@yielded/auth-persistence-drizzle 0.1.0-beta.17 → 0.1.0-beta.19

package/src/drizzle/oauth-drivers.ts

@@ -6,7 +6,7 @@ import {
   OAuthSignInPersistence,
 } from "@yielded/auth/OAuth";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import { makeOAuthConnectedTarget } from "./oauth-connected-drivers";
@@ -70,6 +70,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -103,6 +104,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -131,7 +133,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthSignInPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthSignIn<
@@ -183,6 +185,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -218,6 +221,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -248,7 +252,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthRegistrationIntents> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistrationIntents<
@@ -304,6 +308,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -339,6 +344,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -369,7 +375,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthAccountsPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthAccounts<
@@ -428,6 +434,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TargetId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -462,6 +469,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TargetId | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -495,7 +503,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, TargetId> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistration<

package/src/drizzle/oauth-flow.ts

@@ -301,7 +301,7 @@ export const currentSubject = (mapping: any, nativeId: unknown) =>
 export const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity["identity"]) =>
   Effect.flatMap(CurrentOAuthTransaction, (owner) =>
     Effect.gen(function* () {
-      const key = oauthIdentityKey(identity),
+      const key = yield* oauthIdentityKey(identity),
         o = mapping.ownership;
 
       const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);

package/src/drizzle/oauth-model.ts

@@ -8,7 +8,7 @@ import type {
 import type { AuthenticationFactor } from "@yielded/auth/Operations";
 import type { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
-import type { Effect } from "effect";
+import type { Crypto, Effect, PlatformError } from "effect";
 
 import type { PersistenceMappingError, SubjectIdCodec } from "./model";
 
@@ -506,8 +506,8 @@ export const oauthCleanupTable = <T extends Table, N>(
   Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });
 
 /** A stable application/reference lock acquired before an ownership target.
- * Missing rows retain ownership. Conditions are synchronous and use detached
- * native IDs; every writer of the guarded reference follows the same order. */
+ * Missing rows retain ownership. Conditions use detached native IDs; every
+ * writer of the guarded reference follows the same order. */
 export interface OAuthReferenceGuardTable<T extends Table, N> {
   readonly table: T;
   readonly orderBy: Column<T>;
@@ -515,7 +515,7 @@ export interface OAuthReferenceGuardTable<T extends Table, N> {
     readonly identity: typeof OAuthExternalIdentity.Type;
     readonly identityKey: string;
     readonly subjectId: N;
-  }) => SQL;
+  }) => SQL | Effect.Effect<SQL, PlatformError.PlatformError, Crypto.Crypto>;
 }
 
 export interface OAuthReferenceGuardDescriptor<N> {

package/src/drizzle/oauth-registration.ts

@@ -40,7 +40,7 @@ export const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity
   Effect.flatMap(CurrentOAuthTransaction, (owner) =>
     Effect.gen(function* () {
       const t = ownership.tuple,
-        key = oauthIdentityKey(identity);
+        key = yield* oauthIdentityKey(identity);
 
       const where = { [t.identityKey]: key };
       const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });
@@ -259,7 +259,7 @@ export const inspectIntent = (
           row[i.reference] === intent.reference &&
           row[i.flowId] === c.flowId &&
           row[i.claimId] === intent.claimId &&
-          row[i.identityKey] === oauthIdentityKey(intent.identity) &&
+          row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&
           mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&
           mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,
       );

package/src/drizzle/oauth-state.ts

@@ -1,7 +1,3 @@
-// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.
-import { sha256 } from "@noble/hashes/sha2.js";
-// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.
-import { randomBytes } from "@noble/hashes/utils.js";
 import {
   type OAuthActionAuthorization,
   type OAuthAccountRevision,
@@ -10,9 +6,12 @@ import {
   snapshotOAuthSync,
 } from "@yielded/auth/OAuth";
 import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import { DateTime, Effect, Schema } from "effect";
+import { Crypto, DateTime, Effect, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 
+import { digest, randomId } from "./crypto";
+export { digest } from "./crypto";
+
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
 
