@yielded/auth-persistence 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/drizzle/proof-model.d.mts

@@ -6,27 +6,27 @@ import { ProofBinding, ProofContinuationId, ProofId, ProofPolicy, ProofPurpose,
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 //#region src/drizzle/proof-model.d.ts
 type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-type ProofAction = "issue" | "attempt";
-type ProofScopeKind = "action" | "identifier" | "subject";
-type ProofGenerationState = "active" | "consumed" | "cancelled" | "superseded";
-type ProofDeliveryState = "new" | "claimed" | "accepted" | "failed" | "ambiguous";
-type ProofCommandKind = "attempt" | "complete";
-type ProofCommandDecision = "accepted" | "rejected" | "completed";
-interface ProofScopeKeys {
+export type ProofAction = "issue" | "attempt";
+export type ProofScopeKind = "action" | "identifier" | "subject";
+export type ProofGenerationState = "active" | "consumed" | "cancelled" | "superseded";
+export type ProofDeliveryState = "new" | "claimed" | "accepted" | "failed" | "ambiguous";
+export type ProofCommandKind = "attempt" | "complete";
+export type ProofCommandDecision = "accepted" | "rejected" | "completed";
+export interface ProofScopeKeys {
   /** Stable across flow/context/request changes and bounded by the consumer codec. */
   readonly series: string;
   readonly identifier: string;
   /** A tagged non-null value; use a stable sentinel when the binding has no subject. */
   readonly subject: string;
 }
-interface ProofAuthorityInput<NativeSubjectId> {
+export interface ProofAuthorityInput<NativeSubjectId> {
   readonly moduleId: string;
   readonly purpose: ProofPurpose;
   readonly binding: ProofBinding;
   /** Resolved by Effect preplanning before an interactive check or D1 predicate compile. */
   readonly nativeSubjectId?: NativeSubjectId;
 }
-interface ProofAuthorityTables<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+export interface ProofAuthorityTables<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
   readonly identifier: {
     readonly table: Identifier;
     readonly namespace: ColumnKey<Identifier>;
@@ -55,7 +55,7 @@ interface ProofAuthorityTables<Subject extends Table, Identifier extends Table,
   };
   readonly subjectId?: SubjectIdCodec<NativeSubjectId>;
 }
-interface ProofRequestTable<Request extends Table> {
+export interface ProofRequestTable<Request extends Table> {
   readonly table: Request;
   readonly moduleId: ColumnKey<Request>;
   readonly requestId: ColumnKey<Request>;
@@ -72,7 +72,7 @@ interface ProofRequestTable<Request extends Table> {
   }) => InferInsertModel<Request>;
   readonly decodeReceipt: (row: InferSelectModel<Request>) => Effect.Effect<ProofRequestReceipt, PersistenceMappingError>;
 }
-interface ProofSeriesTable<Series extends Table> {
+export interface ProofSeriesTable<Series extends Table> {
   readonly table: Series;
   readonly moduleId: ColumnKey<Series>;
   readonly purpose: ColumnKey<Series>;
@@ -87,7 +87,7 @@ interface ProofSeriesTable<Series extends Table> {
     readonly version: ProofVersion;
   }) => InferInsertModel<Series>;
 }
-interface ProofGenerationTable<Generation extends Table> {
+export interface ProofGenerationTable<Generation extends Table> {
   readonly table: Generation;
   readonly moduleId: ColumnKey<Generation>;
   readonly purpose: ColumnKey<Generation>;
@@ -120,7 +120,7 @@ interface ProofGenerationTable<Generation extends Table> {
   readonly decodeRecord: (row: InferSelectModel<Generation>) => Effect.Effect<ProofRecord, PersistenceMappingError>;
   readonly decodeBinding: (row: InferSelectModel<Generation>) => Effect.Effect<ProofBinding, PersistenceMappingError>;
 }
-interface ProofContinuationRecord {
+export interface ProofContinuationRecord {
   readonly moduleId: string;
   readonly purpose: ProofPurpose;
   readonly continuationId: ProofContinuationId;
@@ -131,7 +131,7 @@ interface ProofContinuationRecord {
   readonly expiresAtMillis: number;
   readonly version: ProofVersion;
 }
-interface ProofContinuationTable<Continuation extends Table> {
+export interface ProofContinuationTable<Continuation extends Table> {
   readonly table: Continuation;
   readonly moduleId: ColumnKey<Continuation>;
   readonly purpose: ColumnKey<Continuation>;
@@ -149,7 +149,7 @@ interface ProofContinuationTable<Continuation extends Table> {
   }) => InferInsertModel<Continuation>;
   readonly decode: (row: InferSelectModel<Continuation>) => Effect.Effect<ProofContinuationRecord, PersistenceMappingError>;
 }
-interface ProofRateScopeTable<RateScope extends Table> {
+export interface ProofRateScopeTable<RateScope extends Table> {
   readonly table: RateScope;
