@yielded/auth-persistence 0.1.0-beta.17 → 0.1.0-beta.19

package/src/internal/passkeys.ts

@@ -1,4 +1,3 @@
-import { digest } from "@yielded/auth-crypto";
 import {
   PasskeyCredentials,
   PasskeyCredential,
@@ -19,6 +18,7 @@ import {
   type MappingInput,
   type PasskeyFeature,
 } from "./configuration";
+import { digest } from "./crypto";
 import { PersistenceMappingError } from "./mapping-error";
 import {
   requiredPasskeyCredentialConstraints,
@@ -54,6 +54,13 @@ const ModuleRow = Schema.Struct({
   policyRevision: Schema.String,
 });
 
+const ConfiguredModuleRow = Schema.Struct({
+  moduleId: Schema.String,
+  active: Schema.Boolean,
+  policyRevision: Schema.String,
+  admitted: Schema.Literals(["present", "missing"]),
+});
+
 const credentialData = PasskeyCredential.mapFields(
   ({ revision: _revision, active: _active, ...fields }) => fields,
 );
@@ -390,7 +397,21 @@ export const makeComposedPasskeys = (
       const client = yield* SqlClient.SqlClient;
 
       const policies = yield* Effect.forEach(features, (feature) =>
-        Effect.map(feature.policy, (policy) => ({ feature, policy })),
+        Effect.gen(function* () {
+          const policy = yield* feature.policy;
+          const encoded = yield* Schema.encodeEffect(policyJson)(policy);
+
+          const policyRevision = yield* digest(
+            yield* Schema.encodeEffect(seedJson)({
+              policy,
+              ...(feature.managementPolicy === undefined
+                ? {}
+                : { management: feature.managementPolicy }),
+            }),
+          );
+
+          return { feature, policy, encoded, policyRevision };
+        }),
       );
 
       const m = yield* Effect.try({
@@ -413,82 +434,112 @@ export const makeComposedPasskeys = (
       };
 
       const native = yield* CurrentProofSql;
+      const module = m.table("passkeyModules");
+      const columns = getTableColumns(module);
+      const admission = m.table("passkeyAdmissions");
+      const ac = getTableColumns(admission);
+
+      // Read live configuration on every acquisition. Matching modules and
+      // admission ownership need no initialization writes or advisory lock.
+      const configured = yield* native
+        .select({
+          moduleId: columns.moduleId,
+          active: columns.active,
+          policyRevision: columns.policyRevision,
+          // Predicate SQL preserves qualifiers through single-table projections.
+          admitted: sql`case when exists(select 1 from ${admission}
+            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})
+              then 'present' else 'missing' end`,
+        })
+        .from(module)
+        .where(
+          inArray(
+            columns.moduleId,
+            policies.map(({ feature }) => feature.moduleId),
+          ),
+        )
+        .pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),
+          Effect.map((rows) =>
+            policies.every(({ feature, policyRevision }) =>
+              rows.some(
+                (row) =>
+                  row.moduleId === feature.moduleId &&
+                  row.active &&
+                  row.admitted === "present" &&
+                  row.policyRevision === policyRevision,
+              ),
+            ),
+          ),
+        );
 
-      yield* client.withTransaction(
-        Effect.gen(function* () {
-          if (dialect === "pg")
-            yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
-          for (const { feature, policy } of policies) {
-            const encoded = yield* Schema.encodeEffect(policyJson)(policy);
-
-            const policyRevision = digest(
-              yield* Schema.encodeEffect(seedJson)({
-                policy,
-                ...(feature.managementPolicy === undefined
-                  ? {}
-                  : { management: feature.managementPolicy }),
-              }),
-            );
-
-            const module = m.table("passkeyModules");
-            const columns = getTableColumns(module);
-
-            yield* native
-              .insert(module)
-              .values({ moduleId: feature.moduleId, active: true, policy: encoded, policyRevision })
-              .onConflictDoNothing();
-
-            const rows = yield* native
-              .select()
-              .from(module)
-              .where(eq(columns.moduleId, feature.moduleId));
-
-            const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);
-
-            if (!row.active)
-              return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);
-            if (row.policyRevision !== policyRevision) {
-              const previous = yield* Schema.decodeEffect(policyJson)(row.policy);
-
-              if (policy.generation <= previous.generation)
-                return yield* configurationError(
-                  `Increase the passkey policy generation to change ${feature.moduleId}`,
-                );
+      if (!configured)
+        yield* client.withTransaction(
+          Effect.gen(function* () {
+            if (dialect === "pg")
+              yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
+            for (const { feature, policy, encoded, policyRevision } of policies) {
               yield* native
-                .update(module)
-                .set({ policy: encoded, policyRevision })
-                .where(
-                  and(
-                    eq(columns.moduleId, feature.moduleId),
-                    eq(columns.policyRevision, row.policyRevision),
-                    eq(columns.active, true),
-                  ),
-                );
-
-              const updated = yield* native
+                .insert(module)
+                .values({
+                  moduleId: feature.moduleId,
+                  active: true,
+                  policy: encoded,
+                  policyRevision,
+                })
+                .onConflictDoNothing();
+
+              const rows = yield* native
                 .select()
                 .from(module)
                 .where(eq(columns.moduleId, feature.moduleId));
 
