@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/oauth/state.ts

@@ -1,15 +1,14 @@
 import {
-  type OAuthActionAuthorization,
   type OAuthAccountRevision,
   OAuthUnavailable,
   OAuthExternalIdentity,
   snapshotOAuthSync,
 } from "@yielded/auth/OAuth";
 import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import { Crypto, DateTime, Effect, Schema } from "effect";
+import { Crypto, Effect, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 
-import { digest, randomId } from "../crypto";
+import { randomId } from "../crypto";
 export { digest } from "../crypto";
 
 const encoder = new TextEncoder();
@@ -149,70 +148,3 @@ export const satisfies = (
       ),
   );
 };
-
-export const validAction = Effect.fnUntraced(function* (
-  authorization: OAuthActionAuthorization,
-  expected: {
-    readonly moduleId: string;
-    readonly action: OAuthActionAuthorization["challenge"]["action"];
-    readonly flowId: string;
-    readonly commandId: string;
-    readonly revision: OAuthAccountRevision;
-    readonly intent: string;
-  },
-  currentRequirement: AuthenticationRequirement,
-  now: number,
-  maximumAgeMillis: number,
-) {
-  const challenge = authorization.challenge;
-  const evidence = authorization.evidence;
-  const intentDigest = yield* digest(expected.intent);
-
-  const binding = yield* digest(
-    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.
-    JSON.stringify([
-      "effect-auth/oauth-action/v1",
-      expected.moduleId,
-      expected.action,
-      expected.flowId,
-      expected.commandId,
-      intentDigest,
-    ]),
-  );
-
-  if (
-    challenge.moduleId !== expected.moduleId ||
-    challenge.action !== expected.action ||
-    challenge.flowId !== expected.flowId ||
-    challenge.commandId !== expected.commandId ||
-    challenge.intentDigest !== intentDigest ||
-    challenge.bindingDigest !== binding ||
-    evidence.flowId !== expected.flowId ||
-    evidence.bindingDigest !== binding ||
-    !sameRevision(challenge.revision, expected.revision) ||
-    !sameRevision(evidence.revision, expected.revision)
-  )
-    return false;
-
-  const revisions = new Map(
-    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),
-  );
-
-  if (
-    evidence.proofs.some(
-      (proof) =>
-        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,
-    )
-  )
-    return false;
-
-  return [authorization.requirement, currentRequirement].every((requirement) => {
-    const fresh = evidence.proofs.filter((proof) => {
-      const age = now - DateTime.toEpochMillis(proof.verifiedAt);
-
-      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);
-    });
-
-    return satisfies(fresh, requirement);
-  });
-});

package/src/internal/passkey-actions.ts

@@ -0,0 +1,70 @@
+import * as M from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+
+import { digest } from "./crypto";
+
+export const passkeyCanonicalJson = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+) => {
+  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+
+  return {
+    encode: (value: S["Type"]) => Schema.encodeSync(codec)(M.snapshotPasskeySync(schema, value)),
+    decode: (text: unknown): S["Type"] => Schema.decodeUnknownSync(codec)(text),
+  };
+};
+
+export const passkeyDigest = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+  value: S["Type"],
+) => digest(passkeyCanonicalJson(schema).encode(value));
+
+export const passkeyEnrollmentDigest = (ceremony: M.PasskeyCeremony) => {
+  if (ceremony.context._tag !== "Enrollment") throw M.PasskeyUnavailable.make({});
+
+  return passkeyDigest(
+    Schema.Tuple([
+      M.PasskeyModuleId,
+      Schema.Literal("enrollment"),
+      Schema.Struct({ ...M.PasskeyBegin.fields, name: M.PasskeyLabel }),
+      M.PasskeyProfile,
+      M.PasskeyRevision,
+      M.PasskeyUserHandle,
+      Schema.Array(M.PasskeyDescriptor),
+    ]),
+    [
+      ceremony.moduleId,
+      "enrollment",
+      {
+        flowId: ceremony.flowId,
+        commandId: ceremony.commandId,
+        profileId: ceremony.profile.profileId,
+        name: ceremony.context.name,
+      },
+      ceremony.profile,
+      ceremony.context.revision,
+      ceremony.context.userHandle,
+      ceremony.allowedCredentials,
+    ],
+  );
+};
+
+export const passkeyRemoveDigest = (
+  moduleId: string,
+  commandId: string,
+  credential: M.PasskeyCredential,
+) =>
+  passkeyDigest(
+    Schema.Tuple([
+      M.PasskeyModuleId,
+      Schema.Literal("remove"),
+      M.PasskeyBegin.fields.commandId,
+      M.PasskeyCredential,
+    ]),
+    [
+      M.PasskeyModuleId.make(moduleId),
+      "remove",
+      M.PasskeyBegin.fields.commandId.make(commandId),
+      credential,
+    ],
+  );

