@yielded/auth-persistence 0.1.0-beta.10 → 0.1.0-beta.12

package/README.md

@@ -7,13 +7,8 @@ Drizzle integrations live in `@yielded/auth-persistence-drizzle`; this package h
 no Drizzle dependency or exports. Core workflows and replaceable service contracts
 remain in `@yielded/auth`.
 
-`OAuthAppPersistence` separately supplies the single-table store for
-[`OAuthApp`](../../docs/guide/oauth.md#sign-in-and-connect-provider-access).
-It has no dependency on the broader auth schema or a session repository. Apply its
-exported migration with the application's runner and provide an Effect SQL client.
-
 `OAuthServerPersistence` supplies independent, single-table consent and grant
-storage for [MCP authorization](../../docs/guide/oauth.md#authorize-mcp-clients).
+storage for [MCP authorization](../../docs/src/content/docs/guide/oauth.mdx#authorize-mcp-clients).
 Its conditional writes and monotonic revocation require standalone commits.
 
 Applications own subject provisioning, policy, claims, delivery, and their database
@@ -23,5 +18,10 @@ The composed Layer covers password sign-in and management, email address verific
 and changes, phone sign-in, and passkey sign-in and management with stateful sessions
 on PostgreSQL and SQLite. The `/Adapter` module exposes the shared mapping contracts
 and transaction kernels used by companion adapters.
-See [persistence examples](../../docs/reference/adapters.md#runnable-examples) for all
+Its constructors acquire their database through the matching `Current*Sql` or
+`NativeDatabase` service. Provide that dependency during construction only;
+transaction coordinators supply their exact transaction when constructing bound
+services. Keep root database provision outside later operations, where the
+current SQL service identifies an active transaction.
+See [persistence examples](../../docs/src/content/docs/reference/adapters.md#runnable-examples) for all
 four ownership models and their current limits.

package/dist/Adapter.d.mts

@@ -13,7 +13,7 @@ import { requireStandalone } from "./internal/standalone.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, ProofSqlDatabase, ProofSqlQuery, makeProofKernel } from "./internal/proof-kernel.mjs";
 import { CurrentAddress, CurrentEmailSql, EmailSqlConfiguration, EmailSqlDatabase, EmailSqlQuery, makeEmailKernel } from "./internal/email-kernel.mjs";
-import { GuardedUpdate, Observation, Row, TransactionNativeDatabase, TransactionOwner, makeTransactionKernel } from "./internal/transaction-kernel.mjs";
+import { GuardedUpdate, NativeDatabase, Observation, Row, TransactionNativeDatabase, TransactionOwner, makeTransactionKernel } from "./internal/transaction-kernel.mjs";
 import { CurrentPasskeyTransaction, PasskeyOwner } from "./internal/passkey/state.mjs";
 import { TransactionBound, TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration, makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
 import { PasskeyCoordinatorError, PasskeyExecution, PasskeyTargetConfiguration } from "./internal/passkey/target.mjs";
@@ -27,4 +27,4 @@ import { BoundPersistence, ClaimsCodec, Definition, PersistenceApi, PersistenceC
 import { createPersistence } from "./internal/persistence.mjs";
 import { makeComposedPasskeys } from "./internal/passkeys.mjs";
 import { PasswordRegistrationAuthority } from "./internal/registration-contract.mjs";
-export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordChargeTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRateScopeKind, type PasswordRateScopeTable, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordScopeKeys, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };
+export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, NativeDatabase, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordChargeTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRateScopeKind, type PasswordRateScopeTable, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordScopeKeys, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };

package/dist/Adapter.mjs

@@ -5,14 +5,14 @@ import { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requ
 import { requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
 import { CurrentPasskeyTransaction } from "./internal/passkey/state.mjs";
 import { requireStandalone } from "./internal/standalone.mjs";
-import { makeTransactionKernel } from "./internal/transaction-kernel.mjs";
+import { NativeDatabase, makeTransactionKernel } from "./internal/transaction-kernel.mjs";
 import { makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
 import { makePasskeyKernel } from "./internal/passkey-kernel.mjs";
-import { makeComposedPasskeys } from "./internal/passkeys.mjs";
-import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
 import { requiredProofConstraints } from "./internal/models/proof-model.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "./internal/PasswordPreparedPostconditions.mjs";
 import { CurrentProofSql, makeProofKernel } from "./internal/proof-kernel.mjs";
+import { makeComposedPasskeys } from "./internal/passkeys.mjs";
+import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
 import { CurrentEmailSql, makeEmailKernel } from "./internal/email-kernel.mjs";
 import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "./internal/password-kernel.mjs";
@@ -22,4 +22,4 @@ import { CurrentSessionSql, makeSessionKernel } from "./internal/session-kernel.
 import { createPersistence } from "./internal/persistence.mjs";
 import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
 import { requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
-export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };
+export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, NativeDatabase, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };

package/dist/index.d.mts

@@ -2,6 +2,5 @@ import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
-import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
-export { AuthPersistence, OAuthAppPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+export { AuthPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/index.mjs

@@ -2,6 +2,5 @@ import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
-import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
-export { AuthPersistence, OAuthAppPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+export { AuthPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/internal/PasswordPreparedPostconditions.d.mts

@@ -1,8 +1,8 @@
 import { PasswordSqlDatabase } from "./password-kernel.mjs";
 import { Context, Effect } from "effect";
 import { PreparedCommit } from "@yielded/auth/Hooks";
-import { PasswordUnavailable } from "@yielded/auth/Password";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
+import { PasswordUnavailable } from "@yielded/auth/Password";
 //#region src/internal/PasswordPreparedPostconditions.d.ts
 declare const CurrentPasswordPreparedTransaction_base: Context.ServiceClass<CurrentPasswordPreparedTransaction, "effect-auth/drizzle/CurrentPasswordPreparedTransaction", PasswordSqlDatabase>;
 /** Final reads resolve the current physical owner, never a released savepoint. */

package/dist/internal/configuration.d.mts

@@ -1,14 +1,14 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { StorageRole } from "./storage-tables.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
-import { SqlClient } from "effect/unstable/sql";
+import { SqlClient } from "effect/sql";
 import { PasskeyActionChallenge, PasskeyConfig, PasskeyConfigurationError, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
 import { SubjectId } from "@yielded/auth/Schema";
 import { AuthenticationAuthority, AuthenticationRequirement, make } from "@yielded/auth/Sessions";
+import { ProofPersistence } from "@yielded/auth/Proofs";
 import { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
 import { PasswordAction, PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 import { PhoneAdmission, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
-import { ProofPersistence } from "@yielded/auth/Proofs";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 //#region src/internal/configuration.d.ts
 declare const PersistenceConfigurationError_base: Schema.Class<PersistenceConfigurationError, Schema.TaggedStruct<"PersistenceConfigurationError", {

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/unstable/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      :\n          | \"passwords\"\n          | \"passwordAttempts\"\n          | \"passwordScopes\"\n          | \"passwordCharges\"\n          | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    readonly prefix?: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      :\n          | \"passwords\"\n          | \"passwordAttempts\"\n          | \"passwordScopes\"\n          | \"passwordCharges\"\n          | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    readonly prefix?: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/email-kernel.d.mts

