@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/session-policy.ts

@@ -0,0 +1,59 @@
+import type { AuthenticationEvidence } from "@yielded/auth/Sessions";
+import { SessionUnavailable } from "@yielded/auth/Sessions";
+import { DateTime, Effect } from "effect";
+
+import { PersistenceMappingError } from "./mapping-error";
+
+export const preservesRevision = (
+  completed: AuthenticationEvidence,
+  original: AuthenticationEvidence,
+): boolean => {
+  const current = new Map(
+    completed.revision.credentials.map((item) => [item.credentialId, item.revision]),
+  );
+
+  return (
+    completed.flowId === original.flowId &&
+    completed.bindingDigest === original.bindingDigest &&
+    completed.revision.subjectId === original.revision.subjectId &&
+    completed.revision.securityRevision === original.revision.securityRevision &&
+    original.revision.credentials.every(
+      (item) => current.get(item.credentialId) === item.revision,
+    ) &&
+    original.proofs.every((expected) =>
+      completed.proofs.some(
+        (proof) =>
+          proof.method === expected.method &&
+          proof.credentialId === expected.credentialId &&
+          proof.userVerified === expected.userVerified &&
+          proof.phishingResistant === expected.phishingResistant &&
+          DateTime.toEpochMillis(proof.verifiedAt) ===
+            DateTime.toEpochMillis(expected.verifiedAt) &&
+          proof.factors.length === expected.factors.length &&
+          proof.factors.every((factor, index) => factor === expected.factors[index]),
+      ),
+    )
+  );
+};
+
+export const allocateSessionValue = <A>(
+  mode: "interactive" | "synchronous" | "batch",
+  asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,
+  synchronous: (() => A) | undefined,
+): Effect.Effect<A, PersistenceMappingError | SessionUnavailable> => {
+  if (mode === "synchronous")
+    return synchronous === undefined
+      ? Effect.fail(SessionUnavailable.make({}))
+      : Effect.try({
+          try: synchronous,
+          catch: (cause) => PersistenceMappingError.make({ operation: "allocate", cause }),
+        });
+  if (asynchronous !== undefined) return asynchronous;
+
+  return synchronous === undefined
+    ? Effect.fail(SessionUnavailable.make({}))
+    : Effect.try({
+        try: synchronous,
+        catch: (cause) => PersistenceMappingError.make({ operation: "allocate", cause }),
+      });
+};

package/src/internal/sql-authority.ts

@@ -0,0 +1,56 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SessionUnavailable, type AuthenticationAuthority } from "@yielded/auth/Sessions";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+
+import { PersistenceConfigurationError } from "./configuration";
+import type { AuthenticationAuthorityMapping } from "./models/session-model";
+import { makeNativeSqlTables } from "./native-sql-table";
+import {
+  makeNativeAuthenticationAuthorityServices,
+  type NativeAuthenticationAuthorityMapping,
+} from "./session-native-authority";
+import { SqlBatchCommit } from "./sql-commit";
+import { SqlExpression, compileSqlExpression } from "./sql-expression";
+import type { SqlTableModel } from "./sql-oauth-model";
+import { validateSqlStorage } from "./sql-storage-validation";
+
+/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */
+export const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims, N>(
+  mapping: AuthenticationAuthorityMapping<
+    Claims,
+    SqlTableModel,
+    SqlTableModel,
+    SqlTableModel,
+    N,
+    SqlExpression
+  >,
+): Effect.fn.Return<
+  { readonly authenticationAuthority: AuthenticationAuthority["Service"] },
+  SessionUnavailable | PersistenceConfigurationError,
+  LifecycleHooks | SqlClient.SqlClient
+> {
+  const sql = yield* SqlClient.SqlClient;
+
+  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }))
+    return yield* PersistenceConfigurationError.make({
+      reason: "Authentication authority requires PostgreSQL or SQLite",
+    });
+  yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));
+
+  // Erase mapped native ID callback variance, never decoded authentication data.