package/src/internal/passkey-inputs.ts

@@ -0,0 +1,56 @@
+import * as M from "@yielded/auth/Passkey";
+import { CleanupLimit } from "@yielded/auth/Persistence";
+import { SubjectId } from "@yielded/auth/Schema";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { Schema } from "effect";
+const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };
+
+const identity = {
+  ...metadata,
+  commandId: M.PasskeyCommandId,
+  credentialId: M.PasskeyCredentialId,
+};
+
+export const passkeyOperationInputs = {
+  issue: Schema.Struct({ ceremony: M.PasskeyCeremony }),
+  context: M.PasskeyAccess,
+  consume: Schema.Struct({
+    access: M.PasskeyAccess,
+    ceremony: M.PasskeyCeremony,
+    credential: M.PasskeyCredential,
+    assertion: M.PasskeyAssertionVerified,
+  }),
+  cleanup: Schema.Struct({
+    moduleId: M.PasskeyModuleId,
+    limit: CleanupLimit,
+  }),
+  lookup: Schema.Struct({
+    rpId: M.PasskeyProfile.fields.rpId,
+    protocolCredentialId: M.PasskeyProtocolCredentialId,
+  }),
+  listForSubject: Schema.Struct({ ...metadata, rpId: M.PasskeyProfile.fields.rpId }),
+};
+
+export const passkeyManagementInputs = {
+  list: Schema.Struct({
+    ...metadata,
+    cursor: Schema.optionalKey(M.PasskeyCredentialId),
+    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),
+  }),
+  completeEnrollment: Schema.Struct({
+    access: M.PasskeyAccess,
+    ceremony: M.PasskeyCeremony,
+    verified: M.PasskeyRegistrationVerified,
+    management: M.PasskeyManagementPolicy,
+  }),
+  inspectRemove: Schema.Struct({ ...metadata, credentialId: M.PasskeyCredentialId }),
+  rename: Schema.Struct({ ...identity, name: M.PasskeyLabel }),
+  remove: Schema.Struct({
+    moduleId: M.PasskeyModuleId,
+    commandId: M.PasskeyCommandId,
+    credential: M.PasskeyCredential,
+    authorization: M.PasskeyActionAuthorization,
+    management: M.PasskeyManagementPolicy,
+    invalidation: SessionInvalidationWindow,
+  }),
+};

