@yielded/auth-persistence 0.1.0-beta.18 → 0.1.0-beta.20

package/dist/internal/transaction-execution-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-execution-kernel.mjs","names":[],"sources":["../../src/internal/transaction-execution-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  CurrentCommitJournal,\n  type LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\n/* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */\nimport { Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { requireStandalone } from \"./standalone\";\nimport {\n  NativeDatabase,\n  type TransactionNativeDatabase,\n  type TransactionOwner,\n  type makeTransactionKernel,\n} from \"./transaction-kernel\";\n\nexport interface TransactionTargetConfiguration<Failure> {\n  readonly mode: \"interactive\" | \"synchronous\" | \"batch\";\n  readonly dialect: \"pg\" | \"mysql\" | \"sqlite\";\n  readonly locking: boolean;\n  /** The captured database's transaction marker; batch drivers may omit it. */\n  readonly standaloneGuard: (\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => Effect.Effect<void, Failure>;\n  readonly transaction?: <A, E, R>(\n    database: any,\n    body: (transaction: any) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError | Failure, R>;\n}\n\nexport type TransactionCoordinatorError<E, Failure> =\n  | E\n  | Failure\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport interface TransactionBound<Failure> {\n  readonly owner: TransactionOwner<Failure>;\n  used: boolean;\n  poisoned: boolean;\n  active: boolean;\n  inFlight: number;\n}\n\nexport interface TransactionExecution<Failure, OwnerId, Requirements = LifecycleHooks> {\n  readonly bound: boolean;\n  readonly active: () => boolean;\n  readonly admit: Effect.Effect<void, Failure>;\n  readonly poison: () => void;\n  readonly run: <A, E, R>(\n    body: Effect.Effect<A, E, R>,\n    mutation?: boolean,\n  ) => Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | Requirements>;\n}\n\nexport const makeTransactionExecutionKernel = (\n  transactions: Pick<\n    ReturnType<typeof makeTransactionKernel>,\n    \"makeTransactionOwner\" | \"reportTransactionFailure\"\n  >,\n) => {\n  const { makeTransactionOwner, reportTransactionFailure } = transactions;\n\n  const sqlClientTransactionStandaloneGuard = <Failure>(\n    unavailable: () => Failure,\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => requireStandalone(unavailable, transactionService);\n\n  const makeTransactionExecution = Effect.fnUntraced(function* <Failure, OwnerId>(\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    bound?: TransactionBound<Failure>,\n  ): Effect.fn.Return<TransactionExecution<Failure, OwnerId>, never, NativeDatabase> {\n    const database = yield* NativeDatabase;\n\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    return {\n      bound: bound !== undefined,\n      active: () => bound === undefined || bound.active,\n      admit:\n        bound !== undefined\n          ? Effect.suspend(() => (bound.active ? Effect.void : Effect.fail(unavailable())))\n          : Effect.gen(function* () {\n              if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n              yield* configuration.standaloneGuard(database.$client.transactionService);\n            }),\n      poison: () => {\n        if (bound !== undefined) bound.poisoned = true;\n      },\n      run: <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n        mutation = true,\n      ): Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks> => {\n        return Effect.suspend(() => {\n          let entered = false;\n\n          const work =\n            bound !== undefined\n              ? Effect.gen(function* () {\n                  if (!bound.active) return yield* Effect.fail(unavailable());\n                  entered = true;\n                  bound.inFlight++;\n                  if (!mutation)\n                    return yield* Effect.provideContext(\n                      body,\n                      Context.make(ownerTag, bound.owner).pipe(\n                        Context.add(CurrentCommitJournal, bound.owner.journal),\n                      ),\n                    );\n                  invariant(!bound.used && !bound.poisoned);\n                  bound.used = true;\n\n                  const result = yield* coordinateCommit(\n                    (journal) =>\n                      Effect.gen(function* () {\n                        bound.owner.guards.push(journal.prepare(undefined));\n\n                        return yield* Effect.provideContext(\n                          body,\n                          Context.make(ownerTag, { ...bound.owner, journal }).pipe(\n                            Context.add(CurrentCommitJournal, journal),\n                          ),\n                        );\n                      }),\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                }).pipe(\n                  Effect.onExit((exit) =>\n                    Effect.sync(() => {\n                      if (entered) bound.inFlight--;\n                      if (exit._tag === \"Failure\") bound.poisoned = true;\n                    }),\n                  ),\n                )\n              : Effect.gen(function* () {\n                  if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n                  yield* configuration.standaloneGuard(database.$client.transactionService);\n                  const marker = nonce();\n\n                  const result = yield* coordinateCommit(\n                    (journal) => {\n                      const run = (tx: TransactionNativeDatabase) =>\n                        Effect.gen(function* () {\n                          const owner = makeTransactionOwner(tx, journal, marker, unavailable, {\n                            client: database.