@@ -22,8 +21,7 @@ export const invariant: (value: unknown) => asserts value = (value) => {
   if (!value) throw unavailable();
 };
 
-export const nonce = () => Base64Url.encode(randomBytes(32));
-export const digest = (value: string) => Base64Url.encode(sha256(encoder.encode(value)));
+export const nonce = randomId;
 
 /** Capture configuration/callback references while preserving Drizzle table, SQL
  * and Effect objects. Never freeze or mutate the consumer's original graph. */
@@ -57,7 +55,9 @@ export const captureOAuthMapping = <A>(input: A): A => {
 
 /** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.
  * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */
-export const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {
+export const oauthIdentityKey = Effect.fnUntraced(function* (
+  input: typeof OAuthExternalIdentity.Type,
+) {
   const identity = snapshotOAuthSync(OAuthExternalIdentity, input);
 
   const fields = [
@@ -85,8 +85,10 @@ export const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): stri
     offset += 4 + value.length;
   }
 
-  return "v1:" + Base64Url.encode(sha256(packed));
-};
+  const crypto = yield* Crypto.Crypto;
+
+  return "v1:" + Base64Url.encode(yield* crypto.digest("SHA-256", packed));
+});
 
 export const sameIdentity = (
   left: typeof OAuthExternalIdentity.Type,
@@ -148,7 +150,7 @@ export const satisfies = (
   );
 };
 
-export const validAction = (
+export const validAction = Effect.fnUntraced(function* (
   authorization: OAuthActionAuthorization,
   expected: {
     readonly moduleId: string;
@@ -161,12 +163,12 @@ export const validAction = (
   currentRequirement: AuthenticationRequirement,
   now: number,
   maximumAgeMillis: number,
-) => {
+) {
   const challenge = authorization.challenge;
   const evidence = authorization.evidence;
-  const intentDigest = digest(expected.intent);
+  const intentDigest = yield* digest(expected.intent);
 
-  const binding = digest(
+  const binding = yield* digest(
     // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.
     JSON.stringify([
       "effect-auth/oauth-action/v1",
@@ -213,4 +215,4 @@ export const validAction = (
 
     return satisfies(fresh, requirement);
   });
-};
+});

package/src/drizzle/oauth-target.ts

@@ -28,7 +28,7 @@ import {
 import type { SecurityRevision } from "@yielded/auth/Sessions";
 /* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */
 import { eq, sql } from "drizzle-orm";
-import { type Context, Effect, Layer } from "effect";
+import { type Crypto, type Context, Effect, Layer } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
@@ -91,7 +91,11 @@ export const sqlClientOAuthStandaloneGuard = (
 export const makeOAuthExecution = Effect.fnUntraced(function* (
   configuration: OAuthTargetConfiguration,
   mapping: unknown,
-): Effect.fn.Return<OAuthExecution, OAuthUnavailable, LifecycleHooks | NativeDatabase> {
+): Effect.fn.Return<
+  OAuthExecution,
+  OAuthUnavailable,
+  LifecycleHooks | NativeDatabase | Crypto.Crypto
+> {
   const hooks = yield* LifecycleHooks;
 
   yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
@@ -435,7 +439,11 @@ export const coordinateOAuthOwner = <Services, Transaction, A, E, R>(
     services: Services,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> => {
+): Effect.Effect<
+  A,
+  OAuthCoordinatorError<E>,
+  R | Crypto.Crypto | LifecycleHooks | NativeDatabase
+> => {
   const captured = captureOAuthMapping(mapping);
 
   return Effect.flatMap(LifecycleHooks, (hooks) =>

package/src/drizzle/passkey-drivers.ts

@@ -2,7 +2,7 @@ import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasskeyPersistence } from "@yielded/auth/Passkey";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import type {
@@ -84,6 +84,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -130,6 +131,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -175,7 +177,7 @@ export const makePasskeyTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskey(
@@ -221,6 +223,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -255,6 +258,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -288,7 +292,7 @@ export const makePasskeyTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskeyRegistration(