package/src/internal/passkey-managed.ts

@@ -0,0 +1,360 @@
+import * as M from "@yielded/auth/Passkey";
+import { Context, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
+
+import {
+  PersistenceConfigurationError,
+  type MappingInput,
+  type PasskeyFeature,
+} from "./configuration";
+import { PersistenceMappingError } from "./mapping-error";
+import {
+  requiredPasskeyCredentialConstraints,
+  requiredPasskeyPersistenceConstraints,
+} from "./models/passkey-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { makeNativePasskeyServices } from "./passkey-native";
+import type { PasskeyNativeMapping, PasskeyNativeRead } from "./passkey-native-state";
+import {
+  makePasskeyNativeManagement,
+  type NativePasskeyManagementMapping,
+} from "./passkey-native-write";
+import { anySqlCondition } from "./sql-change";
+import { storageTables, type StorageRole } from "./storage-tables";
+
+export interface ComposedPasskeyInput {
+  readonly storage: MappingInput;
+  readonly namespace: string;
+  readonly dialect: "pg" | "sqlite";
+  readonly features: ReadonlyArray<PasskeyFeature>;
+  readonly passwordModules: ReadonlyArray<string>;
+}
+
+const profileJson = Schema.fromJsonString(M.PasskeyProfile);
+
+const credentialData = M.PasskeyCredential.mapFields(
+  ({ revision: _revision, active: _active, requirement: _requirement, ...fields }) => fields,
+);
+
+const configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });
+
+const mappings = Effect.fnUntraced(function* (
+  storage: MappingInput,
+  tables: NativeSqlTables,
+  passwordModules: ReadonlyArray<string>,
+  signInProfiles: ReadonlyArray<M.PasskeyProfile>,
+) {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+
+  const table = (role: StorageRole) => {
+    const value = storage.tables[role];
+
+    if (value === undefined) throw configurationError(`Missing ${role} mapping`);
+
+    return value;
+  };
+
+  const mapped = <Role extends StorageRole>(role: Role) => ({
+    table: table(role),
+    // Managed storage validation owns these physical column keys.
+    ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {
+      readonly [Key in keyof (typeof storageTables)[Role]["columns"]]: Key;
+    }),
+  });
+
+  const t = (role: StorageRole) => tables(table(role));
+
+  const eq = (role: StorageRole, key: string, value: unknown) =>
+    sql`${t(role).column(key)} = ${t(role).value(key, value)}`;
+
+  const s = storage.subjects;
+  const subject = tables(s.table);
+  const active = (value: unknown) => value === true;
+
+  const read: PasskeyNativeRead = {
+    subject: {
+      table: s.table,
+      id: s.id,
+      status: s.status,
+      securityRevision: s.securityRevision,
+      decodeId: (row) => row[s.id],
+      decodeRequirement: s.requirements,
+      isActiveStatus: (value) => Object.is(value, s.activeValue),
+      activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`,
+    },
+    credential: {
+      ...mapped("passkeyCredentials"),
+      status: "active",
+      decode: (row) =>
+        Schema.decodeUnknownSync(credentialData)({
+          ...row,
+          profile: Schema.decodeUnknownSync(profileJson)(row.profile),
+        }),
+      decodeSubjectId: (row) => row.subjectId,
+      isActiveStatus: active,
+      activeCondition: eq("passkeyCredentials", "active", true),
+    },
+    authority: {
+      ...mapped("credentials"),
+      status: "active",
+      isActiveStatus: active,
+      activeCondition: eq("credentials", "active", true),
+    },
+    subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },
+    constraints: requiredPasskeyCredentialConstraints,
+  };
+
+  const base = (feature: PasskeyFeature): PasskeyNativeMapping => ({
+    moduleId: feature.moduleId,
+    read,
+    flow: { ...mapped("passkeyFlows"), encodeInsert: () => ({}) },
+    clock: {
+      encodeInstant: storage.encodeInstant,
+      decodeInstant: storage.decodeInstantSync,
+      engineNowMillis: sql.onDialectOrElse({
+        pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,
+        orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,
+      }),
+      toMillis: (expression: Fragment) => expression,
+      fromMillis: (expression: Fragment) => expression,
+    },
+    telemetry: {
+      lastUsedAt: "lastUsedAt",
+      encodeBackupEligible: (value) => value,
+      encodeBackupState: (value) => value,
+    },
+    constraints: requiredPasskeyPersistenceConstraints,
+  });
+
+  const metadata = (nativeId: unknown) =>
+    sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} and ${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)})`;
+
+  const management = (feature: PasskeyFeature): NativePasskeyManagementMapping => {
+    const policy = feature.managementPolicy;
+
+    if (policy === undefined)
+      throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);
+
+    const c = t("passkeyCredentials"),
+      f = t("credentials");
+
+    return {
+      ...base(feature),
+      write: {
+        credential: {
+          name: "name",
+          createdAt: "createdAt",
+          encodeInsert: ({ credential, subjectId, summary, marker }) => ({
+            credentialId: credential.credentialId,
+            subjectId,
+            rpId: credential.rpId,
+            protocolCredentialId: credential.protocolCredentialId,
+            userHandle: credential.userHandle,
+            credentialKey: "",
+            publicKey: credential.publicKey,
+            algorithm: credential.algorithm,
+            profile: Schema.encodeSync(profileJson)(credential.profile),
+            credentialRevision: marker,
+            active: true,
+            primarySignIn: credential.primarySignIn,
+            enrollmentUserVerified: credential.enrollmentUserVerified,
+            backupEligible: credential.backupEligible,
+            backupState: credential.backupState,
+            counter: credential.counter,
+            name: summary.name,
+            createdAt: storage.encodeInstant(summary.createdAtMillis),
+          }),
+          encodePrimarySignIn: (value) => value,
+          encodeEnrollmentUserVerified: (value) => value,
+          encodeBackupEligible: (value) => value,
+          activeStatus: true,
+          removedStatus: false,
+        },
+        authority: {
+          encodeInsert: ({ subjectId, credential, marker }) => ({
+            subjectId,
+            credentialId: credential.credentialId,
+            revision: marker,
+            active: true,
+          }),
+          activeStatus: true,
+          removedStatus: false,
+        },
+        policy: {
+          subjectColumns: subject.keys,
+          management: () => policy,
+          requirement: s.actionRequirements,
+          metadata,
+          action: metadata,
+          remainingSignIn: (nativeId, excluded, row) =>
+            Effect.gen(function* () {
+              const requirement = yield* Schema.decodeEffect(M.PasskeyRequirement)(
+                yield* s.requirements(row),
+              );
+
+              const alternatives: Fragment[] = [];
+
+              if (
