@yielded/auth-persistence 0.1.0-beta.10

package/src/internal/models/session-model.ts

@@ -0,0 +1,375 @@
+import type { TokenDigest } from "@yielded/auth/Schema";
+import {
+  type AuthenticationRequirement,
+  type AuthenticationEvidence,
+  type SecurityRevision,
+  type SessionId,
+  type PendingAuthenticationRecord,
+  type PendingAuthenticationState,
+  type StatefulSessionRecord,
+} from "@yielded/auth/Sessions";
+import type { DateTime, Effect } from "effect";
+
+import type { TableModel as Table, SqlExpression } from "../query-operations";
+import type { PersistenceMappingError, SubjectIdCodec } from "./common";
+
+type ColumnKey<T extends Table> = T["column"];
+
+export interface SessionIdCodec<NativeId> {
+  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;
+  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;
+  readonly equals: (left: NativeId, right: NativeId) => boolean;
+}
+
+export interface SessionSubjectTables<Subject extends Table, NativeId> {
+  readonly subject: {
+    readonly table: Subject["table"];
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly securityRevision: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly decodeRequirement: (
+      row: Subject["select"],
+    ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    readonly nextSecurityRevision?: (
+      current: SecurityRevision,
+    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+}
+
+export interface SessionAuthorityTables<
+  Subject extends Table,
+  Credential extends Table,
+  NativeId,
+> extends SessionSubjectTables<Subject, NativeId> {
+  readonly credential: {
+    readonly table: Credential["table"];
+    readonly subjectId: ColumnKey<Credential>;
+    readonly credentialId: ColumnKey<Credential>;
+    readonly revision: ColumnKey<Credential>;
+    /** Optional consumer status predicate; omitted means every stored credential row is active. */
+    readonly status?: ColumnKey<Credential>;
+    readonly isActiveStatus?: (value: unknown) => boolean;
+  };
+}
+
+export interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
+  readonly flow: {
+    readonly table: Flow["table"];
+    readonly flowId: ColumnKey<Flow>;
+    readonly subjectId: ColumnKey<Flow>;
+    readonly state: ColumnKey<Flow>;
+    readonly pendingDigest: ColumnKey<Flow>;
+    readonly dedupUntil: ColumnKey<Flow>;
+    readonly pendingStateValue: unknown;
+    readonly establishedStateValue: unknown;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (
+      native: unknown,
+    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
+    readonly encodePendingInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly pendingDigest: TokenDigest;
+      readonly dedupUntil: DateTime.Utc;
+    }) => Flow["insert"];
+    readonly encodeEstablishedInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly dedupUntil: DateTime.Utc;
+    }) => Flow["insert"];
+  };
+}
+
+export interface StatefulSessionTables<
+  Claims,
+  Session extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly session: {
+    readonly table: Session["table"];
+    readonly sessionId: ColumnKey<Session>;
+    readonly subjectId: ColumnKey<Session>;
+    readonly digest: ColumnKey<Session>;
+    readonly version: ColumnKey<Session>;
+    readonly securityRevision: ColumnKey<Session>;
+    readonly issuedAt: ColumnKey<Session>;
+    readonly expiresAt: ColumnKey<Session>;
+    readonly absoluteExpiresAt: ColumnKey<Session>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (
+      record: StatefulSessionRecord<Claims>,
+      ids: {
+        readonly subjectId: NativeSubjectId;
+        readonly sessionId: NativeSessionId;
+      },
+    ) => Session["insert"];
+    /** Persist the prepared credentialVersion and retain exact private provenance. */
+    readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<Session["insert"]>;
+    readonly decode: (
+      row: Session["select"],
+    ) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;
+    readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;
+    readonly allocateIdSync?: () => NativeSessionId;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+
+export interface PendingAuthenticationTables<
+  Claims,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly pending: {
+    readonly table: Pending["table"];
+    readonly digest: ColumnKey<Pending>;
+    readonly version: ColumnKey<Pending>;
+    readonly flowId: ColumnKey<Pending>;
+    readonly subjectId: ColumnKey<Pending>;
+    readonly bindingDigest: ColumnKey<Pending>;
+    readonly expiresAt: ColumnKey<Pending>;
+    readonly attemptLimit: ColumnKey<Pending>;
+    readonly failedAttempts: ColumnKey<Pending>;
+    readonly consumed: ColumnKey<Pending>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (
+      record: PendingAuthenticationRecord<Claims>,
+      input: {
+        readonly subjectId: NativeSubjectId;
+        readonly failedAttempts: 0;
+        readonly consumed: false;
+      },
+    ) => Pending["insert"];
+    readonly decode: (
+      row: Pending["select"],
+    ) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;
+    /** Decodes original evidence and storage guards only. The internal pending
+     * context lookup must not execute unrelated consumer Claims transforms. */
+    readonly decodeContext: (
+      row: Pending["select"],
+    ) => Effect.Effect<PendingAuthenticationState, PersistenceMappingError>;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+
+export interface SignedSessionValidityTables<
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> {
+  readonly tombstone: {
+    readonly table: Tombstone["table"];
+    readonly subjectId: ColumnKey<Tombstone>;
+    readonly sessionId: ColumnKey<Tombstone>;