$client,\n                            batch: configuration.mode === \"batch\",\n                            locking: configuration.locking,\n                            mysql: configuration.dialect === \"mysql\",\n                            dialect: configuration.dialect,\n                          });\n\n                          const value = yield* Effect.provideContext(\n                            body,\n                            Context.make(ownerTag, owner).pipe(\n                              Context.add(CurrentCommitJournal, journal),\n                            ),\n                          );\n\n                          yield* owner.finish();\n                          if (configuration.mode === \"batch\")\n                            yield* tx.$client.batch(owner.statements);\n\n                          return value;\n                        });\n\n                      return configuration.mode === \"batch\"\n                        ? run(database)\n                        : configuration.transaction !== undefined\n                          ? configuration.transaction(database, run)\n                          : database.transaction(run);\n                    },\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                });\n\n          return work.pipe(\n            (operation) => reportTransactionFailure(operation, unavailable),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          );\n        });\n      },\n    };\n  });\n\n  const coordinateTransactionOwner = <\n    Failure,\n    OwnerId,\n    Resources,\n    AllocationError,\n    AllocationRequirements,\n    Services,\n    Transaction,\n    A,\n    E,\n    R,\n  >(\n    database: TransactionNativeDatabase,\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TransactionCoordinatorError<E, Failure>,\n    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements\n  > => {\n    return Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n      yield* configuration.standaloneGuard(database.$client.transactionService);\n\n      // Allocation is independent of registration data and always precedes the physical owner.\n      const resources = yield* allocate.pipe(\n        (operation) => reportTransactionFailure(operation, unavailable),\n        Effect.mapError(unavailable),\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      );\n\n      const marker = nonce();\n\n      const result = yield* coordinateCommit(\n        (journal) => {\n          const run = (tx: TransactionNativeDatabase) =>\n            Effect.gen(function* () {\n              const state = makeTransactionOwner(tx, journal, marker, unavailable, {\n                client: database.$client,\n                batch: configuration.mode === \"batch\",\n                dialect: configuration.dialect,\n                mysql: configuration.dialect === \"mysql\",\n                locking: configuration.locking,\n              });\n\n              const bound: TransactionBound<Failure> = {\n                owner: state,\n                used: false,\n                poisoned: false,\n                active: true,\n                inFlight: 0,\n              };\n\n              return yield* Effect.gen(function* () {\n                const value = yield* owner(\n                  tx as Transaction,\n                  services(\n                    yield* makeTransactionExecution(\n                      ownerTag,\n                      configuration,\n                      unavailable,\n                      nonce,\n                      bound,\n                    ).pipe(Effect.provideService(NativeDatabase, tx)),\n                    resources,\n                  ),\n                  (statement) => {\n                    if (!bound.active) throw unavailable();\n                    state.statements.push(statement);\n                  },\n                );\n\n                bound.active = false;\n                if (bound.poisoned || bound.inFlight !== 0)\n                  return yield* Effect.fail(unavailable());\n                yield* state.finish();\n                if (configuration.mode === \"batch\") yield* tx.$client.batch(state.statements);\n\n                return value;\n              }).pipe(\n                Effect.ensuring(\n                  Effect.sync(() => {\n                    bound.active = false;\n                  }),\n                ),\n              );\n            });\n\n          return configuration.mode === \"batch\"\n            ? run(database)\n            : configuration.transaction !== undefined\n              ? configuration.transaction(database, run)\n              : database.transaction(run);\n        },\n        { mode: configuration.mode },\n      );\n\n      return result.value as A;\n    });\n  };\n\n  return {\n    sqlClientTransactionStandaloneGuard,\n    makeTransactionExecution,\n    coordinateTransactionOwner,\n  };\n};\n"],"mappings":";;;;;AA6DA,MAAa,kCACX,iBAIG;CACH,MAAM,EAAE,sBAAsB,6BAA6B;CAE3D,MAAM,uCACJ,aACA,uBACG,kBAAkB,aAAa,kBAAkB;CAEtD,MAAM,2BAA2B,OAAO,WAAW,WACjD,UACA,eACA,aACA,OACA,OACiF;EACjF,MAAM,WAAW,OAAO;EAExB,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,OAAO;GACL,OAAO,UAAU,KAAA;GACjB,cAAc,UAAU,KAAA,KAAa,MAAM;GAC3C,OACE,UAAU,KAAA,IACN,OAAO,cAAe,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC,CAAE,IAC9E,OAAO,IAAI,aAAa;IACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;IAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAC1E,CAAC;GACP,cAAc;IACZ,IAAI,UAAU,KAAA,GAAW,MAAM,WAAW;GAC5C;GACA,MACE,MACA,WAAW,SACgF;IAC3F,OAAO,OAAO,cAAc;KAC1B,IAAI,UAAU;KAqFd,QAlFE,UAAU,KAAA,IACN,OAAO,IAAI,aAAa;MACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAC1D,UAAU;MACV,MAAM;MACN,IAAI,CAAC,UACH,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,KAClC,QAAQ,IAAI,sBAAsB,MAAM,MAAM,OAAO,CACvD,CACF;MACF,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,QAAQ;MACxC,MAAM,OAAO;MAiBb,QAAO,OAfe,kBACnB,YACC,OAAO,IAAI,aAAa;OACtB,MAAM,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAA,CAAS,CAAC;OAElD,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU;QAAE,GAAG,MAAM;QAAO;OAAQ,CAAC,CAAC,CAAC,KAClD,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;MACF,CAAC,GACH,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;MAChB,IAAI,SAAS,MAAM;MACnB,IAAI,KAAK,SAAS,WAAW,MAAM,WAAW;KAChD,CAAC,CACH,CACF,IACA,OAAO,IAAI,aAAa;MACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;MACxE,MAAM,SAAS,MAAM;MAqCrB,QAAO,OAnCe,kBACnB,YAAY;OACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;QACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;SACnE,QAAQ,SAAS;SACjB,OAAO,cAAc,SAAS;SAC9B,SAAS,cAAc;SACvB,OAAO,cAAc,YAAY;SACjC,SAAS,cAAc;QACzB,CAAC;QAED,MAAM,QAAQ,OAAO,OAAO,eAC1B,MACA,QAAQ,KAAK,UAAU,KAAK,CAAC,CAAC,KAC5B,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;QAEA,OAAO,MAAM,OAAO;QACpB,IAAI,cAAc,SAAS,SACzB,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;QAE1C,OAAO;OACT,CAAC;OAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;MAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,EAAA,CAEK,MACT,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;IACF,CAAC;GACH;EACF;CACF,CAAC;CAED,MAAM,8BAYJ,UACA,UACA,eACA,UACA,aACA,OACA,UACA,UASG;EACH,OAAO,OAAO,IAAI,aAAa;GAC7B,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;GAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAGxE,MAAM,YAAY,OAAO,SAAS,MAC/B,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;GAEA,MAAM,SAAS,MAAM;GAkErB,QAAO,OAhEe,kBACnB,YAAY;IACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;MACnE,QAAQ,SAAS;MACjB,OAAO,cAAc,SAAS;MAC9B,SAAS,cAAc;MACvB,OAAO,cAAc,YAAY;MACjC,SAAS,cAAc;KACzB,CAAC;KAED,MAAM,QAAmC;MACvC,OAAO;MACP,MAAM;MACN,UAAU;MACV,QAAQ;MACR,UAAU;KACZ;KAEA,OAAO,OAAO,OAAO,IAAI,aAAa;MACpC,MAAM,QAAQ,OAAO,MACnB,IACA,SACE,OAAO,yBACL,UACA,eACA,aACA,OACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,EAAE,CAAC,GAChD,SACF,IACC,cAAc;OACb,IAAI,CAAC,MAAM,QAAQ,MAAM,YAAY;OACrC,MAAM,WAAW,KAAK,SAAS;MACjC,CACF;MAEA,MAAM,SAAS;MACf,IAAI,MAAM,YAAY,MAAM,aAAa,GACvC,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MACzC,OAAO,MAAM,OAAO;MACpB,IAAI,cAAc,SAAS,SAAS,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;MAE5E,OAAO;KACT,CAAC,CAAC,CAAC,KACD,OAAO,SACL,OAAO,WAAW;MAChB,MAAM,SAAS;KACjB,CAAC,CACH,CACF;IACF,CAAC;IAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;GAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;EAChB,CAAC;CACH;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"transaction-execution-kernel.mjs","names":[],"sources":["../../src/internal/transaction-execution-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  CurrentCommitJournal,\n  type LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\n/* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */\nimport { Context, Crypto, Effect, type PlatformError } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { requireStandalone } from \"./standalone\";\nimport {\n  NativeDatabase,\n  type TransactionNativeDatabase,\n  type TransactionOwner,\n  type makeTransactionKernel,\n} from \"./transaction-kernel\";\n\nexport interface TransactionTargetConfiguration<Failure> {\n  readonly mode: \"interactive\" | \"synchronous\" | \"batch\";\n  readonly dialect: \"pg\" | \"mysql\" | \"sqlite\";\n  readonly locking: boolean;\n  /** The captured database's transaction marker; batch drivers may omit it. */\n  readonly standaloneGuard: (\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => Effect.Effect<void, Failure>;\n  readonly transaction?: <A, E, R>(\n    database: any,\n    body: (transaction: any) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError | Failure, R>;\n}\n\nexport type TransactionCoordinatorError<E, Failure> =\n  | E\n  | Failure\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport interface TransactionBound<Failure> {\n  readonly owner: TransactionOwner<Failure>;\n  used: boolean;\n  poisoned: boolean;\n  active: boolean;\n  inFlight: number;\n}\n\nexport interface TransactionExecution<Failure, OwnerId, Requirements = LifecycleHooks> {\n  readonly bound: boolean;\n  readonly active: () => boolean;\n  readonly admit: Effect.Effect<void, Failure>;\n  readonly poison: () => void;\n  readonly run: <A, E, R>(\n    body: Effect.Effect<A, E, R>,\n    mutation?: boolean,\n  ) => Effect.Effect<\n    A,\n    Failure,\n    Exclude<Exclude<R, OwnerId | CurrentCommitJournal>, Crypto.Crypto> | Requirements\n  >;\n}\n\nexport const makeTransactionExecutionKernel = (\n  transactions: Pick<\n    ReturnType<typeof makeTransactionKernel>,\n    \"makeTransactionOwner\" | \"reportTransactionFailure\"\n  >,\n) => {\n  const { makeTransactionOwner, reportTransactionFailure } = transactions;\n\n  const sqlClientTransactionStandaloneGuard = <Failure>(\n    unavailable: () => Failure,\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => requireStandalone(unavailable, transactionService);\n\n  const makeTransactionExecution = Effect.fnUntraced(function* <Failure, OwnerId>(\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    unavailable: () => Failure,\n    nonce: Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>,\n    bound?: TransactionBound<Failure>,\n  ): Effect.fn.Return<\n    TransactionExecution<Failure, OwnerId>,\n    never,\n    NativeDatabase | Crypto.Crypto\n  > {\n    const database = yield* NativeDatabase;\n    const crypto = yield* Crypto.Crypto;\n\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    return {\n      bound: bound !== undefined,\n      active: () => bound === undefined || bound.active,\n      admit:\n        bound !== undefined\n          ? Effect.suspend(() => (bound.active ? Effect.void : Effect.fail(unavailable())))\n          : Effect.gen(function* () {\n              if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n              yield* configuration.standaloneGuard(database.$client.transactionService);\n            }),\n      poison: () => {\n        if (bound !== undefined) bound.poisoned = true;\n      },\n      run: <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n        mutation = true,\n      ): Effect.Effect<\n        A,\n        Failure,\n        Exclude<Exclude<R, OwnerId | CurrentCommitJournal>, Crypto.Crypto> | LifecycleHooks\n      > => {\n        return Effect.suspend(() => {\n          let entered = false;\n\n          const work: Effect.Effect<\n            A,\n            E | Failure | HookConfigurationError | SqlError.SqlError | PlatformError.PlatformError,\n            Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks | Crypto.Crypto\n          > =\n            bound !