@yielded/auth-persistence-drizzle 0.1.0-beta.17 → 0.1.0-beta.19

package/src/drizzle/oauth-accounts.ts

@@ -30,7 +30,7 @@ import {
   readFlow,
   terminalFlow,
 } from "./oauth-flow";
-import type { OAuthEligibilityFact } from "./oauth-model";
+import type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from "./oauth-model";
 import { both, col, copiedRow, equal, CurrentOAuthTransaction } from "./oauth-owner";
 import { acquireTuple, readTuple } from "./oauth-registration";
 import {
@@ -71,7 +71,7 @@ const authorization = (
         mapping.subject.decodeActionRequirement(copiedRow(current.row), action),
       );
 
-      const accepted = validAction(
+      const accepted = yield* validAction(
         auth,
         {
           moduleId: auth.challenge.moduleId,
@@ -493,7 +493,7 @@ const targetCredential = (mapping: any, moduleId: string, credentialId: string,
         subject: ownership[t.externalSubject],
       };
 
-      invariant(oauthIdentityKey(identity) === row[cr.identityKey]);
+      invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
 
       const shared = current.revision.credentials.find(
         (item: any) => item.credentialId === credentialId,
@@ -648,23 +648,24 @@ export const unlink = (mapping: any, input: any) =>
       const current = yield* accountCurrent(mapping, expected.revision.subjectId);
 
       if (current === undefined) return { _tag: "Rejected" } as const;
-      const guards = mapping.connectedReferenceGuards ?? [];
+
+      const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =
+        mapping.connectedReferenceGuards ?? [];
 
       invariant(guards.length <= 32);
       let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;
 
       if (mapping.connectedReference !== undefined)
         for (const guard of guards) {
+          const condition = guard.condition({
+            identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
+            identityKey: yield* oauthIdentityKey(expected.identity),
+            subjectId: copiedRow({ value: current.nativeId }).value,
+          });
+
           const read = yield* owner.read(
             guard.table,
-            guard.condition({
-              identity: snapshotOAuthSync(
-                OAuthCredentialSnapshot.fields.identity,
-                expected.identity,
-              ),
-              identityKey: oauthIdentityKey(expected.identity),
-              subjectId: copiedRow({ value: current.nativeId }).value,
-            }),
+            Effect.isEffect(condition) ? yield* condition : condition,
             { orderBy: col(guard.table, guard.orderBy) },
           );
 
@@ -730,7 +731,7 @@ export const unlink = (mapping: any, input: any) =>
         cr = mapping.credential,
         a = mapping.authority;
 
-      const key = oauthIdentityKey(expected.identity),
+      const key = yield* oauthIdentityKey(expected.identity),
         t = mapping.ownership.tuple;
 
       const connected = mapping.connectedReference?.({

package/src/drizzle/oauth-connected-collection.ts

@@ -285,7 +285,7 @@ export const collect = Effect.fn("oauthConnected.collect")(function* (
         subject: candidate[t.externalSubject],
       };
 
-      invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);
+      invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
 
       const tuple = yield* F.inspectTuple(mapping, identity),
         row = tuple.row;

package/src/drizzle/oauth-connected-custody.ts

@@ -113,9 +113,9 @@ export const storeJob = Effect.fn("oauthConnected.storeJob")(function* (
   );
 
   const j = mapping.revocation.job,
-    identity = oauthIdentityKey(token.identity),
-    client = S.clientKey(token.configuration),
-    cohort = S.cohortKey(client, identity);
+    identity = yield* oauthIdentityKey(token.identity),
+    client = yield* S.clientKey(token.configuration),
+    cohort = yield* S.cohortKey(client, identity);
 
   const h = mapping.cohort;
 
@@ -254,14 +254,16 @@ export const noFormerOwner = (
   client: string,
   native: unknown,
 ) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) => {
+  Effect.gen(function* () {
+    const owner = yield* CurrentOAuthTransaction;
+
     const g = mapping.grant,
       f = mapping.flow,
       j = S.jobTable(mapping);
 
     const condition = both(
       sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,
-      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
+      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
       ...(j === undefined
         ? []
         : [
@@ -269,7 +271,7 @@ export const noFormerOwner = (
           ]),
     );
 