+    readonly absoluteExpiresAt: ColumnKey<Tombstone>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (
+      native: unknown,
+    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
+    readonly encodeInsert: (input: {
+      readonly subjectId: NativeSubjectId;
+      readonly sessionId: NativeSessionId;
+      readonly absoluteExpiresAt: DateTime.Utc;
+    }) => Tombstone["insert"];
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+
+export interface RequiredSessionConstraints {
+  readonly sessionDigest: "unique(session.digest)";
+  readonly flowId: "unique(flow.flowId)";
+}
+
+export interface RequiredPendingAuthenticationConstraints {
+  readonly pendingDigest: "unique(pending.digest)";
+  readonly pendingFlow: "unique(pending.flowId)";
+  readonly flowId: "unique(flow.flowId)";
+}
+
+export interface RequiredStatefulPendingConstraints
+  extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
+
+export interface RequiredSignedValidityConstraints {
+  readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+}
+
+export const requiredSessionConstraints: RequiredSessionConstraints = {
+  sessionDigest: "unique(session.digest)",
+  flowId: "unique(flow.flowId)",
+};
+
+export const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints = {
+  pendingDigest: "unique(pending.digest)",
+  pendingFlow: "unique(pending.flowId)",
+  flowId: "unique(flow.flowId)",
+};
+
+export const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints = {
+  ...requiredSessionConstraints,
+  ...requiredPendingAuthenticationConstraints,
+};
+
+export const requiredSignedValidityConstraints: RequiredSignedValidityConstraints = {
+  tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)",
+};
+
+export interface SessionConstraintClassifier {
+  /**
+   * Match only the named unique constraints declared by this mapping. Broad
+   * SQL/constraint classifiers can relabel application or NOT NULL failures as
+   * a domain conflict.
+   */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+
+export type AuthenticationAuthorityMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &
+  SessionConstraintClassifier &
+  (
+    | {
+        /** Omit for single-factor authority installations. Pending input then fails closed. */
+        readonly pending?: undefined;
+      }
+    | {
+        readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;
+        readonly constraints: RequiredPendingAuthenticationConstraints;
+      }
+  );
+
+export type StatefulSessionMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Session extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &
+  StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> &
+  SessionConstraintClassifier &
+  (
+    | {
+        /** Omit when this session module does not support pending MFA completion. */
+        readonly pending?: undefined;
+        readonly constraints: RequiredSessionConstraints;
+      }
+    | {
+        readonly pending: PendingAuthenticationTables<
+          Claims,
+          Pending,
+          Flow,
+          NativeSubjectId
+        >["pending"];
+        readonly constraints: RequiredStatefulPendingConstraints;
+      }
+  );
+
+export type PendingAuthenticationMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &
+  PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> &
+  SessionConstraintClassifier & {
+    readonly constraints: RequiredPendingAuthenticationConstraints;
+  };
+
+export type SignedSessionValidityMapping<
+  Subject extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = SessionSubjectTables<Subject, NativeSubjectId> &
+  SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> &
+  SessionConstraintClassifier & {
+    readonly constraints: RequiredSignedValidityConstraints;
+  };
+
+/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
+ * `engineNow` must use the exact native representation of every mapped instant
+ * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
+ * Changes to the consumer's factor policy MUST bump subject.securityRevision.
+ * Supply the authoritative primary D1 database, never a replica-affined
+ * `withSession` handle, because verification and security revision reads must
+ * observe completed revocation writes across clients.
+ */
+export interface D1SessionClockMapping<Expression extends SqlExpression = SqlExpression> {
+  readonly d1: {
+    readonly engineNow: Expression;
+    readonly engineNowMillis: Expression;
+    readonly activeSubjectStatusValue: unknown;
+    /** Required when `credential.status` is mapped. */
+    readonly activeCredentialStatusValue?: unknown;
+  };
+}
+
+export type D1AuthenticationAuthorityMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+  Expression extends SqlExpression = SqlExpression,
+> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> &
+  D1SessionClockMapping<Expression>;
+
+export type D1PendingAuthenticationMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+  Expression extends SqlExpression = SqlExpression,
+> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> &
+  D1SessionClockMapping<Expression>;
+
+export type D1StatefulSessionMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Session extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+  Expression extends SqlExpression = SqlExpression,
+> = StatefulSessionMapping<
+  Claims,
+  Subject,
+  Credential,
+  Session,
+  Flow,
+  Pending,
+  NativeSubjectId,
+  NativeSessionId
+> &
+  D1SessionClockMapping<Expression>;
+
+export type D1SignedSessionValidityMapping<
+  Subject extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+  Expression extends SqlExpression = SqlExpression,
+> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> &
+  D1SessionClockMapping<Expression>;

