@yielded/auth-persistence 0.1.0-beta.17 → 0.1.0-beta.19

package/src/internal/storage-mapping.ts

@@ -1,4 +1,3 @@
-import { randomId } from "@yielded/auth-crypto";
 import { EmailCredentialSnapshot } from "@yielded/auth/Email";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 import {
@@ -26,9 +25,10 @@ import {
   SessionCredentialVersion,
   type StatefulSessionRecord,
 } from "@yielded/auth/Sessions";
-import { DateTime, Effect, Redacted, Schema } from "effect";
+import { Crypto, DateTime, Effect, Redacted, Schema } from "effect";
 
 import type { MappingInput } from "./configuration";
+import { randomId } from "./crypto";
 import { PersistenceMappingError } from "./mapping-error";
 import { requiredEmailAddressConstraints, type AnyEmailAddressMapping } from "./models/email-model";
 import {
@@ -77,11 +77,19 @@ const ProofContinuation = Schema.Struct({
 });
 
 /** Derive shared row mappings from a managed or custom storage layout.
+ * Acquire Effect Crypto once; the returned allocators retain that implementation.
  * Each factory requires its role tables to exist. Adapter authors supply typed
  * table handles and dialect-specific clocks/commit predicates, and may refine
  * authority policy for explicit services. This does not alter composed defaults.
  */
-export const makeMappings = (input: MappingInput) => {
+export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
+  const crypto = yield* Crypto.Crypto;
+
+  const allocate = randomId.pipe(
+    Effect.provideService(Crypto.Crypto, crypto),
+    Effect.mapError(failure),
+  );
+
   const table = (role: StorageRole) => {
     const found = input.tables[role];
 
@@ -107,7 +115,7 @@ export const makeMappings = (input: MappingInput) => {
     d1ActiveStatusValue: s.activeValue,
     decodeRequirement: s.requirements,
     decodeActionRequirement: s.actionRequirements,
-    nextSecurityRevisionSync: () => SecurityRevision.make(randomId()),
+    nextSecurityRevision: () => allocate.pipe(Effect.map(SecurityRevision.make)),
   };
 
   const authorityCredential = () => ({
@@ -127,7 +135,7 @@ export const makeMappings = (input: MappingInput) => {
     constraints: requiredProofConstraints,
     encodeInstant: instant,
     decodeInstant: readInstant,
-    allocateVersionSync: () => ProofVersion.make(randomId()),
+    allocateVersion: allocate.pipe(Effect.map(ProofVersion.make)),
     isRequestConflict: () => false,
     isSeriesConflict: () => false,
     isCommandConflict: () => false,
@@ -373,9 +381,9 @@ export const makeMappings = (input: MappingInput) => {
       }),
       encodeInstant: instant,
       decodeInstant: readInstant,
-      allocateAttemptIdSync: () => PasswordAttemptId.make(randomId()),
-      allocateCredentialIdSync: randomId,
-      allocateRevisionSync: () => SecurityRevision.make(randomId()),
+      allocateAttemptId: allocate.pipe(Effect.map(PasswordAttemptId.make)),
+      allocateCredentialId: allocate,
+      allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
       commandRetentionMillis: 86_400_000,
       sessionInvalidation: "same-authority-immediate",
       identifier: {
@@ -521,8 +529,8 @@ export const makeMappings = (input: MappingInput) => {
     changeDisposition: "retire-source",
     encodeInstant: instant,
     decodeInstant: readInstant,
-    allocateCredentialIdSync: randomId,
-    allocateRevisionSync: () => SecurityRevision.make(randomId()),
+    allocateCredentialId: allocate,
+    allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
     commandRetentionMillis: 86_400_000,
     sessionInvalidation: "same-authority-immediate",
     isCommandConflict: () => false,
@@ -694,8 +702,8 @@ export const makeMappings = (input: MappingInput) => {
         expiresAt: "expiresAt",
         absoluteExpiresAt: "absoluteExpiresAt",
         encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
-        allocateIdSync: randomId,
-        allocateVersionSync: () => SecurityRevision.make(randomId()),
+        allocateId: allocate,
+        allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),
         encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),
         encodeRotation: encodeRow,
         decode: (row) =>
@@ -710,4 +718,4 @@ export const makeMappings = (input: MappingInput) => {
   };
 
   return { table, authority, proofs, passwords, emails, sessions, string };
-};
+});

package/src/internal/storage-validation.ts

@@ -1,14 +1,33 @@
-import { Effect, Schema } from "effect";
+import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
 import type { StorageTable } from "./storage-tables";
 