-    return Effect.map(owner.check(condition), (accepted) => {
+    return yield* Effect.map(owner.check(condition), (accepted) => {
       if (accepted) owner.postconditions.push(condition);
 
       return accepted;

package/src/drizzle/oauth-connected-drivers.ts

@@ -6,7 +6,7 @@ import {
   OAuthUnavailable,
 } from "@yielded/auth/OAuth";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
@@ -69,6 +69,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -108,6 +109,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -142,7 +144,7 @@ export const makeOAuthConnectedTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(
@@ -193,6 +195,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -228,6 +231,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -258,7 +262,7 @@ export const makeOAuthConnectedTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnectedRevocations<
@@ -361,6 +365,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   > {
@@ -435,6 +440,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   > {

package/src/drizzle/oauth-connected-flow.ts

@@ -45,7 +45,7 @@ export const pending = Effect.fn("oauthConnected.pending")(function* (
       row[f.flowId] === c.flowId &&
       row[f.commandId] === c.commandId &&
       mapping.subjectId.equals(native, row[f.subjectId]) &&
-      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
@@ -238,7 +238,7 @@ export const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(funct
       row[f.flowId] === c.flowId &&
       row[f.commandId] === c.commandId &&
       mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&
-      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
@@ -356,7 +356,7 @@ export const claim = Effect.fn("oauthConnected.claim")(function* (
     {
       [f.state]: "Claimed",
       [f.claimId]: claimed.claimId,
-      [f.claimDigest]: digest(S.claimStorage.encode(claimed)),
+      [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),
       [f.claimOrder]: mapping.order.encode(order),
       [f.claimedAt]: mapping.clock.encodeInstant(now),
       [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
@@ -392,7 +392,7 @@ export const exact = Effect.fn("oauthConnected.exactClaim")(function* (
     row === undefined ||
     row[f.work] !== "Unresolved" ||
     row[f.claimId] !== claim.claimId ||
-    row[f.claimDigest] !== digest(S.claimStorage.encode(claim))
+    row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))
   )
     return undefined;
   const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
@@ -403,7 +403,7 @@ export const exact = Effect.fn("oauthConnected.exactClaim")(function* (
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&
-      row[f.clientKey] === S.clientKey(S.configuration(claim.flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&
       S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&
       mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&
       mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,
@@ -448,7 +448,7 @@ export const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const t = mapping.ownership.tuple,
-    key = oauthIdentityKey(identity);
+    key = yield* oauthIdentityKey(identity);
 
   const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });
   const row = read.rows[0];

package/src/drizzle/oauth-connected-management.ts

@@ -341,7 +341,7 @@ export const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
       [d.grantId]: token.grantId,
       [d.intent]: S.commandStorage.encode({
         context: token,
-        originalDigest: digest(S.disconnectStorage.encode(input.grant)),
+        originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
         ...(input.revocation === undefined
           ? {}
           : { revocationJobId: input.revocation.context.jobId }),

package/src/drizzle/oauth-connected-reference.ts

@@ -1,6 +1,7 @@
 import { eq, is, sql, type SQL, type Table } from "drizzle-orm";
 import { MySqlTable } from "drizzle-orm/mysql-core/table";
 import { PgTable } from "drizzle-orm/pg-core/table";
+import { Effect } from "effect";
 