+  return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {
+    ...mapping,
+    clock: {
+      ...mapping.clock,
+      toMillis: (value: unknown) =>
+        mapping.clock.toMillis(new SqlExpression((client) => compileSqlExpression(client, value))),
+      fromMillis: (value: unknown) =>
+        mapping.clock.fromMillis(
+          new SqlExpression((client) => compileSqlExpression(client, value)),
+        ),
+    },
+  } as unknown as NativeAuthenticationAuthorityMapping<Claims>).pipe(
+    Effect.provideService(SqlBatchCommit, undefined),
+  );
+});

package/src/internal/sql-change.ts

@@ -0,0 +1,38 @@
+import { Effect, Schema } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+import type { SqlError } from "effect/sql/SqlError";
+import { join, type Fragment } from "effect/sql/Statement";
+
+/** Native row counts are the authority for conditional writes. MySQL exposes
+ * its result header; PostgreSQL and SQLite return one row for every match. */
+export const executeSqlChange = (
+  sql: SqlClient,
+  query: Fragment,
+): Effect.Effect<number, SqlError | Schema.SchemaError> =>
+  sql.onDialectOrElse({
+    mysql: () =>
+      sql`${query}`.raw.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ affectedRows: Schema.Int }))),
+        Effect.map((result) => result.affectedRows),
+      ),
+    orElse: () => sql`${query} returning 1 as changed`.pipe(Effect.map((rows) => rows.length)),
+  });
+
+/** Effect renders an empty OR as `1=1`; an empty set of alternatives matches nothing. */
+export const anySqlCondition: (conditions: ReadonlyArray<Fragment>) => Fragment = join(
+  " OR ",
+  true,
+  "1 = 0",
+);
+
+/** Keep the indexed predicate and reject collation aliases of security tokens. */
+export const exactSqlText = (sql: SqlClient, left: Fragment, right: Fragment) =>
+  sql.and([
+    sql`${left} = ${right}`,
+    sql.onDialectOrElse({
+      mysql: () => sql`binary ${left} = binary ${right}`,
+      pg: () =>
+        sql`convert_to(cast(${left} as text), 'UTF8') = convert_to(cast(${right} as text), 'UTF8')`,
+      orElse: () => sql`cast(${left} as blob) = cast(${right} as blob)`,
+    }),
+  ]);

package/src/internal/sql-cleanup.ts

@@ -0,0 +1,56 @@
+import { CleanupLimit, CleanupResult } from "@yielded/auth/Persistence";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import type { SqlTable } from "./native-sql-table";
+import { executeSqlChange } from "./sql-change";
+import { appendSqlBatchStatement } from "./sql-commit";
+
+/** A mapped row key and its strategy-owned retention predicate are the entire
+ * cleanup authority. All tables share the same remaining row budget. */
+export interface SqlCleanupTable {
+  readonly table: SqlTable;
+  readonly keys: readonly [string, ...string[]];
+  readonly due: Fragment;
+  readonly order: ReadonlyArray<Fragment>;
+}
+
+export const cleanupSqlRows = Effect.fnUntraced(function* (
+  candidates: ReadonlyArray<SqlCleanupTable>,
+  requested: CleanupLimit,
+  batch = false,
+) {
+  const limit = yield* Schema.decodeEffect(CleanupLimit)(requested);
+  const sql = (yield* SqlClient).withoutTransforms();
+  let removed = 0;
+
+  for (const candidate of candidates) {
+    const remaining = limit - removed;
+
+    if (remaining === 0) break;
+    const { table, keys, due } = candidate;
+    const aliases = keys.map((_, index) => sql.literal(`cleanup_key_${index}`));
+    const selection = sql`select ${sql.join(", ", false)(keys.map((key, index) => sql`${table.column(key)} as ${aliases[index]!}`))} from ${table.name} where ${due} order by ${sql.join(", ", false)(candidate.order.length === 0 ? keys.map(table.column) : candidate.order)} limit ${remaining}`;
+
+    // An uncorrelated IN selection materializes the bounded key set before
+    // deletion, including SQLite's self-table case and composite tombstone keys.
