@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/phone-model.ts

@@ -0,0 +1,190 @@
+import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import {
+  type PhoneAdmissionPolicy,
+  type PhoneLifecyclePolicy,
+  type PhoneNumber,
+  PhoneAdmission,
+  PhonePersistence,
+  PhoneSignInTargets,
+} from "@yielded/auth/PhoneOtp";
+import type { SubjectId } from "@yielded/auth/Schema";
+import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import { Effect, Layer } from "effect";
+
+import type { PersistenceMappingError } from "./model";
+import type { AnyProofPersistenceMapping, ProofPersistenceMapping } from "./proof-model";
+const proofMapping = Symbol("effect-auth/phone/proofs");
+
+/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */
+export interface PhoneProofCompletionMapping {
+  readonly [proofMapping]: AnyProofPersistenceMapping;
+}
+
+export const phoneProofCompletionMapping = <
+  Rq extends Table,
+  S extends Table,
+  G extends Table,
+  Cn extends Table,
+  Rs extends Table,
+  A extends Table,
+  F extends Table,
+  C extends Table,
+  Sub extends Table,
+  I extends Table,
+  Cr extends Table,
+  N,
+>(
+  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,
+): PhoneProofCompletionMapping =>
+  Object.freeze({
+    [proofMapping]: Object.freeze({
+      ...mapping,
+      request: Object.freeze({ ...mapping.request }),
+      series: Object.freeze({ ...mapping.series }),
+      generation: Object.freeze({ ...mapping.generation }),
+      continuation: Object.freeze({ ...mapping.continuation }),
+      rateScope: Object.freeze({ ...mapping.rateScope }),
+      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),
+      failureEvent: Object.freeze({ ...mapping.failureEvent }),
+      command: Object.freeze({ ...mapping.command }),
+      constraints: Object.freeze({ ...mapping.constraints }),
+      authority: Object.freeze({
+        ...mapping.authority,
+        identifier: Object.freeze({ ...mapping.authority.identifier }),
+        ...(mapping.authority.subject === undefined
+          ? {}
+          : { subject: Object.freeze({ ...mapping.authority.subject }) }),
+        ...(mapping.authority.credential === undefined
+          ? {}
+          : { credential: Object.freeze({ ...mapping.authority.credential }) }),
+        ...(mapping.authority.subjectId === undefined
+          ? {}
+          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),
+      }),
+      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),
+    }) as unknown as AnyProofPersistenceMapping,
+  });
+
+/** @internal */
+export const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];
+export type PhoneColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+
+export const requiredPhoneConstraints = {
+  subject: "unique(id)",
+  identifier: "unique(namespace,value)",
+  credential: "unique(credentialId)",
+  state: "unique(scope)",
+} as const;
+
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * State stores permanent number custody and command tombstones, plus bounded admission
+ * counters. Never delete custody rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+export interface PhoneMapping<
+  S extends Table,
+  I extends Table,
+  C extends Table,
+  T extends Table,
+  N,
+> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly admission: PhoneAdmissionPolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: PhoneProofCompletionMapping;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+    readonly allocate: () => N;
+  };
+  readonly subject: {
+    readonly table: S;
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: SQL;
+    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (
+      row: InferSelectModel<S>,
+      action: "verify" | "change",
+    ) => AuthenticationRequirement;
+    readonly encodeInsert: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => InferInsertModel<S>;
+  };
+  readonly identifier: {
+    readonly table: I;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => InferInsertModel<I>;
+  };
+  readonly credential: {
+    readonly table: C;
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => InferInsertModel<C>;
+  };