-              const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);
+              const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);
 
-              if (!applied.active || applied.policyRevision !== policyRevision)
-                return yield* configurationError(
-                  `Passkey policy changed while configuring ${feature.moduleId}`,
-                );
+              if (!row.active)
+                return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);
+              if (row.policyRevision !== policyRevision) {
+                const previous = yield* Schema.decodeEffect(policyJson)(row.policy);
+
+                if (policy.generation <= previous.generation)
+                  return yield* configurationError(
+                    `Increase the passkey policy generation to change ${feature.moduleId}`,
+                  );
+                yield* native
+                  .update(module)
+                  .set({ policy: encoded, policyRevision })
+                  .where(
+                    and(
+                      eq(columns.moduleId, feature.moduleId),
+                      eq(columns.policyRevision, row.policyRevision),
+                      eq(columns.active, true),
+                    ),
+                  );
+
+                const updated = yield* native
+                  .select()
+                  .from(module)
+                  .where(eq(columns.moduleId, feature.moduleId));
+
+                const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);
+
+                if (!applied.active || applied.policyRevision !== policyRevision)
+                  return yield* configurationError(
+                    `Passkey policy changed while configuring ${feature.moduleId}`,
+                  );
+              }
+              yield* native
+                .insert(m.table("passkeyAdmissions"))
+                .values({
+                  authorityScope: namespace,
+                  moduleId: feature.moduleId,
+                  version: policyRevision,
+                  ownerMarker: policyRevision,
+                })
+                .onConflictDoNothing();
             }
-            yield* native
-              .insert(m.table("passkeyAdmissions"))
-              .values({
-                authorityScope: namespace,
-                moduleId: feature.moduleId,
-                version: policyRevision,
-                ownerMarker: policyRevision,
-              })
-              .onConflictDoNothing();
-          }
-        }),
-      );
+          }),
+        );
 
       const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(
         m.read,

package/src/internal/password-kernel.ts

@@ -1168,9 +1168,9 @@ export const makePasswordKernel = <
                 moduleId: input.moduleId,
                 action: input.action,
                 identifier: input.identifier,
-                ...(resolved === undefined
+                ...(resolved?.snapshot === undefined
                   ? {}
-                  : { subjectId: resolved.snapshot?.revision.subjectId }),
+                  : { subjectId: resolved.snapshot.revision.subjectId }),
               });
 
               const scopes = scopeEntries(keys, input.policy);

package/src/internal/persistence.ts

@@ -1,4 +1,3 @@
-import { digest, randomId } from "@yielded/auth-crypto";
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import type { PasskeyConfig } from "@yielded/auth/Passkey";
@@ -7,7 +6,7 @@ import { hooksLayer } from "@yielded/auth/Persistence";
 import { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
-import { Context, Effect, Layer, Schema } from "effect";
+import { Context, type Crypto, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 
 import {
@@ -27,6 +26,7 @@ import {
   type PasskeyRequirement,
   type MappingInput,
 } from "./configuration";
+import { randomId } from "./crypto";
 import { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from "./email-kernel";
 import { PersistenceMappingError } from "./mapping-error";
 import {
@@ -52,7 +52,11 @@ import {
   type StorageRole,
   type StorageTable,
 } from "./storage-tables";
-import { validateStorage } from "./storage-validation";
+import {
+  validateStorageBatch,
+  withStorageValidation,
+  type StorageValidation,
+} from "./storage-validation";
 import { makeTransactionExecutionKernel } from "./transaction-execution-kernel";
 import {
   makeTransactionKernel,
@@ -74,7 +78,12 @@ export interface Backend<T extends object, R> {
   }) => Effect.Effect<
     Context.Context<never>,
     PersistenceConfigurationError,
-    PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql
+    | PasskeyConfig
+    | LifecycleHooks
+    | SqlClient.SqlClient
+    | NativeDatabase
+    | CurrentProofSql
+    | Crypto.Crypto
   >;
 }
 