+    const rowKey =
+      keys.length === 1
+        ? table.column(keys[0])
+        : sql`(${sql.join(", ", false)(keys.map(table.column))})`;
+
+    const deletion = sql`delete from ${table.name} where ${due} and ${rowKey} in (select ${sql.join(", ", false)(aliases)} from (${selection}) as cleanup_candidates)`;
+
+    if (batch) {
+      const planned = (yield* sql`${selection}`).length;
+
+      yield* appendSqlBatchStatement(deletion);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${planned}`));
+      removed += planned;
+    } else removed += yield* executeSqlChange(sql, deletion);
+  }
+
+  return yield* Schema.decodeEffect(CleanupResult)({ removed, hasMore: removed === limit });
+});

package/src/internal/sql-commit.ts

@@ -0,0 +1,435 @@
+import {
+  type CommitDiscarded,
+  type CommitPending,
+  type PreparedCommit,
+  CurrentCommitJournal,
+  LifecycleHooks,
+  coordinateCommit,
+  hasCommitScope,
+} from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { Cause, Context, Data, Effect, Option, Predicate, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { SqlError } from "effect/sql/SqlError";
+import type { Statement } from "effect/sql/Statement";
+
+import type { PersistenceMappingError } from "./mapping-error";
+import { requireStandalone } from "./standalone";
+
+type SqlCommitError = PersistenceMappingError | Schema.SchemaError | SqlError;
+
+export class SqlCommitOwnerError extends Schema.TaggedError<SqlCommitOwnerError>()(
+  "SqlCommitOwnerError",
+  {
+    reason: Schema.Literals([
+      "closed",
+      "different-client",
+      "poisoned",
+      "in-flight",
+      "invalid-receipt",
+      "invalid-mode",
+      "postcondition-requires-transaction",
+      "batch-required",
+      "empty-batch",
+    ]),
+  },
+) {}
+
+/** Composition selects a D1 batch owner or explicitly supplies no batch owner. */
+export class SqlBatchCommit extends Context.Service<
+  SqlBatchCommit,
+  | undefined
+  | {
+      readonly client: SqlClient.SqlClient;
+      readonly execute: (
+        statements: ReadonlyArray<Statement<unknown>>,
+      ) => Effect.Effect<void, SqlError>;
+    }
+>()("@yielded/auth-persistence/SqlBatchCommit") {}
+
+/** Platform ownership for databases requiring a transaction isolation policy. */
+export class SqlNativeCommit extends Context.Service<
+  SqlNativeCommit,
+  {
+    readonly client: SqlClient.SqlClient;
+    readonly withTransaction: <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+    ) => Effect.Effect<A, E | SqlCommitError, R>;
+  }
+>()("@yielded/auth-persistence/SqlNativeCommit") {}
+
+type SqlCommitMode = "transaction" | "statement" | "batch";
+
+interface SqlPostcondition {
+  readonly name: string;
+  readonly check: Effect.Effect<void, SqlCommitError, SqlClient.SqlClient>;
+}
+
+export interface SqlCommitScope {
+  readonly client: SqlClient.SqlClient;
+  readonly mode: SqlCommitMode;
+  readonly origin: "operation" | "application";
+  readonly postconditions: Array<
+    SqlPostcondition | { readonly name: string; readonly statement: Statement<unknown> }
+  >;
+  readonly receipts: Array<Effect.Effect<void, CommitPending | CommitDiscarded>>;
+  readonly statements: Array<Statement<unknown>>;
+  active: boolean;
+  poisoned: boolean;
+  inFlight: number;
+}
+
+export class CurrentSqlCommit extends Context.Service<CurrentSqlCommit, SqlCommitScope>()(
+  "@yielded/auth-persistence/CurrentSqlCommit",
+) {}
+
+const closed = (): SqlCommitOwnerError => SqlCommitOwnerError.make({ reason: "closed" });
+
+/** Explicit final checks run in the physical owner after application work.
+ * They resolve SqlClient there, rather than retaining a released savepoint.