+  readonly state: {
+    readonly table: T;
+    readonly scope: PhoneColumn<T>;
+    readonly state: PhoneColumn<T>;
+    readonly version: PhoneColumn<T>;
+    readonly encodeInsert: (input: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => InferInsertModel<T>;
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: SQL;
+}
+
+export interface D1PhoneMapping {
+  readonly d1: { readonly primary: true };
+}
+
+export interface PhonePersistenceServices {
+  readonly phonePersistence: PhonePersistence["Service"];
+  readonly phoneAdmission: PhoneAdmission["Service"];
+  readonly phoneSignInTargets: PhoneSignInTargets["Service"];
+}
+
+/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+export const phonePersistenceLayer = <E, R>(
+  services: Effect.Effect<PhonePersistenceServices, E, R>,
+) =>
+  Layer.unwrap(
+    Effect.map(services, (value) =>
+      Layer.mergeAll(
+        Layer.succeed(PhonePersistence, value.phonePersistence),
+        Layer.succeed(PhoneAdmission, value.phoneAdmission),
+        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),
+      ),
+    ),
+  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));

package/src/drizzle/phone-state.ts

@@ -0,0 +1,21 @@
+import { makePhoneKernel } from "../internal/phone-kernel";
+import { drizzleQueryOperations } from "./query-operations";
+import { both, makeTransactionRows } from "./transaction-owner";
+export { CurrentPhoneTransaction } from "../internal/phone-kernel";
+
+export const {
+  unavailable,
+  equal,
+  copiedRow,
+  col,
+  capturePhone,
+  lookupPhone,
+  admitPhone,
+  preparePhoneMutation,
+  cleanupPhoneAdmission,
+} = makePhoneKernel(drizzleQueryOperations, { both, makeTransactionRows });
+
+export const invariant: (value: unknown) => asserts value = makePhoneKernel(
+  drizzleQueryOperations,
+  { both, makeTransactionRows },
+).invariant;

package/src/drizzle/phone-target.ts

@@ -0,0 +1,472 @@
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { randomId } from "@yielded/auth/Persistence";
+import {
+  PhoneConfigurationError,
+  PhoneLifecyclePolicy,
+  PhoneAdmissionPolicy,
+  PhoneLifecycleTarget,
+  PhoneActionAuthorization,
+  PhoneAdmission,
+  type PhoneMutation,
+  PhonePersistence,
+  PhoneSignInTargets,
+  type PhoneOtpUnavailable as PhoneUnavailable,
+} from "@yielded/auth/PhoneOtp";
+import { ProofBinding } from "@yielded/auth/Proofs";
+import { sql, type Table } from "drizzle-orm";
+/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */
+import { Context, Effect, Schema } from "effect";
+import type { Statement } from "effect/unstable/sql/Statement";
+
+import { CurrentD1PlanningDatabase } from "./d1-planning";
+import { compileD1ProofCompletionPlan } from "./d1-proofs";
+import type { PersistenceMappingError } from "./model";
+import {
+  phoneProofs,
+  type PhoneMapping,
+  type PhoneMappingSource,
+  type PhonePersistenceServices,
+  requiredPhoneConstraints,
+} from "./phone-model";
+import {
+  capturePhone,
+  lookupPhone,
+  admitPhone,
+  cleanupPhoneAdmission,
+  CurrentPhoneTransaction,
+  invariant,
+  equal,
+  preparePhoneMutation,
+  unavailable,
+} from "./phone-state";
+import { requiredProofConstraints } from "./proof-model";
+import { completeProofPlanIn, CurrentProofSql } from "./proof-sql";
+import type { SuppliedService } from "./SuppliedService";
+import {
+  coordinateTransactionOwner,
+  makeTransactionExecution,
+  sqlClientTransactionStandaloneGuard,
+  type TransactionExecution,
+  type TransactionTargetConfiguration,
+  type TransactionCoordinatorError,
+} from "./transaction-execution";
+import type { TransactionNativeDatabase } from "./transaction-owner";
+export type PhoneTargetConfiguration = TransactionTargetConfiguration<PhoneUnavailable>;
+
+export type PhoneCoordinatorError<E> =
+  | TransactionCoordinatorError<E, PhoneUnavailable>
+  | PhoneConfigurationError
+  | PersistenceMappingError;
+
+export const sqlClientPhoneStandaloneGuard = (
+  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],
+) => sqlClientTransactionStandaloneGuard(unavailable, database);
+
+const validateMapping = <M>(original: M, configuration: PhoneTargetConfiguration): M => {