@@ -208,8 +217,10 @@ export const createPersistence = <T extends object, R>(
       if (idColumn === undefined || idColumn.type === "boolean")
         throw configError("Subject ID must map a text or integer column");
 
-      const prefix =
-        options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll("-", "_")}`;
+      const prefix = options.prefix;
+
+      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))
+        throw configError("Managed persistence requires an explicit SQL table prefix");
 
       const schema: Partial<Record<StorageRole, T>> = { ...options.tables };
 
@@ -310,6 +321,8 @@ export const createPersistence = <T extends object, R>(
           return yield* configError(
             "Persistence configuration belongs to a different Auth definition",
           );
+        const validations: StorageValidation[] = [];
+
         for (const role of roles) {
           const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
 
@@ -321,12 +334,14 @@ export const createPersistence = <T extends object, R>(
             if (columns[name] === undefined)
               return yield* configError(`Missing ${role}.${name} column`);
           }
-          yield* validateStorage(dialect, description, storageTables[role].unique);
+          validations.push({ table: description, required: storageTables[role].unique });
         }
-        yield* validateStorage(dialect, backend.describe(storage.subjects.table as T), [
-          [storage.subjects.id],
-        ]);
-        const mappings = makeMappings(storage);
+        validations.push({
+          table: backend.describe(storage.subjects.table as T),
+          required: [[storage.subjects.id]],
+        });
+        yield* validateStorageBatch(dialect, validations);
+        const mappings = yield* makeMappings(storage);
 
         const standalone = <E>(error: () => E) =>
           requireStandalone(error, client.transactionService);
@@ -403,7 +418,7 @@ export const createPersistence = <T extends object, R>(
               locking: dialect === "pg",
               standaloneGuard: standalone(() => PasswordUnavailable.make({})),
               insertIfAbsent: (query) => query.onConflictDoNothing(),
-              proof: proofConfiguration,
+              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),
             })
             .pipe(
               Effect.provideService(CurrentPasswordSql, native),
@@ -439,7 +454,7 @@ export const createPersistence = <T extends object, R>(
                 mode: "interactive",
                 locking: dialect === "pg",
                 standaloneGuard: standalone(() => EmailUnavailable.make({})),
-                proof: proofConfiguration,
+                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),
               })
               .pipe(
                 Effect.provideService(CurrentEmailSql, native),
@@ -564,6 +579,7 @@ export const createPersistence = <T extends object, R>(
             Context.Context<never>,
             PersistenceConfigurationError,
             | PasskeyRequirement<A>
+            | Crypto.Crypto
             | LifecycleHooks
             | SqlClient.SqlClient
             | NativeDatabase
@@ -582,6 +598,7 @@ export const createPersistence = <T extends object, R>(
         // The checked capability metadata above determines exactly these service keys.
         return context as Context.Context<Ports<C, Id, A>>;
       }).pipe(
+        withStorageValidation,
         Effect.mapError((error) =>
           Schema.is(PersistenceConfigurationError)(error)
             ? error

package/src/internal/phone-kernel.ts

@@ -1,4 +1,3 @@
-import { digest, randomId } from "@yielded/auth-crypto";
 import {
   PhoneCustody,
   PhoneCommandId,
@@ -14,6 +13,7 @@ import type { SubjectId } from "@yielded/auth/Schema";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import { Context, Effect, Option, Schema } from "effect";
 
+import { digest, randomId } from "./crypto";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 import type { SqlExpression as SQL } from "./query-operations";
 import type { QueryOperations, SqlFragment, SqlColumn } from "./query-operations";
@@ -100,7 +100,7 @@ export const makePhoneKernel = <
         moduleId: mapping.moduleId,
         record: value,
       }),
-      [mapping.state.version]: randomId(),
+      [mapping.state.version]: yield* randomId,
     };
 
     if (observed.rows.length === 0) {
@@ -128,7 +128,7 @@ export const makePhoneKernel = <
     mapping: any,
     phoneNumber: string,
   ) {
-    const key = scope(mapping.moduleId, "custody", phoneNumber),
+    const key = yield* scope(mapping.moduleId, "custody", phoneNumber),
       observation = yield* stateRead(mapping, key);
 
     const custody =
@@ -327,7 +327,7 @@ export const makePhoneKernel = <
       now = yield* owner.now(mapping),
       policy = mapping.admission;
 
