@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.19

package/src/SqliteDo.ts

@@ -1,18 +1,21 @@
 import { SqliteClient } from "@effect/sql-sqlite-do/SqliteClient";
 import { NativeDatabase, PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
 import type { AnyRelations } from "drizzle-orm";
-import { type EffectSQLiteDoDatabase, makeWithDefaults } from "drizzle-orm/effect-sqlite-do";
+import { makeWithDefaults } from "drizzle-orm/effect-sqlite-do";
+
+import { type DatabaseValue, makeDatabase } from "./drizzle/sqlite-do-database";
+export { type DatabaseValue, type Transaction, makeDatabase } from "./drizzle/sqlite-do-database";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Context, Effect, Layer } from "effect";
 
 import { nativeDatabase } from "./drizzle/native-database";
 
-/** The application-owned Drizzle database used to construct persistence services. */
-export class Database extends Context.Service<Database, EffectSQLiteDoDatabase<AnyRelations>>()(
+/** The application-owned Drizzle queries with Effect SQL transaction ownership. */
+export class Database extends Context.Service<Database, DatabaseValue<AnyRelations>>()(
   "effect-auth/persistence-drizzle/SqliteDo/Database",
 ) {}
 
-/** The SQL-client Layer must configure storage so Drizzle owns transactionSync. */
+/** Construct Drizzle with asynchronous transactions owned by Effect SQL. */
 export const databaseLayer = Layer.effect(
   Database,
   Effect.gen(function* () {
@@ -21,19 +24,22 @@ export const databaseLayer = Layer.effect(
 
     if (storage === undefined)
       return yield* PersistenceConfigurationError.make({
-        reason:
-          "SqliteDo requires a SQL client configured with storage for synchronous transactions",
+        reason: "SqliteDo requires a SQL client configured with Durable Object storage",
       });
 
-    return yield* makeWithDefaults({ storage });
+    return yield* makeDatabase(yield* makeWithDefaults({ storage }));
   }),
 );
 
+import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target";
 import type {
   ExternalIdentityTables,
   IdentityTables,
   SubjectProvisioningTables,
 } from "./drizzle/model";
+import { sqlClientPasswordStandaloneGuard } from "./drizzle/password-target";
+import { sqlClientProofStandaloneGuard } from "./drizzle/proof-target";
+import { sqlClientSessionStandaloneGuard } from "./drizzle/session-target";
 import { makeSqliteEmailTarget, sqliteEmailConfiguration } from "./drizzle/sqlite-emails";
 import {
   makeSqliteExternalIdentityServices,
@@ -44,31 +50,36 @@ import { makeSqlitePasswordTarget, sqlitePasswordConfiguration } from "./drizzle
 import { makeSqliteProofTarget, sqliteProofConfiguration } from "./drizzle/sqlite-proofs";
 import { makeSqliteSessionTarget, sqliteSessionConfiguration } from "./drizzle/sqlite-sessions";
 
-const sessionTarget = makeSqliteSessionTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const sessionTarget = makeSqliteSessionTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteSessionConfiguration("synchronous", Effect.void),
+  (service) => sqliteSessionConfiguration("interactive", sqlClientSessionStandaloneGuard(service)),
 );
 
-const proofTarget = makeSqliteProofTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const proofTarget = makeSqliteProofTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteProofConfiguration("synchronous", Effect.void),
+  (service) => sqliteProofConfiguration("interactive", sqlClientProofStandaloneGuard(service)),
 );
 
-const passwordTarget = makeSqlitePasswordTarget<
+const passwordTarget = makeSqlitePasswordTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  true
->(Database, sqlitePasswordConfiguration("synchronous", Effect.void, Effect.void));
+  (service) =>
+    sqlitePasswordConfiguration(
+      "interactive",
+      sqlClientPasswordStandaloneGuard(service),
+      sqlClientProofStandaloneGuard(service),
+    ),
+);
 
-const emailTarget = makeSqliteEmailTarget<Database, EffectSQLiteDoDatabase<AnyRelations>, true>(
+const emailTarget = makeSqliteEmailTarget<Database, DatabaseValue<AnyRelations>>(
   Database,
-  sqliteEmailConfiguration("synchronous", Effect.void, Effect.void),
+  (service) =>
+    sqliteEmailConfiguration(
+      "interactive",
+      sqlClientEmailStandaloneGuard(service),
+      sqlClientProofStandaloneGuard(service),
+    ),
 );
 
-/**
- * Email mutations must own their outer transactionSync. Arbitrary raw Drizzle
- * nesting is not detectable; owner bodies and mapping allocators stay runSync-compatible.
- */
 export const {
   coordinateEmailAddress,
   coordinateEmailRegistration,
@@ -77,11 +88,6 @@ export const {
   makeEmailSignInServices,
 } = emailTarget;
 