   readonly moduleId: ColumnKey<RateScope>;
   readonly purpose: ColumnKey<RateScope>;
@@ -164,7 +164,7 @@ interface ProofRateScopeTable<RateScope extends Table> {
     readonly scopeKey: string;
   }) => InferInsertModel<RateScope>;
 }
-interface ProofAbuseEventTable<AbuseEvent extends Table> {
+export interface ProofAbuseEventTable<AbuseEvent extends Table> {
   readonly table: AbuseEvent;
   readonly moduleId: ColumnKey<AbuseEvent>;
   readonly purpose: ColumnKey<AbuseEvent>;
@@ -185,7 +185,7 @@ interface ProofAbuseEventTable<AbuseEvent extends Table> {
     readonly retentionUntilMillis: number;
   }) => InferInsertModel<AbuseEvent>;
 }
-interface ProofFailureEventTable<FailureEvent extends Table> {
+export interface ProofFailureEventTable<FailureEvent extends Table> {
   readonly table: FailureEvent;
   readonly moduleId: ColumnKey<FailureEvent>;
   readonly purpose: ColumnKey<FailureEvent>;
@@ -202,7 +202,7 @@ interface ProofFailureEventTable<FailureEvent extends Table> {
     readonly retentionUntilMillis: number;
   }) => InferInsertModel<FailureEvent>;
 }
-interface ProofCommandTable<Command extends Table> {
+export interface ProofCommandTable<Command extends Table> {
   readonly table: Command;
   readonly moduleId: ColumnKey<Command>;
   readonly commandId: ColumnKey<Command>;
@@ -217,7 +217,7 @@ interface ProofCommandTable<Command extends Table> {
     readonly retentionUntilMillis: number;
   }) => InferInsertModel<Command>;
 }
-interface RequiredProofConstraints {
+export interface RequiredProofConstraints {
   readonly request: "unique(request.moduleId,request.requestId)";
   readonly series: "unique(series.moduleId,series.purpose,series.scopeKey)";
   readonly proof: "unique(generation.moduleId,generation.proofId)";
@@ -229,8 +229,8 @@ interface RequiredProofConstraints {
   readonly failureEvent: "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
-declare const requiredProofConstraints: RequiredProofConstraints;
-interface ProofConstraintClassifier {
+export declare const requiredProofConstraints: RequiredProofConstraints;
+export interface ProofConstraintClassifier {
   /** Match only the declared request uniqueness constraint, including wrapped driver errors. */
   readonly isRequestConflict: (cause: unknown) => boolean;
   /** Match only the declared series uniqueness constraint, including wrapped driver errors. */
@@ -238,7 +238,7 @@ interface ProofConstraintClassifier {
   /** Match only the declared command uniqueness constraint, including wrapped driver errors. */
   readonly isCommandConflict: (cause: unknown) => boolean;
 }
-interface ProofD1Clock {
+export interface ProofD1Clock {
   /** Native instant expression evaluated by SQLite inside the submitted batch. */
   readonly engineNow: SQL;
   /** Integer Unix milliseconds expression evaluated inside the submitted batch. */
@@ -248,7 +248,7 @@ interface ProofD1Clock {
   /** Native instant expression for a retention/lease deadline from engine time. */
   readonly engineInstantPlus: (millis: number) => SQL;
 }
-interface ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> extends ProofConstraintClassifier {
+export interface ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> extends ProofConstraintClassifier {
   readonly request: ProofRequestTable<Request>;
   readonly series: ProofSeriesTable<Series>;
   readonly generation: ProofGenerationTable<Generation>;
@@ -271,7 +271,7 @@ interface ProofPersistenceMapping<Request extends Table, Series extends Table, G
   /** Required by D1 mappings and ignored by interactive targets. */
   readonly d1?: ProofD1Clock;
 }
-type D1ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = ProofPersistenceMapping<Request, Series, Generation, Continuation, RateScope, AbuseEvent, FailureEvent, Command, Subject, Identifier, Credential, NativeSubjectId> & {
+export type D1ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = ProofPersistenceMapping<Request, Series, Generation, Continuation, RateScope, AbuseEvent, FailureEvent, Command, Subject, Identifier, Credential, NativeSubjectId> & {
   readonly d1: ProofD1Clock;
   readonly authority: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId> & {
     readonly identifier: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId>["identifier"] & {
@@ -280,7 +280,6 @@ type D1ProofPersistenceMapping<Request extends Table, Series extends Table, Gene
     };
   };
 };
-type AnyProofPersistenceMapping = ProofPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyProofPersistenceMapping = ProofPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
 //#endregion
-export { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints };
 //# sourceMappingURL=proof-model.d.mts.map