-const Column = Schema.Struct({ name: Schema.String, pk: Schema.Int });
-const Index = Schema.Struct({ name: Schema.String, unique: Schema.Int, partial: Schema.Int });
-const IndexColumn = Schema.Struct({ name: Schema.NullOr(Schema.String) });
-const PgColumns = Schema.Array(Schema.Struct({ name: Schema.String }));
-const PgKeys = Schema.Array(Schema.Struct({ columns: Schema.Array(Schema.String) }));
+const Columns = Schema.Array(Schema.String);
+const Keys = Schema.Array(Columns);
+const Metadata = Schema.Struct({ relation: Schema.String, columns: Columns, keys: Keys });
+const PgMetadata = Schema.Array(Metadata);
+
+const SqliteMetadata = Schema.Array(
+  Schema.Struct({
+    relation: Schema.String,
+    columns: Schema.fromJsonString(Columns),
+    keys: Schema.fromJsonString(Keys),
+  }),
+);
+
+const MysqlColumns = Schema.Array(Schema.Struct({ relation: Schema.String, name: Schema.String }));
+
+const MysqlIndexes = Schema.Array(
+  Schema.Struct({
+    relation: Schema.String,
+    name: Schema.String,
+    columnName: Schema.NullOr(Schema.String),
+    prefix: Schema.NullOr(Schema.Number),
+  }),
+);
+
 const quote = (value: string) => '"' + value.replaceAll('"', '""') + '"';
 
 /** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */
@@ -21,165 +40,226 @@ export interface PhysicalStorageTable {
 export const qualifiedTableName = (table: Pick<StorageTable, "name" | "schema">) =>
   (table.schema === undefined ? "" : quote(table.schema) + ".") + quote(table.name);
 
-/** Validate physical uniqueness before the first authentication operation. A
- * partial or expression index cannot establish these unconditional guarantees. */
-export const validateStorage = Effect.fnUntraced(
-  function* (
-    dialect: "pg" | "mysql" | "sqlite",
-    table: PhysicalStorageTable,
-    required: ReadonlyArray<ReadonlyArray<string>>,
-  ) {
-    const client = yield* SqlClient;
+const validateKeys = Effect.fnUntraced(function* (
+  table: PhysicalStorageTable,
+  required: ReadonlyArray<ReadonlyArray<string>>,
+  physicalKeys: ReadonlyArray<ReadonlyArray<string>>,
+) {
+  for (const keys of required) {
+    const columns = keys.map((key) => table.columns[key]?.name);
 
-    const physicalKeys: ReadonlyArray<ReadonlyArray<string>> = yield* dialect === "sqlite"
-      ? Effect.gen(function* () {
-          if (table.schema !== undefined && table.schema !== "main")
-            return yield* PersistenceConfigurationError.make({
-              reason: "SQLite storage must belong to the main database",
-            });
+    if (
+      columns.some((column) => column === undefined) ||
+      !physicalKeys.some(
+        // A stronger key also guarantees the required tuple's uniqueness.
+        (actual) =>
+          actual.length > 0 &&
+          actual.length <= columns.length &&
+          actual.every((column) => columns.includes(column)),
+      )
+    )
+      return yield* PersistenceConfigurationError.make({
+        reason: `Missing unique key on ${table.name} (${keys.join(", ")})`,
+      });
+  }
+});
 
-          const columns = yield* client`select name, pk from pragma_table_info(${table.name})`.pipe(
-            Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Column))),
-          );
+interface MetadataCache {
+  active: boolean;
+  readonly clients: Map<SqlClient, Map<string, typeof Metadata.Type>>;
+}
 