 import type { OAuthConnectedMapping } from "./oauth-connected-model";
 import { scopeKey, type Mapping } from "./oauth-connected-state";
@@ -52,15 +53,19 @@ export const oauthConnectedOwnershipReferences = <
         table: c.table,
         orderBy: c.clientKey,
         condition: (input) =>
-          both(
-            equal(c.table, {
-              [c.clientKey]: scopeKey(input.identity.provider, input.identity.issuer),
-              [c.counter]: mapping.order.encode(0),
-            }),
-            exactText(c.table, c.provider, input.identity.provider),
-            exactText(c.table, c.issuer, input.identity.issuer),
-            exactText(c.table, c.clientRegistrationId, ""),
-          ),
+          Effect.gen(function* () {
+            const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
+
+            return both(
+              equal(c.table, {
+                [c.clientKey]: key,
+                [c.counter]: mapping.order.encode(0),
+              }),
+              exactText(c.table, c.provider, input.identity.provider),
+              exactText(c.table, c.issuer, input.identity.issuer),
+              exactText(c.table, c.clientRegistrationId, ""),
+            );
+          }),
       }),
     ],
     connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),

package/src/drizzle/oauth-connected-settlement.ts

@@ -46,9 +46,9 @@ export const activateGrant = Effect.fn("oauthConnected.activateGrant")(function*
   const owner = yield* CurrentOAuthTransaction;
   const token = grant.context;
   const g = mapping.grant;
-  const identityKey = oauthIdentityKey(token.identity);
-  const clientKey = S.clientKey(token.configuration);
-  const cohortKey = S.cohortKey(clientKey, identityKey);
+  const identityKey = yield* oauthIdentityKey(token.identity);
+  const clientKey = yield* S.clientKey(token.configuration);
+  const cohortKey = yield* S.cohortKey(clientKey, identityKey);
 
   const values = {
     ...g.encodeInsert({
@@ -143,7 +143,7 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
       token.grantId === c.grantId &&
       token.identity.provider === c.provider &&
       token.identity.issuer === c.issuer &&
-      S.clientKey(token.configuration) === cl.id &&
+      (yield* S.clientKey(token.configuration)) === cl.id &&
       S.tokenContextStorage.encode({
         ...token,
         configuration: S.configuration(input.claim.flow),

package/src/drizzle/oauth-connected-sign-in.ts

@@ -83,7 +83,7 @@ export const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (
       [f.stateDigest]: c.stateDigest,
       [f.snapshot]: null,
       [f.claimId]: claim.claimId,
-      [f.claimDigest]: digest(reservationStorage.encode(reservation)),
+      [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),
       [f.claimOrder]: mapping.order.encode(order),
       [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
       [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
@@ -116,13 +116,13 @@ const exact = Effect.fn("oauthConnected.exactSignIn")(function* (
     row === undefined ||
     row[f.work] !== "Unresolved" ||
     row[f.claimId] !== reservation.claim.claimId ||
-    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))
+    row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))
   )
     return undefined;
   invariant(
     row[f.subjectId] === null &&
       row[f.commandId] === c.commandId &&
-      row[f.clientKey] === S.clientKey(reservation.configuration) &&
+      row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&
       S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),
   );
   const now = yield* owner.now(mapping.clock);
@@ -164,7 +164,7 @@ const credential = Effect.fn("oauthConnected.signInCredential")(function* (
       [c.moduleId]: context.moduleId,
       [c.credentialId]: input.credentialId,
       [c.subjectId]: found.nativeId,
-      [c.identityKey]: oauthIdentityKey(input.identity),
+      [c.identityKey]: yield* oauthIdentityKey(input.identity),
       [c.credentialRevision]: input.credentialRevision,
     }),
     c.activeCondition,
@@ -242,18 +242,19 @@ const slot = Effect.fn("oauthConnected.signInSlot")(function* (
 
 /** Orders belong to one client registration. Moving a profile to another client
  * requires a newer profile generation; retired clients cannot replace it later. */
-const canReplace = (
+const canReplace = Effect.fnUntraced(function* (
   reservation: M.OAuthSignInAccessClaim,
   previous: M.OAuthConnectedTokenContext,
-) => {
+) {
   const generation = reservation.configuration.profile.generation;
   const oldGeneration = previous.configuration.profile.generation;
 