package/dist/drizzle/proof-target.d.mts

@@ -4,9 +4,8 @@ import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import "effect/unstable/sql/SqlError";
 //#region src/drizzle/proof-target.d.ts
-declare const proofPersistenceLayer: (services: Effect.Effect<{
+export declare const proofPersistenceLayer: (services: Effect.Effect<{
   readonly proofPersistence: ProofPersistence["Service"];
 }, never, LifecycleHooks>) => Layer.Layer<ProofPersistence, never, LifecycleHooks>;
 //#endregion
-export { proofPersistenceLayer };
 //# sourceMappingURL=proof-target.d.mts.map

package/dist/drizzle/session-model.d.mts

@@ -6,12 +6,12 @@ import { AuthenticationEvidence, AuthenticationRequirement, PendingAuthenticatio
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 //#region src/drizzle/session-model.d.ts
 type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-interface SessionIdCodec<NativeId> {
+export interface SessionIdCodec<NativeId> {
   readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;
   readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;
   readonly equals: (left: NativeId, right: NativeId) => boolean;
 }
-interface SessionSubjectTables<Subject extends Table, NativeId> {
+export interface SessionSubjectTables<Subject extends Table, NativeId> {
   readonly subject: {
     readonly table: Subject;
     readonly id: ColumnKey<Subject>;
@@ -24,7 +24,7 @@ interface SessionSubjectTables<Subject extends Table, NativeId> {
   };
   readonly subjectId: SubjectIdCodec<NativeId>;
 }
-interface SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> extends SessionSubjectTables<Subject, NativeId> {
+export interface SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> extends SessionSubjectTables<Subject, NativeId> {
   readonly credential: {
     readonly table: Credential;
     readonly subjectId: ColumnKey<Credential>;
@@ -35,7 +35,7 @@ interface SessionAuthorityTables<Subject extends Table, Credential extends Table
     readonly isActiveStatus?: (value: unknown) => boolean;
   };
 }
-interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
+export interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
   readonly flow: {
     readonly table: Flow;
     readonly flowId: ColumnKey<Flow>;
@@ -60,7 +60,7 @@ interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
     }) => InferInsertModel<Flow>;
   };
 }
-interface StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> extends SessionFlowTables<Flow, NativeSubjectId> {
+export interface StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> extends SessionFlowTables<Flow, NativeSubjectId> {
   readonly session: {
     readonly table: Session;
     readonly sessionId: ColumnKey<Session>;
@@ -86,7 +86,7 @@ interface StatefulSessionTables<Claims, Session extends Table, Flow extends Tabl
   };
   readonly sessionId: SessionIdCodec<NativeSessionId>;
 }
-interface PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> extends SessionFlowTables<Flow, NativeSubjectId> {
+export interface PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> extends SessionFlowTables<Flow, NativeSubjectId> {
   readonly pending: {
     readonly table: Pending;
     readonly digest: ColumnKey<Pending>;
@@ -112,7 +112,7 @@ interface PendingAuthenticationTables<Claims, Pending extends Table, Flow extend
     readonly allocateVersionSync?: () => SecurityRevision;
   };
 }
-interface SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> {
+export interface SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> {
   readonly tombstone: {
     readonly table: Tombstone;
     readonly subjectId: ColumnKey<Tombstone>;
@@ -128,24 +128,24 @@ interface SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId,
   };
   readonly sessionId: SessionIdCodec<NativeSessionId>;
 }
-interface RequiredSessionConstraints {
+export interface RequiredSessionConstraints {
   readonly sessionDigest: "unique(session.digest)";
   readonly flowId: "unique(flow.flowId)";
 }
-interface RequiredPendingAuthenticationConstraints {
+export interface RequiredPendingAuthenticationConstraints {
   readonly pendingDigest: "unique(pending.digest)";
   readonly pendingFlow: "unique(pending.flowId)";
