Skip to content
// EFFECT DAYS 2026

SqlEventLogServerEncrypted unstable

Stores encrypted event-log server state in SQL.

This module provides the durable Storage implementation used by EventLogServerEncrypted when entries should be stored without exposing plaintext event data to the database. It persists the server remote id, session authentication bindings, and encrypted batch tables, assigns stable sequence numbers, streams changes, and stores encrypted compaction snapshots. Clients remain responsible for encrypting writes and decrypting reads.

3 exports Since v4.0.0 Source

Constructors

makeStorage

unstable
Since v4.0.0

Creates encrypted event-log server Storage backed by SQL.

Details

It persists the server remote id, session authentication bindings, and encrypted batches in dialect-specific tables, creating per-identity/store batch and entry id tables as needed.

The storage always provides compaction. Its tables are created on startup and when a store is first opened. A sweep in the surrounding scope prunes superseded generations every sweepInterval. Startup dies on invalid compaction options (see EventLogServerEncrypted.makeCompactionConfig).

Gotchas

Storage does not retry sequence conflicts between competing instances. EventLog.runRemote retries failed writes; direct EventLogRemote.write callers must retry failures other than Forbidden themselves. Live notifications are local to each storage instance; clients on other instances must reconnect to read those writes.

Inside a caller's transaction, write and compaction.rollback publish to live readers after the outermost commit, and not at all if it rolls back. Concurrent caller transactions may reach live readers out of sequence order. changes always reads in committed order.

Instances sharing a database should share compaction options. The instance that writes a generation or stage fixes its prune time or expiry.

Signature

declare function makeStorage(options?: {
  readonly compaction?: CompactionOptions;
  readonly entryTablePrefix?: string;
  readonly remoteIdTable?: string;
}): Effect<{
  readonly changes: (publicKey: string, storeId: StoreId, startSequence: number) => Stream<EncryptedRemoteBatch>;
  readonly compaction?: StorageCompaction;
  readonly entrySequences: (publicKey: string, storeId: StoreId, entryIds: readonly Array<EntryId>) => Effect<readonly Array<{
    readonly entryId: Uint8Array<ArrayBuffer> & Brand<"effect/eventlog/EventJournal/EntryId">;
    readonly sequence: number;
  }>>;
  readonly firstSequence?: number;
  readonly getId: Effect<RemoteId>;
  readonly getOrCreateSessionAuthBinding: (publicKey: string, signingPublicKey: Uint8Array<ArrayBuffer>) => Effect<Uint8Array<ArrayBuffer>>;
  readonly write: (publicKey: string, storeId: StoreId, batches: readonly Array<EncryptedBatch>) => Effect<readonly Array<EncryptedRemoteBatch>>;
}, SqlError, Scope | SqlClient | Digest>

Layers

layerStorage

unstable
Since v4.0.0

Provides encrypted server Storage using the SQL-backed implementation.

Signature

declare function layerStorage(options?: {
  readonly compaction?: CompactionOptions;
  readonly entryTablePrefix?: string;
  readonly remoteIdTable?: string;
}): Layer<Storage, SqlError, SqlClient | Digest>

layerStorageSubtle

unstable
Since v4.0.0

Provides SQL-backed encrypted server Storage and supplies the default Web Crypto Digest layer.

Signature

declare function layerStorageSubtle(options?: {
  readonly compaction?: CompactionOptions;
  readonly entryTablePrefix?: string;
  readonly remoteIdTable?: string;
}): Layer<Storage, SqlError, SqlClient>