@yielded/auth-persistence 0.1.0-beta.17 → 0.1.0-beta.19

package/src/internal/passkey/admission.ts

@@ -31,18 +31,19 @@ export const makePasskeyAdmissionKernel = (
 
   const chargeRetentionMillis = 86_400_000;
 
-  const chargeScopes = (ceremony: PasskeyCeremony, subjectId?: string) => {
+  const chargeScopes = Effect.fnUntraced(function* (ceremony: PasskeyCeremony, subjectId?: string) {
     const scopes: { kind: PasskeyChargeKind; scope: string }[] = [
-      { kind: "global", scope: key("global", [ceremony.moduleId]) },
+      { kind: "global", scope: yield* key("global", [ceremony.moduleId]) },
     ];
 
-    if (subjectId !== undefined) scopes.push({ kind: "subject", scope: subjectScope(subjectId) });
-    const target = targetScope(ceremony);
+    if (subjectId !== undefined)
+      scopes.push({ kind: "subject", scope: yield* subjectScope(subjectId) });
+    const target = yield* targetScope(ceremony);
 
     if (target !== null) scopes.push({ kind: "target", scope: target });
 
     return scopes;
-  };
+  });
 
   const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping: any) {
     const owner = yield* CurrentPasskeyTransaction;
@@ -107,7 +108,7 @@ export const makePasskeyAdmissionKernel = (
     )})`;
   };
 
-  const admissionCondition = (
+  const admissionCondition = Effect.fnUntraced(function* (
     mapping: any,
     policies: ReadonlyArray<PasskeyMethodPolicy>,
     ceremony: PasskeyCeremony,
@@ -115,19 +116,23 @@ export const makePasskeyAdmissionKernel = (
     added: ReadonlyArray<PasskeyChargeKind>,
     newFlow: boolean,
     resolvedSubject: boolean,
-  ) =>
-    both(
+  ) {
+    const subject = subjectId === undefined ? undefined : yield* subjectScope(subjectId);
+    const scopes = yield* chargeScopes(ceremony, subjectId);
+
+    return both(
       ...policies.flatMap((policy) => [
         sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
         subjectId === undefined
           ? undefined
-          : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
-        ...chargeScopes(ceremony, subjectId).map(
+          : sql`${pendingCount(mapping, subject)} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
+        ...scopes.map(
           ({ kind, scope }) =>
             sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,
         ),
       ]),
     );
+  });
 
   const guardAdmission = (
     mapping: any,
@@ -135,9 +140,11 @@ export const makePasskeyAdmissionKernel = (
     ceremony: PasskeyCeremony,
     subjectId?: string,
   ) =>
-    Effect.map(CurrentPasskeyTransaction, (owner) => {
+    Effect.gen(function* () {
+      const owner = yield* CurrentPasskeyTransaction;
+
       owner.postconditions.push(
-        admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),
+        yield* admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),
       );
     });
 
@@ -161,7 +168,7 @@ export const makePasskeyAdmissionKernel = (
       columns: mappedColumns(table),
     });
 
-    const scopes = chargeScopes(ceremony, subjectId);
+    const scopes = yield* chargeScopes(ceremony, subjectId);
 
     invariant(found.rows.length === scopes.length);
     for (const { kind, scope } of scopes) {
@@ -202,7 +209,7 @@ export const makePasskeyAdmissionKernel = (
     Effect.flatMap(CurrentPasskeyTransaction, (owner) =>
       Effect.gen(function* () {
         const table = mapping.charge;
-        const scopes = chargeScopes(ceremony, subjectId);
+        const scopes = yield* chargeScopes(ceremony, subjectId);
 
         const where = equal(table.table, {
           [table.moduleId]: ceremony.moduleId,
@@ -241,7 +248,7 @@ export const makePasskeyAdmissionKernel = (
     const earliest = yield* owner.now(clock);
     const identities: Record<string, unknown>[] = [];
 
-    for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) =>
+    for (const { kind, scope } of (yield* chargeScopes(ceremony, subjectId)).filter((item) =>
       kinds.includes(item.kind),
     )) {
       const identity = {

package/src/internal/passkey/credentials.ts

@@ -172,7 +172,7 @@ export const makePasskeyCredentialsKernel = (
     const found = yield* owner.read(
       descriptor.table,
       equal(descriptor.table, {
-        [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId),
+        [descriptor.credentialKey]: yield* credentialKey(rpId, protocolCredentialId),
       }),
       { lock: false, observe: false, limit: 1, columns: mappedColumns(descriptor) },
     );
@@ -257,7 +257,7 @@ export const makePasskeyCredentialsKernel = (
   ) {
     const owner = yield* CurrentPasskeyTransaction;
     const ownership = mapping.credentialOwnership;
-    const tupleKey = credentialKey(rpId, protocolCredentialId);
+    const tupleKey = yield* credentialKey(rpId, protocolCredentialId);
 
     const tuple = (yield* owner.read(
       ownership.table,
@@ -298,7 +298,7 @@ export const makePasskeyCredentialsKernel = (
       return undefined;
     let decoded = descriptor.decode(copiedRow(row));
     const handle = mapping.handleOwnership;
-    const expectedHandleKey = handleKey(rpId, decoded.userHandle);
+    const expectedHandleKey = yield* handleKey(rpId, decoded.userHandle);
 
     const handleRow = (yield* owner.read(
       handle.table,
@@ -452,7 +452,7 @@ export const makePasskeyCredentialsKernel = (
       );
       // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.
       userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);
-      invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));
+      invariant(handleRow[handle.handleKey] === (yield* handleKey(input.rpId, userHandle)));
     }
     const credential = mapping.read.credential;
 

package/src/internal/passkey/enrollment.ts

@@ -97,7 +97,7 @@ export const makePasskeyEnrollmentKernel = (
 
     const found = yield* owner.read(table.table, where, { limit: 1 });
     const row = found.rows[0];
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     if (row !== undefined)
       return (
@@ -193,7 +193,7 @@ export const makePasskeyEnrollmentKernel = (
           action: "enroll-begin",
           commandId: ceremony.commandId,
           flowId: ceremony.flowId,
-          bindingDigest: enrollmentDigest(ceremony),
+          bindingDigest: yield* enrollmentDigest(ceremony),
           revision: ceremony.context.revision,
         },
         {
@@ -207,11 +207,11 @@ export const makePasskeyEnrollmentKernel = (
     )
       return { _tag: "Rejected" } as const;
     invariant(
-      digest(Ceremony.fields.context, ceremony.context) ===
-        digest(Ceremony.fields.context, {
+      (yield* digest(Ceremony.fields.context, ceremony.context)) ===
+        (yield* digest(Ceremony.fields.context, {
           ...ceremony.context,
           authorization: input.authorization,
-        }),
+        })),
     );
     const issued = yield* issueAssertion(mapping, ceremony, input.policy);
 
@@ -277,7 +277,7 @@ export const makePasskeyEnrollmentKernel = (
           action: "enroll-complete",
           commandId: ceremony.commandId,
           flowId: ceremony.flowId,
-          bindingDigest: digest(Ceremony, ceremony),
+          bindingDigest: yield* digest(Ceremony, ceremony),
           revision: ceremony.context.revision,
         },
         {
@@ -293,7 +293,7 @@ export const makePasskeyEnrollmentKernel = (
       return yield* reject;
     const tuple = mapping.read.credentialOwnership;
     // Credential ownership is RP-global, including retained registration custody.
-    const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);
+    const key = yield* credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);
 
     if (
       (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {

package/src/internal/passkey/flow.ts

@@ -233,8 +233,8 @@ export const makePasskeyFlowKernel = (
     const subject = credential?.revision.subjectId ?? knownSubject(ceremony);
 
     invariant(
-      row[table.subjectScope] === (subject === undefined ? null : subjectScope(subject)) &&
-        row[table.targetScope] === targetScope(ceremony),
+      row[table.subjectScope] === (subject === undefined ? null : yield* subjectScope(subject)) &&
+        row[table.targetScope] === (yield* targetScope(ceremony)),
     );
     if (state === "Pending") {
       invariant(
@@ -378,12 +378,12 @@ export const makePasskeyFlowKernel = (
 
     if (sameCommand.rows.length !== 0 || sameFlow !== undefined)
       return { _tag: "Rejected" } as const;
-    const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);
+    const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);
 
     if (
       !(yield* owner.check(liveCondition(mapping, ceremony))) ||
       !(yield* owner.check(
-        admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),
+        yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),
       ))
     )
       return { _tag: "Rejected" } as const;
@@ -410,8 +410,8 @@ export const makePasskeyFlowKernel = (
       [table.claimedAt]: null,
       [table.claimExpiresAt]: null,
       [table.credentialSnapshot]: null,
-      [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),
-      [table.targetScope]: targetScope(ceremony),
+      [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),
+      [table.targetScope]: yield* targetScope(ceremony),
     };
 
     // Empty-key observations now expect this exact inserted row as well.
@@ -554,7 +554,7 @@ export const makePasskeyFlowKernel = (
 
     if (
       !(yield* owner.check(
-        admissionCondition(
+        yield* admissionCondition(
           mapping,
           [read.policy, current],
           read.ceremony,
@@ -591,7 +591,7 @@ export const makePasskeyFlowKernel = (
         [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
         [table.credentialSnapshot]:
           input.credential === undefined ? null : credentialStorage.encode(input.credential),
-        [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),
+        [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),
       },
     );
     if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, ["subject"], subjectId);

package/src/internal/passkey/management.ts

@@ -335,7 +335,7 @@ export const makePasskeyManagementKernel = (
           action: "remove",
           commandId: input.commandId,
           flowId: input.commandId,
-          bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+          bindingDigest: yield* removeDigest(mapping.moduleId, input.commandId, input.credential),
           revision: input.credential.revision,
         },
         {
@@ -384,7 +384,12 @@ export const makePasskeyManagementKernel = (
 
     yield* owner.update(
       tuple.table,
-      { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },
+      {
+        [tuple.credentialKey]: yield* credentialKey(
+          credential.rpId,
+          credential.protocolCredentialId,
+        ),
+      },
       {
         [tuple.state]: mapping.write.credentialOwnership.removedState,
         [tuple.version]: owner.marker,

package/src/internal/passkey/registration-ceremony.ts

@@ -78,7 +78,7 @@ export const makePasskeyRegistrationCeremonyKernel = (
     })).rows[0];
 
     if (advisory === undefined) return false;
-    const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+    const hashedHandle = yield* handleKey(ceremony.profile.rpId, context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -204,7 +204,7 @@ export const makePasskeyRegistrationCeremonyKernel = (
       policyStorage.encode(current) !== policyStorage.encode(input.policy) ||
       !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||
       !(yield* owner.check(
-        admissionCondition(
+        yield* admissionCondition(
           mapping,
           [read.policy, current],
           read.ceremony,

package/src/internal/passkey/registration-custody.ts

@@ -26,7 +26,7 @@ export const makePasskeyRegistrationCustodyKernel = (
     const owner = yield* CurrentPasskeyTransaction;
     const handle = mapping.handle;
     const intent = mapping.intent;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,

package/src/internal/passkey/registration-write.ts

@@ -67,7 +67,7 @@ export const makePasskeyRegistrationWriteKernel = (
   const { digest, insertCredential, jsonStorage, validRegistration } = writeState;
   const { both } = transactions;
 
-  const registrationData = (mapping: any, registration: any) => {
+  const registrationData = Effect.fnUntraced(function* (mapping: any, registration: any) {
     const codec = jsonStorage(mapping.registration.schema);
     const encoded = codec.encode(registration);
 
@@ -76,26 +76,26 @@ export const makePasskeyRegistrationWriteKernel = (
     return {
       encoded,
       registration: codec.decode(encoded),
-      fingerprint: digest(mapping.registration.schema, registration),
+      fingerprint: yield* digest(mapping.registration.schema, registration),
     };
-  };
+  });
 
-  const describe = (mapping: any, registration: any) => {
-    const data = registrationData(mapping, registration);
+  const describe = Effect.fnUntraced(function* (mapping: any, registration: any) {
+    const data = yield* registrationData(mapping, registration);
 
     const labels = Schema.decodeSync(
       Schema.Struct({ name: PasskeyLabel, displayName: PasskeyLabel }),
     )(mapping.registration.describe(data.registration));
 
     return { ...data, ...labels };
-  };
+  });
 
   const inspectRegistration = Effect.fn("passkey.inspectRegistration")(function* (
     mapping: any,
     registration: any,
   ) {
     const owner = yield* CurrentPasskeyTransaction;
-    const value = describe(mapping, registration);
+    const value = yield* describe(mapping, registration);
     const current = yield* readModule(mapping);
 
     yield* readPolicyGuards(mapping);
@@ -133,7 +133,7 @@ export const makePasskeyRegistrationWriteKernel = (
       ceremony.allowedCredentials.length !== 0
     )
       return { _tag: "Rejected" } as const;
-    const value = describe(mapping, input.registration);
+    const value = yield* describe(mapping, input.registration);
 
     if (
       value.fingerprint !== ceremony.context.fingerprint ||
@@ -148,7 +148,7 @@ export const makePasskeyRegistrationWriteKernel = (
 
     if (!(yield* owner.check(eligible))) return { _tag: "Rejected" } as const;
     const handle = mapping.handle;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const absentHandle = yield* owner.read(
       handle.table,
@@ -259,7 +259,7 @@ export const makePasskeyRegistrationWriteKernel = (
     const absentCredential = yield* owner.read(
       tuple.table,
       equal(tuple.table, {
-        [tuple.credentialKey]: credentialKey(
+        [tuple.credentialKey]: yield* credentialKey(
           ceremony.profile.rpId,
           input.verified.protocolCredentialId,
         ),
@@ -268,7 +268,7 @@ export const makePasskeyRegistrationWriteKernel = (
     );
 
     const handle = mapping.handle;
-    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -319,7 +319,7 @@ export const makePasskeyRegistrationWriteKernel = (
     )
       return yield* reject;
 
-    const data = describe(
+    const data = yield* describe(
       mapping,
       jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]),
     );

package/src/internal/passkey/state.ts

@@ -1,9 +1,5 @@
 /* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
 
-// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.
-import { sha256 } from "@noble/hashes/sha2.js";
-// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.
-import { randomBytes } from "@noble/hashes/utils.js";
 import {
   PasskeyConfigurationError,
   PasskeyUnavailable,
@@ -15,9 +11,9 @@ import {
   PasskeyMethodPolicy,
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
-import { Context, Effect, Schema } from "effect";
-import { Base64Url } from "effect/encoding";
+import { Context, Crypto, Effect, Schema } from "effect";
 
+import { randomId } from "../crypto";
 import {
   requiredPasskeyCredentialConstraints,
   requiredPasskeyPersistenceConstraints,
@@ -48,14 +44,14 @@ export const makePasskeyStateKernel = (
 
   const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
 
-  const nonce = () => Base64Url.encode(randomBytes(32));
+  const nonce = randomId;
 
   const encoder = new TextEncoder();
 
   const decoder = new TextDecoder("utf-8", { fatal: true });
 
   /** RP tuples and admission scopes have no collation-dependent string identity. */
-  const key = (kind: string, fields: ReadonlyArray<string>) => {
+  const key = Effect.fnUntraced(function* (kind: string, fields: ReadonlyArray<string>) {
     const values = ["effect-auth/passkey/" + kind + "/v1", ...fields].map((field) => {
       const bytes = encoder.encode(field);
 
@@ -74,10 +70,11 @@ export const makePasskeyStateKernel = (
       offset += 4 + bytes.length;
     }
 
-    return (
-      "v1:" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, "0")).join("")
-    );
-  };
+    const crypto = yield* Crypto.Crypto;
+    const hashed = yield* crypto.digest("SHA-256", packed);
+
+    return "v1:" + Array.from(hashed, (value) => value.toString(16).padStart(2, "0")).join("");
+  });
 
   const credentialKey = (rpId: string, id: string) => key("credential", [rpId, id]);
 
@@ -88,7 +85,7 @@ export const makePasskeyStateKernel = (
   const targetScope = (ceremony: PasskeyCeremony) => {
     const context = ceremony.context;
 
-    if (!("target" in context)) return null;
+    if (!("target" in context)) return Effect.succeed(null);
     const target = context.target;
 
     return key("target", [

package/src/internal/passkey/target.ts

@@ -26,7 +26,7 @@ import {
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
 import { SubjectId } from "@yielded/auth/Schema";
-import { Effect, Schema } from "effect";
+import { type Crypto, Effect, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "../mapping-error";
@@ -130,7 +130,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.fn.Return<
     PasskeyExecution,
     PasskeyConfigurationError,
-    LifecycleHooks | NativeDatabase
+    LifecycleHooks | NativeDatabase | Crypto.Crypto
   > {
     const hooks = yield* LifecycleHooks;
 
@@ -437,7 +437,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyCredentialServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | NativeDatabase
+    RSetup | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "read", configuration);
@@ -455,7 +455,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyEnrollmentContextServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | NativeDatabase
+    RSetup | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "context", configuration);
@@ -473,7 +473,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyPersistenceServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | LifecycleHooks | NativeDatabase
+    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "assertion", configuration);
@@ -490,7 +490,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyRegistrationCeremonyServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | LifecycleHooks | NativeDatabase
+    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "registration", configuration);
@@ -508,7 +508,11 @@ export const makePasskeyTargetKernel = (
       services: PasskeyPersistenceServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) =>
       Effect.flatMap(LifecycleHooks, (hooks) =>
         coordinateTransactionOwner(
@@ -545,7 +549,11 @@ export const makePasskeyTargetKernel = (
       services: PasskeyRegistrationCeremonyServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) =>
       Effect.flatMap(LifecycleHooks, (hooks) =>
         coordinateTransactionOwner(

package/src/internal/passkey/write-state.ts

@@ -1,7 +1,5 @@
 /* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
 
-// oxlint-disable-next-line import/extensions -- Noble exposes explicit .js subpaths.
-import { sha256 } from "@noble/hashes/sha2.js";
 import {
   type PasskeyActionAuthorization,
   type PasskeyCeremony,
@@ -18,11 +16,11 @@ import {
   PasskeyManagementPolicy,
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
-import { TokenDigest, type SubjectId } from "@yielded/auth/Schema";
+import { type SubjectId } from "@yielded/auth/Schema";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Schema } from "effect";
-import { Base64Url } from "effect/encoding";
 
+import { digest as digestText } from "../crypto";
 import type { PersistenceMappingError } from "../mapping-error";
 import type { QueryOperations } from "../query-operations";
 import type { makeTransactionKernel } from "../transaction-kernel";
@@ -85,10 +83,7 @@ export const makePasskeyWriteStateKernel = (
   const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(
     schema: S,
     value: S["Type"],
-  ) =>
-    TokenDigest.make(
-      Base64Url.encode(sha256(new TextEncoder().encode(jsonStorage(schema).encode(value)))),
-    );
+  ) => digestText(jsonStorage(schema).encode(value));
 
   const currentSubject = Effect.fn("passkey.currentWriteSubject")(function* (
     mapping: any,
@@ -205,7 +200,7 @@ export const makePasskeyWriteStateKernel = (
         read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),
     );
     const ownership = read.credentialOwnership;
-    const key = credentialKey(decoded.rpId, decoded.protocolCredentialId);
+    const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);
 
     const tuple = (yield* owner.read(
       ownership.table,
@@ -226,7 +221,7 @@ export const makePasskeyWriteStateKernel = (
         row[table.credentialKey] === key,
     );
     const handle = read.handleOwnership;
-    const hashedHandle = handleKey(decoded.rpId, decoded.userHandle);
+    const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -470,9 +465,10 @@ export const makePasskeyWriteStateKernel = (
     }
     owner.postconditions.push(mapping.invalidation.postcondition(input));
     const flow = mapping.flow;
+    const scope = yield* subjectScope(subject.subjectId);
 
     const where = both(
-      equal(flow.table, { [flow.subjectScope]: subjectScope(subject.subjectId) }),
+      equal(flow.table, { [flow.subjectScope]: scope }),
       sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,
     );
 
@@ -485,7 +481,7 @@ export const makePasskeyWriteStateKernel = (
     for (const observation of owner.observations)
       if (observation.table === flow.table)
         observation.rows = observation.rows.map((row) =>
-          row[flow.subjectScope] === subjectScope(subject.subjectId) &&
+          row[flow.subjectScope] === scope &&
           [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])
             ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }
             : row,
@@ -559,8 +555,8 @@ export const makePasskeyWriteStateKernel = (
     });
 
     const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };
-    const tupleKey = credentialKey(credential.rpId, credential.protocolCredentialId);
-    const hashedHandle = handleKey(credential.rpId, credential.userHandle);
+    const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);
+    const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);
     const tuple = read.credentialOwnership;
 
     const absent = yield* owner.read(

package/src/internal/passkey/write-target.ts

@@ -10,7 +10,7 @@ import {
 import * as M from "@yielded/auth/Passkey";
 import { SubjectId } from "@yielded/auth/Schema";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-import { Effect, Layer, Schema } from "effect";
+import { type Crypto, Effect, Layer, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PasskeyMappingSource } from "../models/passkey-model";
@@ -371,7 +371,11 @@ export const makePasskeyWriteTargetKernel = (
       services: PasskeyManagementServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.gen(function* () {
       const mapping = yield* writeMapping(source, configuration, false);
       const hooks = yield* LifecycleHooks;
@@ -406,7 +410,11 @@ export const makePasskeyWriteTargetKernel = (
       services: PasskeyRegistrationServices<Value>,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.gen(function* () {
       const mapping = yield* writeMapping(source, configuration, true);
       const hooks = yield* LifecycleHooks;