+  const mapping = original as any;
+
+  invariant(mapping.moduleId.length > 0);
+  Schema.decodeSync(PhoneLifecyclePolicy)(mapping.policy);
+  Schema.decodeSync(PhoneAdmissionPolicy)(mapping.admission);
+  invariant(mapping.admission.requestRetentionMillis >= mapping.admission.windowMillis);
+  const proofs = phoneProofs(mapping.proofs);
+
+  invariant(proofs !== undefined);
+  for (const [key, value] of Object.entries(requiredProofConstraints))
+    invariant((proofs.constraints as any)?.[key] === value);
+  if (configuration.mode === "synchronous") invariant(proofs.allocateVersionSync !== undefined);
+  if (configuration.mode === "batch")
+    invariant(
+      proofs.d1 !== undefined && proofs.authority.identifier.d1CurrentCondition !== undefined,
+    );
+  for (const [key, value] of Object.entries(requiredPhoneConstraints))
+    invariant(mapping.constraints?.[key] === value);
+  if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
+
+  return Object.freeze({
+    ...mapping,
+    policy: Object.freeze({ ...mapping.policy }),
+    subject: Object.freeze({ ...mapping.subject }),
+    state: Object.freeze({ ...mapping.state }),
+    identifier: Object.freeze({ ...mapping.identifier }),
+    admission: Object.freeze({ ...mapping.admission }),
+    credential: Object.freeze({ ...mapping.credential }),
+    subjectIds: Object.freeze({ ...mapping.subjectIds }),
+  });
+};
+
+const services = (
+  mapping: any,
+  execution: TransactionExecution<PhoneUnavailable, CurrentPhoneTransaction>,
+  hooks: LifecycleHooks["Service"],
+  configuration: PhoneTargetConfiguration,
+): PhonePersistenceServices => {
+  const run = <A, E, R>(effect: Effect.Effect<A, E, R>, mutation = true) =>
+    execution.admit.pipe(
+      Effect.andThen(execution.run(effect, mutation)),
+      Effect.provideService(LifecycleHooks, hooks),
+    );
+
+  return {
+    phoneAdmission: PhoneAdmission.of({
+      admit: (input) => run(admitPhone(mapping, { ...input })),
+      cleanup: (input) => run(cleanupPhoneAdmission(mapping, { ...input })),
+    }),
+    phoneSignInTargets: PhoneSignInTargets.of({
+      lookup: (input) => run(lookupPhone(mapping, { ...input }), false),
+    }),
+    phonePersistence: PhonePersistence.of({
+      target: (input) =>
+        run(
+          Effect.gen(function* () {
+            invariant(input.moduleId === mapping.moduleId);
+
+            return (yield* capturePhone(mapping, { ...input })).target;
+          }),
+          false,
+        ),
+      mutate: (original, prepare) =>
+        Effect.suspend(() => {
+          const input: PhoneMutation = {
+            ...original,
+            target: Schema.decodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(
+              Schema.encodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(original.target),
+            ),
+            policy: { ...original.policy },
+            ...(original.authorization === undefined
+              ? {}
+              : {
+                  authorization: Schema.decodeSync(Schema.toCodecIso(PhoneActionAuthorization))(
+                    Schema.encodeSync(Schema.toCodecIso(PhoneActionAuthorization))(
+                      original.authorization,
+                    ),
+                  ),
+                }),
+            completion: {
+              input: {
+                ...original.completion.input,
+                binding: Schema.decodeSync(Schema.toCodecIso(ProofBinding))(
+                  Schema.encodeSync(Schema.toCodecIso(ProofBinding))(
+                    original.completion.input.binding,
+                  ),
+                ),
+              },
+              prepare: original.completion.prepare,
+            },
+          };
+
+          return run(
+            Effect.gen(function* () {
+              const owner = yield* CurrentPhoneTransaction,
+                candidate = yield* preparePhoneMutation(mapping, input);
+
+              if (candidate.mutate === undefined) {
+                const receipt = prepare(candidate.decision, owner.journal);
+
+                owner.guards.push(receipt as any);
+
+                return receipt;
+              }
+              const cn = phoneProofs(mapping.proofs).continuation;