   readonly flowId: "unique(flow.flowId)";
 }
-interface RequiredStatefulPendingConstraints extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
-interface RequiredSignedValidityConstraints {
+export interface RequiredStatefulPendingConstraints extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
+export interface RequiredSignedValidityConstraints {
   readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
 }
-declare const requiredSessionConstraints: RequiredSessionConstraints;
-declare const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints;
-declare const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints;
-declare const requiredSignedValidityConstraints: RequiredSignedValidityConstraints;
-interface SessionConstraintClassifier {
+export declare const requiredSessionConstraints: RequiredSessionConstraints;
+export declare const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints;
+export declare const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints;
+export declare const requiredSignedValidityConstraints: RequiredSignedValidityConstraints;
+export interface SessionConstraintClassifier {
   /**
    * Match only the named unique constraints declared by this mapping. Broad
    * SQL/constraint classifiers can relabel application or NOT NULL failures as
@@ -153,14 +153,14 @@ interface SessionConstraintClassifier {
    */
   readonly isConstraintConflict: (cause: unknown) => boolean;
 }
-type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionConstraintClassifier & ({
+export type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionConstraintClassifier & ({
   /** Omit for single-factor authority installations. Pending input then fails closed. */
   readonly pending?: undefined;
 } | {
   readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;
   readonly constraints: RequiredPendingAuthenticationConstraints;
 });
-type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & ({
+export type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & ({
   /** Omit when this session module does not support pending MFA completion. */
   readonly pending?: undefined;
   readonly constraints: RequiredSessionConstraints;
@@ -168,10 +168,10 @@ type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Ta
   readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>["pending"];
   readonly constraints: RequiredStatefulPendingConstraints;
 });
-type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> & SessionConstraintClassifier & {
+export type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> & SessionConstraintClassifier & {
   readonly constraints: RequiredPendingAuthenticationConstraints;
 };
-type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & {
+export type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & {
   readonly constraints: RequiredSignedValidityConstraints;
 };
 /** D1 evaluates these expressions inside the atomic batch, after queueing delay.
@@ -182,7 +182,7 @@ type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table
  * `withSession` handle, because verification and security revision reads must
  * observe completed revocation writes across clients.
  */
-interface D1SessionClockMapping {
+export interface D1SessionClockMapping {
   readonly d1: {
     readonly engineNow: SQL;
     readonly engineNowMillis: SQL;
@@ -191,10 +191,9 @@ interface D1SessionClockMapping {
     readonly activeCredentialStatusValue?: unknown;
   };
 }
-type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> & D1SessionClockMapping;
-type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> & D1SessionClockMapping;
-type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
-type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+export type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> & D1SessionClockMapping;
+export type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> & D1SessionClockMapping;
+export type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+export type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
 //#endregion
-export { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
 //# sourceMappingURL=session-model.d.mts.map