-  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)
+  return (yield* S.clientKey(reservation.configuration)) ===
+    (yield* S.clientKey(previous.configuration))
     ? generation >= oldGeneration &&
         S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)
     : generation > oldGeneration;
-};
+});
 
 export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function* (
   mapping: S.Mapping,
@@ -293,7 +294,7 @@ export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function*
     co.blocked ||
     S.orderNumber(r.order) <= co.cutoff ||
     previous?.row[mapping.grant.refreshWork] === "Unresolved" ||
-    (previous !== undefined && !canReplace(r, previous.context));
+    (previous !== undefined && !(yield* canReplace(r, previous.context)));
 
   return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
     _tag: quarantine ? "Quarantine" : "Target",
@@ -377,7 +378,7 @@ export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
         F.sameTarget(out.previous, previous.context) &&
         sameIdentity(previous.context.identity, token.identity) &&
         previous.row[mapping.grant.refreshWork] !== "Unresolved" &&
-        canReplace(r, previous.context);
+        (yield* canReplace(r, previous.context));
 
   const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
 

package/src/drizzle/oauth-connected-state.ts

@@ -107,11 +107,11 @@ export const nativeOrder = (mapping: Authority, value: unknown) =>
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
 
-const key = (domain: string, fields: ReadonlyArray<string>) => {
+const key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {
   for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
 
-  return "v1:" + digest(strings.encode([domain, ...fields]));
-};
+  return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
+});
 
 export const clientKey = (configuration: M.OAuthConnectedConfiguration) =>
   key("effect-auth/oauth-connected-client/v1", [
@@ -124,7 +124,9 @@ export const cohortKey = (client: string, identity: string) =>
   key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
 
 export const initialGeneration = (cohort: string) =>
-  M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + digest(cohort));
+  digest(cohort).pipe(
+    Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)),
+  );
 
 export const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>
   snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
@@ -254,9 +256,9 @@ export const action = Effect.fn("oauthConnected.action")(function* (
         ? "connected-disconnect"
         : "connected-complete";
 
-  const intentDigest = digest(expected.intent);
+  const intentDigest = yield* digest(expected.intent);
 
-  const binding = digest(
+  const binding = yield* digest(
     strings.encode([
       "effect-auth/oauth-connected-action/v1",
       expected.moduleId,
@@ -364,7 +366,9 @@ export const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (
 });
 
 export const scopeKey = (provider: string, issuer: string) =>
-  "scope:" + key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]);
+  key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(
+    Effect.map((value) => "scope:" + value),
+  );
 
 export interface ScopeAnchor {
   readonly id: string;
@@ -412,7 +416,7 @@ export const scope = Effect.fn("oauthConnected.scope")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = scopeKey(config.provider, config.issuer),
+    id = yield* scopeKey(config.provider, config.issuer),
     cache = yield* anchors(scopeCache, c.table);
 
   const existing = cache.get(id);
@@ -497,7 +501,7 @@ export const readScope = Effect.fn("oauthConnected.readScope")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = scopeKey(provider, issuer),
+    id = yield* scopeKey(provider, issuer),
     cache = yield* anchors(scopeCache, c.table),
     cached = cache.get(id);
 
@@ -549,12 +553,12 @@ export const lockClientById = Effect.fn("oauthConnected.lockClientById")(functio
     row !== undefined &&
       row[c.clientRegistrationId] !== "" &&
       id ===
-        key("effect-auth/oauth-connected-client/v1", [
+        (yield* key("effect-auth/oauth-connected-client/v1", [
           row[c.provider],
           row[c.issuer],
           row[c.clientRegistrationId],
-        ]) &&
-      scope.id === scopeKey(row[c.provider], row[c.issuer]),
+        ])) &&
+      scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),
   );
   const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };
 
@@ -563,10 +567,15 @@ export const lockClientById = Effect.fn("oauthConnected.lockClientById")(functio
   return found;
 });
 
-export const heldScope = (mapping: Authority, provider: string, issuer: string) =>
-  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>
-    cache.get(scopeKey(provider, issuer)),
-  );
+export const heldScope = Effect.fnUntraced(function* (
+  mapping: Authority,
+  provider: string,
+  issuer: string,
+) {
+  const cache = yield* anchors(scopeCache, mapping.client.table);
+
+  return cache.get(yield* scopeKey(provider, issuer));
+});
 
