Initial commit.

Packages/Persistence/Sources/Public/Enumerations/Driver.swift

@@ -0,0 +1,17 @@
+/// The persistence backend the service runs against.
+///
+/// The executable picks a driver at startup and hands it to ``Service``, which registers the matching database as the default one. Repositories resolve
+/// that default and stay agnostic of which backend is in use.
+public enum Driver: Sendable {
+
+    /// A PostgreSQL server, reached with the given connection parameters.
+    ///
+    /// - Parameter configuration: the host, credentials, TLS posture, and pooling limits the connection is opened with.
+    case postgres(Configuration)
+
+    /// An ephemeral, in-process SQLite database held entirely in memory.
+    ///
+    /// Nothing is written to disk, and all data is lost when the service stops — intended for local development and tests.
+    case inMemory
+
+}

Packages/Persistence/Sources/Public/Enumerations/TLS.swift

@@ -0,0 +1,41 @@
+import NIOSSL
+import PostgresNIO
+
+/// The TLS posture used when connecting to the database.
+///
+/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the PostgreSQL driver
+/// receives the resulting connection TLS mode through ``postgresTLS()``.
+public enum TLS: Sendable {
+
+    /// Connect without TLS, in plaintext.
+    case off
+
+    /// Connect over TLS when the server offers it, falling back to plaintext otherwise.
+    case prefer
+
+    /// Connect only over TLS, refusing the connection when the server offers none.
+    case require
+
+}
+
+// MARK: - Methods
+
+extension TLS {
+
+    /// The connection TLS mode passed to the PostgreSQL driver for this posture.
+    ///
+    /// Returns `.disable` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``. The driver enforces
+    /// both semantics natively: `prefer` upgrades to TLS only when the server advertises support and continues in plaintext otherwise, while `require`
+    /// refuses the connection when the server offers no TLS.
+    ///
+    /// - Throws: an error when the TLS context cannot be built from the default client configuration.
+    /// - Returns: the connection TLS mode for this posture.
+    func postgresTLS() throws -> PostgresConnection.Configuration.TLS {
+        switch self {
+        case .off: .disable
+        case .prefer: .prefer(try NIOSSLContext(configuration: .makeClientConfiguration()))
+        case .require: .require(try NIOSSLContext(configuration: .makeClientConfiguration()))
+        }
+    }
+
+}