package/src/drizzle/passkey-write-drivers.ts

@@ -2,7 +2,7 @@ import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasskeyManagementPersistence, PasskeyPersistence } from "@yielded/auth/Passkey";
 import type { Table } from "drizzle-orm";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import type { PasskeyMappingSource } from "./passkey-model";
@@ -73,6 +73,7 @@ export const makePasskeyWriteTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -120,6 +121,7 @@ export const makePasskeyWriteTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -159,6 +161,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -250,6 +253,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -297,6 +301,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -339,7 +344,11 @@ export const makePasskeyWriteTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence | AuthorityId> | LifecycleHooks | RSetup | DatabaseRequirements
+    | Exclude<R, PasskeyPersistence | AuthorityId>
+    | Crypto.Crypto
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskeyRegistrationWriter(

package/src/drizzle/password-prepared-sql.ts

@@ -752,7 +752,7 @@ export const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPrep
                 nativeNow = p.encodeInstant(now);
 
               const scope = identifierScope({
-                credential: authority.snapshot,
+                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),
                 revision: authority.revision,
               });
 

package/src/drizzle/pg-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   IdentityConflict,
@@ -307,4 +307,4 @@ export const makePgIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makePgSubjectProvisioningServices(mapping)),
     ...(yield* makePgExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/phone-model.ts

@@ -1,4 +1,4 @@
-import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import { hooksLayer } from "@yielded/auth/Persistence";
 import {
   type PhoneAdmissionPolicy,
   type PhoneLifecyclePolicy,
@@ -175,7 +175,7 @@ export interface PhonePersistenceServices {
   readonly phoneSignInTargets: PhoneSignInTargets["Service"];
 }
 
-/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+/** Bundle phone storage, admission, and lookup with empty hook defaults. */
 export const phonePersistenceLayer = <E, R>(
   services: Effect.Effect<PhonePersistenceServices, E, R>,
 ) =>
@@ -187,4 +187,4 @@ export const phonePersistenceLayer = <E, R>(
         Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),
       ),
     ),
-  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));
+  ).pipe(Layer.provide(hooksLayer));

package/src/drizzle/phone-target.ts

@@ -1,4 +1,3 @@
-import { randomId } from "@yielded/auth-crypto";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
@@ -16,9 +15,10 @@ import {
 import { ProofBinding } from "@yielded/auth/Proofs";
 import { sql, type Table } from "drizzle-orm";
 /* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */
-import { Context, Effect, Schema } from "effect";
+import { type Crypto, Context, Effect, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import { randomId } from "./crypto";
 import { CurrentD1PlanningDatabase } from "./d1-planning";
 import { compileD1ProofCompletionPlan } from "./d1-proofs";
 import type { PersistenceMappingError } from "./model";
@@ -309,7 +309,11 @@ export const coordinateTargetPhone = <
     services: PhonePersistenceServices,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, PhoneCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+): Effect.Effect<
+  A,
+  PhoneCoordinatorError<E>,
+  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase
+> =>
   Effect.gen(function* () {
     const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
 
@@ -342,7 +346,7 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
   ? Parameters<Parameters<D["transaction"]>[0]>[0]
   : never;
 
-/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+/** Concrete driver wrappers select transaction mode. */
 export const makePhoneTarget = <
   DatabaseId,
   D extends { readonly transaction: any },
@@ -383,6 +387,7 @@ export const makePhoneTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -421,6 +426,7 @@ export const makePhoneTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -451,6 +457,7 @@ export const makePhoneTarget = <
     A,
     PhoneCoordinatorError<E> | DatabaseError,
     | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements

package/src/drizzle/sqlite-do-database.ts

@@ -0,0 +1,87 @@
+import type { SqliteClient } from "@effect/sql-sqlite-do/SqliteClient";
+import { PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
+import type { AnyRelations } from "drizzle-orm";
+import { EffectTransactionRollbackError } from "drizzle-orm/effect-core";
+import type { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
+import { Effect } from "effect";
+import type { SqlError } from "effect/sql/SqlError";
+
+type NativeDatabase<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {
+  readonly $client: SqliteClient;
+};
+
+type Queries<T extends AnyRelations> = Pick<
+  NativeDatabase<T>,
+  | "query"
+  | "$cache"
+  | "$with"
+  | "$count"
+  | "with"
+  | "select"
+  | "selectDistinct"
+  | "insert"
+  | "update"
+  | "delete"
+  | "run"
+  | "all"
+  | "get"
+  | "values"
+>;
+
+/** Drizzle queries with transactions owned by the captured Effect SQL client. */
+export type DatabaseValue<T extends AnyRelations = AnyRelations> = Queries<T> & {
+  readonly $client: SqliteClient;
+  readonly transaction: <A, E, R>(
+    body: (transaction: Transaction<T>) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError, R>;
+};
+
+/** An asynchronous Durable Object transaction, including nested rollback. */
+export type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T> & {
+  readonly rollback: () => EffectTransactionRollbackError;
+};
+
+/**
+ * Keep the application's Drizzle query configuration and capture its SQL client.
+ * Effect SQL owns storage.transaction, so cryptography may suspend before commit.
+ * Raw Drizzle transactionSync callbacks are not supported outer owners.
+ */
+export const makeDatabase = Effect.fnUntraced(function* <T extends AnyRelations>(
+  database: NativeDatabase<T>,
+): Effect.fn.Return<DatabaseValue<T>, PersistenceConfigurationError> {
+  const client = database.$client;
+
+  if (client.config.storage === undefined)
+    return yield* PersistenceConfigurationError.make({
+      reason: "SqliteDo requires a SQL client configured with Durable Object storage",
+    });
+
+  const queries: Queries<T> = {
+    query: database.query,
+    $cache: database.$cache,
+    $with: database.$with.bind(database),
+    $count: database.$count.bind(database),
+    with: database.with.bind(database),
+    select: database.select.bind(database),
+    selectDistinct: database.selectDistinct.bind(database),
+    insert: database.insert.bind(database),
+    update: database.update.bind(database),
+    delete: database.delete.bind(database),
+    run: database.run.bind(database),
+    all: database.all.bind(database),
+    get: database.get.bind(database),
+    values: database.values.bind(database),
+  };
+
+  const transaction: DatabaseValue<T>["transaction"] = (body) =>
+    client.withTransaction(Effect.suspend(() => body(makeTransaction())));
+
+  const makeTransaction = (): Transaction<T> => ({
+    ...queries,
+    $client: client,
+    transaction,
+    rollback: () => new EffectTransactionRollbackError(),
+  });
+
+  return { ...queries, $client: client, transaction };
+});

package/src/drizzle/sqlite-emails.ts

@@ -5,7 +5,6 @@ import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase as DODatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase as NodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase as WasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -31,6 +30,7 @@ import {
 import { nativeDatabase } from "./native-database";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
+import type { DatabaseValue as DODatabase } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,

package/src/drizzle/sqlite-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -326,4 +326,4 @@ export const makeSqliteIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeSqliteSubjectProvisioningServices(mapping, mode)),
     ...(yield* makeSqliteExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/sqlite-passwords.ts

@@ -5,7 +5,6 @@ import { type PasswordUnavailable, PasswordPersistence } from "@yielded/auth/Pas
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase as DODatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase as NodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase as WasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -26,6 +25,7 @@ import {
 } from "./password-target";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
+import type { DatabaseValue as DODatabase } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,

package/src/drizzle/sqlite-proofs.ts

@@ -4,7 +4,6 @@ import { type ProofUnavailable, ProofPersistence } from "@yielded/auth/Proofs";
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -19,6 +18,7 @@ import {
   makeTargetProofPersistenceServices,
   type ProofTargetConfiguration,
 } from "./proof-target";
+import type { DatabaseValue } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,
@@ -29,7 +29,7 @@ import type { SuppliedService } from "./SuppliedService";
 type Database =
   | EffectLibsqlDatabase<AnyRelations>
   | EffectSQLiteBunDatabase<AnyRelations>
-  | EffectSQLiteDoDatabase<AnyRelations>
+  | DatabaseValue<AnyRelations>
   | EffectSQLiteNodeDatabase<AnyRelations>
   | EffectSQLiteWasmDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];