@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.20

package/src/drizzle/oauth-connected-flow.ts

@@ -45,7 +45,7 @@ export const pending = Effect.fn("oauthConnected.pending")(function* (
       row[f.flowId] === c.flowId &&
       row[f.commandId] === c.commandId &&
       mapping.subjectId.equals(native, row[f.subjectId]) &&
-      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
@@ -238,7 +238,7 @@ export const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(funct
       row[f.flowId] === c.flowId &&
       row[f.commandId] === c.commandId &&
       mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&
-      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
@@ -356,7 +356,7 @@ export const claim = Effect.fn("oauthConnected.claim")(function* (
     {
       [f.state]: "Claimed",
       [f.claimId]: claimed.claimId,
-      [f.claimDigest]: digest(S.claimStorage.encode(claimed)),
+      [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),
       [f.claimOrder]: mapping.order.encode(order),
       [f.claimedAt]: mapping.clock.encodeInstant(now),
       [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
@@ -392,7 +392,7 @@ export const exact = Effect.fn("oauthConnected.exactClaim")(function* (
     row === undefined ||
     row[f.work] !== "Unresolved" ||
     row[f.claimId] !== claim.claimId ||
-    row[f.claimDigest] !== digest(S.claimStorage.encode(claim))
+    row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))
   )
     return undefined;
   const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
@@ -403,7 +403,7 @@ export const exact = Effect.fn("oauthConnected.exactClaim")(function* (
       row[f.stateDigest] === c.stateDigest &&
       mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
       mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&
-      row[f.clientKey] === S.clientKey(S.configuration(claim.flow)) &&
+      row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&
       S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&
       mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&
       mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,
@@ -448,7 +448,7 @@ export const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const t = mapping.ownership.tuple,
-    key = oauthIdentityKey(identity);
+    key = yield* oauthIdentityKey(identity);
 
   const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });
   const row = read.rows[0];

package/src/drizzle/oauth-connected-management.ts

@@ -341,7 +341,7 @@ export const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
       [d.grantId]: token.grantId,
       [d.intent]: S.commandStorage.encode({
         context: token,
-        originalDigest: digest(S.disconnectStorage.encode(input.grant)),
+        originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
         ...(input.revocation === undefined
           ? {}
           : { revocationJobId: input.revocation.context.jobId }),

package/src/drizzle/oauth-connected-reference.ts

@@ -1,6 +1,7 @@
 import { eq, is, sql, type SQL, type Table } from "drizzle-orm";
 import { MySqlTable } from "drizzle-orm/mysql-core/table";
 import { PgTable } from "drizzle-orm/pg-core/table";
+import { Effect } from "effect";
 
 import type { OAuthConnectedMapping } from "./oauth-connected-model";
 import { scopeKey, type Mapping } from "./oauth-connected-state";
@@ -52,15 +53,19 @@ export const oauthConnectedOwnershipReferences = <
         table: c.table,
         orderBy: c.clientKey,
         condition: (input) =>
-          both(
-            equal(c.table, {
-              [c.clientKey]: scopeKey(input.identity.provider, input.identity.issuer),
-              [c.counter]: mapping.order.encode(0),
-            }),
-            exactText(c.table, c.provider, input.identity.provider),
-            exactText(c.table, c.issuer, input.identity.issuer),
-            exactText(c.table, c.clientRegistrationId, ""),
-          ),
+          Effect.gen(function* () {
+            const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
+
+            return both(
+              equal(c.table, {
+                [c.clientKey]: key,
+                [c.counter]: mapping.order.encode(0),
+              }),
+              exactText(c.table, c.provider, input.identity.provider),
+              exactText(c.table, c.issuer, input.identity.issuer),
+              exactText(c.table, c.clientRegistrationId, ""),
+            );
+          }),
       }),
     ],
     connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),

package/src/drizzle/oauth-connected-settlement.ts

@@ -46,9 +46,9 @@ export const activateGrant = Effect.fn("oauthConnected.activateGrant")(function*
   const owner = yield* CurrentOAuthTransaction;
   const token = grant.context;
   const g = mapping.grant;
-  const identityKey = oauthIdentityKey(token.identity);
-  const clientKey = S.clientKey(token.configuration);
-  const cohortKey = S.cohortKey(clientKey, identityKey);
+  const identityKey = yield* oauthIdentityKey(token.identity);
+  const clientKey = yield* S.clientKey(token.configuration);
+  const cohortKey = yield* S.cohortKey(clientKey, identityKey);
 