+
+              const observed = yield* owner.read(
+                cn.table,
+                equal(cn.table, {
+                  [cn.moduleId]: input.completion.input.moduleId,
+                  [cn.continuationId]: input.completion.input.continuationId,
+                }),
+                { limit: 1 },
+              );
+
+              let completed = false;
+
+              const plan = {
+                ...input.completion,
+                prepare: (decision: any, journal: any) => {
+                  completed = decision === "completed";
+                  const proofReceipt = input.completion.prepare(decision, journal, () => undefined);
+
+                  owner.guards.push(proofReceipt);
+
+                  return prepare(
+                    decision === "completed" ? candidate.decision : { _tag: "Rejected" },
+                    journal,
+                  );
+                },
+              };
+
+              let receipt;
+
+              if (owner.batch) {
+                const offset = owner.statements.length;
+
+                yield* candidate.mutate;
+                const statements = owner.statements.splice(offset);
+
+                const compiled = yield* compileD1ProofCompletionPlan(
+                  phoneProofs(mapping.proofs) as any,
+                  plan as any,
+                  { statements, appliedCondition: candidate.appliedCondition! },
+                  (x) => x,
+                ).pipe(Effect.provideService(CurrentD1PlanningDatabase, owner.database));
+
+                // Mutation observations describe an accepted plan. A stale proof aborts this owner.
+                invariant(compiled.statements.length !== 0);
+                owner.statements.push(...compiled.statements, ...(compiled.postconditions ?? []));
+                receipt = compiled.receipt;
+              } else {
+                receipt = yield* completeProofPlanIn(
+                  phoneProofs(mapping.proofs),
+                  {
+                    mode: configuration.mode === "synchronous" ? "synchronous" : "interactive",
+                    locking: configuration.locking,
+                    standaloneGuard: Effect.void,
+                    coordinated: true,
+                    insertIfAbsent: (query: any, key, value) =>
+                      configuration.dialect === "mysql"
+                        ? query.onDuplicateKeyUpdate({ set: { [key]: value } })
+                        : query.onConflictDoNothing(),
+                  },
+                  plan as any,
+                  candidate.mutate,
+                  (x) => x,
+                ).pipe(Effect.provideService(CurrentProofSql, owner.database));
+              }
+              if (completed) {
+                invariant(observed.rows.length === 1);
+                const record = yield* cn.decode(observed.rows[0]!);
+
+                observed.rows = observed.rows.map((row) => ({ ...row, [cn.consumed]: true }));
+                const command = phoneProofs(mapping.proofs).command;
+
+                owner.postconditions.push(
+                  sql`${mapping.engineNowMillis} < ${record.expiresAtMillis}`,
+                  sql`exists(select 1 from ${command.table} where ${equal(command.table, { [command.moduleId]: input.completion.input.moduleId, [command.commandId]: input.completion.input.continuationDigest, [command.kind]: "complete", [command.decision]: "completed", [command.retentionUntil]: phoneProofs(mapping.proofs).encodeInstant(record.expiresAtMillis) })})`,
+                );
+              }
+              invariant(receipt?._tag === "PreparedCommit");
+              owner.guards.push(receipt as any);
+
+              return receipt as ReturnType<typeof prepare>;
+            }),
+          );
+        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),
+    }),
+  };
+};
+
+export const makeTargetPhonePersistence = <
+  S extends Table,
+  I extends Table,
+  F extends Table,
+  C extends Table,
+  N,
+  RSetup = never,
+>(
+  database: TransactionNativeDatabase,
+  source: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>,
+  configuration: PhoneTargetConfiguration,
