@yielded/auth-react-native 0.1.0-beta.12

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel van der Merwe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @yielded/auth-react-native
+
+Client-local iOS passkey registration, authentication, and capability checks for
+`@yielded/auth`. Import `* as ReactNativePasskey` from this package and construct
+the adapter with `ReactNativePasskey.make()`, or provide `ReactNativePasskey.layer`.
+
+Install this package and its `react-native` and `react-native-passkey` peers only
+in the native application. `@yielded/auth` does not depend on React Native or
+this adapter. The adapter consumes core's public passkey schemas and returns the
+same flow IDs and redacted completion responses as the browser adapter.
+
+Applications own begin → prompt → complete, HTTP, binding, persistence, sessions,
+and associated domains. Registration creates ES256 platform passkeys; authentication
+also supports existing security-key credentials. iOS 16+ is supported; Android and
+conditional mediation are unsupported. Interruption discards delivery but cannot dismiss the system
+prompt, and the shared busy guard stays held until the native promise settles.
+
+See the [iOS setup guide](../../docs/src/content/docs/guide/passkeys.md#prompt-in-an-ios-react-native-app)
+and [API reference](../../docs/src/content/docs/reference/passkey-react-native.md).

package/dist/index.d.mts

@@ -0,0 +1,4 @@
+import { PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported } from "./internal/models.mjs";
+import { PasskeyReactNative } from "./internal/PasskeyReactNative.mjs";
+import { layer, make } from "./internal/react-native-passkey.mjs";
+export { PasskeyReactNative, PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported, layer, make };

package/dist/index.mjs

@@ -0,0 +1,4 @@
+import { PasskeyReactNative } from "./internal/PasskeyReactNative.mjs";
+import { PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported } from "./internal/models.mjs";
+import { layer, make } from "./internal/react-native-passkey.mjs";
+export { PasskeyReactNative, PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported, layer, make };

package/dist/internal/PasskeyReactNative.d.mts

@@ -0,0 +1,21 @@
+import { PasskeyReactNativeAuthentication, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable } from "./models.mjs";
+import { Context, Effect } from "effect";
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from "@yielded/auth/Passkey";
+//#region src/internal/PasskeyReactNative.d.ts
+declare const PasskeyReactNative_base: Context.ServiceClass<PasskeyReactNative, "effect-auth/PasskeyReactNative", {
+  readonly capabilities: Effect.Effect<PasskeyReactNativeCapabilities, PasskeyReactNativeUnavailable>;
+  /** Registers a platform passkey; requested algorithms must include ES256 (-7). */
+  readonly register: (started: typeof PasskeyRegistrationStarted.Type) => Effect.Effect<PasskeyReactNativeRegistration, PasskeyReactNativeFailure>;
+  /** Conditional mediation is accepted for port compatibility but fails Unsupported. */
+  readonly authenticate: (input: {
+    readonly started: typeof PasskeyAuthenticationStarted.Type;
+    readonly mediation: "required" | "conditional";
+  }) => Effect.Effect<PasskeyReactNativeAuthentication, PasskeyReactNativeFailure>;
+}>;
+/** Client-local iOS ceremonies. Applications own Begin/Complete and request binding.
+ * Interruption stops delivery, but cannot dismiss OS UI. A started native request
+ * retains the shared busy guard until its promise settles, even after interruption.
+ * The calling fiber owns failure diagnostics; late settlement only clears the guard. */
+export declare class PasskeyReactNative extends PasskeyReactNative_base {}
+//#endregion
+//# sourceMappingURL=PasskeyReactNative.d.mts.map

package/dist/internal/PasskeyReactNative.mjs

@@ -0,0 +1,11 @@
+import { Context } from "effect";
+//#region src/internal/PasskeyReactNative.ts
+/** Client-local iOS ceremonies. Applications own Begin/Complete and request binding.
+* Interruption stops delivery, but cannot dismiss OS UI. A started native request
+* retains the shared busy guard until its promise settles, even after interruption.
+* The calling fiber owns failure diagnostics; late settlement only clears the guard. */
+var PasskeyReactNative = class extends Context.Service()("effect-auth/PasskeyReactNative") {};
+//#endregion
+export { PasskeyReactNative };
+
+//# sourceMappingURL=PasskeyReactNative.mjs.map