+ */
+export const registerSqlPostcondition = (
+  condition: SqlPostcondition,
+): Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit> =>
+  Effect.flatMap(CurrentSqlCommit, (scope) => {
+    if (!scope.active) return Effect.fail(closed());
+    if (scope.mode !== "transaction")
+      return Effect.fail(
+        SqlCommitOwnerError.make({ reason: "postcondition-requires-transaction" }),
+      );
+
+    return Effect.sync(() => {
+      scope.postconditions.push(condition);
+    });
+  });
+
+/** D1 checks final semantic predicates after all application batch statements. */
+export const registerSqlBatchPostcondition = (condition: {
+  readonly name: string;
+  readonly statement: Statement<unknown>;
+}): Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit> =>
+  Effect.flatMap(CurrentSqlCommit, (scope) => {
+    if (!scope.active) return Effect.fail(closed());
+    if (scope.mode !== "batch")
+      return Effect.fail(SqlCommitOwnerError.make({ reason: "batch-required" }));
+
+    return Effect.sync(() => {
+      scope.postconditions.push(condition);
+    });
+  });
+
+/** A caught rollback cannot leave a discarded receipt in a successful owner. A D1
+ * batch needs one physical statement even when the decision writes nothing. */
+export const registerSqlCommitReceipt = <A>(
+  receipt: PreparedCommit<A>,
+): Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit> =>
+  Effect.flatMap(CurrentSqlCommit, (scope) => {
+    if (!scope.active) return Effect.fail(closed());
+
+    return Effect.sync(() => {
+      if (scope.mode === "batch" && scope.statements.length === 0)
+        scope.statements.push(scope.client`select 1`);
+      scope.receipts.push(receipt.read.pipe(Effect.asVoid));
+    });
+  });
+
+export const appendSqlBatchStatement = (
+  statement: Statement<unknown>,
+): Effect.Effect<void, SqlCommitOwnerError, CurrentSqlCommit> =>
+  Effect.flatMap(CurrentSqlCommit, (scope) => {
+    if (!scope.active) return Effect.fail(closed());
+    if (scope.mode !== "batch")
+      return Effect.fail(SqlCommitOwnerError.make({ reason: "batch-required" }));
+
+    return Effect.sync(() => {
+      scope.statements.push(statement);
+    });
+  });
+
+type OwnedRequirements<R> = Exclude<
+  Exclude<Exclude<Exclude<R, CurrentSqlCommit>, CurrentCommitJournal>, SqlClient.SqlClient>,
+  LifecycleHooks
+>;
+
+export interface SqlCommitExecutor<Failure> {
+  readonly read: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, Failure, Exclude<Exclude<R, SqlClient.SqlClient>, LifecycleHooks>>;
+  /** Session verification only: runs on the caller's transaction connection when
+   * one is ambient. Other reads reject ambient transactions before any result. */
+  readonly verify: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, Failure, Exclude<Exclude<R, SqlClient.SqlClient>, LifecycleHooks>>;
+  /** Preserve expected operation failures without admitting application suffix work. */
+  readonly operation: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode?: "transaction" | "statement",
+  ) => Effect.Effect<A, E | Failure, OwnedRequirements<R>>;
+  readonly operationBatch: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | Failure, OwnedRequirements<R> | SqlBatchCommit>;
+  readonly coordinate: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode?: "transaction" | "statement",
+  ) => Effect.Effect<A, E | Failure, OwnedRequirements<R>>;
+  readonly coordinateBatch: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | Failure, OwnedRequirements<R> | SqlBatchCommit>;
+  readonly run: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode?: "transaction" | "statement",
+  ) => Effect.Effect<A, Failure, OwnedRequirements<R>>;
+  readonly batch: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, Failure, OwnedRequirements<R> | SqlBatchCommit>;
+}
+
+/** Capture an executor where its service is constructed. Bound services cannot
+ * escape their owner, join another client, or silently start a second commit.
+ * Reads are advisory and never coordinate a commit. Statement mode is reserved
+ * for one atomic SQL mutation; authority mutations use transaction or batch mode.