+) =>
+  Effect.gen(function* () {
+    const hooks = yield* LifecycleHooks;
+    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+
+    const mapping = yield* Effect.try({
+      try: () => validateMapping(original, configuration),
+      catch: () => PhoneConfigurationError.make({}),
+    });
+
+    const execution = makeTransactionExecution(
+      CurrentPhoneTransaction,
+      database,
+      configuration,
+      unavailable,
+      randomId,
+    );
+
+    return services(mapping, execution, hooks, configuration);
+  });
+
+export const coordinateTargetPhone = <M, A, E, R, RSetup = never>(
+  database: TransactionNativeDatabase,
+  source: PhoneMappingSource<M, RSetup>,
+  configuration: PhoneTargetConfiguration,
+  body: (
+    transaction: any,
+    services: PhonePersistenceServices,
+    append: (statement: Statement<any>) => void,
+  ) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, PhoneCoordinatorError<E>, R | RSetup | LifecycleHooks> =>
+  Effect.gen(function* () {
+    const hooks = yield* LifecycleHooks;
+    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+
+    const mapping = yield* Effect.try({
+      try: () => validateMapping(original, configuration),
+      catch: () => PhoneConfigurationError.make({}),
+    });
+
+    return yield* coordinateTransactionOwner(
+      database,
+      CurrentPhoneTransaction,
+      configuration,
+      Effect.void,
+      unavailable,
+      randomId,
+      (execution) => services(mapping, execution, hooks, configuration),
+      body,
+    );
+  });
+
+type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }
+  ? Parameters<Parameters<D["transaction"]>[0]>[0]
+  : never;
+
+/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+export const makePhoneTarget = <
+  D extends { readonly transaction: any },
+  T extends Table,
+  Extra = unknown,
+  Synchronous extends boolean = false,
+>(
+  configuration: PhoneTargetConfiguration,
+) => {
+  function coordinatePhonePersistence<
+    Database extends D,
+    S extends T,
+    I extends T,
+    F extends T,
+    C extends T,
+    N,
+    A,
+    E,
+    R,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets> : R
+    >,
+  ): Effect.Effect<
+    A,
+    PhoneCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true
+        ? never
+        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePhonePersistence<
+    Database extends D,
+    S extends T,
+    I extends T,
+    F extends T,
+    C extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;
+      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true
+        ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>
+        : R
+    >,
+  ): Effect.Effect<
+    A,
+    PhoneCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true
+        ? never
+        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePhonePersistence<
+    Database extends D,
+    S extends T,
+    I extends T,
+    F extends T,
+    C extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;
+      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    PhoneCoordinatorError<E> | DatabaseError,
+    | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  > {
+    return Effect.flatMap(acquire, (database) =>
+      coordinateTargetPhone(
+        database as any,
+        options.mapping,
+        configuration,
+        (transaction: TransactionOf<Database>, services) => {
+          const provided = Context.make(PhonePersistence, services.phonePersistence).pipe(
+            Context.add(PhoneAdmission, services.phoneAdmission),
+            Context.add(PhoneSignInTargets, services.phoneSignInTargets),
+          );
+
+          const work = Effect.provideContext(body, provided);
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+
+  return {
+    makePhonePersistenceServices: <
+      Database extends D,
+      S extends T,
+      I extends T,
+      F extends T,
+      C extends T,
+      N,
+      RSetup = never,
+    >(
+      database: Database,
+      mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>,
+    ) => makeTargetPhonePersistence(database as any, mapping, configuration),
+    coordinatePhonePersistence,
+  };
+};