   const values = {
     ...g.encodeInsert({
@@ -143,7 +143,7 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
       token.grantId === c.grantId &&
       token.identity.provider === c.provider &&
       token.identity.issuer === c.issuer &&
-      S.clientKey(token.configuration) === cl.id &&
+      (yield* S.clientKey(token.configuration)) === cl.id &&
       S.tokenContextStorage.encode({
         ...token,
         configuration: S.configuration(input.claim.flow),

package/src/drizzle/oauth-connected-sign-in.ts

@@ -83,7 +83,7 @@ export const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (
       [f.stateDigest]: c.stateDigest,
       [f.snapshot]: null,
       [f.claimId]: claim.claimId,
-      [f.claimDigest]: digest(reservationStorage.encode(reservation)),
+      [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),
       [f.claimOrder]: mapping.order.encode(order),
       [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
       [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
@@ -116,13 +116,13 @@ const exact = Effect.fn("oauthConnected.exactSignIn")(function* (
     row === undefined ||
     row[f.work] !== "Unresolved" ||
     row[f.claimId] !== reservation.claim.claimId ||
-    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))
+    row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))
   )
     return undefined;
   invariant(
     row[f.subjectId] === null &&
       row[f.commandId] === c.commandId &&
-      row[f.clientKey] === S.clientKey(reservation.configuration) &&
+      row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&
       S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),
   );
   const now = yield* owner.now(mapping.clock);
@@ -164,7 +164,7 @@ const credential = Effect.fn("oauthConnected.signInCredential")(function* (
       [c.moduleId]: context.moduleId,
       [c.credentialId]: input.credentialId,
       [c.subjectId]: found.nativeId,
-      [c.identityKey]: oauthIdentityKey(input.identity),
+      [c.identityKey]: yield* oauthIdentityKey(input.identity),
       [c.credentialRevision]: input.credentialRevision,
     }),
     c.activeCondition,
@@ -242,18 +242,19 @@ const slot = Effect.fn("oauthConnected.signInSlot")(function* (
 
 /** Orders belong to one client registration. Moving a profile to another client
  * requires a newer profile generation; retired clients cannot replace it later. */
-const canReplace = (
+const canReplace = Effect.fnUntraced(function* (
   reservation: M.OAuthSignInAccessClaim,
   previous: M.OAuthConnectedTokenContext,
-) => {
+) {
   const generation = reservation.configuration.profile.generation;
   const oldGeneration = previous.configuration.profile.generation;
 
-  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)
+  return (yield* S.clientKey(reservation.configuration)) ===
+    (yield* S.clientKey(previous.configuration))
     ? generation >= oldGeneration &&
         S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)
     : generation > oldGeneration;
-};
+});
 
 export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function* (
   mapping: S.Mapping,
@@ -293,7 +294,7 @@ export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function*
     co.blocked ||
     S.orderNumber(r.order) <= co.cutoff ||
     previous?.row[mapping.grant.refreshWork] === "Unresolved" ||
-    (previous !== undefined && !canReplace(r, previous.context));
+    (previous !== undefined && !(yield* canReplace(r, previous.context)));
 
   return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
     _tag: quarantine ? "Quarantine" : "Target",
@@ -377,7 +378,7 @@ export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
         F.sameTarget(out.previous, previous.context) &&
         sameIdentity(previous.context.identity, token.identity) &&
         previous.row[mapping.grant.refreshWork] !== "Unresolved" &&
-        canReplace(r, previous.context);
+        (yield* canReplace(r, previous.context));
 
   const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
 

package/src/drizzle/oauth-connected-state.ts

@@ -107,11 +107,11 @@ export const nativeOrder = (mapping: Authority, value: unknown) =>
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
 
-const key = (domain: string, fields: ReadonlyArray<string>) => {
+const key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {
   for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
 
-  return "v1:" + digest(strings.encode([domain, ...fields]));
-};
+  return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
+});
 
 export const clientKey = (configuration: M.OAuthConnectedConfiguration) =>
   key("effect-auth/oauth-connected-client/v1", [
@@ -124,7 +124,9 @@ export const cohortKey = (client: string, identity: string) =>
   key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
 
 export const initialGeneration = (cohort: string) =>
-  M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + digest(cohort));
+  digest(cohort).pipe(
+    Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)),
+  );
 
 export const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>
   snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
@@ -254,9 +256,9 @@ export const action = Effect.fn("oauthConnected.action")(function* (
         ? "connected-disconnect"
         : "connected-complete";
 