package/src/internal/models/step-up-model.ts

@@ -0,0 +1,135 @@
+import type { SecurityRevision, SessionStepUpIntent } from "@yielded/auth/Sessions";
+import type { DateTime, Effect } from "effect";
+
+import type { TableModel as Table, SqlExpression } from "../query-operations";
+import type { PersistenceMappingError } from "./common";
+import type {
+  D1SessionClockMapping,
+  SessionAuthorityTables,
+  SessionConstraintClassifier,
+  SessionIdCodec,
+  SignedSessionValidityTables,
+  StatefulSessionTables,
+} from "./session-model";
+
+type ColumnKey<T extends Table> = T["column"];
+
+/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
+ * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
+export interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {
+  readonly intent: {
+    readonly table: Intent["table"];
+    readonly digest: ColumnKey<Intent>;
+    readonly version: ColumnKey<Intent>;
+    readonly flowId: ColumnKey<Intent>;
+    readonly subjectId: ColumnKey<Intent>;
+    readonly bindingDigest: ColumnKey<Intent>;
+    readonly snapshot: ColumnKey<Intent>;
+    readonly expiresAt: ColumnKey<Intent>;
+    readonly attemptLimit: ColumnKey<Intent>;
+    readonly failedAttempts: ColumnKey<Intent>;
+    readonly consumed: ColumnKey<Intent>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    /** Consumer fields/defaults; the adapter sets all mapped security columns. */
+    readonly encodeInsert: (
+      intent: SessionStepUpIntent,
+      input: {
+        readonly subjectId: NativeSubjectId;
+      },
+    ) => Intent["insert"];
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+
+export interface RequiredSessionStepUpConstraints {
+  readonly intentDigest: "unique(intent.digest)";
+  readonly intentFlow: "unique(intent.flowId)";
+}
+
+export const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints = {
+  intentDigest: "unique(intent.digest)",
+  intentFlow: "unique(intent.flowId)",
+};
+
+/** Fixed source discriminator is checked against every stored intent. A minimal
+ * pure-signed installation does not provide dummy session or tombstone tables. */
+export type SessionStepUpSourceTables<
+  Claims,
+  Session extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> =
+  | {
+      readonly kind: "StatelessSigned";
+    }
+  | ({
+      readonly kind: "StateAssistedSigned";
+      readonly constraints: {
+        readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+      };
+    } & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>)
+  | {
+      readonly kind: "Stateful";
+      readonly constraints: {
+        readonly sessionDigest: "unique(session.digest)";
+      };
+      readonly sessionId: SessionIdCodec<NativeSessionId>;
+      /** encodeRotation must replace Claims, provenance, and the queryable security
+       * fields together; it must not retain the old proof payload. */
+      readonly session: StatefulSessionTables<
+        Claims,
+        Session,
+        Table,
+        NativeSubjectId,
+        NativeSessionId
+      >["session"] & {
+        readonly credentialVersion: ColumnKey<Session>;
+        readonly authenticatedAt: ColumnKey<Session>;
+      };
+    };
+
+export type SessionStepUpMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Intent extends Table,
+  Session extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &
+  SessionStepUpIntentTables<Intent, NativeSubjectId> &
+  SessionConstraintClassifier & {
+    readonly source: SessionStepUpSourceTables<
+      Claims,
+      Session,
+      Tombstone,
+      NativeSubjectId,
+      NativeSessionId
+    >;
+    readonly constraints: RequiredSessionStepUpConstraints;
+  };
+
+export type D1SessionStepUpMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Intent extends Table,
+  Session extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+  Expression extends SqlExpression = SqlExpression,
+> = SessionStepUpMapping<
+  Claims,
+  Subject,
+  Credential,
+  Intent,
+  Session,
+  Tombstone,
+  NativeSubjectId,
+  NativeSessionId
+> &
+  D1SessionClockMapping<Expression>;