-          for (const column of Object.values(table.columns)) {
-            if (!columns.some((actual) => actual.name === column.name))
-              return yield* PersistenceConfigurationError.make({
-                reason: `Missing SQL column ${table.name}.${column.name}`,
-              });
-          }
-          const keys: string[][] = [];
-          const primary = columns.filter((column) => column.pk > 0).sort((a, b) => a.pk - b.pk);
+const CurrentMetadata = Context.Reference<MetadataCache | undefined>(
+  "@yielded/auth-persistence/StorageMetadata",
+  { defaultValue: () => undefined },
+);
 
-          if (primary.length > 0) keys.push(primary.map((column) => column.name));
+/** Share metadata only while constructing one service graph. Captured contexts
+ * cannot reuse it after acquisition succeeds, fails, or is interrupted. */
+export const withStorageValidation = Effect.fnUntraced(function* <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.fn.Return<A, E, R> {
+  const parent = yield* CurrentMetadata;
 
-          const indexes =
-            yield* client`select name, "unique", partial from pragma_index_list(${table.name})`.pipe(
-              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Index))),
-            );
+  if (parent?.active) return yield* effect;
+  const cache: MetadataCache = { active: true, clients: new Map() };
 
-          for (const index of indexes) {
-            if (index.unique !== 1 || index.partial !== 0) continue;
+  return yield* effect.pipe(
+    Effect.provideService(CurrentMetadata, cache),
+    Effect.ensuring(
+      Effect.sync(() => {
+        cache.active = false;
+        cache.clients.clear();
+      }),
+    ),
+  );
+});
 
-            const columns = yield* client`select name from pragma_index_info(${index.name})`.pipe(
-              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(IndexColumn))),
-            );
+/** Requirements checked against one physical catalog snapshot. */
+export interface StorageValidation {
+  readonly table: PhysicalStorageTable;
+  readonly required: ReadonlyArray<ReadonlyArray<string>>;
+}
 
-            if (columns.every((column) => column.name !== null))
-              keys.push(columns.flatMap((column) => (column.name === null ? [] : [column.name])));
-          }
+/** Batch physical metadata reads, reusing only the current acquisition snapshot.
+ * Every requirement is still checked; later acquisitions read fresh metadata. */
+export const validateStorageBatch = Effect.fnUntraced(
+  function* (dialect: "pg" | "mysql" | "sqlite", requirements: ReadonlyArray<StorageValidation>) {
+    if (requirements.length === 0) return;
+    if (
+      dialect === "sqlite" &&
+      requirements.some(({ table }) => table.schema !== undefined && table.schema !== "main")
+    )
+      return yield* PersistenceConfigurationError.make({
+        reason: "SQLite storage must belong to the main database",
+      });
+    const client = yield* SqlClient;
+    const cache = yield* CurrentMetadata;
 
-          return keys;
-        })
-      : dialect === "mysql"
-        ? Effect.gen(function* () {
-            const columns = yield* client`
-              select column_name as name from information_schema.columns
-              where table_schema = coalesce(${table.schema ?? null}, database())
-                and table_name = ${table.name}
-            `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)));
-
-            for (const column of Object.values(table.columns)) {
-              if (!columns.some((actual) => actual.name === column.name))
-                return yield* PersistenceConfigurationError.make({
-                  reason: `Missing SQL column ${table.name}.${column.name}`,
-                });
-            }
-
-            const indexes = yield* client`
-              select index_name as name, column_name as columnName, sub_part as prefix
-              from information_schema.statistics
-              where table_schema = coalesce(${table.schema ?? null}, database())
-                and table_name = ${table.name} and non_unique = 0
-              order by index_name, seq_in_index
-            `.pipe(
-              Effect.flatMap(
-                Schema.decodeUnknownEffect(
-                  Schema.Array(
-                    Schema.Struct({
-                      name: Schema.String,
-                      columnName: Schema.NullOr(Schema.String),
-                      prefix: Schema.NullOr(Schema.Number),
-                    }),
-                  ),
-                ),
-              ),
-            );
+    const byRelation = cache?.active
+      ? (cache.clients.get(client) ?? new Map<string, typeof Metadata.Type>())
+      : new Map<string, typeof Metadata.Type>();
+
+    if (cache?.active) cache.clients.set(client, byRelation);
 
