentication, coordinatePhonePersistence, coordinateProofPersistence, coordinateSessionStepUp, coordinateSignedSessionValidity, coordinateStatefulSessions, coordinateTotpPersistence, databaseLayer, makeAuthenticationAuthorityServices, makeEmailAddressServices, makeEmailRegistrationServices, makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makePasswordPersistenceServices, makePasswordPreparedPersistenceServices, makePasswordRegistrationServices, makePendingAuthenticationServices, makePhonePersistenceServices, makeProofPersistenceServices, makeSessionStepUpServices, makeSignedSessionValidityServices, makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
 
 //# sourceMappingURL=Libsql.mjs.map