package/dist/drizzle/session-target.d.mts

@@ -3,26 +3,25 @@ import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
 import { AuthenticationAuthority, PendingAuthentication, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StatefulSessionPersistence } from "@yielded/auth/Sessions";
 import "effect/unstable/sql/SqlError";
 //#region src/drizzle/session-target.d.ts
-declare const authenticationAuthorityLayer: (services: Effect.Effect<{
+export declare const authenticationAuthorityLayer: (services: Effect.Effect<{
   readonly authenticationAuthority: AuthenticationAuthority["Service"];
 }, never, LifecycleHooks>) => Layer.Layer<AuthenticationAuthority, never, LifecycleHooks>;
-declare const statefulSessionLayers: <Claims>(module: {
+export declare const statefulSessionLayers: <Claims>(module: {
   readonly StatefulSessionPersistence: any;
   readonly SessionRepository: any;
 }, services: Effect.Effect<{
   readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
   readonly sessionRepository: SessionRepository;
 }, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
-declare const pendingAuthenticationLayer: <Claims>(module: {
+export declare const pendingAuthenticationLayer: <Claims>(module: {
   readonly PendingAuthentication: any;
 }, services: Effect.Effect<{
   readonly pendingAuthentication: PendingAuthentication<Claims>;
 }, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
-declare const signedSessionValidityLayer: (module: {
+export declare const signedSessionValidityLayer: (module: {
   readonly SignedSessionValidity: any;
 }, services: Effect.Effect<{
   readonly signedSessionValidity: SignedSessionValidity;
 }, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
 //#endregion
-export { authenticationAuthorityLayer, pendingAuthenticationLayer, signedSessionValidityLayer, statefulSessionLayers };
 //# sourceMappingURL=session-target.d.mts.map

package/dist/drizzle/sqlite.d.mts

@@ -3,9 +3,9 @@ import { SuppliedService } from "./SuppliedService.mjs";
 import { Effect } from "effect";
 import { AuthStoreDecisions } from "@yielded/auth/Persistence";
 import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
 import { AnyRelations } from "drizzle-orm";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { SqlError } from "effect/unstable/sql/SqlError";
@@ -23,7 +23,7 @@ type TransactionOf<D extends AnyDatabase> = Parameters<Parameters<D["transaction
  * unsupported interactive transaction and Durable Objects never suspend in a
  * transactionSync callback.
  */
-declare const makeSqliteAuthStoreServices: <C extends AnySQLiteTable, R extends AnySQLiteTable, HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT, RunResult = unknown>(database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>, mapping: AuthStoreTables<C, R>, standaloneGuard?: Effect.Effect<void, AuthStoreError>) => {
+export declare const makeSqliteAuthStoreServices: <C extends AnySQLiteTable, R extends AnySQLiteTable, HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT, RunResult = unknown>(database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>, mapping: AuthStoreTables<C, R>, standaloneGuard?: Effect.Effect<void, AuthStoreError>) => {
   readonly authStore: {
     readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, import("@yielded/auth/AuthStore").IssueChallengeError>;
     readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
@@ -36,7 +36,7 @@ declare const makeSqliteAuthStoreServices: <C extends AnySQLiteTable, R extends
     readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError, never>;
   };
 };
-declare const makeSqliteOAuthStateServices: <S extends AnySQLiteTable, HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT, RunResult = unknown>(database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>, mapping: OAuthStateTables<S>, standaloneGuard?: Effect.Effect<void, AuthStoreError>) => {
+export declare const makeSqliteOAuthStateServices: <S extends AnySQLiteTable, HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT, RunResult = unknown>(database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>, mapping: OAuthStateTables<S>, standaloneGuard?: Effect.Effect<void, AuthStoreError>) => {
   readonly oauthStateStore: {
     readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
     readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
@@ -49,30 +49,29 @@ declare const makeSqliteOAuthStateServices: <S extends AnySQLiteTable, HKT exten
  * Owns the native outer commit for interactive SQLite targets. Keep rejection
  * as a decision value inside the owner; interruption before commit rolls back.
  */
-declare function coordinateSqliteAuthStoreTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteAuthStoreTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: AuthStoreTables<C, R>;
   readonly transaction?: never;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements>;
-declare function coordinateSqliteAuthStoreTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteAuthStoreTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: AuthStoreTables<C, R>;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements>;
-declare function coordinateSqliteOAuthStateTransaction<D extends AnyDatabase, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteOAuthStateTransaction<D extends AnyDatabase, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: OAuthStateTables<S>;
   readonly transaction?: never;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements>;
-declare function coordinateSqliteOAuthStateTransaction<D extends AnyDatabase, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteOAuthStateTransaction<D extends AnyDatabase, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: OAuthStateTables<S>;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements>;
-declare function coordinateSqliteAuthTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteAuthTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: AuthTables<C, R, S>;
   readonly transaction?: never;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements>;
-declare function coordinateSqliteAuthTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+export declare function coordinateSqliteAuthTransaction<D extends AnyDatabase, C extends AnySQLiteTable, R extends AnySQLiteTable, S extends AnySQLiteTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: AuthTables<C, R, S>;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
 }, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements>;
 //#endregion
-export { coordinateSqliteAuthStoreTransaction, coordinateSqliteAuthTransaction, coordinateSqliteOAuthStateTransaction, makeSqliteAuthStoreServices, makeSqliteOAuthStateServices };
 //# sourceMappingURL=sqlite.d.mts.map