-            const keys = new Map<string, Array<(typeof indexes)[number]>>();
+    const tables = new Map(requirements.map(({ table }) => [qualifiedTableName(table), table]));
 
-            for (const index of indexes) {
-              const columns = keys.get(index.name) ?? [];
+    const missing = [...tables.entries()].filter(
+      ([relation]) => !byRelation.has(`${dialect}:${relation}`),
+    );
 
-              columns.push(index);
-              keys.set(index.name, columns);
-            }
+    const relations = missing.map(([relation]) => relation);
 
-            return [...keys.values()]
-              .filter((columns) =>
-                columns.every((column) => column.columnName !== null && column.prefix === null),
+    if (relations.length > 0) {
+      const metadata = yield* dialect === "sqlite"
+        ? Effect.gen(function* () {
+            const requested = client.join(
+              ", ",
+              false,
+            )(missing.map(([relation, table]) => client`(${relation}, ${table.name})`));
+
+            return yield* client`
+          with requested(relation, name) as (values ${requested})
+          select requested.relation,
+            (select json_group_array(name) from pragma_table_info(requested.name)) as columns,
+            (select json_group_array(json(storage_key.columns)) from (
+              select json_group_array(name) as columns from (
+                select name from pragma_table_info(requested.name) where pk > 0 order by pk
               )
-              .map((columns) =>
-                columns.flatMap((column) =>
-                  column.columnName === null ? [] : [column.columnName],
+              union all
+              select (select json_group_array(name) from pragma_index_info(i.name)) as columns
+              from pragma_index_list(requested.name) i
+              where i."unique" = 1 and i.partial = 0
+                and not exists(select 1 from pragma_index_info(i.name) where name is null)
+            ) storage_key where json_array_length(storage_key.columns) > 0) as keys
+          from requested
+        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SqliteMetadata)));
+          })
+        : dialect === "mysql"
+          ? Effect.gen(function* () {
+              const requested = client.join(
+                " union all ",
+                false,
+              )(
+                missing.map(
+                  ([relation, table]) =>
+                    client`select ${relation} as relation, ${table.schema ?? null} as schemaName, ${table.name} as tableName`,
                 ),
               );
-          })
-        : Effect.gen(function* () {
-            const relation = qualifiedTableName(table);
 
-            const columns =
-              yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(
-                Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)),
-              );
+              const columns = yield* client`
+          select requested.relation, c.column_name as name
+          from (${requested}) requested join information_schema.columns c
+            on c.table_schema = coalesce(requested.schemaName, database()) and c.table_name = requested.tableName
+        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlColumns)));
+
+              const indexes = yield* client`
+          select requested.relation, i.index_name as name, i.column_name as columnName, i.sub_part as prefix
+          from (${requested}) requested join information_schema.statistics i
+            on i.table_schema = coalesce(requested.schemaName, database()) and i.table_name = requested.tableName
+          where i.non_unique = 0 order by requested.relation, i.index_name, i.seq_in_index
+        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlIndexes)));
+
+              return relations.map((relation) => {
+                const grouped = new Map<string, Array<(typeof indexes)[number]>>();
+
+                for (const index of indexes) {
+                  if (index.relation !== relation) continue;
+                  const entries = grouped.get(index.name) ?? [];
+
+                  entries.push(index);
+                  grouped.set(index.name, entries);
+                }
 
-            for (const column of Object.values(table.columns)) {
-              if (!columns.some((actual) => actual.name === column.name))
-                return yield* PersistenceConfigurationError.make({
-                  reason: `Missing SQL column ${relation}.${column.name}`,
-                });
-            }
+                return {
+                  relation,
+                  columns: columns
+                    .filter((column) => column.relation === relation)
+                    .map((column) => column.name),
+                  keys: [...grouped.values()]
+                    .filter((entries) =>
+                      entries.every((entry) => entry.columnName !== null && entry.prefix === null),
+                    )
+                    .map((entries) =>
+                      entries.flatMap((entry) =>
+                        entry.columnName === null ? [] : [entry.columnName],
+                      ),
+                    ),
+                };
+              });
+            })
+          : Effect.gen(function* () {
+              const requested = client.join(
+                ", ",
+                false,
+              )(relations.map((relation) => client`(${relation}::text)`));
 