package/src/internal/oauth-app.ts

@@ -0,0 +1,82 @@
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence, Record } from "@yielded/auth/OAuthApp";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { requireStandalone } from "./standalone";
+
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({ payload: Schema.String, version: Schema.String });
+
+/** Apply with the application's migrations. SQLite (including D1) and PostgreSQL.
+ * Each transition is one conditional statement, so D1 needs no interactive
+ * transaction and parallel workers share the same refresh/code claim.
+ */
+const migration = `CREATE TABLE yielded_oauth_app (
+  namespace TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  version TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, record_key)
+)`;
+
+const layer = Layer.effect(
+  Persistence,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+      return yield* OAuthUnavailable.make({});
+
+    const noTransaction = requireStandalone(() => OAuthUnavailable.make({}), sql);
+
+    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+
+    return Persistence.of({
+      get: Effect.fn("OAuthAppPersistence.get")(function* (namespace, key) {
+        yield* noTransaction;
+
+        const rows = yield* sql<{
+          payload: string;
+          version: string;
+        }>`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;
+
+        if (rows.length === 0) return undefined;
+        if (rows.length !== 1) return yield* OAuthUnavailable.make({});
+        const row = yield* Schema.decodeEffect(Row)(rows[0]);
+        const value = yield* Schema.decodeEffect(codec)(row.payload);
+
+        if (value.version !== row.version) return yield* OAuthUnavailable.make({});
+
+        return value;
+      }, failure),
+      insert: Effect.fn("OAuthAppPersistence.insert")(function* (namespace, key, value) {
+        yield* noTransaction;
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      compareAndSet: Effect.fn("OAuthAppPersistence.compareAndSet")(function* (
+        namespace,
+        key,
+        version,
+        value,
+      ) {
+        yield* noTransaction;
+        if (value.version === version) return yield* OAuthUnavailable.make({});
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+    });
+  }),
+);
+
+export const OAuthAppPersistence = { layer, migration };

package/src/internal/oauth-server.ts

@@ -0,0 +1,89 @@
+import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { requireStandalone } from "./standalone";
+
+const codec = Schema.fromJsonString(Record);
+
+const Row = Schema.Struct({
+  payload: Schema.String,
+  version: Schema.String,
+  revoked: Schema.Literals([0, 1]),
+});
+
+/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.
+ * Expired records may be deleted when expires_at_millis <= the current time.
+ * Revocation has its own monotonic column so it cannot lose a race with rotation.
+ */
+const migration = `CREATE TABLE yielded_oauth_server (
+  namespace TEXT NOT NULL,
+  grant_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at_millis BIGINT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, grant_id)
+)`;
+
+const layer = Layer.effect(
+  Persistence,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+      return yield* Unavailable.make({});
+    const standalone = requireStandalone(() => Unavailable.make({}), sql);
+
+    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.mapError(() => Unavailable.make({})));
+
+    return Persistence.of({
+      get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {
+        yield* standalone;
+
+        const rows =
+          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;
+
+        if (rows.length === 0) return undefined;
+        if (rows.length !== 1) return yield* Unavailable.make({});
+        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);
+        const record = yield* Schema.decodeEffect(codec)(row.payload);
+
+        if (record.version !== row.version) return yield* Unavailable.make({});
+
+        return row.revoked === 1 ? { ...record, status: "Revoked" as const } : record;
+      }, failure),
+      insert: Effect.fn("OAuthServerPersistence.insert")(function* (namespace, id, record) {
+        yield* standalone;
+        const payload = yield* Schema.encodeEffect(codec)(record);
+
+        const rows =
+          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === "Revoked" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      compareAndSet: Effect.fn("OAuthServerPersistence.compareAndSet")(function* (
+        namespace,
+        id,
+        version,
+        record,
+      ) {
+        yield* standalone;
+        if (version === record.version) return yield* Unavailable.make({});
+        const payload = yield* Schema.encodeEffect(codec)(record);
+
+        const rows =
+          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === "Revoked" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      revoke: Effect.fn("OAuthServerPersistence.revoke")(function* (namespace, id) {
+        yield* standalone;
+        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;
+      }, failure),
+    });
+  }),
+);
+
+export const OAuthServerPersistence = { migration, layer };