package/dist/drizzle/sqlite.mjs

@@ -2,9 +2,9 @@ import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
 import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
 import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { VerifiedEmail } from "@yielded/auth/Schema";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
 import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
 import { and, eq, gt, lt, lte, ne, or, sql } from "drizzle-orm";
 //#region src/drizzle/sqlite.ts
 const storeReadError = () => AuthStoreError.make({ message: "Auth store read failed" });

package/dist/drizzle/standalone-guard.mjs

@@ -1,4 +1,5 @@
-import { Context, Effect, Option, Predicate } from "effect";
+import { requireStandalone } from "../internal/standalone.mjs";
+import { Context, Effect, Predicate } from "effect";
 //#region src/drizzle/standalone-guard.ts
 const transactionService = (database) => {
 	if (!Predicate.hasProperty(database, "$client") || !Predicate.hasProperty(database.$client, "transactionService") || !Context.isKey(database.$client.transactionService)) return;
@@ -8,10 +9,7 @@ const transactionService = (database) => {
 const sqlClientStandaloneGuard = (database, unavailable) => {
 	const service = transactionService(database);
 	if (service === void 0) return Effect.suspend(() => Effect.fail(unavailable()));
-	return Effect.serviceOption(service).pipe(Effect.flatMap(Option.match({
-		onNone: () => Effect.void,
-		onSome: () => Effect.fail(unavailable())
-	})));
+	return requireStandalone(unavailable, { transactionService: service });
 };
 //#endregion
 export { sqlClientStandaloneGuard };

package/dist/drizzle/standalone-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"standalone-guard.mjs","names":[],"sources":["../../src/drizzle/standalone-guard.ts"],"sourcesContent":["import { Context, Effect, Option, Predicate } from \"effect\";\nimport type * as SqlClient from \"effect/unstable/sql/SqlClient\";\n\ntype TransactionService = Context.Key<\n  SqlClient.TransactionConnection,\n  SqlClient.TransactionConnection.Service\n>;\n\nconst transactionService = (database: unknown): TransactionService | undefined => {\n  if (\n    !Predicate.hasProperty(database, \"$client\") ||\n    !Predicate.hasProperty(database.$client, \"transactionService\") ||\n    !Context.isKey(database.$client.transactionService)\n  ) {\n    return undefined;\n  }\n\n  return database.$client.transactionService;\n};\n\n/** Bind the client-specific transaction marker at foreign adapter construction. */\nexport const sqlClientStandaloneGuard = <Failure>(\n  database: unknown,\n  unavailable: () => Failure,\n): Effect.Effect<void, Failure> => {\n  const service = transactionService(database);\n\n  if (service === undefined) return Effect.suspend(() => Effect.fail(unavailable()));\n\n  return Effect.serviceOption(service).pipe(\n    Effect.flatMap(\n      Option.match({\n        onNone: () => Effect.void,\n        onSome: () => Effect.fail(unavailable()),\n      }),\n    ),\n  );\n};\n"],"mappings":";;AAQA,MAAM,sBAAsB,aAAsD;CAChF,IACE,CAAC,UAAU,YAAY,UAAU,SAAS,KAC1C,CAAC,UAAU,YAAY,SAAS,SAAS,oBAAoB,KAC7D,CAAC,QAAQ,MAAM,SAAS,QAAQ,kBAAkB,GAElD;CAGF,OAAO,SAAS,QAAQ;AAC1B;;AAGA,MAAa,4BACX,UACA,gBACiC;CACjC,MAAM,UAAU,mBAAmB,QAAQ;CAE3C,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,cAAc,OAAO,KAAK,YAAY,CAAC,CAAC;CAEjF,OAAO,OAAO,cAAc,OAAO,CAAC,CAAC,KACnC,OAAO,QACL,OAAO,MAAM;EACX,cAAc,OAAO;EACrB,cAAc,OAAO,KAAK,YAAY,CAAC;CACzC,CAAC,CACH,CACF;AACF"}
+{"version":3,"file":"standalone-guard.mjs","names":[],"sources":["../../src/drizzle/standalone-guard.ts"],"sourcesContent":["import { Context, Effect, Predicate } from \"effect\";\nimport type * as SqlClient from \"effect/unstable/sql/SqlClient\";\n\nimport { requireStandalone } from \"../internal/standalone\";\n\ntype TransactionService = Context.Key<\n  SqlClient.TransactionConnection,\n  SqlClient.TransactionConnection.Service\n>;\n\nconst transactionService = (database: unknown): TransactionService | undefined => {\n  if (\n    !Predicate.hasProperty(database, \"$client\") ||\n    !Predicate.hasProperty(database.$client, \"transactionService\") ||\n    !Context.isKey(database.$client.transactionService)\n  ) {\n    return undefined;\n  }\n\n  return database.$client.transactionService;\n};\n\n/** Bind the client-specific transaction marker at foreign adapter construction. */\nexport const sqlClientStandaloneGuard = <Failure>(\n  database: unknown,\n  unavailable: () => Failure,\n): Effect.Effect<void, Failure> => {\n  const service = transactionService(database);\n\n  if (service === undefined) return Effect.suspend(() => Effect.fail(unavailable()));\n\n  return requireStandalone(unavailable, { transactionService: service });\n};\n"],"mappings":";;;AAUA,MAAM,sBAAsB,aAAsD;CAChF,IACE,CAAC,UAAU,YAAY,UAAU,SAAS,KAC1C,CAAC,UAAU,YAAY,SAAS,SAAS,oBAAoB,KAC7D,CAAC,QAAQ,MAAM,SAAS,QAAQ,kBAAkB,GAElD;CAGF,OAAO,SAAS,QAAQ;AAC1B;;AAGA,MAAa,4BACX,UACA,gBACiC;CACjC,MAAM,UAAU,mBAAmB,QAAQ;CAE3C,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,cAAc,OAAO,KAAK,YAAY,CAAC,CAAC;CAEjF,OAAO,kBAAkB,aAAa,EAAE,oBAAoB,QAAQ,CAAC;AACvE"}