-            const indexes = yield* client`
-          select array_agg(a.attname order by k.ordinality) as columns
+              return yield* client`
+      select requested.relation,
+        array(select a.attname::text from pg_attribute a
+          where a.attrelid = to_regclass(requested.relation)
+            and a.attnum > 0 and not a.attisdropped) as columns,
+        coalesce((select jsonb_agg(storage_key.columns) from (
+          select array_agg(a.attname::text order by k.ordinality) as columns
           from pg_index i
           cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)
           join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum
-          where i.indrelid = to_regclass(${relation}) and i.indisunique and i.indisvalid
-            and i.indimmediate and i.indpred is null and i.indexprs is null
+          where i.indrelid = to_regclass(requested.relation)
+            and i.indisunique and i.indisvalid and i.indimmediate
+            and i.indpred is null and i.indexprs is null
             and k.ordinality <= i.indnkeyatts
           group by i.indexrelid
-        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgKeys)));
+        ) storage_key), '[]'::jsonb) as keys
+      from (values ${requested}) requested(relation)
+    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgMetadata)));
+            });
 
-            return indexes.map((index) => index.columns);
-          });
+      for (const row of metadata) byRelation.set(`${dialect}:${row.relation}`, row);
+    }
 
-    for (const keys of required) {
-      const columns = keys.map((key) => table.columns[key]?.name);
-
-      if (
-        columns.some((column) => column === undefined) ||
-        !physicalKeys.some(
-          // A stronger key also guarantees the required tuple's uniqueness.
-          (actual) =>
-            actual.length > 0 &&
-            actual.length <= columns.length &&
-            actual.every((column) => columns.includes(column)),
-        )
-      )
-        return yield* PersistenceConfigurationError.make({
-          reason: `Missing unique key on ${table.name} (${keys.join(", ")})`,
-        });
+    for (const { table, required } of requirements) {
+      const relation = qualifiedTableName(table);
+      const actual = byRelation.get(`${dialect}:${relation}`);
+
+      for (const column of Object.values(table.columns)) {
+        if (actual === undefined || !actual.columns.includes(column.name))
+          return yield* PersistenceConfigurationError.make({
+            reason: `Missing SQL column ${relation}.${column.name}`,
+          });
+      }
+      yield* validateKeys(table, required, actual?.keys ?? []);
     }
   },
-  (effect, _dialect, table) =>
-    effect.pipe(
-      Effect.mapError((error) =>
-        Schema.is(PersistenceConfigurationError)(error)
-          ? error
-          : PersistenceConfigurationError.make({
-              reason: `Cannot validate SQL storage for ${table.name}`,
-            }),
-      ),
-    ),
+  Effect.mapError((error) =>
+    Schema.is(PersistenceConfigurationError)(error)
+      ? error
+      : PersistenceConfigurationError.make({ reason: "Cannot validate SQL storage metadata" }),
+  ),
 );
+
+/** Validate physical columns and unconditional uniqueness before operations run. */
+export const validateStorage = (
+  dialect: "pg" | "mysql" | "sqlite",
+  table: PhysicalStorageTable,
+  required: ReadonlyArray<ReadonlyArray<string>>,
+) => validateStorageBatch(dialect, [{ table, required }]);

package/src/internal/transaction-execution-kernel.ts

@@ -7,7 +7,7 @@ import {
 } from "@yielded/auth/Hooks";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 /* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */
-import { Context, Effect } from "effect";
+import { Context, Crypto, Effect, type PlatformError } from "effect";
 import type * as SqlClient from "effect/sql/SqlClient";
 import type * as SqlError from "effect/sql/SqlError";
 import type { Statement } from "effect/sql/Statement";
@@ -56,7 +56,11 @@ export interface TransactionExecution<Failure, OwnerId, Requirements = Lifecycle
   readonly run: <A, E, R>(
     body: Effect.Effect<A, E, R>,
     mutation?: boolean,
-  ) => Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | Requirements>;
+  ) => Effect.Effect<
+    A,
+    Failure,
+    Exclude<Exclude<R, OwnerId | CurrentCommitJournal>, Crypto.Crypto> | Requirements
+  >;
 }
 