-/**
- * Password mutations and registration must own their outer transactionSync.
- * Arbitrary raw Drizzle nesting is not detectable; owner bodies must remain
- * runSync-compatible. Detectable Effect commit scopes are rejected pre-write.
- */
 export const {
   coordinatePasswordPersistence,
   coordinatePasswordRegistration,
@@ -89,21 +95,8 @@ export const {
   makePasswordRegistrationServices,
 } = passwordTarget;
 
-/**
- * Proof mutations and coordinateProofPersistence must own their outermost
- * transactionSync call. The installed driver cannot detect an arbitrary raw
- * Drizzle outer transaction; calling either boundary from one is unsupported.
- * The owner body must remain runSync-compatible.
- */
 export const { coordinateProofPersistence, makeProofPersistenceServices } = proofTarget;
 
-/**
- * Session mutation methods and coordinate* functions must own their outermost
- * transactionSync call. The installed Drizzle driver exposes no context marker
- * for an arbitrary raw outer database.transaction call, so invoking either
- * boundary from one is unsupported and cannot be detected. Detectable Effect
- * commit scopes are rejected before writes.
- */
 export const {
   coordinateAuthenticationAuthority,
   coordinatePendingAuthentication,
@@ -117,7 +110,7 @@ export const {
   makeStatefulSessionServices,
 } = sessionTarget;
 
-export const commitMode = "synchronous" as const;
+export const commitMode = "interactive" as const;
 
 export const makeIdentityServices = <
   Subject extends AnySQLiteTable,
@@ -128,7 +121,7 @@ export const makeIdentityServices = <
 >(
   mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,
 ) =>
-  makeSqliteIdentityServices(mapping, "synchronous").pipe(
+  makeSqliteIdentityServices(mapping, "interactive").pipe(
     Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)),
   );
 
@@ -140,7 +133,7 @@ export const makeSubjectProvisioningServices = <
 >(
   mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,
 ) =>
-  makeSqliteSubjectProvisioningServices(mapping, "synchronous").pipe(
+  makeSqliteSubjectProvisioningServices(mapping, "interactive").pipe(
     Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)),
   );
 
@@ -159,9 +152,14 @@ import { makeSqlitePasswordPreparedTarget } from "./drizzle/sqlite-password-prep
 
 const passwordPreparedTarget = makeSqlitePasswordPreparedTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  true
->(Database, sqlitePasswordConfiguration("synchronous", Effect.void, Effect.void));
+  DatabaseValue<AnyRelations>
+>(Database, (service) =>
+  sqlitePasswordConfiguration(
+    "interactive",
+    sqlClientPasswordStandaloneGuard(service),
+    sqlClientProofStandaloneGuard(service),
+  ),
+);
 
 export const { makePasswordPreparedPersistenceServices, coordinatePasswordPreparedPersistence } =
   passwordPreparedTarget;
@@ -169,17 +167,17 @@ export const { makePasswordPreparedPersistenceServices, coordinatePasswordPrepar
 export { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target";
 
 import { makeOAuthTarget } from "./drizzle/oauth-drivers";
+import { sqlClientOAuthStandaloneGuard } from "./drizzle/oauth-target";
 
 const oauthTarget = makeOAuthTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientOAuthStandaloneGuard,
 });
 
 export const {
@@ -198,18 +196,17 @@ export const {
 } = oauthTarget;
 
 import { makePasskeyTarget } from "./drizzle/passkey-drivers";
+import { sqlClientPasskeyStandaloneGuard } from "./drizzle/passkey-target";
 
 const passkeyTarget = makePasskeyTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientPasskeyStandaloneGuard,
 });
 
 export const {
@@ -225,36 +222,32 @@ export const {
   coordinatePasskeyRegistration,
 } = passkeyTarget;
 
-import { makeTotpTarget } from "./drizzle/totp-target";
+import { makeTotpTarget, sqlClientTotpStandaloneGuard } from "./drizzle/totp-target";
 
 const totpTarget = makeTotpTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientTotpStandaloneGuard,
 });
 
 export const { makeTotpPersistenceServices, coordinateTotpPersistence } = totpTarget;
 