+                requirement.alternatives.some(
+                  (alternative) =>
+                    alternative.minimumCredentials === 1 &&
+                    alternative.factors.every((factor) => factor === "possession"),
+                )
+              ) {
+                alternatives.push(sql`exists(select 1 from ${c.name} join ${f.name} on ${f.column("credentialId")} = ${c.column("credentialId")} and ${f.column("subjectId")} = ${f.value("subjectId", nativeId)} and ${f.column("revision")} = ${c.column("credentialRevision")} and ${eq("credentials", "active", true)}
+                where ${eq("passkeyCredentials", "subjectId", nativeId)} and ${c.column("credentialId")} <> ${c.value("credentialId", excluded)} and ${eq("passkeyCredentials", "active", true)} and ${eq("passkeyCredentials", "primarySignIn", true)} and ${eq("passkeyCredentials", "enrollmentUserVerified", true)} and ${anySqlCondition(
+                  signInProfiles.map((profile) => eq("passkeyCredentials", "rpId", profile.rpId)),
+                )})`);
+              }
+              if (
+                passwordModules.length > 0 &&
+                requirement.alternatives.some(
+                  (alternative) =>
+                    alternative.minimumCredentials === 1 &&
+                    !alternative.userVerified &&
+                    !alternative.phishingResistant &&
+                    alternative.factors.every((factor) => factor === "knowledge"),
+                )
+              ) {
+                const p = t("passwords"),
+                  i = t("identifiers");
+
+                alternatives.push(sql`exists(select 1 from ${p.name} join ${f.name} on ${f.column("credentialId")} = ${p.column("credentialId")} and ${f.column("subjectId")} = ${f.value("subjectId", nativeId)} and ${f.column("revision")} = ${p.column("credentialRevision")} and ${eq("credentials", "active", true)}
+                join ${i.name} on ${eq("identifiers", "subjectId", nativeId)} and ${eq("identifiers", "active", true)} and ${eq("identifiers", "namespace", "email")}
+                where ${eq("passwords", "subjectId", nativeId)} and ${p.column("credentialId")} <> ${p.value("credentialId", excluded)} and ${anySqlCondition(
+                  passwordModules.map((module) => eq("passwords", "moduleId", module)),
+                )})`);
+              }
+
+              return anySqlCondition(alternatives);
+            }).pipe(
+              Effect.mapError((cause) =>
+                PersistenceMappingError.make({ operation: "mapping", cause }),
+              ),
+            ),
+        },
+      },
+      invalidation: {
+        window: {
+          trigger: "credential-change",
+          existingSessions: "immediate",
+          maximumExposureMillis: 0,
+          oldAuthenticationEvidence: "rejected",
+        },
+        mutations: [],
+        postcondition: ({ subjectId, securityRevision }) =>
+          sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, subjectId)} and ${subject.column(s.securityRevision)} = ${subject.value(s.securityRevision, securityRevision)})`,
+      },
+    };
+  };
+
+  return { base, management };
+});
+
+/** Managed and mapped tables feed the same native passkey statements. */
+export const makeManagedPasskeys = Effect.fnUntraced(
+  function* (input: ComposedPasskeyInput, tables: NativeSqlTables) {
+    const policies = yield* Effect.forEach(input.features, (feature) =>
+      Effect.map(feature.policy, (policy) => ({ feature, policy })),
+    );
+
+    const mapping = yield* mappings(
+      input.storage,
+      tables,
+      input.passwordModules,
+      policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),
+    );
+
+    const services = new Map<
+      string,
+      Effect.Success<ReturnType<typeof makeNativePasskeyServices>>
+    >();
+
+    const managers = new Map<string, M.PasskeyManagementPersistence["Service"]>();
+
+    for (const feature of input.features) {
+      const selected = feature.management ? mapping.management(feature) : mapping.base(feature);
+      const base = yield* makeNativePasskeyServices(tables, selected);
+
+      services.set(feature.moduleId, base);
+      if (feature.management)
+        managers.set(
+          feature.moduleId,
+          makePasskeyNativeManagement(base, mapping.management(feature))
+            .passkeyManagementPersistence,
+        );
+    }
+
+    const service = (moduleId: string) => {
+      const value = services.get(moduleId);
+
+      return value === undefined
+        ? Effect.fail(M.PasskeyUnavailable.make({}))
+        : Effect.succeed(value);
+    };
+
+    const manager = (moduleId: string) => {
+      const value = managers.get(moduleId);
+
+      return value === undefined
+        ? Effect.fail(M.PasskeyUnavailable.make({}))
+        : Effect.succeed(value);
+    };
+
+    const first = services.values().next().value;
+
+    if (first === undefined) return yield* configurationError("A passkey module is required");
+
+    let context: Context.Context<never> = Context.make(M.PasskeyCredentials, {
+      lookup: (input) => first.passkeyCredentials.lookup(input),
+      listForSubject: (input) =>
+        Effect.flatMap(service(input.moduleId), (value) =>
+          value.passkeyCredentials.listForSubject(input),
+        ),
+    }).pipe(
+      Context.add(M.PasskeyPersistence, {
+        issue: (input, prepare) =>
+          Effect.flatMap(service(input.ceremony.moduleId), (value) =>
+            value.passkeyPersistence.issue(input, prepare),
+          ),
+        context: (input) =>
+          Effect.flatMap(service(input.moduleId), (value) =>
+            value.passkeyPersistence.context(input),
+          ),
+        consume: (input, prepare) =>
+          Effect.flatMap(service(input.access.moduleId), (value) =>
+            value.passkeyPersistence.consume(input, prepare),
+          ),
+        cleanup: (input, prepare) =>
+          Effect.flatMap(service(input.moduleId), (value) =>
+            value.passkeyPersistence.cleanup(input, prepare),
+          ),
+      }),
+    );
+
+    if (managers.size > 0)
+      context = context.pipe(
+        Context.add(M.PasskeyManagementPersistence, {
+          completeEnrollment: (input, prepare) =>
+            Effect.flatMap(manager(input.ceremony.moduleId), (value) =>
+              value.completeEnrollment(input, prepare),
+            ),
+          list: (input) => Effect.flatMap(manager(input.moduleId), (value) => value.list(input)),
+          inspectRemove: (input) =>
+            Effect.flatMap(manager(input.moduleId), (value) => value.inspectRemove(input)),
+          rename: (input, prepare) =>
+            Effect.flatMap(manager(input.moduleId), (value) => value.rename(input, prepare)),
+          remove: (input, prepare) =>
+            Effect.flatMap(manager(input.moduleId), (value) => value.remove(input, prepare)),
+        }),
+      );
+
+    return context;
+  },
+  Effect.mapError((error) =>
+    Schema.is(PersistenceConfigurationError)(error)
+      ? error
+      : configurationError("Unable to configure passkey persistence"),
+  ),
+);