== undefined\n              ? Effect.gen(function* () {\n                  if (!bound.active) return yield* Effect.fail(unavailable());\n                  entered = true;\n                  bound.inFlight++;\n                  if (!mutation)\n                    return yield* Effect.provideContext(\n                      body,\n                      Context.make(ownerTag, bound.owner).pipe(\n                        Context.add(CurrentCommitJournal, bound.owner.journal),\n                      ),\n                    );\n                  invariant(!bound.used && !bound.poisoned);\n                  bound.used = true;\n\n                  const result = yield* coordinateCommit(\n                    (journal) =>\n                      Effect.gen(function* () {\n                        bound.owner.guards.push(journal.prepare(undefined));\n\n                        return yield* Effect.provideContext(\n                          body,\n                          Context.make(ownerTag, { ...bound.owner, journal }).pipe(\n                            Context.add(CurrentCommitJournal, journal),\n                          ),\n                        );\n                      }),\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                }).pipe(\n                  Effect.onExit((exit) =>\n                    Effect.sync(() => {\n                      if (entered) bound.inFlight--;\n                      if (exit._tag === \"Failure\") bound.poisoned = true;\n                    }),\n                  ),\n                )\n              : Effect.gen(function* () {\n                  if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n                  yield* configuration.standaloneGuard(database.$client.transactionService);\n                  const marker = yield* nonce;\n\n                  const result = yield* coordinateCommit(\n                    (journal) => {\n                      const run = (tx: TransactionNativeDatabase) =>\n                        Effect.gen(function* () {\n                          const owner = makeTransactionOwner(tx, journal, marker, unavailable, {\n                            client: database.$client,\n                            batch: configuration.mode === \"batch\",\n                            locking: configuration.locking,\n                            mysql: configuration.dialect === \"mysql\",\n                            dialect: configuration.dialect,\n                          });\n\n                          const value = yield* Effect.provideContext(\n                            body,\n                            Context.make(ownerTag, owner).pipe(\n                              Context.add(CurrentCommitJournal, journal),\n                            ),\n                          );\n\n                          yield* owner.finish();\n                          if (configuration.mode === \"batch\")\n                            yield* tx.$client.batch(owner.statements);\n\n                          return value;\n                        });\n\n                      return configuration.mode === \"batch\"\n                        ? run(database)\n                        : configuration.transaction !== undefined\n                          ? configuration.transaction(database, run)\n                          : database.transaction(run);\n                    },\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                });\n\n          return work.pipe(\n            Effect.provideService(Crypto.Crypto, crypto),\n            (operation) => reportTransactionFailure(operation, unavailable),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          );\n        });\n      },\n    };\n  });\n\n  const coordinateTransactionOwner = <\n    Failure,\n    OwnerId,\n    Resources,\n    AllocationError,\n    AllocationRequirements,\n    Services,\n    Transaction,\n    A,\n    E,\n    R,\n  >(\n    database: TransactionNativeDatabase,\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>,\n    unavailable: () => Failure,\n    nonce: Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>,\n    services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TransactionCoordinatorError<E, Failure>,\n    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements | Crypto.Crypto\n  > => {\n    return Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n      yield* configuration.standaloneGuard(database.$client.transactionService);\n      const crypto = yield* Crypto.Crypto;\n\n      // Allocation is independent of registration data and always precedes the physical owner.\n      const resources = yield* allocate.pipe(\n        (operation) => reportTransactionFailure(operation, unavailable),\n        Effect.mapError(unavailable),\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      );\n\n      const marker = yield* nonce.pipe(Effect.mapError(unavailable));\n\n      const result = yield* coordinateCommit(\n        (journal) => {\n          const run = (tx: TransactionNativeDatabase) =>\n            Effect.gen(function* () {\n              const state = makeTransactionOwner(tx, journal, marker, unavailable, {\n                client: database.$client,\n                batch: configuration.mode === \"batch\",\n                dialect: configuration.dialect,\n                mysql: configuration.dialect === \"mysql\",\n                locking: configuration.locking,\n              });\n\n              const bound: TransactionBound<Failure> = {\n                owner: state,\n                used: false,\n                poisoned: false,\n                active: true,\n                inFlight: 0,\n              };\n\n              return yield* Effect.gen(function* () {\n                const value = yield* owner(\n                  tx as Transaction,\n                  services(\n                    yield* makeTransactionExecution(\n                      ownerTag,\n                      configuration,\n                      unavailable,\n                      nonce,\n                      bound,\n                    ).pipe(Effect.provideService(NativeDatabase, tx)),\n                    resources,\n                  ),\n                  (statement) => {\n                    if (!bound.active) throw unavailable();\n                    state.statements.push(statement);\n                  },\n                );\n\n                bound.active = false;\n                if (bound.poisoned || bound.inFlight !