package/dist/drizzle/step-up-model.d.mts

@@ -8,7 +8,7 @@ import { InferInsertModel, Table } from "drizzle-orm";
 type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
 /** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
  * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
-interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {
+export interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {
   readonly intent: {
     readonly table: Intent;
     readonly digest: ColumnKey<Intent>;
@@ -30,14 +30,14 @@ interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {
     readonly allocateVersionSync?: () => SecurityRevision;
   };
 }
-interface RequiredSessionStepUpConstraints {
+export interface RequiredSessionStepUpConstraints {
   readonly intentDigest: "unique(intent.digest)";
   readonly intentFlow: "unique(intent.flowId)";
 }
-declare const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints;
+export declare const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints;
 /** Fixed source discriminator is checked against every stored intent. A minimal
  * pure-signed installation does not provide dummy session or tombstone tables. */
-type SessionStepUpSourceTables<Claims, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = {
+export type SessionStepUpSourceTables<Claims, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = {
   readonly kind: "StatelessSigned";
 } | ({
   readonly kind: "StateAssistedSigned";
@@ -55,11 +55,10 @@ type SessionStepUpSourceTables<Claims, Session extends Table, Tombstone extends
     readonly authenticatedAt: ColumnKey<Session>;
   };
 };
-type SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionStepUpIntentTables<Intent, NativeSubjectId> & SessionConstraintClassifier & {
+export type SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionStepUpIntentTables<Intent, NativeSubjectId> & SessionConstraintClassifier & {
   readonly source: SessionStepUpSourceTables<Claims, Session, Tombstone, NativeSubjectId, NativeSessionId>;
   readonly constraints: RequiredSessionStepUpConstraints;
 };
-type D1SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionStepUpMapping<Claims, Subject, Credential, Intent, Session, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+export type D1SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionStepUpMapping<Claims, Subject, Credential, Intent, Session, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
 //#endregion
-export { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints };
 //# sourceMappingURL=step-up-model.d.mts.map

