@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.20

package/src/drizzle/oauth-target.ts

@@ -28,7 +28,7 @@ import {
 import type { SecurityRevision } from "@yielded/auth/Sessions";
 /* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */
 import { eq, sql } from "drizzle-orm";
-import { type Context, Effect, Layer } from "effect";
+import { type Crypto, type Context, Effect, Layer } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
@@ -91,7 +91,11 @@ export const sqlClientOAuthStandaloneGuard = (
 export const makeOAuthExecution = Effect.fnUntraced(function* (
   configuration: OAuthTargetConfiguration,
   mapping: unknown,
-): Effect.fn.Return<OAuthExecution, OAuthUnavailable, LifecycleHooks | NativeDatabase> {
+): Effect.fn.Return<
+  OAuthExecution,
+  OAuthUnavailable,
+  LifecycleHooks | NativeDatabase | Crypto.Crypto
+> {
   const hooks = yield* LifecycleHooks;
 
   yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
@@ -435,7 +439,11 @@ export const coordinateOAuthOwner = <Services, Transaction, A, E, R>(
     services: Services,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> => {
+): Effect.Effect<
+  A,
+  OAuthCoordinatorError<E>,
+  R | Crypto.Crypto | LifecycleHooks | NativeDatabase
+> => {
   const captured = captureOAuthMapping(mapping);
 
   return Effect.flatMap(LifecycleHooks, (hooks) =>

package/src/drizzle/passkey-drivers.ts

@@ -2,7 +2,7 @@ import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasskeyPersistence } from "@yielded/auth/Passkey";
 import type { Table } from "drizzle-orm";
-import { Effect, Context } from "effect";
+import { type Crypto, Effect, Context } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import type {
@@ -84,6 +84,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -130,6 +131,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -175,7 +177,7 @@ export const makePasskeyTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskey(
@@ -221,6 +223,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -255,6 +258,7 @@ export const makePasskeyTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
     | RSetup
@@ -288,7 +292,7 @@ export const makePasskeyTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskeyRegistration(

package/src/drizzle/passkey-write-drivers.ts

@@ -2,7 +2,7 @@ import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasskeyManagementPersistence, PasskeyPersistence } from "@yielded/auth/Passkey";
 import type { Table } from "drizzle-orm";
-import { Context, Effect } from "effect";
+import { type Crypto, Context, Effect } from "effect";
 
 import { nativeDatabase } from "./native-database";
 import type { PasskeyMappingSource } from "./passkey-model";
@@ -73,6 +73,7 @@ export const makePasskeyWriteTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -120,6 +121,7 @@ export const makePasskeyWriteTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -159,6 +161,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -250,6 +253,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -297,6 +301,7 @@ export const makePasskeyWriteTarget = <
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -339,7 +344,11 @@ export const makePasskeyWriteTarget = <
   ): Effect.Effect<
     A,
     PasskeyCoordinatorError<E> | DatabaseError,
-    Exclude<R, PasskeyPersistence | AuthorityId> | LifecycleHooks | RSetup | DatabaseRequirements
+    | Exclude<R, PasskeyPersistence | AuthorityId>
+    | Crypto.Crypto
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetPasskeyRegistrationWriter(

package/src/drizzle/pg-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   IdentityConflict,
@@ -307,4 +307,4 @@ export const makePgIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makePgSubjectProvisioningServices(mapping)),
     ...(yield* makePgExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/phone-model.ts

@@ -1,4 +1,4 @@
-import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import { hooksLayer } from "@yielded/auth/Persistence";
 import {
   type PhoneAdmissionPolicy,
   type PhoneLifecyclePolicy,
@@ -175,7 +175,7 @@ export interface PhonePersistenceServices {
   readonly phoneSignInTargets: PhoneSignInTargets["Service"];
 }
 
-/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+/** Bundle phone storage, admission, and lookup with empty hook defaults. */
 export const phonePersistenceLayer = <E, R>(
   services: Effect.Effect<PhonePersistenceServices, E, R>,
 ) =>
@@ -187,4 +187,4 @@ export const phonePersistenceLayer = <E, R>(
         Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),
       ),
     ),
-  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));
+  ).pipe(Layer.provide(hooksLayer));

package/src/drizzle/phone-target.ts

@@ -1,4 +1,3 @@
-import { randomId } from "@yielded/auth-crypto";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
@@ -16,9 +15,10 @@ import {
 import { ProofBinding } from "@yielded/auth/Proofs";
 import { sql, type Table } from "drizzle-orm";
 /* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */
-import { Context, Effect, Schema } from "effect";
+import { type Crypto, Context, Effect, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import { randomId } from "./crypto";
 import { CurrentD1PlanningDatabase } from "./d1-planning";
 import { compileD1ProofCompletionPlan } from "./d1-proofs";
 import type { PersistenceMappingError } from "./model";
@@ -309,7 +309,11 @@ export const coordinateTargetPhone = <
     services: PhonePersistenceServices,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, PhoneCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+): Effect.Effect<
+  A,
+  PhoneCoordinatorError<E>,
+  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase
+> =>
   Effect.gen(function* () {
     const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
 