== 0)\n                  return yield* Effect.fail(unavailable());\n                yield* state.finish();\n                if (configuration.mode === \"batch\") yield* tx.$client.batch(state.statements);\n\n                return value;\n              }).pipe(\n                Effect.ensuring(\n                  Effect.sync(() => {\n                    bound.active = false;\n                  }),\n                ),\n              );\n            }).pipe(Effect.provideService(Crypto.Crypto, crypto));\n\n          return configuration.mode === \"batch\"\n            ? run(database)\n            : configuration.transaction !== undefined\n              ? configuration.transaction(database, run)\n              : database.transaction(run);\n        },\n        { mode: configuration.mode },\n      );\n\n      return result.value as A;\n    });\n  };\n\n  return {\n    sqlClientTransactionStandaloneGuard,\n    makeTransactionExecution,\n    coordinateTransactionOwner,\n  };\n};\n"],"mappings":";;;;;AAiEA,MAAa,kCACX,iBAIG;CACH,MAAM,EAAE,sBAAsB,6BAA6B;CAE3D,MAAM,uCACJ,aACA,uBACG,kBAAkB,aAAa,kBAAkB;CAEtD,MAAM,2BAA2B,OAAO,WAAW,WACjD,UACA,eACA,aACA,OACA,OAKA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,OAAO;GACL,OAAO,UAAU,KAAA;GACjB,cAAc,UAAU,KAAA,KAAa,MAAM;GAC3C,OACE,UAAU,KAAA,IACN,OAAO,cAAe,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC,CAAE,IAC9E,OAAO,IAAI,aAAa;IACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;IAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAC1E,CAAC;GACP,cAAc;IACZ,IAAI,UAAU,KAAA,GAAW,MAAM,WAAW;GAC5C;GACA,MACE,MACA,WAAW,SAKR;IACH,OAAO,OAAO,cAAc;KAC1B,IAAI,UAAU;KAyFd,QAlFE,UAAU,KAAA,IACN,OAAO,IAAI,aAAa;MACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAC1D,UAAU;MACV,MAAM;MACN,IAAI,CAAC,UACH,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,KAClC,QAAQ,IAAI,sBAAsB,MAAM,MAAM,OAAO,CACvD,CACF;MACF,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,QAAQ;MACxC,MAAM,OAAO;MAiBb,QAAO,OAfe,kBACnB,YACC,OAAO,IAAI,aAAa;OACtB,MAAM,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAA,CAAS,CAAC;OAElD,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU;QAAE,GAAG,MAAM;QAAO;OAAQ,CAAC,CAAC,CAAC,KAClD,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;MACF,CAAC,GACH,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;MAChB,IAAI,SAAS,MAAM;MACnB,IAAI,KAAK,SAAS,WAAW,MAAM,WAAW;KAChD,CAAC,CACH,CACF,IACA,OAAO,IAAI,aAAa;MACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;MACxE,MAAM,SAAS,OAAO;MAqCtB,QAAO,OAnCe,kBACnB,YAAY;OACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;QACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;SACnE,QAAQ,SAAS;SACjB,OAAO,cAAc,SAAS;SAC9B,SAAS,cAAc;SACvB,OAAO,cAAc,YAAY;SACjC,SAAS,cAAc;QACzB,CAAC;QAED,MAAM,QAAQ,OAAO,OAAO,eAC1B,MACA,QAAQ,KAAK,UAAU,KAAK,CAAC,CAAC,KAC5B,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;QAEA,OAAO,MAAM,OAAO;QACpB,IAAI,cAAc,SAAS,SACzB,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;QAE1C,OAAO;OACT,CAAC;OAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;MAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,EAAA,CAEK,KACV,OAAO,eAAe,OAAO,QAAQ,MAAM,IAC1C,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;IACF,CAAC;GACH;EACF;CACF,CAAC;CAED,MAAM,8BAYJ,UACA,UACA,eACA,UACA,aACA,OACA,UACA,UASG;EACH,OAAO,OAAO,IAAI,aAAa;GAC7B,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;GAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GACxE,MAAM,SAAS,OAAO,OAAO;GAG7B,MAAM,YAAY,OAAO,SAAS,MAC/B,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;GAEA,MAAM,SAAS,OAAO,MAAM,KAAK,OAAO,SAAS,WAAW,CAAC;GAkE7D,QAAO,OAhEe,kBACnB,YAAY;IACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;MACnE,QAAQ,SAAS;MACjB,OAAO,cAAc,SAAS;MAC9B,SAAS,cAAc;MACvB,OAAO,cAAc,YAAY;MACjC,SAAS,cAAc;KACzB,CAAC;KAED,MAAM,QAAmC;MACvC,OAAO;MACP,MAAM;MACN,UAAU;MACV,QAAQ;MACR,UAAU;KACZ;KAEA,OAAO,OAAO,OAAO,IAAI,aAAa;MACpC,MAAM,QAAQ,OAAO,MACnB,IACA,SACE,OAAO,yBACL,UACA,eACA,aACA,OACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,EAAE,CAAC,GAChD,SACF,IACC,cAAc;OACb,IAAI,CAAC,MAAM,QAAQ,MAAM,YAAY;OACrC,MAAM,WAAW,KAAK,SAAS;MACjC,CACF;MAEA,MAAM,SAAS;MACf,IAAI,MAAM,YAAY,MAAM,aAAa,GACvC,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MACzC,OAAO,MAAM,OAAO;MACpB,IAAI,cAAc,SAAS,SAAS,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;MAE5E,OAAO;KACT,CAAC,CAAC,CAAC,KACD,OAAO,SACL,OAAO,WAAW;MAChB,MAAM,SAAS;KACjB,CAAC,CACH,CACF;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC;IAEtD,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;GAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;EAChB,CAAC;CACH;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-persistence","version":"0.1.0-beta.18","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.18","@yielded/auth-crypto":"0.1.0-beta.18"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/vitest":"4.0.0","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Adapter":{"types":"./dist/Adapter.d.mts","default":"./dist/Adapter.mjs"}},"description":"Direct Effect SQL persistence and shared storage contracts for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}
+{"name":"@yielded/auth-persistence","version":"0.1.0-beta.20","dependencies":{"@yielded/auth":"0.1.0-beta.20"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/vitest":"4.0.0","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Adapter":{"types":"./dist/Adapter.d.mts","default":"./dist/Adapter.mjs"}},"description":"Direct Effect SQL persistence and shared storage contracts for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}

