@yielded/auth-persistence 0.1.0-beta.7 → 0.1.0-beta.8

package/README.md

@@ -8,6 +8,11 @@ or from `@yielded/auth-persistence/drizzle/<driver>` for Drizzle. The raw entry
 does not require Drizzle. Core workflows and replaceable service contracts remain
 in `@yielded/auth`.
 
+`OAuthAppPersistence` separately supplies the single-table store for
+[`OAuthApp`](../../docs/guide/oauth.md#sign-in-and-connect-provider-access).
+It has no dependency on the broader auth schema or a session repository. Apply its
+exported migration with the application's runner and provide an Effect SQL client.
+
 Applications own subject provisioning, policy, claims, delivery, and their database
 connection. Drizzle Kit generates migrations from managed or application-declared
 Drizzle tables. Install `AuthPersistence.migrationsLayer({ migrationsFolder })`

package/dist/DrizzleD1.d.mts

@@ -300,14 +300,14 @@ declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -316,12 +316,12 @@ declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzleLibsql.d.mts

@@ -645,8 +645,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
     } | {
@@ -670,6 +668,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -1224,14 +1224,14 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -1242,10 +1242,10 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzleMysql2.d.mts

@@ -184,11 +184,9 @@ declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Linked";
       readonly credential: {
@@ -210,6 +208,8 @@ declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -764,14 +764,14 @@ declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
       };
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -781,11 +781,11 @@ declare const makeOAuthAccountsServices: <S extends AnyMySqlTable<{
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
     } | {
-      readonly _tag: "Ambiguous";
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzlePglite.d.mts

@@ -187,8 +187,6 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
     } | {
@@ -212,6 +210,8 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -766,14 +766,14 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -784,10 +784,10 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzlePostgres.d.mts

@@ -186,11 +186,9 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Linked";
       readonly credential: {
@@ -212,6 +210,8 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -766,14 +766,14 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -783,11 +783,11 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
     } | {
-      readonly _tag: "Ambiguous";
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzleSqliteBun.d.mts

@@ -640,8 +640,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
     } | {
@@ -665,6 +663,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -1219,14 +1219,14 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -1237,10 +1237,10 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly _tag: "Rejected";
     } | {
       readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/DrizzleSqliteNode.d.mts

@@ -638,12 +638,10 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Linked";
       readonly credential: {
@@ -665,6 +663,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -1219,14 +1219,14 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       };
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, import("@yielded/auth/OAuth").OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
@@ -1235,12 +1235,12 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
       readonly nowMillis: number;
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Conflict";
-    } | {
-      readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/drizzle/d1-oauth.d.mts

@@ -133,11 +133,9 @@ declare const makeD1OAuthAccountsServices: <S extends SQLiteTable, O extends SQL
     }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
-    } | {
-      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Linked";
       readonly credential: {
@@ -159,6 +157,8 @@ declare const makeD1OAuthAccountsServices: <S extends SQLiteTable, O extends SQL
         };
       };
       readonly changed: boolean;
+    } | {
+      readonly _tag: "Conflict";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
     readonly inspectUnlink: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;

package/dist/drizzle/model.d.mts

@@ -3,9 +3,9 @@ import { DateTime, Effect, Layer } from "effect";
 import { ChallengeConsumeDecision } from "@yielded/auth/Persistence";
 import { ConsumeChallenge, NewChallenge, NewRegistration, PendingRegistration, SubjectId } from "@yielded/auth/Schema";
 import { ExternalIdentity, ExternalIdentityMutation, LoginIdentifier, SubjectProvisioner, SubjectProvisioningInput } from "@yielded/auth/Identity";
+import { OAuthState, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, ConsumeDecision } from "@yielded/auth/AuthStore";
 import { AuthStoreError } from "@yielded/auth/Errors";
-import { OAuthState, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AnyColumn, InferInsertModel, InferSelectModel, Table } from "drizzle-orm";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 //#region src/drizzle/model.d.ts

package/dist/drizzle/model.mjs

@@ -2,9 +2,9 @@ import { PersistenceMappingError, isMappedConstraintConflict } from "../internal
 import { Context, DateTime, Effect, Layer, Option } from "effect";
 import "@yielded/auth/Schema";
 import { ExternalIdentityMutation, SubjectProvisioner } from "@yielded/auth/Identity";
+import { OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore } from "@yielded/auth/AuthStore";
 import { AuthStoreError } from "@yielded/auth/Errors";
-import { OAuthStateStore } from "@yielded/auth/OAuth";
 import { getTableColumns } from "drizzle-orm";
 //#region src/drizzle/model.ts
 const requireStandaloneConsume = (database) => Effect.serviceOption(database.$client.transactionService).pipe(Effect.flatMap(Option.match({