 /** Cleanup obtains every scope then every client before entering any tuple. */
 export const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (
@@ -583,7 +592,7 @@ export const prelockClients = Effect.fn("oauthConnected.prelockClients")(functio
   const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();
 
   for (const value of releaseScopes)
-    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });
+    scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });
   for (const id of unique) {
     const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
         limit: 1,
@@ -593,7 +602,7 @@ export const prelockClients = Effect.fn("oauthConnected.prelockClients")(functio
       row = read.rows[0];
 
     invariant(row !== undefined);
-    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {
+    scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
       provider: row[c.provider],
       issuer: row[c.issuer],
       required: true,
@@ -629,7 +638,7 @@ export const client = Effect.fn("oauthConnected.client")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = clientKey(config),
+    id = yield* clientKey(config),
     where = { [c.clientKey]: id };
 
   const heldScope = yield* scope(mapping, config, create);
@@ -723,7 +732,7 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.cohort,
-    id = cohortKey(clientId, identityId),
+    id = yield* cohortKey(clientId, identityId),
     where = { [c.cohortKey]: id };
 
   let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
@@ -755,7 +764,7 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
         ...where,
         [c.clientKey]: clientId,
         [c.identityKey]: identityId,
-        [c.generation]: initialGeneration(id),
+        [c.generation]: yield* initialGeneration(id),
         [c.cutoff]: mapping.order.encode(0),
         [c.state]: "Open",
         [c.version]: owner.marker,
@@ -769,7 +778,13 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
   const row = read.rows[0];
 
   if (row === undefined)
-    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };
+    return {
+      id,
+      row: undefined,
+      generation: yield* initialGeneration(id),
+      cutoff: 0,
+      blocked: false,
+    };
   invariant(
     row[c.clientKey] === clientId &&
       row[c.identityKey] === identityId &&
@@ -816,9 +831,9 @@ export const readGrant = Effect.fn("oauthConnected.readGrant")(function* (
     context.moduleId === moduleId &&
       context.grantId === grantId &&
       mapping.subjectId.equals(native, row[g.subjectId]) &&
-      row[g.identityKey] === oauthIdentityKey(context.identity) &&
-      row[g.clientKey] === clientKey(context.configuration) &&
-      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&
+      row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&
+      row[g.clientKey] === (yield* clientKey(context.configuration)) &&
+      row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&
       row[g.profileKey] === context.configuration.profile.key &&
       row[g.grantVersion] === context.grantVersion &&
       row[g.tokenVersion] === context.tokenVersion &&

package/src/drizzle/oauth-connected-target.ts

@@ -8,7 +8,7 @@ import {
   type PrepareOAuthCommit,
 } from "@yielded/auth/OAuth";
 /* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */
-import { Effect, Layer, Schema } from "effect";
+import { type Crypto, Effect, Layer, type PlatformError, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
@@ -94,8 +94,10 @@ const mutation =
       input: Input,
     ) => Effect.Effect<
       Value,
-      import("@yielded/auth/OAuth").OAuthUnavailable | PersistenceMappingError,
-      CurrentOAuthTransaction
+      | import("@yielded/auth/OAuth").OAuthUnavailable
+      | PersistenceMappingError
+      | PlatformError.PlatformError,
+      CurrentOAuthTransaction | Crypto.Crypto
     >,
     schema: Schema.Codec<Value, Encoded, never, never>,
   ) =>
@@ -111,8 +113,10 @@ const read =
       input: Input,
     ) => Effect.Effect<
       Value,
-      import("@yielded/auth/OAuth").OAuthUnavailable | PersistenceMappingError,
-      CurrentOAuthTransaction
+      | import("@yielded/auth/OAuth").OAuthUnavailable
+      | PersistenceMappingError
+      | PlatformError.PlatformError,
+      CurrentOAuthTransaction | Crypto.Crypto
     >,
   ) =>
   (input: Input) =>