package/src/Adapter.ts

@@ -297,4 +297,10 @@ export type {
   PersistenceApi,
 } from "./internal/configuration";
 
-export { validateStorage, type PhysicalStorageTable } from "./internal/storage-validation";
+export {
+  validateStorage,
+  validateStorageBatch,
+  withStorageValidation,
+  type PhysicalStorageTable,
+  type StorageValidation,
+} from "./internal/storage-validation";

package/src/internal/configuration.ts

@@ -24,7 +24,7 @@ import type {
   AuthenticationRequirement,
   make as makeSessions,
 } from "@yielded/auth/Sessions";
-import { type Context, type Effect, type Layer, Schema } from "effect";
+import { type Context, type Crypto, type Effect, type Layer, Schema } from "effect";
 import type { SqlClient } from "effect/sql";
 
 import type { PersistenceMappingError } from "./mapping-error";
@@ -251,6 +251,7 @@ export interface BoundPersistence<
   readonly layer: Layer.Layer<
     Ports<C, Id, A>,
     PersistenceConfigurationError,
+    | Crypto.Crypto
     | ConfigId<A["namespace"]>
     | ProvisioningRequirement<A>
     | PasskeyRequirement<A>
@@ -260,7 +261,8 @@ export interface BoundPersistence<
   readonly managed: <N, Instant = number>(options: {
     readonly subjects: SubjectOptions<T, N>;
     readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;
-    readonly prefix?: string;
+    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */
+    readonly prefix: string;
     readonly timestamps?: TimestampOptions<Instant>;
   }) => StorageLayout<T, Roles<C, Id, A>>;
   readonly map: <N, Instant = number>(options: {

package/src/internal/crypto.ts

@@ -0,0 +1,15 @@
+import { TokenDigest } from "@yielded/auth/Schema";
+import { Crypto, Effect } from "effect";
+import { Base64Url } from "effect/encoding";
+
+const encoder = new TextEncoder();
+
+export const randomId = Effect.flatMap(Crypto.Crypto, (crypto) =>
+  crypto.randomBytes(32).pipe(Effect.map(Base64Url.encode)),
+);
+
+/** Persisted UTF-8 SHA-256, encoded as unpadded base64url. */
+export const digest = (value: string) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) => crypto.digest("SHA-256", encoder.encode(value))).pipe(
+    Effect.map((bytes) => TokenDigest.make(Base64Url.encode(bytes))),
+  );

package/src/internal/passkey/admission.ts

@@ -31,18 +31,19 @@ export const makePasskeyAdmissionKernel = (
 
   const chargeRetentionMillis = 86_400_000;
 
-  const chargeScopes = (ceremony: PasskeyCeremony, subjectId?: string) => {
+  const chargeScopes = Effect.fnUntraced(function* (ceremony: PasskeyCeremony, subjectId?: string) {
     const scopes: { kind: PasskeyChargeKind; scope: string }[] = [
-      { kind: "global", scope: key("global", [ceremony.moduleId]) },
+      { kind: "global", scope: yield* key("global", [ceremony.moduleId]) },
     ];
 
-    if (subjectId !== undefined) scopes.push({ kind: "subject", scope: subjectScope(subjectId) });
-    const target = targetScope(ceremony);
+    if (subjectId !== undefined)
+      scopes.push({ kind: "subject", scope: yield* subjectScope(subjectId) });
+    const target = yield* targetScope(ceremony);
 
     if (target !== null) scopes.push({ kind: "target", scope: target });
 
     return scopes;
-  };
+  });
 
   const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping: any) {
     const owner = yield* CurrentPasskeyTransaction;
@@ -107,7 +108,7 @@ export const makePasskeyAdmissionKernel = (
     )})`;
   };
 
-  const admissionCondition = (
+  const admissionCondition = Effect.fnUntraced(function* (
     mapping: any,
     policies: ReadonlyArray<PasskeyMethodPolicy>,
     ceremony: PasskeyCeremony,
@@ -115,19 +116,23 @@ export const makePasskeyAdmissionKernel = (
     added: ReadonlyArray<PasskeyChargeKind>,
     newFlow: boolean,
     resolvedSubject: boolean,
-  ) =>
-    both(
+  ) {
+    const subject = subjectId === undefined ? undefined : yield* subjectScope(subjectId);
+    const scopes = yield* chargeScopes(ceremony, subjectId);
+
+    return both(
       ...policies.flatMap((policy) => [
         sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
         subjectId === undefined
           ? undefined
-          : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
-        ...chargeScopes(ceremony, subjectId).map(
+          : sql`${pendingCount(mapping, subject)} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
+        ...scopes.map(
           ({ kind, scope }) =>
             sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,
         ),
       ]),
     );
+  });
 
   const guardAdmission = (
     mapping: any,
@@ -135,9 +140,11 @@ export const makePasskeyAdmissionKernel = (
     ceremony: PasskeyCeremony,
     subjectId?: string,
   ) =>
-    Effect.map(CurrentPasskeyTransaction, (owner) => {
+    Effect.gen(function* () {
+      const owner = yield* CurrentPasskeyTransaction;
+
       owner.postconditions.push(
-        admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),
+        yield* admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),
       );
     });
 
@@ -161,7 +168,7 @@ export const makePasskeyAdmissionKernel = (
       columns: mappedColumns(table),
     });
 
-    const scopes = chargeScopes(ceremony, subjectId);
+    const scopes = yield* chargeScopes(ceremony, subjectId);
 
     invariant(found.rows.length === scopes.length);
     for (const { kind, scope } of scopes) {
@@ -202,7 +209,7 @@ export const makePasskeyAdmissionKernel = (
     Effect.flatMap(CurrentPasskeyTransaction, (owner) =>
       Effect.gen(function* () {
         const table = mapping.charge;
-        const scopes = chargeScopes(ceremony, subjectId);
+        const scopes = yield* chargeScopes(ceremony, subjectId);
 
         const where = equal(table.table, {
           [table.moduleId]: ceremony.moduleId,
@@ -241,7 +248,7 @@ export const makePasskeyAdmissionKernel = (
     const earliest = yield* owner.now(clock);
     const identities: Record<string, unknown>[] = [];
 
-    for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) =>
+    for (const { kind, scope } of (yield* chargeScopes(ceremony, subjectId)).filter((item) =>
       kinds.includes(item.kind),
     )) {
       const identity = {

package/src/internal/passkey/credentials.ts

@@ -172,7 +172,7 @@ export const makePasskeyCredentialsKernel = (
     const found = yield* owner.read(
       descriptor.table,
       equal(descriptor.table, {
-        [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId),
+        [descriptor.credentialKey]: yield* credentialKey(rpId, protocolCredentialId),
       }),
       { lock: false, observe: false, limit: 1, columns: mappedColumns(descriptor) },
     );
@@ -257,7 +257,7 @@ export const makePasskeyCredentialsKernel = (
   ) {
     const owner = yield* CurrentPasskeyTransaction;
     const ownership = mapping.credentialOwnership;
-    const tupleKey = credentialKey(rpId, protocolCredentialId);
+    const tupleKey = yield* credentialKey(rpId, protocolCredentialId);
 