-    const key = scope(mapping.moduleId, "admission", input.action + "/" + input.requestId),
+    const key = yield* scope(mapping.moduleId, "admission", input.action + "/" + input.requestId),
       receipt = yield* stateRead(mapping, key);
 
     if (receipt.rows.length !== 0) {
@@ -338,7 +338,7 @@ export const makePhoneKernel = <
 
       return (
         saved.fingerprint === input.fingerprint &&
-        saved.network === digest(input.networkKey) &&
+        saved.network === (yield* digest(input.networkKey)) &&
         saved.accepted === true &&
         saved.expiresAtMillis > now
       );
@@ -347,11 +347,20 @@ export const makePhoneKernel = <
     const window = Math.floor(now / policy.windowMillis),
       entries = [
         {
-          key: scope(mapping.moduleId, "network", input.action + "/" + digest(input.networkKey)),
+          key: yield* scope(
+            mapping.moduleId,
+            "network",
+            input.action + "/" + (yield* digest(input.networkKey)),
+          ),
           limit: input.action === "request" ? policy.networkRequests : policy.networkAttempts,
         },
         ...(input.action === "request"
-          ? [{ key: scope(mapping.moduleId, "messages", "global"), limit: policy.maximumMessages }]
+          ? [
+              {
+                key: yield* scope(mapping.moduleId, "messages", "global"),
+                limit: policy.maximumMessages,
+              },
+            ]
           : []),
       ].sort((a, b) => a.key.localeCompare(b.key));
 
@@ -383,7 +392,7 @@ export const makePhoneKernel = <
       key,
       {
         fingerprint: input.fingerprint,
-        network: digest(input.networkKey),
+        network: yield* digest(input.networkKey),
         accepted,
         expiresAtMillis: now + Math.min(policy.requestRetentionMillis, input.replayLifetimeMillis),
       },
@@ -446,7 +455,7 @@ export const makePhoneKernel = <
     )
       return { decision: rejected };
 
-    const commandKey = scope(mapping.moduleId, "command", input.commandId),
+    const commandKey = yield* scope(mapping.moduleId, "command", input.commandId),
       command = yield* stateRead(mapping, commandKey);
 
     if (command.rows.length !== 0) return { decision: rejected };
@@ -564,10 +573,10 @@ export const makePhoneKernel = <
           ? mapping.subjectIds.toSubject(mapping.subjectIds.allocate())
           : captured.target.revision!.subjectId,
       nativeId = mapping.subjectIds.toNative(subjectId),
-      securityRevision = SecurityRevision.make(randomId()),
-      credentialRevision = SecurityRevision.make(randomId()),
-      custodyRevision = SecurityRevision.make(randomId()),
-      credentialId = captured.target.custody?.credentialId ?? randomId();
+      securityRevision = SecurityRevision.make(yield* randomId),
+      credentialRevision = SecurityRevision.make(yield* randomId),
+      custodyRevision = SecurityRevision.make(yield* randomId),
+      credentialId = captured.target.custody?.credentialId ?? (yield* randomId);
 
     invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
 
@@ -647,12 +656,12 @@ export const makePhoneKernel = <
         yield* owner.update(
           i.table,
           { [i.namespace]: "phone", [i.value]: old.phoneNumber },
-          { [i.status]: i.encodeStatus(false), [i.revision]: randomId() },
+          { [i.status]: i.encodeStatus(false), [i.revision]: yield* randomId },
         );
         yield* owner.update(
           c.table,
           { [c.id]: old.credentialId, [c.subjectId]: nativeId },
-          { [c.status]: c.encodeStatus(false), [c.revision]: randomId() },
+          { [c.status]: c.encodeStatus(false), [c.revision]: yield* randomId },
         );
         yield* stateWrite(
           mapping,
@@ -660,8 +669,8 @@ export const makePhoneKernel = <
           {
             ...old,
             state: "retired",
-            custodyRevision: SecurityRevision.make(randomId()),
-            credentialRevision: SecurityRevision.make(randomId()),
+            custodyRevision: SecurityRevision.make(yield* randomId),
+            credentialRevision: SecurityRevision.make(yield* randomId),
           },
           captured.source.observation,
         );

package/src/internal/registration.ts

@@ -1,13 +1,13 @@
-import { randomId } from "@yielded/auth-crypto";
 import { coordinateCommit, hasCommitScope, LifecycleHooks } from "@yielded/auth/Hooks";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
 import { PasswordUnavailable } from "@yielded/auth/Password";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision } from "@yielded/auth/Sessions";
-import { type Context, Effect, Schema } from "effect";
+import { type Context, Crypto, Effect, Schema } from "effect";
 