-import { makePhoneTarget } from "./drizzle/phone-target";
+import { makePhoneTarget, sqlClientPhoneStandaloneGuard } from "./drizzle/phone-target";
 
 const phoneTarget = makePhoneTarget<
   Database,
-  EffectSQLiteDoDatabase<AnyRelations>,
-  AnySQLiteTable<{ dialect: "sqlite" }>,
-  unknown,
-  true
+  DatabaseValue<AnyRelations>,
+  AnySQLiteTable<{ dialect: "sqlite" }>
 >(Database, {
-  mode: "synchronous",
+  mode: "interactive",
   dialect: "sqlite",
   locking: false,
-  standaloneGuard: () => Effect.void,
+  standaloneGuard: sqlClientPhoneStandaloneGuard,
 });
 
 export const { makePhonePersistenceServices, coordinatePhonePersistence } = phoneTarget;

package/src/drizzle/crypto.ts

@@ -0,0 +1,14 @@
+import { TokenDigest } from "@yielded/auth/Schema";
+import { Crypto, Effect } from "effect";
+import { Base64Url } from "effect/encoding";
+
+const encoder = new TextEncoder();
+
+export const randomId = Effect.flatMap(Crypto.Crypto, (crypto) =>
+  crypto.randomBytes(32).pipe(Effect.map(Base64Url.encode)),
+);
+
+export const digest = (value: string) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) => crypto.digest("SHA-256", encoder.encode(value))).pipe(
+    Effect.map((bytes) => TokenDigest.make(Base64Url.encode(bytes))),
+  );

package/src/drizzle/d1-identity.ts

@@ -1,5 +1,5 @@
 import type { D1Client } from "@effect/sql-d1/D1Client";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -382,4 +382,4 @@ export const makeD1IdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeD1SubjectProvisioningServices(mapping)),
     ...(yield* makeD1ExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/d1-oauth.ts

@@ -10,7 +10,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -129,7 +129,10 @@ export function coordinateD1OAuthSignIn<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthSignInPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthSignInPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthSignIn<
@@ -189,7 +192,10 @@ export function coordinateD1OAuthRegistrationIntents<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthRegistrationIntents | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthRegistrationIntents | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistrationIntents<
@@ -244,7 +250,10 @@ export function coordinateD1OAuthAccounts<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, OAuthAccountsPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  | Exclude<R, OAuthAccountsPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthAccounts<
@@ -312,7 +321,7 @@ export function coordinateD1OAuthRegistration<
 ): Effect.Effect<
   A,
   OAuthCoordinatorError<E> | DatabaseError,
-  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements
+  Exclude<R, TargetId | D1BatchStatements> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
 > {
   return Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetOAuthRegistration<

package/src/drizzle/d1-passkey.ts

@@ -9,7 +9,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -94,6 +94,7 @@ export function coordinatePasskeyPersistence<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -156,6 +157,7 @@ export function coordinatePasskeyRegistrationCeremony<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -239,6 +241,7 @@ export function coordinatePasskeyManagement<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup
@@ -328,6 +331,7 @@ export function coordinatePasskeyRegistration<
   A,
   PasskeyCoordinatorError<E> | DatabaseError,
   | Exclude<R, PasskeyPersistence | AuthorityId | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | DatabaseRequirements
   | RSetup

package/src/drizzle/d1-phone.ts

@@ -10,7 +10,7 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -59,6 +59,7 @@ export const coordinatePhonePersistence = <
   A,
   PhoneCoordinatorError<E> | DatabaseError,
   | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | D1BatchStatements>
+  | Crypto.Crypto
   | LifecycleHooks
   | RSetup
   | DatabaseRequirements

package/src/drizzle/d1-totp.ts

@@ -5,7 +5,7 @@ import { TotpUnavailable, TotpPersistence } from "@yielded/auth/Totp";
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { Database as DatabaseService } from "./d1-database";
 import { makeD1Owner } from "./d1-planning";
@@ -50,7 +50,11 @@ export const coordinateTotpPersistence = <
 ): Effect.Effect<
   A,
   TotpCoordinatorError<E> | DatabaseError,
-  Exclude<R, TotpPersistence | D1BatchStatements> | LifecycleHooks | RSetup | DatabaseRequirements
+  | Exclude<R, TotpPersistence | D1BatchStatements>
+  | Crypto.Crypto
+  | LifecycleHooks
+  | RSetup
+  | DatabaseRequirements
 > =>
   Effect.flatMap(nativeDatabase(acquire), (database) =>
     coordinateTargetTotp(

package/src/drizzle/mysql-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -331,4 +331,4 @@ export const makeMysqlIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeMysqlSubjectProvisioningServices(mapping)),
     ...(yield* makeMysqlExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/oauth-accounts.ts