     const tuple = (yield* owner.read(
       ownership.table,
@@ -298,7 +298,7 @@ export const makePasskeyCredentialsKernel = (
       return undefined;
     let decoded = descriptor.decode(copiedRow(row));
     const handle = mapping.handleOwnership;
-    const expectedHandleKey = handleKey(rpId, decoded.userHandle);
+    const expectedHandleKey = yield* handleKey(rpId, decoded.userHandle);
 
     const handleRow = (yield* owner.read(
       handle.table,
@@ -452,7 +452,7 @@ export const makePasskeyCredentialsKernel = (
       );
       // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.
       userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);
-      invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));
+      invariant(handleRow[handle.handleKey] === (yield* handleKey(input.rpId, userHandle)));
     }
     const credential = mapping.read.credential;
 

package/src/internal/passkey/enrollment.ts

@@ -97,7 +97,7 @@ export const makePasskeyEnrollmentKernel = (
 
     const found = yield* owner.read(table.table, where, { limit: 1 });
     const row = found.rows[0];
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     if (row !== undefined)
       return (
@@ -193,7 +193,7 @@ export const makePasskeyEnrollmentKernel = (
           action: "enroll-begin",
           commandId: ceremony.commandId,
           flowId: ceremony.flowId,
-          bindingDigest: enrollmentDigest(ceremony),
+          bindingDigest: yield* enrollmentDigest(ceremony),
           revision: ceremony.context.revision,
         },
         {
@@ -207,11 +207,11 @@ export const makePasskeyEnrollmentKernel = (
     )
       return { _tag: "Rejected" } as const;
     invariant(
-      digest(Ceremony.fields.context, ceremony.context) ===
-        digest(Ceremony.fields.context, {
+      (yield* digest(Ceremony.fields.context, ceremony.context)) ===
+        (yield* digest(Ceremony.fields.context, {
           ...ceremony.context,
           authorization: input.authorization,
-        }),
+        })),
     );
     const issued = yield* issueAssertion(mapping, ceremony, input.policy);
 
@@ -277,7 +277,7 @@ export const makePasskeyEnrollmentKernel = (
           action: "enroll-complete",
           commandId: ceremony.commandId,
           flowId: ceremony.flowId,
-          bindingDigest: digest(Ceremony, ceremony),
+          bindingDigest: yield* digest(Ceremony, ceremony),
           revision: ceremony.context.revision,
         },
         {
@@ -293,7 +293,7 @@ export const makePasskeyEnrollmentKernel = (
       return yield* reject;
     const tuple = mapping.read.credentialOwnership;
     // Credential ownership is RP-global, including retained registration custody.
-    const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);
+    const key = yield* credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);
 
     if (
       (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {

package/src/internal/passkey/flow.ts

@@ -233,8 +233,8 @@ export const makePasskeyFlowKernel = (
     const subject = credential?.revision.subjectId ?? knownSubject(ceremony);
 
     invariant(
-      row[table.subjectScope] === (subject === undefined ? null : subjectScope(subject)) &&
-        row[table.targetScope] === targetScope(ceremony),
+      row[table.subjectScope] === (subject === undefined ? null : yield* subjectScope(subject)) &&
+        row[table.targetScope] === (yield* targetScope(ceremony)),
     );
     if (state === "Pending") {
       invariant(
@@ -378,12 +378,12 @@ export const makePasskeyFlowKernel = (
 
     if (sameCommand.rows.length !== 0 || sameFlow !== undefined)
       return { _tag: "Rejected" } as const;
-    const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);
+    const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);
 
     if (
       !(yield* owner.check(liveCondition(mapping, ceremony))) ||
       !(yield* owner.check(
-        admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),
+        yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),
       ))
     )
       return { _tag: "Rejected" } as const;
@@ -410,8 +410,8 @@ export const makePasskeyFlowKernel = (
       [table.claimedAt]: null,
       [table.claimExpiresAt]: null,
       [table.credentialSnapshot]: null,
-      [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),
-      [table.targetScope]: targetScope(ceremony),
+      [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),
+      [table.targetScope]: yield* targetScope(ceremony),
     };
 
     // Empty-key observations now expect this exact inserted row as well.
@@ -554,7 +554,7 @@ export const makePasskeyFlowKernel = (
 
     if (
       !(yield* owner.check(
-        admissionCondition(
+        yield* admissionCondition(
           mapping,
           [read.policy, current],
           read.ceremony,
@@ -591,7 +591,7 @@ export const makePasskeyFlowKernel = (
         [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
         [table.credentialSnapshot]:
           input.credential === undefined ? null : credentialStorage.encode(input.credential),
-        [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),
+        [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),
       },
     );
     if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, ["subject"], subjectId);

package/src/internal/passkey/management.ts

@@ -335,7 +335,7 @@ export const makePasskeyManagementKernel = (
           action: "remove",
           commandId: input.commandId,
           flowId: input.commandId,
-          bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+          bindingDigest: yield* removeDigest(mapping.moduleId, input.commandId, input.credential),
           revision: input.credential.revision,
         },
         {
@@ -384,7 +384,12 @@ export const makePasskeyManagementKernel = (
 
     yield* owner.update(
       tuple.table,
-      { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },
+      {
+        [tuple.credentialKey]: yield* credentialKey(
+          credential.rpId,
+          credential.protocolCredentialId,
+        ),
+      },
       {
         [tuple.state]: mapping.write.credentialOwnership.removedState,
         [tuple.version]: owner.marker,

package/src/internal/passkey/registration-ceremony.ts

@@ -78,7 +78,7 @@ export const makePasskeyRegistrationCeremonyKernel = (
     })).rows[0];
 
     if (advisory === undefined) return false;
-    const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+    const hashedHandle = yield* handleKey(ceremony.profile.rpId, context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -204,7 +204,7 @@ export const makePasskeyRegistrationCeremonyKernel = (
       policyStorage.encode(current) !== policyStorage.encode(input.policy) ||
       !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||
       !(yield* owner.check(
-        admissionCondition(
+        yield* admissionCondition(
           mapping,
           [read.policy, current],
           read.ceremony,

package/src/internal/passkey/registration-custody.ts

@@ -26,7 +26,7 @@ export const makePasskeyRegistrationCustodyKernel = (
     const owner = yield* CurrentPasskeyTransaction;
     const handle = mapping.handle;
     const intent = mapping.intent;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,

package/src/internal/passkey/registration-write.ts

@@ -67,7 +67,7 @@ export const makePasskeyRegistrationWriteKernel = (
   const { digest, insertCredential, jsonStorage, validRegistration } = writeState;
   const { both } = transactions;
 