 import { PersistenceConfigurationError } from "./configuration";
+import { randomId } from "./crypto";
 import { CurrentPasswordSql } from "./password-kernel";
 import type { QueryOperations } from "./query-operations";
 import type { PasswordRegistrationAuthority } from "./registration-contract";
@@ -25,7 +25,7 @@ type CreateSubject = (input: {
  * always suppress; a public request ID never recovers a private password intent.
  */
 export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(function* <R>(
-  mappings: ReturnType<typeof makeMappings>,
+  mappings: Effect.Success<ReturnType<typeof makeMappings>>,
   operations: QueryOperations,
   standalone: Effect.Effect<void, PasswordUnavailable>,
   provisioning: Context.Key<R, object>,
@@ -33,10 +33,11 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
 ): Effect.fn.Return<
   PasswordRegistrationAuthority<unknown>,
   PersistenceConfigurationError,
-  LifecycleHooks | CurrentPasswordSql | R
+  LifecycleHooks | CurrentPasswordSql | Crypto.Crypto | R
 > {
   const database = yield* CurrentPasswordSql;
   const hooks = yield* LifecycleHooks;
+  const crypto = yield* Crypto.Crypto;
   // Core has already decoded registration with the selected strategy's Schema;
   // the dynamic strategy table erases only that heterogeneous callback signature.
   const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;
@@ -129,7 +130,7 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
                     mapping.identifier.encodeInitialInsert(
                       input.identifier,
                       nativeId,
-                      SecurityRevision.make(randomId()),
+                      SecurityRevision.make(yield* randomId),
                     ),
                   )
                   .onConflictDoNothing()
@@ -139,8 +140,8 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
                 // subject too, then persist a non-authorizing receipt in a new transaction.
                 if (bound.length !== 1) return yield* new IdentifierTaken({});
 
-                const credentialId = randomId();
-                const credentialRevision = SecurityRevision.make(randomId());
+                const credentialId = yield* randomId;
+                const credentialRevision = SecurityRevision.make(yield* randomId);
 
                 yield* tx.insert(mapping.credential.table).values(
                   mapping.credential.encodeInsert({
@@ -148,7 +149,7 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
                     subjectId: nativeId,
                     credentialId,
                     credentialRevision,
-                    verifierVersion: SecurityRevision.make(randomId()),
+                    verifierVersion: SecurityRevision.make(yield* randomId),
                     replacement: input.replacement,
                   }),
                 );
@@ -169,6 +170,7 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
         return committed.value;
       }).pipe(
         Effect.provideService(LifecycleHooks, hooks),
+        Effect.provideService(Crypto.Crypto, crypto),
         (work) => reportPersistenceFailure(work, Schema.is(PasswordUnavailable)),
         Effect.mapError(() => PasswordUnavailable.make({})),
       ),

package/src/internal/session-kernel.ts

@@ -466,7 +466,7 @@ export const makeSessionKernel = (operations: QueryOperations) => {
   const ensureDirectFlowAvailable = Effect.fn("DrizzleSession.ensureFlowAvailable")(function* (
     mapping: AnyAuthorityMapping &
       AnyFlowMapping & {
-        readonly pending?: PendingAuthenticationTables<any, any, any, any>["pending"];
+        readonly pending?: PendingAuthenticationTables<any, any, any, any>["pending"] | undefined;
       },
     evidence: AuthenticationEvidence,
     nativeSubjectId: unknown,
@@ -1389,10 +1389,11 @@ export const makeSessionKernel = (operations: QueryOperations) => {
               );
 
               const extra = decoded[input.limit];
+              const nextCursor = extra === undefined ? undefined : sessions.at(-1)?.sessionId;
 
               return {
                 sessions,
-                ...(extra === undefined ? {} : { nextCursor: sessions.at(-1)?.sessionId }),
+                ...(nextCursor === undefined ? {} : { nextCursor }),
               };
             }),
           ),

package/src/internal/sql-query.ts

@@ -107,7 +107,7 @@ interface QueryState {
     readonly on: Fragment;
   }>;
   readonly selection?: Selection;
-  readonly where?: Fragment;
+  readonly where?: Fragment | undefined;
   readonly values?: Row;
   readonly returning?: Selection | true;
   readonly order?: ReadonlyArray<Fragment>;
@@ -258,7 +258,8 @@ export const makeSqlDatabase = Effect.fnUntraced(function* (dialect: Dialect) {
 
   const database: SqlDatabase = {
     $client: client,
-    select: (selection?: Selection) => query({ operation: "select", selection }),
+    select: (selection?: Selection) =>
+      query({ operation: "select", ...(selection === undefined ? {} : { selection }) }),
     insert: (table: Table) => query({ operation: "insert", table }),
     update: (table: Table) => query({ operation: "update", table }),
     delete: (table: Table) => query({ operation: "delete", table }),