package/dist/drizzle/mysql.d.mts

@@ -3,9 +3,9 @@ import { SuppliedService } from "./SuppliedService.mjs";
 import { Effect } from "effect";
 import { AuthStoreDecisions } from "@yielded/auth/Persistence";
 import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { AnyRelations } from "drizzle-orm";
 import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import { SqlError } from "effect/unstable/sql/SqlError";

package/dist/drizzle/mysql.mjs

@@ -2,9 +2,9 @@ import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
 import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
 import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { VerifiedEmail, timingSafeStringEqual } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { and, eq, gt, sql } from "drizzle-orm";
 //#region src/drizzle/mysql.ts
 const selected = (row) => row;

package/dist/drizzle/oauth-connected-target.d.mts

@@ -226,14 +226,14 @@ declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping
       readonly identity: typeof OAuthExternalIdentity.Type;
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, M.OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: M.OAuthConnectedClaim;
@@ -243,11 +243,11 @@ declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping
     }, prepare: PrepareOAuthCommit<{
       readonly _tag: "Rejected";
     } | {
-      readonly _tag: "Conflict";
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Cancelled";
     } | {
-      readonly _tag: "Ambiguous";
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {

package/dist/drizzle/pg.d.mts

@@ -4,9 +4,9 @@ import { Context, Effect, Layer } from "effect";
 import { AuthStoreDecisions } from "@yielded/auth/Persistence";
 import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, SubjectId, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
 import { ExternalIdentity, ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioner, SubjectProvisioningInput } from "@yielded/auth/Identity";
+import { InvalidOAuthState, OAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AnyRelations } from "drizzle-orm";
 import { EffectPgDatabase } from "drizzle-orm/effect-pglite";
 import { AnyPgTable } from "drizzle-orm/pg-core";

package/dist/drizzle/pg.mjs

@@ -4,9 +4,9 @@ import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
 import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { VerifiedEmail } from "@yielded/auth/Schema";
 import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { and, eq, gt, lt, lte, ne, or, sql } from "drizzle-orm";
 import "drizzle-orm/pg-core";
 //#region src/drizzle/pg.ts

package/dist/drizzle/sqlite.d.mts

@@ -3,9 +3,9 @@ import { SuppliedService } from "./SuppliedService.mjs";
 import { Effect } from "effect";
 import { AuthStoreDecisions } from "@yielded/auth/Persistence";
 import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { AnyRelations } from "drizzle-orm";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { SqlError } from "effect/unstable/sql/SqlError";

package/dist/drizzle/sqlite.mjs

@@ -2,9 +2,9 @@ import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
 import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
 import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { VerifiedEmail } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { and, eq, gt, lt, lte, ne, or, sql } from "drizzle-orm";
 //#region src/drizzle/sqlite.ts
 const storeReadError = () => AuthStoreError.make({ message: "Auth store read failed" });

package/dist/index.d.mts

@@ -2,4 +2,5 @@ import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
-export { AuthPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
+export { AuthPersistence, OAuthAppPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/index.mjs

@@ -2,4 +2,5 @@ import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
-export { AuthPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
+export { AuthPersistence, OAuthAppPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/internal/oauth-app.d.mts

@@ -0,0 +1,12 @@
+import { Layer } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence } from "@yielded/auth/OAuthApp";
+//#region src/internal/oauth-app.d.ts
+declare const OAuthAppPersistence: {
+  layer: Layer.Layer<Persistence, OAuthUnavailable, SqlClient.SqlClient>;
+  migration: string;
+};
+//#endregion
+export { OAuthAppPersistence };
+//# sourceMappingURL=oauth-app.d.mts.map