@@ -342,7 +346,7 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
   ? Parameters<Parameters<D["transaction"]>[0]>[0]
   : never;
 
-/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+/** Concrete driver wrappers select transaction mode. */
 export const makePhoneTarget = <
   DatabaseId,
   D extends { readonly transaction: any },
@@ -383,6 +387,7 @@ export const makePhoneTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -421,6 +426,7 @@ export const makePhoneTarget = <
     | (Synchronous extends true
         ? never
         : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -451,6 +457,7 @@ export const makePhoneTarget = <
     A,
     PhoneCoordinatorError<E> | DatabaseError,
     | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements

package/src/drizzle/sqlite-do-database.ts

@@ -0,0 +1,87 @@
+import type { SqliteClient } from "@effect/sql-sqlite-do/SqliteClient";
+import { PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
+import type { AnyRelations } from "drizzle-orm";
+import { EffectTransactionRollbackError } from "drizzle-orm/effect-core";
+import type { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
+import { Effect } from "effect";
+import type { SqlError } from "effect/sql/SqlError";
+
+type NativeDatabase<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {
+  readonly $client: SqliteClient;
+};
+
+type Queries<T extends AnyRelations> = Pick<
+  NativeDatabase<T>,
+  | "query"
+  | "$cache"
+  | "$with"
+  | "$count"
+  | "with"
+  | "select"
+  | "selectDistinct"
+  | "insert"
+  | "update"
+  | "delete"
+  | "run"
+  | "all"
+  | "get"
+  | "values"
+>;
+
+/** Drizzle queries with transactions owned by the captured Effect SQL client. */
+export type DatabaseValue<T extends AnyRelations = AnyRelations> = Queries<T> & {
+  readonly $client: SqliteClient;
+  readonly transaction: <A, E, R>(
+    body: (transaction: Transaction<T>) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError, R>;
+};
+
+/** An asynchronous Durable Object transaction, including nested rollback. */
+export type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T> & {
+  readonly rollback: () => EffectTransactionRollbackError;
+};
+
+/**
+ * Keep the application's Drizzle query configuration and capture its SQL client.
+ * Effect SQL owns storage.transaction, so cryptography may suspend before commit.
+ * Raw Drizzle transactionSync callbacks are not supported outer owners.
+ */
+export const makeDatabase = Effect.fnUntraced(function* <T extends AnyRelations>(
+  database: NativeDatabase<T>,
+): Effect.fn.Return<DatabaseValue<T>, PersistenceConfigurationError> {
+  const client = database.$client;
+
+  if (client.config.storage === undefined)
+    return yield* PersistenceConfigurationError.make({
+      reason: "SqliteDo requires a SQL client configured with Durable Object storage",
+    });
+
+  const queries: Queries<T> = {
+    query: database.query,
+    $cache: database.$cache,
+    $with: database.$with.bind(database),
+    $count: database.$count.bind(database),
+    with: database.with.bind(database),
+    select: database.select.bind(database),
+    selectDistinct: database.selectDistinct.bind(database),
+    insert: database.insert.bind(database),
+    update: database.update.bind(database),
+    delete: database.delete.bind(database),
+    run: database.run.bind(database),
+    all: database.all.bind(database),
+    get: database.get.bind(database),
+    values: database.values.bind(database),
+  };
+
+  const transaction: DatabaseValue<T>["transaction"] = (body) =>
+    client.withTransaction(Effect.suspend(() => body(makeTransaction())));
+
+  const makeTransaction = (): Transaction<T> => ({
+    ...queries,
+    $client: client,
+    transaction,
+    rollback: () => new EffectTransactionRollbackError(),
+  });
+
+  return { ...queries, $client: client, transaction };
+});

package/src/drizzle/sqlite-emails.ts

@@ -5,7 +5,6 @@ import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase as DODatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase as NodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase as WasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -31,6 +30,7 @@ import {
 import { nativeDatabase } from "./native-database";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
+import type { DatabaseValue as DODatabase } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,

package/src/drizzle/sqlite-identity.ts

@@ -1,4 +1,4 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -326,4 +326,4 @@ export const makeSqliteIdentityServices = Effect.fnUntraced(function* <
     ...(yield* makeSqliteSubjectProvisioningServices(mapping, mode)),
     ...(yield* makeSqliteExternalIdentityServices(mapping)),
   };
-});
+}, withStorageValidation);