-  const registrationData = (mapping: any, registration: any) => {
+  const registrationData = Effect.fnUntraced(function* (mapping: any, registration: any) {
     const codec = jsonStorage(mapping.registration.schema);
     const encoded = codec.encode(registration);
 
@@ -76,26 +76,26 @@ export const makePasskeyRegistrationWriteKernel = (
     return {
       encoded,
       registration: codec.decode(encoded),
-      fingerprint: digest(mapping.registration.schema, registration),
+      fingerprint: yield* digest(mapping.registration.schema, registration),
     };
-  };
+  });
 
-  const describe = (mapping: any, registration: any) => {
-    const data = registrationData(mapping, registration);
+  const describe = Effect.fnUntraced(function* (mapping: any, registration: any) {
+    const data = yield* registrationData(mapping, registration);
 
     const labels = Schema.decodeSync(
       Schema.Struct({ name: PasskeyLabel, displayName: PasskeyLabel }),
     )(mapping.registration.describe(data.registration));
 
     return { ...data, ...labels };
-  };
+  });
 
   const inspectRegistration = Effect.fn("passkey.inspectRegistration")(function* (
     mapping: any,
     registration: any,
   ) {
     const owner = yield* CurrentPasskeyTransaction;
-    const value = describe(mapping, registration);
+    const value = yield* describe(mapping, registration);
     const current = yield* readModule(mapping);
 
     yield* readPolicyGuards(mapping);
@@ -133,7 +133,7 @@ export const makePasskeyRegistrationWriteKernel = (
       ceremony.allowedCredentials.length !== 0
     )
       return { _tag: "Rejected" } as const;
-    const value = describe(mapping, input.registration);
+    const value = yield* describe(mapping, input.registration);
 
     if (
       value.fingerprint !== ceremony.context.fingerprint ||
@@ -148,7 +148,7 @@ export const makePasskeyRegistrationWriteKernel = (
 
     if (!(yield* owner.check(eligible))) return { _tag: "Rejected" } as const;
     const handle = mapping.handle;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const absentHandle = yield* owner.read(
       handle.table,
@@ -259,7 +259,7 @@ export const makePasskeyRegistrationWriteKernel = (
     const absentCredential = yield* owner.read(
       tuple.table,
       equal(tuple.table, {
-        [tuple.credentialKey]: credentialKey(
+        [tuple.credentialKey]: yield* credentialKey(
           ceremony.profile.rpId,
           input.verified.protocolCredentialId,
         ),
@@ -268,7 +268,7 @@ export const makePasskeyRegistrationWriteKernel = (
     );
 
     const handle = mapping.handle;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -319,7 +319,7 @@ export const makePasskeyRegistrationWriteKernel = (
     )
       return yield* reject;
 
-    const data = describe(
+    const data = yield* describe(
       mapping,
       jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]),
     );

package/src/internal/passkey/state.ts

@@ -1,9 +1,5 @@
 /* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
 
-// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.
-import { sha256 } from "@noble/hashes/sha2.js";
-// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.
-import { randomBytes } from "@noble/hashes/utils.js";
 import {
   PasskeyConfigurationError,
   PasskeyUnavailable,
@@ -15,9 +11,9 @@ import {
   PasskeyMethodPolicy,
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
-import { Context, Effect, Schema } from "effect";
-import { Base64Url } from "effect/encoding";
+import { Context, Crypto, Effect, Schema } from "effect";
 
+import { randomId } from "../crypto";
 import {
   requiredPasskeyCredentialConstraints,
   requiredPasskeyPersistenceConstraints,
@@ -48,14 +44,14 @@ export const makePasskeyStateKernel = (
 
   const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
 
-  const nonce = () => Base64Url.encode(randomBytes(32));
+  const nonce = randomId;
 
   const encoder = new TextEncoder();
 
   const decoder = new TextDecoder("utf-8", { fatal: true });
 
   /** RP tuples and admission scopes have no collation-dependent string identity. */
-  const key = (kind: string, fields: ReadonlyArray<string>) => {
+  const key = Effect.fnUntraced(function* (kind: string, fields: ReadonlyArray<string>) {
     const values = ["effect-auth/passkey/" + kind + "/v1", ...fields].map((field) => {
       const bytes = encoder.encode(field);
 
@@ -74,10 +70,11 @@ export const makePasskeyStateKernel = (
       offset += 4 + bytes.length;
     }
 
-    return (
-      "v1:" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, "0")).join("")
-    );
-  };
+    const crypto = yield* Crypto.Crypto;
+    const hashed = yield* crypto.digest("SHA-256", packed);
+
+    return "v1:" + Array.from(hashed, (value) => value.toString(16).padStart(2, "0")).join("");
+  });
 
   const credentialKey = (rpId: string, id: string) => key("credential", [rpId, id]);
 
@@ -88,7 +85,7 @@ export const makePasskeyStateKernel = (
   const targetScope = (ceremony: PasskeyCeremony) => {
     const context = ceremony.context;
 
-    if (!("target" in context)) return null;
+    if (!("target" in context)) return Effect.succeed(null);
     const target = context.target;
 
     return key("target", [