package/src/internal/passkey-native-ceremony.ts

@@ -0,0 +1,66 @@
+import * as M from "@yielded/auth/Passkey";
+import { Effect } from "effect";
+
+import type { PasskeyCeremonyMapping } from "./models/passkey-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { passkeyOperationInputs } from "./passkey-inputs";
+import { preparePasskeyNative } from "./passkey-native";
+import { makePasskeyNativeFlow } from "./passkey-native-flow";
+import { passkeyNativeInvariant } from "./passkey-native-state";
+import { makeSqlCommitExecutor, SqlBatchCommit } from "./sql-commit";
+import type { TableModel } from "./table-model";
+
+// Physical SQL expressions are validated by the table compiler.
+// oxlint-disable-next-line no-explicit-any
+export type NativePasskeyCeremonyMapping = PasskeyCeremonyMapping<TableModel, any>;
+
+export const makeNativePasskeyCeremonyServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: NativePasskeyCeremonyMapping,
+  batch?: SqlBatchCommit["Service"],
+) {
+  const flow = yield* makePasskeyNativeFlow(tables, mapping);
+  const executor = yield* makeSqlCommitExecutor(() => M.PasskeyUnavailable.make({}));
+
+  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    batch === undefined
+      ? executor.run(effect, "statement")
+      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const passkeyPersistence: M.PasskeyPersistence["Service"] = {
+    issue: () => Effect.fail(M.PasskeyUnavailable.make({})),
+    consume: () => Effect.fail(M.PasskeyUnavailable.make({})),
+    context: (access) =>
+      executor.read(
+        Effect.suspend(() => {
+          const input = M.snapshotPasskeySync(M.PasskeyAccess, access);
+
+          passkeyNativeInvariant(input.purpose === "registration");
+
+          return flow.context(input);
+        }),
+      ),
+    cleanup: (original, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);
+
+          passkeyNativeInvariant(flow.validModule(input.moduleId));
+
+          return yield* preparePasskeyNative(
+            yield* flow.cleanup(input.moduleId, input.limit, batch !== undefined),
+            prepare,
+          );
+        }),
+      ),
+  };
+
+  return {
+    passkeyPersistence,
+    capabilities: {
+      purposes: ["registration"] as const,
+      issue: "registration-authority" as const,
+      assertionConsumption: false as const,
+    },
+  };
+});