package/src/drizzle/sqlite-passwords.ts

@@ -5,7 +5,6 @@ import { type PasswordUnavailable, PasswordPersistence } from "@yielded/auth/Pas
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase as DODatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase as NodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase as WasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -26,6 +25,7 @@ import {
 } from "./password-target";
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
+import type { DatabaseValue as DODatabase } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,

package/src/drizzle/sqlite-proofs.ts

@@ -4,7 +4,6 @@ import { type ProofUnavailable, ProofPersistence } from "@yielded/auth/Proofs";
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -19,6 +18,7 @@ import {
   makeTargetProofPersistenceServices,
   type ProofTargetConfiguration,
 } from "./proof-target";
+import type { DatabaseValue } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,
@@ -29,7 +29,7 @@ import type { SuppliedService } from "./SuppliedService";
 type Database =
   | EffectLibsqlDatabase<AnyRelations>
   | EffectSQLiteBunDatabase<AnyRelations>
-  | EffectSQLiteDoDatabase<AnyRelations>
+  | DatabaseValue<AnyRelations>
   | EffectSQLiteNodeDatabase<AnyRelations>
   | EffectSQLiteWasmDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];

package/src/drizzle/sqlite-sessions.ts

@@ -12,7 +12,6 @@ import {
 import type { AnyRelations } from "drizzle-orm";
 import type { EffectLibsqlDatabase } from "drizzle-orm/effect-libsql";
 import type { EffectSQLiteBunDatabase } from "drizzle-orm/effect-sqlite-bun";
-import type { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
 import type { EffectSQLiteNodeDatabase } from "drizzle-orm/effect-sqlite-node";
 import type { EffectSQLiteWasmDatabase } from "drizzle-orm/effect-sqlite-wasm";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -40,6 +39,7 @@ import {
   makeTargetSessionStepUpServices,
   coordinateTargetSessionStepUp,
 } from "./session-target";
+import type { DatabaseValue } from "./sqlite-do-database";
 import {
   type TransactionService,
   acquireTransactionService,
@@ -50,7 +50,7 @@ import type { SuppliedService } from "./SuppliedService";
 type Database =
   | EffectLibsqlDatabase<AnyRelations>
   | EffectSQLiteBunDatabase<AnyRelations>
-  | EffectSQLiteDoDatabase<AnyRelations>
+  | DatabaseValue<AnyRelations>
   | EffectSQLiteNodeDatabase<AnyRelations>
   | EffectSQLiteWasmDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];

package/src/drizzle/storage-validation.ts

@@ -1,7 +1,8 @@
 import {
   NativeDatabase,
   PersistenceMappingError,
-  validateStorage,
+  validateStorageBatch,
+  type StorageValidation,
 } from "@yielded/auth-persistence/Adapter";
 import { getTableColumns, getTableName, is, Table } from "drizzle-orm";
 import { getTableConfig as getMysqlTableConfig, MySqlTable } from "drizzle-orm/mysql-core";
@@ -243,6 +244,8 @@ export const validateDrizzleStorage = Effect.fnUntraced(
 
     const { $client: client } = yield* NativeDatabase;
 
+    const batches = new Map<"pg" | "mysql" | "sqlite", StorageValidation[]>();
+
     for (const plan of physical) {
       const pg = is(plan.table, PgTable);
       const mysql = is(plan.table, MySqlTable);
@@ -255,15 +258,21 @@ export const validateDrizzleStorage = Effect.fnUntraced(
 
       const columns = getTableColumns(plan.table);
 
-      yield* validateStorage(
-        pg ? "pg" : mysql ? "mysql" : "sqlite",
-        {
+      const dialect = pg ? "pg" : mysql ? "mysql" : "sqlite";
+      const batch = batches.get(dialect) ?? [];
+
+      batch.push({
+        table: {
           name: getTableName(plan.table),
           ...(schema === undefined ? {} : { schema }),
           columns: Object.fromEntries(plan.keys.map((key) => [key, { name: columns[key]!.name }])),
         },
-        [plan.keys],
-      ).pipe(
+        required: [plan.keys],
+      });
+      batches.set(dialect, batch);
+    }
+    for (const [dialect, requirements] of batches) {
+      yield* validateStorageBatch(dialect, requirements).pipe(
         Effect.provideService(SqlClient, client),
         Effect.mapError(() =>
           PersistenceMappingError.make({

package/src/drizzle/totp-state.ts

@@ -1,4 +1,3 @@
-import { randomId, digest } from "@yielded/auth-crypto";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import {
   TotpUnavailable,
@@ -11,6 +10,7 @@ import {
 import { sql, type SQL } from "drizzle-orm";
 import { Context, Effect, Schema } from "effect";
 