package/dist/internal/PasskeyReactNative.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyReactNative.mjs","names":[],"sources":["../../src/internal/PasskeyReactNative.ts"],"sourcesContent":["import type {\n  PasskeyAuthenticationStarted,\n  PasskeyRegistrationStarted,\n} from \"@yielded/auth/Passkey\";\nimport { Context, type Effect } from \"effect\";\n\nimport type {\n  PasskeyReactNativeAuthentication,\n  PasskeyReactNativeCapabilities,\n  PasskeyReactNativeFailure,\n  PasskeyReactNativeRegistration,\n  PasskeyReactNativeUnavailable,\n} from \"./models\";\n\n/** Client-local iOS ceremonies. Applications own Begin/Complete and request binding.\n * Interruption stops delivery, but cannot dismiss OS UI. A started native request\n * retains the shared busy guard until its promise settles, even after interruption.\n * The calling fiber owns failure diagnostics; late settlement only clears the guard. */\nexport class PasskeyReactNative extends Context.Service<\n  PasskeyReactNative,\n  {\n    readonly capabilities: Effect.Effect<\n      PasskeyReactNativeCapabilities,\n      PasskeyReactNativeUnavailable\n    >;\n    /** Registers a platform passkey; requested algorithms must include ES256 (-7). */\n    readonly register: (\n      started: typeof PasskeyRegistrationStarted.Type,\n    ) => Effect.Effect<PasskeyReactNativeRegistration, PasskeyReactNativeFailure>;\n    /** Conditional mediation is accepted for port compatibility but fails Unsupported. */\n    readonly authenticate: (input: {\n      readonly started: typeof PasskeyAuthenticationStarted.Type;\n      readonly mediation: \"required\" | \"conditional\";\n    }) => Effect.Effect<PasskeyReactNativeAuthentication, PasskeyReactNativeFailure>;\n  }\n>()(\"effect-auth/PasskeyReactNative\") {}\n"],"mappings":";;;;;;AAkBA,IAAa,qBAAb,cAAwC,QAAQ,QAiB9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/internal/models.d.mts

@@ -0,0 +1,39 @@
+import { Schema } from "effect";
+//#region src/internal/models.d.ts
+/** OS availability only; does not attest to entitlements, linking, or a saved key. */
+export declare const PasskeyReactNativeCapabilities: Schema.Struct<{
+  readonly supported: Schema.Boolean;
+  readonly conditionalGet: Schema.Literal<"unsupported">;
+  readonly cancellation: Schema.Literal<"unsupported">;
+}>;
+export type PasskeyReactNativeCapabilities = typeof PasskeyReactNativeCapabilities.Type;
+export declare const PasskeyReactNativeRegistration: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+export type PasskeyReactNativeRegistration = typeof PasskeyReactNativeRegistration.Type;
+export declare const PasskeyReactNativeAuthentication: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+export type PasskeyReactNativeAuthentication = typeof PasskeyReactNativeAuthentication.Type;
+declare const PasskeyReactNativeInputRejected_base: Schema.Class<PasskeyReactNativeInputRejected, Schema.TaggedStruct<"PasskeyReactNativeInputRejected", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyReactNativeInputRejected extends PasskeyReactNativeInputRejected_base {}
+declare const PasskeyReactNativeUnsupported_base: Schema.Class<PasskeyReactNativeUnsupported, Schema.TaggedStruct<"PasskeyReactNativeUnsupported", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyReactNativeUnsupported extends PasskeyReactNativeUnsupported_base {}
+declare const PasskeyReactNativeBusy_base: Schema.Class<PasskeyReactNativeBusy, Schema.TaggedStruct<"PasskeyReactNativeBusy", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyReactNativeBusy extends PasskeyReactNativeBusy_base {}
+declare const PasskeyReactNativeNotCompleted_base: Schema.Class<PasskeyReactNativeNotCompleted, Schema.TaggedStruct<"PasskeyReactNativeNotCompleted", {
+  readonly reason: Schema.Literals<readonly ["cancelled", "no-credentials", "credential-exists", "interrupted", "timed-out", "request-failed"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A local outcome, never evidence that a credential was not created. */
+export declare class PasskeyReactNativeNotCompleted extends PasskeyReactNativeNotCompleted_base {}
+declare const PasskeyReactNativeInvalidResponse_base: Schema.Class<PasskeyReactNativeInvalidResponse, Schema.TaggedStruct<"PasskeyReactNativeInvalidResponse", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyReactNativeInvalidResponse extends PasskeyReactNativeInvalidResponse_base {}
+declare const PasskeyReactNativeUnavailable_base: Schema.Class<PasskeyReactNativeUnavailable, Schema.TaggedStruct<"PasskeyReactNativeUnavailable", {}>, import("effect/Cause").YieldableError>;
+/** Configuration failures, native defects, and unrecognized failures; no native message/cause. */
+export declare class PasskeyReactNativeUnavailable extends PasskeyReactNativeUnavailable_base {}
+export declare const PasskeyReactNativeFailure: Schema.Union<readonly [typeof PasskeyReactNativeInputRejected, typeof PasskeyReactNativeUnsupported, typeof PasskeyReactNativeBusy, typeof PasskeyReactNativeNotCompleted, typeof PasskeyReactNativeInvalidResponse, typeof PasskeyReactNativeUnavailable]>;
+export type PasskeyReactNativeFailure = typeof PasskeyReactNativeFailure.Type;
+//#endregion
+//# sourceMappingURL=models.d.mts.map