package/dist/drizzle/totp-model.d.mts

@@ -6,9 +6,9 @@ import { AuthenticationRequirement, PendingAuthenticationContext } from "@yielde
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 import { TotpPersistence, TotpPolicy } from "@yielded/auth/Totp";
 //#region src/drizzle/totp-model.d.ts
-type TotpColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
-declare const requiredTotpConstraints: {
+export type TotpColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+export declare const requiredTotpConstraints: {
   readonly factor: "unique(scope)";
   readonly credential: "unique(credentialId)";
   readonly subject: "unique(id)";
@@ -20,7 +20,7 @@ declare const requiredTotpConstraints: {
  * domain-separated management command tombstones; retain them while command IDs
  * can be replayed. Encoders and current requirement decoding cannot suspend.
  */
-interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
+export interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
   readonly moduleId: string;
   readonly policy: TotpPolicy;
   readonly constraints: typeof requiredTotpConstraints;
@@ -70,15 +70,14 @@ interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
    * revisions. No request-supplied SQL or external I/O is accepted. */
   readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;
 }
-interface D1TotpMapping {
+export interface D1TotpMapping {
   readonly d1: {
     readonly primary: true;
   };
 }
-interface TotpPersistenceServices {
+export interface TotpPersistenceServices {
   readonly totpPersistence: TotpPersistence["Service"];
 }
-declare const totpPersistenceLayer: <E, R>(services: Effect.Effect<TotpPersistenceServices, E, R>) => Layer.Layer<TotpPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const totpPersistenceLayer: <E, R>(services: Effect.Effect<TotpPersistenceServices, E, R>) => Layer.Layer<TotpPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion
-export { D1TotpMapping, TotpColumn, TotpMapping, TotpMappingSource, TotpPersistenceServices, requiredTotpConstraints, totpPersistenceLayer };
 //# sourceMappingURL=totp-model.d.mts.map

package/dist/drizzle/totp-state.d.mts

@@ -3,8 +3,8 @@ import { Context, Effect } from "effect";
 import { SQL } from "drizzle-orm";
 import { TotpRecord, TotpUnavailable } from "@yielded/auth/Totp";
 //#region src/drizzle/totp-state.d.ts
-declare const encodeTotpRecord: (record: TotpRecord) => string;
-declare const decodeTotpRecord: (state: string) => {
+export declare const encodeTotpRecord: (record: TotpRecord) => string;
+export declare const decodeTotpRecord: (state: string) => {
   readonly moduleId: string;
   readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
   readonly credentialId: string;
@@ -34,5 +34,4 @@ declare const decodeTotpRecord: (state: string) => {
   readonly failedAttempts: number;
 };
 //#endregion
-export { decodeTotpRecord, encodeTotpRecord };
 //# sourceMappingURL=totp-state.d.mts.map

package/dist/drizzle/totp-target.d.mts

@@ -11,7 +11,6 @@ import { Table } from "drizzle-orm";
 import { TotpConfigurationError, TotpPersistence, TotpUnavailable } from "@yielded/auth/Totp";
 import { Statement } from "effect/unstable/sql/Statement";
 //#region src/drizzle/totp-target.d.ts
-type TotpCoordinatorError<E> = TransactionCoordinatorError<E, TotpUnavailable> | TotpConfigurationError | PersistenceMappingError;
+export type TotpCoordinatorError<E> = TransactionCoordinatorError<E, TotpUnavailable> | TotpConfigurationError | PersistenceMappingError;
 //#endregion
-export { TotpCoordinatorError };
 //# sourceMappingURL=totp-target.d.mts.map

package/dist/drizzle/transaction-mysql.mjs

@@ -29,6 +29,7 @@ const mysqlTransaction = (unavailable, database, body) => Effect.scoped(Effect.g
 		commit: () => statement("COMMIT"),
 		rollback: () => statement("ROLLBACK"),
 		savepoint: (_connection, id) => statement(`SAVEPOINT effect_auth_oauth_${id}`),
+		releaseSavepoint: (_connection, id) => statement(`RELEASE SAVEPOINT effect_auth_oauth_${id}`),
 		rollbackSavepoint: (_connection, id) => statement(`ROLLBACK TO SAVEPOINT effect_auth_oauth_${id}`)
 	});
 	class NativeTransaction extends EffectMysql2Transaction {