package/dist/internal/oauth-app.mjs

@@ -0,0 +1,58 @@
+import { Effect, Layer, Option, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence, Record } from "@yielded/auth/OAuthApp";
+//#region src/internal/oauth-app.ts
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({
+	payload: Schema.String,
+	version: Schema.String
+});
+const OAuthAppPersistence = {
+	layer: Layer.effect(Persistence, Effect.gen(function* () {
+		const sql = yield* SqlClient.SqlClient;
+		if (!sql.onDialectOrElse({
+			sqlite: () => true,
+			pg: () => true,
+			orElse: () => false
+		})) return yield* OAuthUnavailable.make({});
+		const noTransaction = Effect.gen(function* () {
+			if (Option.isSome(yield* Effect.serviceOption(sql.transactionService))) return yield* OAuthUnavailable.make({});
+		});
+		const failure = (effect) => effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+		return Persistence.of({
+			get: Effect.fn("OAuthAppPersistence.get")(function* (namespace, key) {
+				yield* noTransaction;
+				const rows = yield* sql`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;
+				if (rows.length === 0) return void 0;
+				if (rows.length !== 1) return yield* OAuthUnavailable.make({});
+				const row = yield* Schema.decodeEffect(Row)(rows[0]);
+				const value = yield* Schema.decodeEffect(codec)(row.payload);
+				if (value.version !== row.version) return yield* OAuthUnavailable.make({});
+				return value;
+			}, failure),
+			insert: Effect.fn("OAuthAppPersistence.insert")(function* (namespace, key, value) {
+				yield* noTransaction;
+				const payload = yield* Schema.encodeEffect(codec)(value);
+				return (yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`).length === 1;
+			}, failure),
+			compareAndSet: Effect.fn("OAuthAppPersistence.compareAndSet")(function* (namespace, key, version, value) {
+				yield* noTransaction;
+				if (value.version === version) return yield* OAuthUnavailable.make({});
+				const payload = yield* Schema.encodeEffect(codec)(value);
+				return (yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`).length === 1;
+			}, failure)
+		});
+	})),
+	migration: `CREATE TABLE yielded_oauth_app (
+  namespace TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  version TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, record_key)
+)`
+};
+//#endregion
+export { OAuthAppPersistence };
+
+//# sourceMappingURL=oauth-app.mjs.map

package/dist/internal/oauth-app.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-app.mjs","names":[],"sources":["../../src/internal/oauth-app.ts"],"sourcesContent":["import { OAuthUnavailable } from \"@yielded/auth/OAuth\";\nimport { Persistence, Record } from \"@yielded/auth/OAuthApp\";\nimport { Effect, Layer, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/unstable/sql\";\n\nconst codec = Schema.fromJsonString(Record);\nconst Row = Schema.Struct({ payload: Schema.String, version: Schema.String });\n\n/** Apply with the application's migrations. SQLite (including D1) and PostgreSQL.\n * Each transition is one conditional statement, so D1 needs no interactive\n * transaction and parallel workers share the same refresh/code claim.\n */\nconst migration = `CREATE TABLE yielded_oauth_app (\n  namespace TEXT NOT NULL,\n  record_key TEXT NOT NULL,\n  version TEXT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, record_key)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* OAuthUnavailable.make({});\n\n    const noTransaction = Effect.gen(function* () {\n      if (Option.isSome(yield* Effect.serviceOption(sql.transactionService)))\n        return yield* OAuthUnavailable.make({});\n    });\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthAppPersistence.get\")(function* (namespace, key) {\n        yield* noTransaction;\n\n        const rows = yield* sql<{\n          payload: string;\n          version: string;\n        }>`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* OAuthUnavailable.make({});\n        const row = yield* Schema.decodeEffect(Row)(rows[0]);\n        const value = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (value.version !== row.version) return yield* OAuthUnavailable.make({});\n\n        return value;\n      }, failure),\n      insert: Effect.fn(\"OAuthAppPersistence.insert\")(function* (namespace, key, value) {\n        yield* noTransaction;\n        const payload = yield* Schema.encodeEffect(codec)(value);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthAppPersistence.compareAndSet\")(function* (\n        namespace,\n        key,\n        version,\n        value,\n      ) {\n        yield* noTransaction;\n        if (value.version === version) return yield* OAuthUnavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(value);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthAppPersistence = { layer, migration };\n"],"mappings":";;;;;AAKA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAM,MAAM,OAAO,OAAO;CAAE,SAAS,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC;AA4E5E,MAAa,sBAAsB;CAAE,OA9DvB,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,IAAI,OAAO,OAAO,OAAO,OAAO,cAAc,IAAI,kBAAkB,CAAC,GACnE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAC1C,CAAC;EAED,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;EAE9D,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,WAAW,KAAK;IACnE,OAAO;IAEP,MAAM,OAAO,OAAO,GAGlB,oEAAoE,UAAU,oBAAoB;IAEpG,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC7D,MAAM,MAAM,OAAO,OAAO,aAAa,GAAG,CAAC,CAAC,KAAK,EAAE;IACnD,MAAM,QAAQ,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE3D,IAAI,MAAM,YAAY,IAAI,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEzE,OAAO;GACT,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,KAAK,OAAO;IAChF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;IAKvD,QAAO,OAFE,GAAG,mFAAmF,UAAU,IAAI,IAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,oEAAA,CAEnI,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAC5D,WACA,KACA,SACA,OACA;IACA,OAAO;IACP,IAAI,MAAM,YAAY,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACrE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;IAKvD,QAAO,OAFE,GAAG,0CAA0C,MAAM,QAAQ,cAAc,QAAQ,qBAAqB,UAAU,oBAAoB,IAAI,iBAAiB,QAAQ,oBAAA,CAE9J,WAAW;GACzB,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGkC;CAAO;;;;;;;AAAU"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-persistence","version":"0.1.0-beta.7","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.7"},"devDependencies":{"@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./drizzle/d1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./drizzle/libsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./drizzle/mysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./drizzle/pglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./drizzle/postgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./drizzle/sqlite-bun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./drizzle/sqlite-do":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./drizzle/sqlite-node":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./drizzle/sqlite-wasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"}},"description":"SQL persistence, Drizzle bindings, and managed schemas for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"drizzle-orm":{"optional":true}}}
+{"name":"@yielded/auth-persistence","version":"0.1.0-beta.8","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.8"},"devDependencies":{"@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./drizzle/d1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./drizzle/libsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./drizzle/mysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./drizzle/pglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./drizzle/postgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./drizzle/sqlite-bun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./drizzle/sqlite-do":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./drizzle/sqlite-node":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./drizzle/sqlite-wasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"}},"description":"SQL persistence, Drizzle bindings, and managed schemas for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"drizzle-orm":{"optional":true}}}