+ */
+export const makeSqlCommitExecutor = Effect.fnUntraced(function* <Failure>(
+  unavailable: () => Failure,
+): Effect.fn.Return<SqlCommitExecutor<Failure>, never, SqlClient.SqlClient | LifecycleHooks> {
+  const sql = yield* SqlClient.SqlClient;
+  const hooks = yield* LifecycleHooks;
+  const captured = yield* Effect.serviceOption(CurrentSqlCommit);
+  const native = yield* Effect.serviceOption(SqlNativeCommit);
+  const failure = unavailable();
+
+  const report = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    reportPersistenceFailure(
+      effect,
+      (error) =>
+        Object.is(error, failure) ||
+        Schema.is(SqlCommitOwnerError)(error) ||
+        (Predicate.hasProperty(failure, "_tag") &&
+          typeof failure._tag === "string" &&
+          Predicate.hasProperty(error, "_tag") &&
+          error._tag === failure._tag),
+    ).pipe(
+      Effect.mapError(() => failure),
+      Effect.catchCause((cause) =>
+        Cause.hasInterrupts(cause) ? Effect.failCause(cause) : Effect.fail(failure),
+      ),
+    );
+
+  const admit = Effect.gen(function* () {
+    if (Option.isSome(captured)) {
+      const scope = captured.value;
+      const current = yield* Effect.serviceOption(CurrentSqlCommit);
+
+      if (!scope.active || Option.isNone(current) || current.value !== scope)
+        return yield* closed();
+      if (scope.client.transactionService !== sql.transactionService)
+        return yield* SqlCommitOwnerError.make({ reason: "different-client" });
+    } else {
+      if (yield* hasCommitScope) return yield* Effect.fail(failure);
+      yield* requireStandalone(() => failure, sql.transactionService);
+    }
+  });
+
+  const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    effect.pipe(
+      Effect.provideService(SqlClient.SqlClient, sql),
+      Effect.provideService(LifecycleHooks, hooks),
+    );
+
+  const bound = <A, E, R>(scope: SqlCommitScope, effect: Effect.Effect<A, E, R>) =>
+    Effect.uninterruptibleMask((restore) =>
+      Effect.gen(function* () {
+        yield* admit;
+        const journal = yield* Effect.serviceOption(CurrentCommitJournal);
+
+        if (Option.isNone(journal)) return yield* closed();
+        scope.inFlight++;
+
+        return yield* restore(
+          effect.pipe(
+            Effect.provideService(CurrentSqlCommit, scope),
+            Effect.provideService(CurrentCommitJournal, journal.value),
+          ),
+        ).pipe(
+          Effect.flatMap((value) => admit.pipe(Effect.as(value))),
+          Effect.onExit((exit) =>
+            Effect.sync(() => {
+              scope.inFlight--;
+              if (exit._tag === "Failure") scope.poisoned = true;
+            }),
+          ),
+        );
+      }),
+    );
+
+  const finish = Effect.fnUntraced(function* (scope: SqlCommitScope) {
+    if (scope.poisoned) return yield* SqlCommitOwnerError.make({ reason: "poisoned" });
+    if (scope.inFlight !== 0) return yield* SqlCommitOwnerError.make({ reason: "in-flight" });
+
+    for (const condition of scope.postconditions) {
+      if ("statement" in condition) scope.statements.push(condition.statement);
+      else yield* condition.check;
+    }
+    for (const receipt of scope.receipts) {
+      const status = yield* Effect.result(receipt);
+
+      if (status._tag !== "Failure" || status.failure._tag !== "CommitPending")
+        return yield* SqlCommitOwnerError.make({ reason: "invalid-receipt" });
+    }
+  });
+
+  const owned = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode: SqlCommitMode,
+    origin: SqlCommitScope["origin"],
+    batch?: SqlBatchCommit["Service"],
+  ) => {
+    if (Option.isSome(captured)) {
+      const scope = captured.value;
+
+      if (mode !== scope.mode && !(mode === "statement" && scope.mode === "transaction"))
+        return Effect.fail(SqlCommitOwnerError.make({ reason: "invalid-mode" }));
+
+      return provide(bound(scope, effect));
+    }
+
+    const work = Effect.gen(function* () {
+      yield* admit;
+
+      const result = yield* coordinateCommit(() => {
+        const scope: SqlCommitScope = {
+          client: sql,
+          mode,
+          origin,
+          active: true,
+          poisoned: false,
+          inFlight: 0,
+          postconditions: [],
+          receipts: [],
+          statements: [],
+        };
+
+        const owner = Effect.gen(function* () {
+          const value = yield* effect.pipe(
+            Effect.provideService(CurrentSqlCommit, scope),
+            Effect.ensuring(