package/dist/internal/models.mjs

@@ -0,0 +1,44 @@
+import { Schema } from "effect";
+import { PasskeyAssertion, PasskeyAttestation, PasskeyAuthenticationStarted } from "@yielded/auth/Passkey";
+//#region src/internal/models.ts
+/** OS availability only; does not attest to entitlements, linking, or a saved key. */
+const PasskeyReactNativeCapabilities = Schema.Struct({
+	supported: Schema.Boolean,
+	conditionalGet: Schema.Literal("unsupported"),
+	cancellation: Schema.Literal("unsupported")
+});
+const PasskeyReactNativeRegistration = Schema.Struct({
+	flowId: PasskeyAuthenticationStarted.fields.flowId,
+	response: PasskeyAttestation
+});
+const PasskeyReactNativeAuthentication = Schema.Struct({
+	flowId: PasskeyAuthenticationStarted.fields.flowId,
+	response: PasskeyAssertion
+});
+var PasskeyReactNativeInputRejected = class extends Schema.TaggedError()("PasskeyReactNativeInputRejected", {}) {};
+var PasskeyReactNativeUnsupported = class extends Schema.TaggedError()("PasskeyReactNativeUnsupported", {}) {};
+var PasskeyReactNativeBusy = class extends Schema.TaggedError()("PasskeyReactNativeBusy", {}) {};
+/** A local outcome, never evidence that a credential was not created. */
+var PasskeyReactNativeNotCompleted = class extends Schema.TaggedError()("PasskeyReactNativeNotCompleted", { reason: Schema.Literals([
+	"cancelled",
+	"no-credentials",
+	"credential-exists",
+	"interrupted",
+	"timed-out",
+	"request-failed"
+]) }) {};
+var PasskeyReactNativeInvalidResponse = class extends Schema.TaggedError()("PasskeyReactNativeInvalidResponse", {}) {};
+/** Configuration failures, native defects, and unrecognized failures; no native message/cause. */
+var PasskeyReactNativeUnavailable = class extends Schema.TaggedError()("PasskeyReactNativeUnavailable", {}) {};
+const PasskeyReactNativeFailure = Schema.Union([
+	PasskeyReactNativeInputRejected,
+	PasskeyReactNativeUnsupported,
+	PasskeyReactNativeBusy,
+	PasskeyReactNativeNotCompleted,
+	PasskeyReactNativeInvalidResponse,
+	PasskeyReactNativeUnavailable
+]);
+//#endregion
+export { PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeCapabilities, PasskeyReactNativeFailure, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported };
+
+//# sourceMappingURL=models.mjs.map