@@ -30,7 +30,7 @@ import {
   readFlow,
   terminalFlow,
 } from "./oauth-flow";
-import type { OAuthEligibilityFact } from "./oauth-model";
+import type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from "./oauth-model";
 import { both, col, copiedRow, equal, CurrentOAuthTransaction } from "./oauth-owner";
 import { acquireTuple, readTuple } from "./oauth-registration";
 import {
@@ -71,7 +71,7 @@ const authorization = (
         mapping.subject.decodeActionRequirement(copiedRow(current.row), action),
       );
 
-      const accepted = validAction(
+      const accepted = yield* validAction(
         auth,
         {
           moduleId: auth.challenge.moduleId,
@@ -493,7 +493,7 @@ const targetCredential = (mapping: any, moduleId: string, credentialId: string,
         subject: ownership[t.externalSubject],
       };
 
-      invariant(oauthIdentityKey(identity) === row[cr.identityKey]);
+      invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
 
       const shared = current.revision.credentials.find(
         (item: any) => item.credentialId === credentialId,
@@ -648,23 +648,24 @@ export const unlink = (mapping: any, input: any) =>
       const current = yield* accountCurrent(mapping, expected.revision.subjectId);
 
       if (current === undefined) return { _tag: "Rejected" } as const;
-      const guards = mapping.connectedReferenceGuards ?? [];
+
+      const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =
+        mapping.connectedReferenceGuards ?? [];
 
       invariant(guards.length <= 32);
       let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;
 
       if (mapping.connectedReference !== undefined)
         for (const guard of guards) {
+          const condition = guard.condition({
+            identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
+            identityKey: yield* oauthIdentityKey(expected.identity),
+            subjectId: copiedRow({ value: current.nativeId }).value,
+          });
+
           const read = yield* owner.read(
             guard.table,
-            guard.condition({
-              identity: snapshotOAuthSync(
-                OAuthCredentialSnapshot.fields.identity,
-                expected.identity,
-              ),
-              identityKey: oauthIdentityKey(expected.identity),
-              subjectId: copiedRow({ value: current.nativeId }).value,
-            }),
+            Effect.isEffect(condition) ? yield* condition : condition,
             { orderBy: col(guard.table, guard.orderBy) },
           );
 
@@ -730,7 +731,7 @@ export const unlink = (mapping: any, input: any) =>
         cr = mapping.credential,
         a = mapping.authority;
 
-      const key = oauthIdentityKey(expected.identity),
+      const key = yield* oauthIdentityKey(expected.identity),
         t = mapping.ownership.tuple;
 
       const connected = mapping.connectedReference?.({

package/src/drizzle/oauth-connected-collection.ts

@@ -285,7 +285,7 @@ export const collect = Effect.fn("oauthConnected.collect")(function* (
         subject: candidate[t.externalSubject],
       };
 
-      invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);
+      invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
 
       const tuple = yield* F.inspectTuple(mapping, identity),
         row = tuple.row;

package/src/drizzle/oauth-connected-custody.ts

@@ -113,9 +113,9 @@ export const storeJob = Effect.fn("oauthConnected.storeJob")(function* (
   );
 
   const j = mapping.revocation.job,
-    identity = oauthIdentityKey(token.identity),
-    client = S.clientKey(token.configuration),
-    cohort = S.cohortKey(client, identity);
+    identity = yield* oauthIdentityKey(token.identity),
+    client = yield* S.clientKey(token.configuration),
+    cohort = yield* S.cohortKey(client, identity);
 
   const h = mapping.cohort;
 
@@ -254,14 +254,16 @@ export const noFormerOwner = (
   client: string,
   native: unknown,
 ) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) => {
+  Effect.gen(function* () {
+    const owner = yield* CurrentOAuthTransaction;
+
     const g = mapping.grant,
       f = mapping.flow,
       j = S.jobTable(mapping);
 
     const condition = both(
       sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,
-      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
+      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
       ...(j === undefined
         ? []
         : [
@@ -269,7 +271,7 @@ export const noFormerOwner = (
           ]),
     );
 
-    return Effect.map(owner.check(condition), (accepted) => {
+    return yield* Effect.map(owner.check(condition), (accepted) => {
       if (accepted) owner.postconditions.push(condition);
 
       return accepted;

package/src/drizzle/oauth-connected-drivers.ts

@@ -6,7 +6,7 @@ import {
   OAuthUnavailable,
 } from "@yielded/auth/OAuth";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
@@ -69,6 +69,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -108,6 +109,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -142,7 +144,7 @@ export const makeOAuthConnectedTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(
@@ -193,6 +195,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -228,6 +231,7 @@ export const makeOAuthConnectedTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -258,7 +262,7 @@ export const makeOAuthConnectedTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthConnectedRevocations<
@@ -361,6 +365,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   > {
@@ -435,6 +440,7 @@ export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   > {