package/src/index.ts

@@ -1,4 +1,5 @@
 export { AuthPersistence } from "./internal/sql-persistence";
+export { OAuthAppPersistence } from "./internal/oauth-app";
 export { PersistenceConfigurationError } from "./internal/configuration";
 export { PersistenceMappingError } from "./internal/mapping-error";
 export { StorageColumn, StorageTable } from "./internal/storage-tables";

package/src/internal/oauth-app.ts

@@ -0,0 +1,83 @@
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence, Record } from "@yielded/auth/OAuthApp";
+import { Effect, Layer, Option, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({ payload: Schema.String, version: Schema.String });
+
+/** Apply with the application's migrations. SQLite (including D1) and PostgreSQL.
+ * Each transition is one conditional statement, so D1 needs no interactive
+ * transaction and parallel workers share the same refresh/code claim.
+ */
+const migration = `CREATE TABLE yielded_oauth_app (
+  namespace TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  version TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, record_key)
+)`;
+
+const layer = Layer.effect(
+  Persistence,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+      return yield* OAuthUnavailable.make({});
+
+    const noTransaction = Effect.gen(function* () {
+      if (Option.isSome(yield* Effect.serviceOption(sql.transactionService)))
+        return yield* OAuthUnavailable.make({});
+    });
+
+    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+
+    return Persistence.of({
+      get: Effect.fn("OAuthAppPersistence.get")(function* (namespace, key) {
+        yield* noTransaction;
+
+        const rows = yield* sql<{
+          payload: string;
+          version: string;
+        }>`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;
+
+        if (rows.length === 0) return undefined;
+        if (rows.length !== 1) return yield* OAuthUnavailable.make({});
+        const row = yield* Schema.decodeEffect(Row)(rows[0]);
+        const value = yield* Schema.decodeEffect(codec)(row.payload);
+
+        if (value.version !== row.version) return yield* OAuthUnavailable.make({});
+
+        return value;
+      }, failure),
+      insert: Effect.fn("OAuthAppPersistence.insert")(function* (namespace, key, value) {
+        yield* noTransaction;
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      compareAndSet: Effect.fn("OAuthAppPersistence.compareAndSet")(function* (
+        namespace,
+        key,
+        version,
+        value,
+      ) {
+        yield* noTransaction;
+        if (value.version === version) return yield* OAuthUnavailable.make({});
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+    });
+  }),
+);
+
+export const OAuthAppPersistence = { layer, migration };