+import { randomId, digest } from "./crypto";
 import { both, makeTransactionRows, type TransactionOwner } from "./transaction-owner";
 export const unavailable = () => TotpUnavailable.make({});
 
@@ -59,7 +59,7 @@ export const captureTotp = Effect.fn("TotpNative.capture")(function* (
   )
     return undefined;
 
-  const scope = scopeFor(mapping.moduleId, subjectId),
+  const scope = yield* scopeFor(mapping.moduleId, subjectId),
     found = yield* owner.read(factor.table, equal(factor.table, { [factor.scope]: scope }), {
       limit: 1,
     }),
@@ -140,7 +140,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
   const guards: SQL[] = [];
   const credentialGuards: { credentialId: string; condition: SQL }[] = [];
 
-  const commandScope = digest(
+  const commandScope = yield* digest(
     `effect-auth/totp/command/v1/${mapping.moduleId.length}:${mapping.moduleId}/${input.subjectId.length}:${input.subjectId}/${input.commandId}`,
   );
 
@@ -413,7 +413,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
               secret: null,
               pending: null,
               recoveryDigests: [],
-              revision: randomId(),
+              revision: yield* randomId,
             };
             semantic = true;
           }
@@ -428,7 +428,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
           secret: null,
           pending: null,
           recoveryDigests: [],
-          revision: randomId(),
+          revision: yield* randomId,
         };
       else {
         if (new Set(action.recoveryDigests).size !== 10) return reject;
@@ -436,7 +436,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
       }
     }
   }
-  next = { ...next, version: randomId() };
+  next = { ...next, version: yield* randomId };
 
   const subject = mapping.subject,
     factor = mapping.factor,
@@ -445,7 +445,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
   const subjectKey = { [subject.id]: nativeId };
 
   if (semantic) {
-    const revision = randomId(),
+    const revision = yield* randomId,
       updates = {
         [subject.securityRevision]: revision,
         [subject.factorEnabled]: subject.encodeEnabled(next.secret !== null),
@@ -500,7 +500,7 @@ export const mutateTotp = Effect.fn("TotpNative.mutate")(function* (
     const values = factor.encodeInsert({
       scope: commandScope,
       state: "totp-command/v1",
-      version: randomId(),
+      version: yield* randomId,
     });
 
     invariant(values[factor.scope] === commandScope && values[factor.state] === "totp-command/v1");

package/src/drizzle/totp-target.ts

@@ -1,4 +1,3 @@
-import { randomId } from "@yielded/auth-crypto";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
@@ -10,9 +9,10 @@ import {
 } from "@yielded/auth/Totp";
 import type { Table } from "drizzle-orm";
 /* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */
-import { Context, Effect, Schema } from "effect";
+import { type Crypto, Context, Effect, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import { randomId } from "./crypto";
 import type { PersistenceMappingError } from "./model";
 import { nativeDatabase } from "./native-database";
 import { validateDrizzleStorage } from "./storage-validation";
@@ -164,7 +164,11 @@ export const coordinateTargetTotp = <M, A, E, R, RSetup = never>(
     services: TotpPersistenceServices,
     append: (statement: Statement<any>) => void,
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, TotpCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+): Effect.Effect<
+  A,
+  TotpCoordinatorError<E>,
+  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase
+> =>
   Effect.gen(function* () {
     const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
 
@@ -196,7 +200,7 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
   ? Parameters<Parameters<D["transaction"]>[0]>[0]
   : never;
 
-/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+/** Concrete driver wrappers select transaction mode. */
 export const makeTotpTarget = <
   DatabaseId,
   D extends { readonly transaction: any },
@@ -230,6 +234,7 @@ export const makeTotpTarget = <
     A,
     TotpCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -259,6 +264,7 @@ export const makeTotpTarget = <
     A,
     TotpCoordinatorError<E> | DatabaseError,
     | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)
+    | Crypto.Crypto
     | LifecycleHooks
     | RSetup
     | DatabaseRequirements
@@ -287,7 +293,7 @@ export const makeTotpTarget = <
   ): Effect.Effect<
     A,
     TotpCoordinatorError<E> | DatabaseError,
-    Exclude<R, TotpPersistence> | LifecycleHooks | RSetup | DatabaseRequirements
+    Exclude<R, TotpPersistence> | Crypto.Crypto | LifecycleHooks | RSetup | DatabaseRequirements
   > {
     return Effect.flatMap(nativeDatabase(acquire), (database) =>
       coordinateTargetTotp(