+              Effect.sync(() => {
+                scope.active = false;
+              }),
+            ),
+          );
+
+          yield* finish(scope);
+          if (mode === "batch") {
+            if (batch === undefined)
+              return yield* SqlCommitOwnerError.make({ reason: "batch-required" });
+            if (batch.client.transactionService !== sql.transactionService)
+              return yield* SqlCommitOwnerError.make({ reason: "different-client" });
+            if (scope.statements.length === 0)
+              return yield* SqlCommitOwnerError.make({ reason: "empty-batch" });
+
+            yield* batch.execute(scope.statements);
+          }
+
+          return value;
+        });
+
+        if (mode !== "transaction") return owner;
+        if (Option.isNone(native)) return sql.withTransaction(owner);
+        if (native.value.client.transactionService !== sql.transactionService)
+          return Effect.fail(SqlCommitOwnerError.make({ reason: "different-client" }));
+
+        return native.value.withTransaction(owner);
+      });
+
+      return result.value;
+    });
+
+    return provide(work);
+  };
+
+  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) => {
+    if (Option.isSome(captured)) return provide(report(bound(captured.value, effect)));
+
+    return provide(report(admit.pipe(Effect.andThen(effect))));
+  };
+
+  const verify = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Option.isSome(captured) ? read(effect) : provide(report(effect));
+
+  const coordinate = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode: SqlCommitMode,
+    origin: SqlCommitScope["origin"],
+    batch?: SqlBatchCommit["Service"],
+  ) => {
+    class ApplicationFailure extends Data.TaggedError("SqlCommitApplicationFailure")<{
+      readonly error: E;
+    }> {}
+    const wrapped = effect.pipe(Effect.mapError((error) => new ApplicationFailure({ error })));
+
+    return reportPersistenceFailure(
+      owned(wrapped, mode, origin, batch),
+      (error) => error instanceof ApplicationFailure || Schema.is(SqlCommitOwnerError)(error),
+    ).pipe(
+      Effect.catchCause((cause) =>
+        Effect.failCause(
+          Cause.fromReasons(
+            cause.reasons.map((reason): Cause.Reason<E | Failure> => {
+              if (Cause.isInterruptReason(reason)) return reason;
+              if (Cause.isFailReason(reason) && reason.error instanceof ApplicationFailure)
+                return Cause.makeFailReason(reason.error.error);
+
+              return Cause.makeFailReason(failure);
+            }),
+          ),
+        ),
+      ),
+    );
+  };
+
+  return {
+    read,
+    verify,
+    operation: <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      mode: "transaction" | "statement" = "transaction",
+    ) => coordinate(effect, mode, "operation"),
+    operationBatch: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      Effect.flatMap(SqlBatchCommit, (batch) => coordinate(effect, "batch", "operation", batch)),
+    coordinate: <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      mode: "transaction" | "statement" = "transaction",
+    ) => coordinate(effect, mode, "application"),
+    coordinateBatch: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      Effect.flatMap(SqlBatchCommit, (batch) => coordinate(effect, "batch", "application", batch)),
+    run: <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      mode: "transaction" | "statement" = "transaction",
+    ): Effect.Effect<A, Failure, OwnedRequirements<R>> => report(owned(effect, mode, "operation")),
+    batch: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      Effect.flatMap(SqlBatchCommit, (batch) => report(owned(effect, "batch", "operation", batch))),
+  };
+});
+
+/** Application statements join the same fixed batch and cannot escape it. */
+export interface SqlBatchCollector {
+  readonly append: (statement: Statement<unknown>) => Effect.Effect<void, SqlCommitOwnerError>;
+}
+
+export const captureSqlBatchStatements: Effect.Effect<SqlBatchCollector, never, CurrentSqlCommit> =
+  Effect.map(CurrentSqlCommit, (scope) => ({
+    append: (statement: Statement<unknown>) =>
+      Effect.gen(function* () {
+        const current = yield* Effect.serviceOption(CurrentSqlCommit);
+
+        if (
+          !scope.active ||
+          scope.mode !== "batch" ||
+          Option.isNone(current) ||
+          current.value !== scope
+        )
+          return yield* closed();
+        scope.statements.push(statement);
+      }),
+  }));