-  const intentDigest = digest(expected.intent);
+  const intentDigest = yield* digest(expected.intent);
 
-  const binding = digest(
+  const binding = yield* digest(
     strings.encode([
       "effect-auth/oauth-connected-action/v1",
       expected.moduleId,
@@ -364,7 +366,9 @@ export const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (
 });
 
 export const scopeKey = (provider: string, issuer: string) =>
-  "scope:" + key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]);
+  key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(
+    Effect.map((value) => "scope:" + value),
+  );
 
 export interface ScopeAnchor {
   readonly id: string;
@@ -412,7 +416,7 @@ export const scope = Effect.fn("oauthConnected.scope")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = scopeKey(config.provider, config.issuer),
+    id = yield* scopeKey(config.provider, config.issuer),
     cache = yield* anchors(scopeCache, c.table);
 
   const existing = cache.get(id);
@@ -497,7 +501,7 @@ export const readScope = Effect.fn("oauthConnected.readScope")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = scopeKey(provider, issuer),
+    id = yield* scopeKey(provider, issuer),
     cache = yield* anchors(scopeCache, c.table),
     cached = cache.get(id);
 
@@ -549,12 +553,12 @@ export const lockClientById = Effect.fn("oauthConnected.lockClientById")(functio
     row !== undefined &&
       row[c.clientRegistrationId] !== "" &&
       id ===
-        key("effect-auth/oauth-connected-client/v1", [
+        (yield* key("effect-auth/oauth-connected-client/v1", [
           row[c.provider],
           row[c.issuer],
           row[c.clientRegistrationId],
-        ]) &&
-      scope.id === scopeKey(row[c.provider], row[c.issuer]),
+        ])) &&
+      scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),
   );
   const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };
 
@@ -563,10 +567,15 @@ export const lockClientById = Effect.fn("oauthConnected.lockClientById")(functio
   return found;
 });
 
-export const heldScope = (mapping: Authority, provider: string, issuer: string) =>
-  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>
-    cache.get(scopeKey(provider, issuer)),
-  );
+export const heldScope = Effect.fnUntraced(function* (
+  mapping: Authority,
+  provider: string,
+  issuer: string,
+) {
+  const cache = yield* anchors(scopeCache, mapping.client.table);
+
+  return cache.get(yield* scopeKey(provider, issuer));
+});
 
 /** Cleanup obtains every scope then every client before entering any tuple. */
 export const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (
@@ -583,7 +592,7 @@ export const prelockClients = Effect.fn("oauthConnected.prelockClients")(functio
   const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();
 
   for (const value of releaseScopes)
-    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });
+    scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });
   for (const id of unique) {
     const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
         limit: 1,
@@ -593,7 +602,7 @@ export const prelockClients = Effect.fn("oauthConnected.prelockClients")(functio
       row = read.rows[0];
 
     invariant(row !== undefined);
-    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {
+    scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
       provider: row[c.provider],
       issuer: row[c.issuer],
       required: true,
@@ -629,7 +638,7 @@ export const client = Effect.fn("oauthConnected.client")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.client,
-    id = clientKey(config),
+    id = yield* clientKey(config),
     where = { [c.clientKey]: id };
 
   const heldScope = yield* scope(mapping, config, create);
@@ -723,7 +732,7 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
   const owner = yield* CurrentOAuthTransaction;
 
   const c = mapping.cohort,
-    id = cohortKey(clientId, identityId),
+    id = yield* cohortKey(clientId, identityId),
     where = { [c.cohortKey]: id };
 
   let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
@@ -755,7 +764,7 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
         ...where,
         [c.clientKey]: clientId,
         [c.identityKey]: identityId,
-        [c.generation]: initialGeneration(id),
+        [c.generation]: yield* initialGeneration(id),
         [c.cutoff]: mapping.order.encode(0),
         [c.state]: "Open",
         [c.version]: owner.marker,
@@ -769,7 +778,13 @@ export const cohort = Effect.fn("oauthConnected.cohort")(function* (
   const row = read.rows[0];
 
   if (row === undefined)
-    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };
+    return {
+      id,
+      row: undefined,
+      generation: yield* initialGeneration(id),
+      cutoff: 0,
+      blocked: false,
+    };
   invariant(
     row[c.clientKey] === clientId &&
       row[c.identityKey] === identityId &&
@@ -816,9 +831,9 @@ export const readGrant = Effect.fn("oauthConnected.readGrant")(function* (
     context.moduleId === moduleId &&
       context.grantId === grantId &&
       mapping.subjectId.equals(native, row[g.subjectId]) &&
-      row[g.identityKey] === oauthIdentityKey(context.identity) &&
-      row[g.clientKey] === clientKey(context.configuration) &&
-      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&
+      row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&
+      row[g.clientKey] === (yield* clientKey(context.configuration)) &&
+      row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&
       row[g.profileKey] === context.configuration.profile.key &&
       row[g.grantVersion] === context.grantVersion &&
       row[g.tokenVersion] === context.tokenVersion &&

package/src/drizzle/oauth-connected-target.ts

@@ -8,7 +8,7 @@ import {
   type PrepareOAuthCommit,
 } from "@yielded/auth/OAuth";
 /* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */
-import { Effect, Layer, Schema } from "effect";
+import { type Crypto, Effect, Layer, type PlatformError, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
@@ -94,8 +94,10 @@ const mutation =
       input: Input,
     ) => Effect.Effect<
       Value,
-      import("@yielded/auth/OAuth").OAuthUnavailable | PersistenceMappingError,
-      CurrentOAuthTransaction
+      | import("@yielded/auth/OAuth").OAuthUnavailable
+      | PersistenceMappingError
+      | PlatformError.PlatformError,
+      CurrentOAuthTransaction | Crypto.Crypto
     >,
     schema: Schema.Codec<Value, Encoded, never, never>,
   ) =>
@@ -111,8 +113,10 @@ const read =
       input: Input,
     ) => Effect.Effect<
       Value,
-      import("@yielded/auth/OAuth").OAuthUnavailable | PersistenceMappingError,
-      CurrentOAuthTransaction
+      | import("@yielded/auth/OAuth").OAuthUnavailable
+      | PersistenceMappingError
+      | PlatformError.PlatformError,
+      CurrentOAuthTransaction | Crypto.Crypto
     >,
   ) =>
   (input: Input) =>

package/src/drizzle/oauth-drivers.ts

@@ -6,7 +6,7 @@ import {
   OAuthSignInPersistence,
 } from "@yielded/auth/OAuth";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import { makeOAuthConnectedTarget } from "./oauth-connected-drivers";
@@ -70,6 +70,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -103,6 +104,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -131,7 +133,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthSignInPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthSignIn<
@@ -183,6 +185,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -218,6 +221,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -248,7 +252,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthRegistrationIntents> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistrationIntents<
@@ -304,6 +308,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -339,6 +344,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -369,7 +375,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, OAuthAccountsPersistence> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthAccounts<
@@ -428,6 +434,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TargetId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -462,6 +469,7 @@ export const makeOAuthTarget = <
     A,
     OAuthCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TargetId | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
@@ -495,7 +503,7 @@ export const makeOAuthTarget = <
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
+    Exclude<R, TargetId> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetOAuthRegistration<

package/src/drizzle/oauth-flow.ts

@@ -301,7 +301,7 @@ export const currentSubject = (mapping: any, nativeId: unknown) =>
 export const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity["identity"]) =>
   Effect.flatMap(CurrentOAuthTransaction, (owner) =>
     Effect.gen(function* () {
-      const key = oauthIdentityKey(identity),
+      const key = yield* oauthIdentityKey(identity),
         o = mapping.ownership;
 
       const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);

package/src/drizzle/oauth-model.ts

@@ -8,7 +8,7 @@ import type {
 import type { AuthenticationFactor } from "@yielded/auth/Operations";
 import type { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
-import type { Effect } from "effect";
+import type { Crypto, Effect, PlatformError } from "effect";
 
 import type { PersistenceMappingError, SubjectIdCodec } from "./model";
 
@@ -506,8 +506,8 @@ export const oauthCleanupTable = <T extends Table, N>(
   Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });
 
 /** A stable application/reference lock acquired before an ownership target.
- * Missing rows retain ownership. Conditions are synchronous and use detached
- * native IDs; every writer of the guarded reference follows the same order. */
+ * Missing rows retain ownership. Conditions use detached native IDs; every
+ * writer of the guarded reference follows the same order. */
 export interface OAuthReferenceGuardTable<T extends Table, N> {
   readonly table: T;
   readonly orderBy: Column<T>;
@@ -515,7 +515,7 @@ export interface OAuthReferenceGuardTable<T extends Table, N> {
     readonly identity: typeof OAuthExternalIdentity.Type;
     readonly identityKey: string;
     readonly subjectId: N;
-  }) => SQL;
+  }) => SQL | Effect.Effect<SQL, PlatformError.PlatformError, Crypto.Crypto>;
 }
 
 export interface OAuthReferenceGuardDescriptor<N> {

package/src/drizzle/oauth-registration.ts

@@ -40,7 +40,7 @@ export const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity
   Effect.flatMap(CurrentOAuthTransaction, (owner) =>
     Effect.gen(function* () {
       const t = ownership.tuple,
-        key = oauthIdentityKey(identity);
+        key = yield* oauthIdentityKey(identity);
 
       const where = { [t.identityKey]: key };
       const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });
@@ -259,7 +259,7 @@ export const inspectIntent = (
           row[i.reference] === intent.reference &&
           row[i.flowId] === c.flowId &&
           row[i.claimId] === intent.claimId &&
-          row[i.identityKey] === oauthIdentityKey(intent.identity) &&
+          row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&
           mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&
           mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,
       );

package/src/drizzle/oauth-state.ts

@@ -1,7 +1,3 @@
-// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.
-import { sha256 } from "@noble/hashes/sha2.js";
-// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.
-import { randomBytes } from "@noble/hashes/utils.js";
 import {
   type OAuthActionAuthorization,
   type OAuthAccountRevision,
@@ -10,9 +6,12 @@ import {
   snapshotOAuthSync,
 } from "@yielded/auth/OAuth";
 import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import { DateTime, Effect, Schema } from "effect";
+import { Crypto, DateTime, Effect, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 
+import { digest, randomId } from "./crypto";
+export { digest } from "./crypto";
+
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
 
@@ -22,8 +21,7 @@ export const invariant: (value: unknown) => asserts value = (value) => {
   if (!value) throw unavailable();
 };
 
-export const nonce = () => Base64Url.encode(randomBytes(32));
-export const digest = (value: string) => Base64Url.encode(sha256(encoder.encode(value)));
+export const nonce = randomId;
 
 /** Capture configuration/callback references while preserving Drizzle table, SQL
  * and Effect objects. Never freeze or mutate the consumer's original graph. */
@@ -57,7 +55,9 @@ export const captureOAuthMapping = <A>(input: A): A => {
 
 /** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.
  * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */
-export const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {
+export const oauthIdentityKey = Effect.fnUntraced(function* (
+  input: typeof OAuthExternalIdentity.Type,
+) {
   const identity = snapshotOAuthSync(OAuthExternalIdentity, input);
 
   const fields = [
@@ -85,8 +85,10 @@ export const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): stri
     offset += 4 + value.length;
   }
 
-  return "v1:" + Base64Url.encode(sha256(packed));
-};
+  const crypto = yield* Crypto.Crypto;
+
+  return "v1:" + Base64Url.encode(yield* crypto.digest("SHA-256", packed));
+});
 
 export const sameIdentity = (
   left: typeof OAuthExternalIdentity.Type,
@@ -148,7 +150,7 @@ export const satisfies = (
   );
 };
 
-export const validAction = (
+export const validAction = Effect.fnUntraced(function* (
   authorization: OAuthActionAuthorization,
   expected: {
     readonly moduleId: string;
@@ -161,12 +163,12 @@ export const validAction = (
   currentRequirement: AuthenticationRequirement,
   now: number,
   maximumAgeMillis: number,
-) => {
+) {
   const challenge = authorization.challenge;
   const evidence = authorization.evidence;
-  const intentDigest = digest(expected.intent);
+  const intentDigest = yield* digest(expected.intent);
 
-  const binding = digest(
+  const binding = yield* digest(
     // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.
     JSON.stringify([
       "effect-auth/oauth-action/v1",
@@ -213,4 +215,4 @@ export const validAction = (
 
     return satisfies(fresh, requirement);
   });
-};
+});