@@ -5,10 +5,10 @@ import { ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
 import { Context, DateTime, Effect, Option } from "effect";
 import { LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationRevision, SecurityRevision } from "@yielded/auth/Sessions";
-import { EmailAddressMutation, EmailCredentialSnapshot, EmailUnavailable } from "@yielded/auth/Email";
 import { ProofCompletionInput } from "@yielded/auth/Proofs";
+import { EmailAddressMutation, EmailCredentialSnapshot, EmailUnavailable } from "@yielded/auth/Email";
 import { LoginIdentifier } from "@yielded/auth/Identity";
-import * as SqlError$1 from "effect/unstable/sql/SqlError";
+import * as SqlError$1 from "effect/sql/SqlError";
 //#region src/internal/email-kernel.d.ts
 type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError$1.SqlError;
 type SignInMapping = AnyEmailSignInMapping;
@@ -92,12 +92,12 @@ export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragmen
       }[];
     };
   }> | undefined, EmailUnavailable | PersistenceMappingError, never>;
-  makeSqlEmailSignInTargets: (database: EmailSqlDatabase, mapping: AnyEmailSignInMapping, configuration: EmailSqlConfiguration) => Effect.Effect<{
+  makeSqlEmailSignInTargets: (mapping: AnyEmailSignInMapping, configuration: EmailSqlConfiguration) => Effect.Effect<{
     readonly lookup: (input: {
       readonly moduleId: string;
       readonly identifier: LoginIdentifier;
     }) => Effect.Effect<Option.Option<EmailCredentialSnapshot>, EmailUnavailable>;
-  }, never, never>;
+  }, never, CurrentEmailSql>;
   currentAddress: (mapping: AnyEmailAddressMapping<Fragment>, input: {
     readonly moduleId: string;
     readonly subjectId: string;
@@ -252,7 +252,7 @@ export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragmen
     targetIdentifierRevision?: any;
     eligible: boolean;
   } | undefined, EmailUnavailable | QueryFailure, CurrentEmailSql>;
-  makeSqlEmailAddressPersistence: (database: EmailSqlDatabase, mapping: AnyEmailAddressMapping<Fragment>, configuration: EmailSqlConfiguration) => Effect.Effect<{
+  makeSqlEmailAddressPersistence: (mapping: AnyEmailAddressMapping<Fragment>, configuration: EmailSqlConfiguration) => Effect.Effect<{
     readonly target: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -269,7 +269,7 @@ export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragmen
       readonly removed: number;
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
-  }, never, LifecycleHooks>;
+  }, never, CurrentEmailSql | LifecycleHooks>;
 };
 //#endregion
 //# sourceMappingURL=email-kernel.d.mts.map

package/dist/internal/email-kernel.mjs

@@ -1,12 +1,12 @@
 import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
-import { requiredEmailAddressConstraints, requiredEmailSignInConstraints } from "./models/email-model.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
+import { requiredEmailAddressConstraints, requiredEmailSignInConstraints } from "./models/email-model.mjs";
 import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { assessAuthentication, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable, snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "@yielded/auth/Email";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
+import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable, snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "@yielded/auth/Email";
 //#region src/internal/email-kernel.ts
 var CurrentEmailSql = class extends Context.Service()("effect-auth/CurrentEmailSql") {};
 const makeEmailKernel = (operations, proofs) => {
@@ -138,13 +138,14 @@ const makeEmailKernel = (operations, proofs) => {
 		if (snapshot.moduleId !== moduleId || !sameIdentifier(snapshot.identifier, requested) || snapshot.revision.subjectId !== subjectId || snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] || snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] || snapshot.verifiedAtMillis !== verifiedAtMillis || snapshot.credentialId !== row.credential[mapping.credential.credentialId] || snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]) return void 0;
 		return snapshot;
 	});
-	const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function(database, mapping, configuration) {
-		return Effect.succeed(EmailSignInTargets.of({ lookup: (input) => (validEmailSignInConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
+	const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function* (mapping, configuration) {
+		const database = yield* CurrentEmailSql;
+		return EmailSignInTargets.of({ lookup: (input) => (validEmailSignInConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
 			const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];
 			if (row === void 0) return Option.none();
 			const snapshot = yield* decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row);
 			return snapshot === void 0 ? Option.none() : Option.some(snapshot);
-		})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure) }));
+		})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure) });
 	});
 	const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (mapping, subjectId, locking) {
 		const database = yield* CurrentEmailSql;
@@ -379,7 +380,8 @@ const makeEmailKernel = (operations, proofs) => {
 			return yield* Effect.succeed(prepare("rejected", journal));
 		}));
 	});
-	const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (database, mapping, configuration) {
+	const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (mapping, configuration) {
+		const database = yield* CurrentEmailSql;
 		const hooks = yield* LifecycleHooks;
 		return EmailAddressPersistence.of({
 			target: (input) => (validAddressConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {