@yielded/auth-persistence 0.1.0-beta.18 → 0.1.0-beta.20

package/src/internal/passkey/target.ts

@@ -26,7 +26,7 @@ import {
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
 import { SubjectId } from "@yielded/auth/Schema";
-import { Effect, Schema } from "effect";
+import { type Crypto, Effect, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "../mapping-error";
@@ -130,7 +130,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.fn.Return<
     PasskeyExecution,
     PasskeyConfigurationError,
-    LifecycleHooks | NativeDatabase
+    LifecycleHooks | NativeDatabase | Crypto.Crypto
   > {
     const hooks = yield* LifecycleHooks;
 
@@ -437,7 +437,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyCredentialServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | NativeDatabase
+    RSetup | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "read", configuration);
@@ -455,7 +455,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyEnrollmentContextServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | NativeDatabase
+    RSetup | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "context", configuration);
@@ -473,7 +473,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyPersistenceServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | LifecycleHooks | NativeDatabase
+    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "assertion", configuration);
@@ -490,7 +490,7 @@ export const makePasskeyTargetKernel = (
   ): Effect.Effect<
     PasskeyRegistrationCeremonyServices,
     PasskeyConfigurationError | PersistenceMappingError,
-    RSetup | LifecycleHooks | NativeDatabase
+    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
   > =>
     Effect.gen(function* () {
       const mapping = yield* capturedMapping(source, "registration", configuration);
@@ -508,7 +508,11 @@ export const makePasskeyTargetKernel = (
       services: PasskeyPersistenceServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) =>
       Effect.flatMap(LifecycleHooks, (hooks) =>
         coordinateTransactionOwner(
@@ -545,7 +549,11 @@ export const makePasskeyTargetKernel = (
       services: PasskeyRegistrationCeremonyServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) =>
       Effect.flatMap(LifecycleHooks, (hooks) =>
         coordinateTransactionOwner(

package/src/internal/passkey/write-state.ts

@@ -1,7 +1,5 @@
 /* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
 
-// oxlint-disable-next-line import/extensions -- Noble exposes explicit .js subpaths.
-import { sha256 } from "@noble/hashes/sha2.js";
 import {
   type PasskeyActionAuthorization,
   type PasskeyCeremony,
@@ -18,11 +16,11 @@ import {
   PasskeyManagementPolicy,
   snapshotPasskeySync,
 } from "@yielded/auth/Passkey";
-import { TokenDigest, type SubjectId } from "@yielded/auth/Schema";
+import { type SubjectId } from "@yielded/auth/Schema";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Schema } from "effect";
-import { Base64Url } from "effect/encoding";
 
+import { digest as digestText } from "../crypto";
 import type { PersistenceMappingError } from "../mapping-error";
 import type { QueryOperations } from "../query-operations";
 import type { makeTransactionKernel } from "../transaction-kernel";
@@ -85,10 +83,7 @@ export const makePasskeyWriteStateKernel = (
   const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(
     schema: S,
     value: S["Type"],
-  ) =>
-    TokenDigest.make(
-      Base64Url.encode(sha256(new TextEncoder().encode(jsonStorage(schema).encode(value)))),
-    );
+  ) => digestText(jsonStorage(schema).encode(value));
 
   const currentSubject = Effect.fn("passkey.currentWriteSubject")(function* (
     mapping: any,
@@ -205,7 +200,7 @@ export const makePasskeyWriteStateKernel = (
         read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),
     );
     const ownership = read.credentialOwnership;
-    const key = credentialKey(decoded.rpId, decoded.protocolCredentialId);
+    const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);
 
     const tuple = (yield* owner.read(
       ownership.table,
@@ -226,7 +221,7 @@ export const makePasskeyWriteStateKernel = (
         row[table.credentialKey] === key,
     );
     const handle = read.handleOwnership;
-    const hashedHandle = handleKey(decoded.rpId, decoded.userHandle);
+    const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);
 
     const held = (yield* owner.read(
       handle.table,
@@ -470,9 +465,10 @@ export const makePasskeyWriteStateKernel = (
     }
     owner.postconditions.push(mapping.invalidation.postcondition(input));
     const flow = mapping.flow;
+    const scope = yield* subjectScope(subject.subjectId);
 
     const where = both(
-      equal(flow.table, { [flow.subjectScope]: subjectScope(subject.subjectId) }),
+      equal(flow.table, { [flow.subjectScope]: scope }),
       sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,
     );
 
@@ -485,7 +481,7 @@ export const makePasskeyWriteStateKernel = (
     for (const observation of owner.observations)
       if (observation.table === flow.table)
         observation.rows = observation.rows.map((row) =>
-          row[flow.subjectScope] === subjectScope(subject.subjectId) &&
+          row[flow.subjectScope] === scope &&
           [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])
             ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }
             : row,
@@ -559,8 +555,8 @@ export const makePasskeyWriteStateKernel = (
     });
 
     const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };
-    const tupleKey = credentialKey(credential.rpId, credential.protocolCredentialId);
-    const hashedHandle = handleKey(credential.rpId, credential.userHandle);
+    const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);
+    const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);
     const tuple = read.credentialOwnership;
 
     const absent = yield* owner.read(

package/src/internal/passkey/write-target.ts

@@ -10,7 +10,7 @@ import {
 import * as M from "@yielded/auth/Passkey";
 import { SubjectId } from "@yielded/auth/Schema";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-import { Effect, Layer, Schema } from "effect";
+import { type Crypto, Effect, Layer, Schema } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
 import type { PasskeyMappingSource } from "../models/passkey-model";
@@ -371,7 +371,11 @@ export const makePasskeyWriteTargetKernel = (
       services: PasskeyManagementServices,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.gen(function* () {
       const mapping = yield* writeMapping(source, configuration, false);
       const hooks = yield* LifecycleHooks;
@@ -406,7 +410,11 @@ export const makePasskeyWriteTargetKernel = (
       services: PasskeyRegistrationServices<Value>,
       append: (statement: Statement<unknown>) => void,
     ) => Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E>,
+    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto
+  > =>
     Effect.gen(function* () {
       const mapping = yield* writeMapping(source, configuration, true);
       const hooks = yield* LifecycleHooks;

package/src/internal/passkeys.ts

@@ -1,4 +1,3 @@
-import { digest } from "@yielded/auth-crypto";
 import {
   PasskeyCredentials,
   PasskeyCredential,
@@ -19,6 +18,7 @@ import {
   type MappingInput,
   type PasskeyFeature,
 } from "./configuration";
+import { digest } from "./crypto";
 import { PersistenceMappingError } from "./mapping-error";
 import {
   requiredPasskeyCredentialConstraints,
@@ -54,6 +54,13 @@ const ModuleRow = Schema.Struct({
   policyRevision: Schema.String,
 });
 
+const ConfiguredModuleRow = Schema.Struct({
+  moduleId: Schema.String,
+  active: Schema.Boolean,
+  policyRevision: Schema.String,
+  admitted: Schema.Literals(["present", "missing"]),
+});
+
 const credentialData = PasskeyCredential.mapFields(
   ({ revision: _revision, active: _active, ...fields }) => fields,
 );
@@ -390,7 +397,21 @@ export const makeComposedPasskeys = (
       const client = yield* SqlClient.SqlClient;
 
       const policies = yield* Effect.forEach(features, (feature) =>
-        Effect.map(feature.policy, (policy) => ({ feature, policy })),
+        Effect.gen(function* () {
+          const policy = yield* feature.policy;
+          const encoded = yield* Schema.encodeEffect(policyJson)(policy);
+
+          const policyRevision = yield* digest(
+            yield* Schema.encodeEffect(seedJson)({
+              policy,
+              ...(feature.managementPolicy === undefined
+                ? {}
+                : { management: feature.managementPolicy }),
+            }),
+          );
+
+          return { feature, policy, encoded, policyRevision };
+        }),
       );
 
       const m = yield* Effect.try({
@@ -413,82 +434,112 @@ export const makeComposedPasskeys = (
       };
 
       const native = yield* CurrentProofSql;
+      const module = m.table("passkeyModules");
+      const columns = getTableColumns(module);
+      const admission = m.table("passkeyAdmissions");
+      const ac = getTableColumns(admission);
+
+      // Read live configuration on every acquisition. Matching modules and
+      // admission ownership need no initialization writes or advisory lock.
+      const configured = yield* native
+        .select({
+          moduleId: columns.moduleId,
+          active: columns.active,
+          policyRevision: columns.policyRevision,
+          // Predicate SQL preserves qualifiers through single-table projections.
+          admitted: sql`case when exists(select 1 from ${admission}
+            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})
+              then 'present' else 'missing' end`,
+        })
+        .from(module)
+        .where(
+          inArray(
+            columns.moduleId,
+            policies.map(({ feature }) => feature.moduleId),
+          ),
+        )
+        .pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),
+          Effect.map((rows) =>
+            policies.every(({ feature, policyRevision }) =>
+              rows.some(
+                (row) =>
+                  row.moduleId === feature.moduleId &&
+                  row.active &&
+                  row.admitted === "present" &&
+                  row.policyRevision === policyRevision,
+              ),
+            ),
+          ),
+        );
 
-      yield* client.withTransaction(
-        Effect.gen(function* () {
-          if (dialect === "pg")
-            yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
-          for (const { feature, policy } of policies) {
-            const encoded = yield* Schema.encodeEffect(policyJson)(policy);
-
-            const policyRevision = digest(
-              yield* Schema.encodeEffect(seedJson)({
-                policy,
-                ...(feature.managementPolicy === undefined
-                  ? {}
-                  : { management: feature.managementPolicy }),
-              }),
-            );
-
-            const module = m.table("passkeyModules");
-            const columns = getTableColumns(module);
-
-            yield* native
-              .insert(module)
-              .values({ moduleId: feature.moduleId, active: true, policy: encoded, policyRevision })
-              .onConflictDoNothing();
-
-            const rows = yield* native
-              .select()
-              .from(module)
-              .where(eq(columns.moduleId, feature.moduleId));
-
-            const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);
-
-            if (!row.active)
-              return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);
-            if (row.policyRevision !== policyRevision) {
-              const previous = yield* Schema.decodeEffect(policyJson)(row.policy);
-
-              if (policy.generation <= previous.generation)
-                return yield* configurationError(
-                  `Increase the passkey policy generation to change ${feature.moduleId}`,
-                );
+      if (!configured)
+        yield* client.withTransaction(
+          Effect.gen(function* () {
+            if (dialect === "pg")
+              yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
+            for (const { feature, policy, encoded, policyRevision } of policies) {
               yield* native
-                .update(module)
-                .set({ policy: encoded, policyRevision })
-                .where(
-                  and(
-                    eq(columns.moduleId, feature.moduleId),
-                    eq(columns.policyRevision, row.policyRevision),
-                    eq(columns.active, true),
-                  ),
-                );
-
-              const updated = yield* native
+                .insert(module)
+                .values({
+                  moduleId: feature.moduleId,
+                  active: true,
+                  policy: encoded,
+                  policyRevision,
+                })
+                .onConflictDoNothing();
+
+              const rows = yield* native
                 .select()
                 .from(module)
                 .where(eq(columns.moduleId, feature.moduleId));
 
-              const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);
+              const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);
 
-              if (!applied.active || applied.policyRevision !== policyRevision)
-                return yield* configurationError(
-                  `Passkey policy changed while configuring ${feature.moduleId}`,
-                );
+              if (!row.active)
+                return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);
+              if (row.policyRevision !== policyRevision) {
+                const previous = yield* Schema.decodeEffect(policyJson)(row.policy);
+
+                if (policy.generation <= previous.generation)
+                  return yield* configurationError(
+                    `Increase the passkey policy generation to change ${feature.moduleId}`,
+                  );
+                yield* native
+                  .update(module)
+                  .set({ policy: encoded, policyRevision })
+                  .where(
+                    and(
+                      eq(columns.moduleId, feature.moduleId),
+                      eq(columns.policyRevision, row.policyRevision),
+                      eq(columns.active, true),
+                    ),
+                  );
+
+                const updated = yield* native
+                  .select()
+                  .from(module)
+                  .where(eq(columns.moduleId, feature.moduleId));
+
+                const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);
+
+                if (!applied.active || applied.policyRevision !== policyRevision)
+                  return yield* configurationError(
+                    `Passkey policy changed while configuring ${feature.moduleId}`,
+                  );
+              }
+              yield* native
+                .insert(m.table("passkeyAdmissions"))
+                .values({
+                  authorityScope: namespace,
+                  moduleId: feature.moduleId,
+                  version: policyRevision,
+                  ownerMarker: policyRevision,
+                })
+                .onConflictDoNothing();
             }
-            yield* native
-              .insert(m.table("passkeyAdmissions"))
-              .values({
-                authorityScope: namespace,
-                moduleId: feature.moduleId,
-                version: policyRevision,
-                ownerMarker: policyRevision,
-              })
-              .onConflictDoNothing();
-          }
-        }),
-      );
+          }),
+        );
 
       const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(
         m.read,

package/src/internal/persistence.ts

@@ -1,4 +1,3 @@
-import { digest, randomId } from "@yielded/auth-crypto";
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import type { PasskeyConfig } from "@yielded/auth/Passkey";
@@ -7,7 +6,7 @@ import { hooksLayer } from "@yielded/auth/Persistence";
 import { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
-import { Context, Effect, Layer, Schema } from "effect";
+import { Context, type Crypto, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 
 import {
@@ -27,6 +26,7 @@ import {
   type PasskeyRequirement,
   type MappingInput,
 } from "./configuration";
+import { randomId } from "./crypto";
 import { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from "./email-kernel";
 import { PersistenceMappingError } from "./mapping-error";
 import {
@@ -52,7 +52,11 @@ import {
   type StorageRole,
   type StorageTable,
 } from "./storage-tables";
-import { validateStorage } from "./storage-validation";
+import {
+  validateStorageBatch,
+  withStorageValidation,
+  type StorageValidation,
+} from "./storage-validation";
 import { makeTransactionExecutionKernel } from "./transaction-execution-kernel";
 import {
   makeTransactionKernel,
@@ -74,7 +78,12 @@ export interface Backend<T extends object, R> {
   }) => Effect.Effect<
     Context.Context<never>,
     PersistenceConfigurationError,
-    PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql
+    | PasskeyConfig
+    | LifecycleHooks
+    | SqlClient.SqlClient
+    | NativeDatabase
+    | CurrentProofSql
+    | Crypto.Crypto
   >;
 }
 
@@ -208,8 +217,10 @@ export const createPersistence = <T extends object, R>(
       if (idColumn === undefined || idColumn.type === "boolean")
         throw configError("Subject ID must map a text or integer column");
 
-      const prefix =
-        options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll("-", "_")}`;
+      const prefix = options.prefix;
+
+      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))
+        throw configError("Managed persistence requires an explicit SQL table prefix");
 
       const schema: Partial<Record<StorageRole, T>> = { ...options.tables };
 
@@ -310,6 +321,8 @@ export const createPersistence = <T extends object, R>(
           return yield* configError(
             "Persistence configuration belongs to a different Auth definition",
           );
+        const validations: StorageValidation[] = [];
+
         for (const role of roles) {
           const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
 
@@ -321,12 +334,14 @@ export const createPersistence = <T extends object, R>(
             if (columns[name] === undefined)
               return yield* configError(`Missing ${role}.${name} column`);
           }
-          yield* validateStorage(dialect, description, storageTables[role].unique);
+          validations.push({ table: description, required: storageTables[role].unique });
         }
-        yield* validateStorage(dialect, backend.describe(storage.subjects.table as T), [
-          [storage.subjects.id],
-        ]);
-        const mappings = makeMappings(storage);
+        validations.push({
+          table: backend.describe(storage.subjects.table as T),
+          required: [[storage.subjects.id]],
+        });
+        yield* validateStorageBatch(dialect, validations);
+        const mappings = yield* makeMappings(storage);
 
         const standalone = <E>(error: () => E) =>
           requireStandalone(error, client.transactionService);
@@ -564,6 +579,7 @@ export const createPersistence = <T extends object, R>(
             Context.Context<never>,
             PersistenceConfigurationError,
             | PasskeyRequirement<A>
+            | Crypto.Crypto
             | LifecycleHooks
             | SqlClient.SqlClient
             | NativeDatabase
@@ -582,6 +598,7 @@ export const createPersistence = <T extends object, R>(
         // The checked capability metadata above determines exactly these service keys.
         return context as Context.Context<Ports<C, Id, A>>;
       }).pipe(
+        withStorageValidation,
         Effect.mapError((error) =>
           Schema.is(PersistenceConfigurationError)(error)
             ? error

package/src/internal/phone-kernel.ts

@@ -1,4 +1,3 @@
-import { digest, randomId } from "@yielded/auth-crypto";
 import {
   PhoneCustody,
   PhoneCommandId,
@@ -14,6 +13,7 @@ import type { SubjectId } from "@yielded/auth/Schema";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import { Context, Effect, Option, Schema } from "effect";
 
+import { digest, randomId } from "./crypto";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 import type { SqlExpression as SQL } from "./query-operations";
 import type { QueryOperations, SqlFragment, SqlColumn } from "./query-operations";
@@ -100,7 +100,7 @@ export const makePhoneKernel = <
         moduleId: mapping.moduleId,
         record: value,
       }),
-      [mapping.state.version]: randomId(),
+      [mapping.state.version]: yield* randomId,
     };
 
     if (observed.rows.length === 0) {
@@ -128,7 +128,7 @@ export const makePhoneKernel = <
     mapping: any,
     phoneNumber: string,
   ) {
-    const key = scope(mapping.moduleId, "custody", phoneNumber),
+    const key = yield* scope(mapping.moduleId, "custody", phoneNumber),
       observation = yield* stateRead(mapping, key);
 
     const custody =
@@ -327,7 +327,7 @@ export const makePhoneKernel = <
       now = yield* owner.now(mapping),
       policy = mapping.admission;
 