 export const makeTransactionExecutionKernel = (
@@ -76,10 +80,15 @@ export const makeTransactionExecutionKernel = (
     ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,
     configuration: TransactionTargetConfiguration<Failure>,
     unavailable: () => Failure,
-    nonce: () => string,
+    nonce: Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>,
     bound?: TransactionBound<Failure>,
-  ): Effect.fn.Return<TransactionExecution<Failure, OwnerId>, never, NativeDatabase> {
+  ): Effect.fn.Return<
+    TransactionExecution<Failure, OwnerId>,
+    never,
+    NativeDatabase | Crypto.Crypto
+  > {
     const database = yield* NativeDatabase;
+    const crypto = yield* Crypto.Crypto;
 
     const invariant: (value: unknown) => asserts value = (value) => {
       if (!value) throw unavailable();
@@ -101,11 +110,19 @@ export const makeTransactionExecutionKernel = (
       run: <A, E, R>(
         body: Effect.Effect<A, E, R>,
         mutation = true,
-      ): Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks> => {
+      ): Effect.Effect<
+        A,
+        Failure,
+        Exclude<Exclude<R, OwnerId | CurrentCommitJournal>, Crypto.Crypto> | LifecycleHooks
+      > => {
         return Effect.suspend(() => {
           let entered = false;
 
-          const work =
+          const work: Effect.Effect<
+            A,
+            E | Failure | HookConfigurationError | SqlError.SqlError | PlatformError.PlatformError,
+            Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks | Crypto.Crypto
+          > =
             bound !== undefined
               ? Effect.gen(function* () {
                   if (!bound.active) return yield* Effect.fail(unavailable());
@@ -148,7 +165,7 @@ export const makeTransactionExecutionKernel = (
               : Effect.gen(function* () {
                   if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
                   yield* configuration.standaloneGuard(database.$client.transactionService);
-                  const marker = nonce();
+                  const marker = yield* nonce;
 
                   const result = yield* coordinateCommit(
                     (journal) => {
@@ -189,6 +206,7 @@ export const makeTransactionExecutionKernel = (
                 });
 
           return work.pipe(
+            Effect.provideService(Crypto.Crypto, crypto),
             (operation) => reportTransactionFailure(operation, unavailable),
             Effect.mapError(unavailable),
             Effect.catchDefect(() => Effect.fail(unavailable())),
@@ -215,7 +233,7 @@ export const makeTransactionExecutionKernel = (
     configuration: TransactionTargetConfiguration<Failure>,
     allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>,
     unavailable: () => Failure,
-    nonce: () => string,
+    nonce: Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>,
     services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,
     owner: (
       transaction: Transaction,
@@ -225,11 +243,12 @@ export const makeTransactionExecutionKernel = (
   ): Effect.Effect<
     A,
     TransactionCoordinatorError<E, Failure>,
-    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements
+    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements | Crypto.Crypto
   > => {
     return Effect.gen(function* () {
       if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
       yield* configuration.standaloneGuard(database.$client.transactionService);
+      const crypto = yield* Crypto.Crypto;
 
       // Allocation is independent of registration data and always precedes the physical owner.
       const resources = yield* allocate.pipe(
@@ -238,7 +257,7 @@ export const makeTransactionExecutionKernel = (
         Effect.catchDefect(() => Effect.fail(unavailable())),
       );
 
-      const marker = nonce();
+      const marker = yield* nonce.pipe(Effect.mapError(unavailable));
 
       const result = yield* coordinateCommit(
         (journal) => {
@@ -293,7 +312,7 @@ export const makeTransactionExecutionKernel = (
                   }),
                 ),
               );
-            });
+            }).pipe(Effect.provideService(Crypto.Crypto, crypto));
 
           return configuration.mode === "batch"
             ? run(database)