-    const key = scope(mapping.moduleId, "admission", input.action + "/" + input.requestId),
+    const key = yield* scope(mapping.moduleId, "admission", input.action + "/" + input.requestId),
       receipt = yield* stateRead(mapping, key);
 
     if (receipt.rows.length !== 0) {
@@ -338,7 +338,7 @@ export const makePhoneKernel = <
 
       return (
         saved.fingerprint === input.fingerprint &&
-        saved.network === digest(input.networkKey) &&
+        saved.network === (yield* digest(input.networkKey)) &&
         saved.accepted === true &&
         saved.expiresAtMillis > now
       );
@@ -347,11 +347,20 @@ export const makePhoneKernel = <
     const window = Math.floor(now / policy.windowMillis),
       entries = [
         {
-          key: scope(mapping.moduleId, "network", input.action + "/" + digest(input.networkKey)),
+          key: yield* scope(
+            mapping.moduleId,
+            "network",
+            input.action + "/" + (yield* digest(input.networkKey)),
+          ),
           limit: input.action === "request" ? policy.networkRequests : policy.networkAttempts,
         },
         ...(input.action === "request"
-          ? [{ key: scope(mapping.moduleId, "messages", "global"), limit: policy.maximumMessages }]
+          ? [
+              {
+                key: yield* scope(mapping.moduleId, "messages", "global"),
+                limit: policy.maximumMessages,
+              },
+            ]
           : []),
       ].sort((a, b) => a.key.localeCompare(b.key));
 
@@ -383,7 +392,7 @@ export const makePhoneKernel = <
       key,
       {
         fingerprint: input.fingerprint,
-        network: digest(input.networkKey),
+        network: yield* digest(input.networkKey),
         accepted,
         expiresAtMillis: now + Math.min(policy.requestRetentionMillis, input.replayLifetimeMillis),
       },
@@ -446,7 +455,7 @@ export const makePhoneKernel = <
     )
       return { decision: rejected };
 
-    const commandKey = scope(mapping.moduleId, "command", input.commandId),
+    const commandKey = yield* scope(mapping.moduleId, "command", input.commandId),
       command = yield* stateRead(mapping, commandKey);
 
     if (command.rows.length !== 0) return { decision: rejected };
@@ -564,10 +573,10 @@ export const makePhoneKernel = <
           ? mapping.subjectIds.toSubject(mapping.subjectIds.allocate())
           : captured.target.revision!.subjectId,
       nativeId = mapping.subjectIds.toNative(subjectId),
-      securityRevision = SecurityRevision.make(randomId()),
-      credentialRevision = SecurityRevision.make(randomId()),
-      custodyRevision = SecurityRevision.make(randomId()),
-      credentialId = captured.target.custody?.credentialId ?? randomId();
+      securityRevision = SecurityRevision.make(yield* randomId),
+      credentialRevision = SecurityRevision.make(yield* randomId),
+      custodyRevision = SecurityRevision.make(yield* randomId),
+      credentialId = captured.target.custody?.credentialId ?? (yield* randomId);
 
     invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
 
@@ -647,12 +656,12 @@ export const makePhoneKernel = <
         yield* owner.update(
           i.table,
           { [i.namespace]: "phone", [i.value]: old.phoneNumber },
-          { [i.status]: i.encodeStatus(false), [i.revision]: randomId() },
+          { [i.status]: i.encodeStatus(false), [i.revision]: yield* randomId },
         );
         yield* owner.update(
           c.table,
           { [c.id]: old.credentialId, [c.subjectId]: nativeId },
-          { [c.status]: c.encodeStatus(false), [c.revision]: randomId() },
+          { [c.status]: c.encodeStatus(false), [c.revision]: yield* randomId },
         );
         yield* stateWrite(
           mapping,
@@ -660,8 +669,8 @@ export const makePhoneKernel = <
           {
             ...old,
             state: "retired",
-            custodyRevision: SecurityRevision.make(randomId()),
-            credentialRevision: SecurityRevision.make(randomId()),
+            custodyRevision: SecurityRevision.make(yield* randomId),
+            credentialRevision: SecurityRevision.make(yield* randomId),
           },
           captured.source.observation,
         );