package/dist/internal/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/internal/models.ts"],"sourcesContent":["import {\n  PasskeyAssertion,\n  PasskeyAttestation,\n  PasskeyAuthenticationStarted,\n} from \"@yielded/auth/Passkey\";\nimport { Schema } from \"effect\";\n\n/** OS availability only; does not attest to entitlements, linking, or a saved key. */\nexport const PasskeyReactNativeCapabilities = Schema.Struct({\n  supported: Schema.Boolean,\n  conditionalGet: Schema.Literal(\"unsupported\"),\n  cancellation: Schema.Literal(\"unsupported\"),\n});\n\nexport type PasskeyReactNativeCapabilities = typeof PasskeyReactNativeCapabilities.Type;\n\nexport const PasskeyReactNativeRegistration = Schema.Struct({\n  flowId: PasskeyAuthenticationStarted.fields.flowId,\n  response: PasskeyAttestation,\n});\n\nexport type PasskeyReactNativeRegistration = typeof PasskeyReactNativeRegistration.Type;\n\nexport const PasskeyReactNativeAuthentication = Schema.Struct({\n  flowId: PasskeyAuthenticationStarted.fields.flowId,\n  response: PasskeyAssertion,\n});\n\nexport type PasskeyReactNativeAuthentication = typeof PasskeyReactNativeAuthentication.Type;\n\nexport class PasskeyReactNativeInputRejected extends Schema.TaggedError<PasskeyReactNativeInputRejected>()(\n  \"PasskeyReactNativeInputRejected\",\n  {},\n) {}\n\nexport class PasskeyReactNativeUnsupported extends Schema.TaggedError<PasskeyReactNativeUnsupported>()(\n  \"PasskeyReactNativeUnsupported\",\n  {},\n) {}\n\nexport class PasskeyReactNativeBusy extends Schema.TaggedError<PasskeyReactNativeBusy>()(\n  \"PasskeyReactNativeBusy\",\n  {},\n) {}\n\n/** A local outcome, never evidence that a credential was not created. */\nexport class PasskeyReactNativeNotCompleted extends Schema.TaggedError<PasskeyReactNativeNotCompleted>()(\n  \"PasskeyReactNativeNotCompleted\",\n  {\n    reason: Schema.Literals([\n      \"cancelled\",\n      \"no-credentials\",\n      \"credential-exists\",\n      \"interrupted\",\n      \"timed-out\",\n      \"request-failed\",\n    ]),\n  },\n) {}\n\nexport class PasskeyReactNativeInvalidResponse extends Schema.TaggedError<PasskeyReactNativeInvalidResponse>()(\n  \"PasskeyReactNativeInvalidResponse\",\n  {},\n) {}\n\n/** Configuration failures, native defects, and unrecognized failures; no native message/cause. */\nexport class PasskeyReactNativeUnavailable extends Schema.TaggedError<PasskeyReactNativeUnavailable>()(\n  \"PasskeyReactNativeUnavailable\",\n  {},\n) {}\n\nexport const PasskeyReactNativeFailure = Schema.Union([\n  PasskeyReactNativeInputRejected,\n  PasskeyReactNativeUnsupported,\n  PasskeyReactNativeBusy,\n  PasskeyReactNativeNotCompleted,\n  PasskeyReactNativeInvalidResponse,\n  PasskeyReactNativeUnavailable,\n]);\n\nexport type PasskeyReactNativeFailure = typeof PasskeyReactNativeFailure.Type;\n"],"mappings":";;;;AAQA,MAAa,iCAAiC,OAAO,OAAO;CAC1D,WAAW,OAAO;CAClB,gBAAgB,OAAO,QAAQ,aAAa;CAC5C,cAAc,OAAO,QAAQ,aAAa;AAC5C,CAAC;AAID,MAAa,iCAAiC,OAAO,OAAO;CAC1D,QAAQ,6BAA6B,OAAO;CAC5C,UAAU;AACZ,CAAC;AAID,MAAa,mCAAmC,OAAO,OAAO;CAC5D,QAAQ,6BAA6B,OAAO;CAC5C,UAAU;AACZ,CAAC;AAID,IAAa,kCAAb,cAAqD,OAAO,YAA6C,CAAC,CACxG,mCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,oCAAb,cAAuD,OAAO,YAA+C,CAAC,CAC5G,qCACA,CAAC,CACH,CAAC,CAAC,CAAC;;AAGH,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,4BAA4B,OAAO,MAAM;CACpD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/internal/react-native-passkey.d.mts

@@ -0,0 +1,9 @@
+import { PasskeyReactNative } from "./PasskeyReactNative.mjs";
+import { Effect, Layer } from "effect";
+//#region src/internal/react-native-passkey.d.ts
+type Native = PasskeyReactNative["Service"];
+/** Creates the iOS adapter. Ceremonies own their scopes; construction performs no native I/O. */
+export declare const make: () => Effect.Effect<Native>;
+export declare const layer: Layer.Layer<PasskeyReactNative>;
+//#endregion
+//# sourceMappingURL=react-native-passkey.d.mts.map

package/dist/internal/react-native-passkey.mjs

@@ -0,0 +1,200 @@
+import { PasskeyReactNative } from "./PasskeyReactNative.mjs";
+import { PasskeyReactNativeAuthentication, PasskeyReactNativeBusy, PasskeyReactNativeInputRejected, PasskeyReactNativeInvalidResponse, PasskeyReactNativeNotCompleted, PasskeyReactNativeRegistration, PasskeyReactNativeUnavailable, PasskeyReactNativeUnsupported } from "./models.mjs";
+import { authenticationWire, nativeAuthentication, nativeRegistration, registrationWire } from "./wire.mjs";
+import { Cause, DateTime, Effect, Layer, Predicate, Redacted, Schema } from "effect";
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted, snapshotPasskey } from "@yielded/auth/Passkey";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+import { Platform } from "react-native";
+import { Passkey } from "react-native-passkey";
+//#region src/internal/react-native-passkey.ts
+const unavailable = () => new PasskeyReactNativeUnavailable({});
+const rejected = () => new PasskeyReactNativeInputRejected({});
+const invalid = () => new PasskeyReactNativeInvalidResponse({});
+const timedOut = () => new PasskeyReactNativeNotCompleted({ reason: "timed-out" });
+const redactDefects = (failure) => (effect) => effect.pipe(Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-react-native", cause).pipe(Effect.andThen(Effect.fail(failure()))) : Effect.failCause(cause)));
+const unexpected = redactDefects(unavailable);
+const timeout = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 3e5
+}));
+const registrationInput = Schema.Struct({
+	...PasskeyRegistrationStarted.fields,
+	options: Schema.Struct({
+		...PasskeyRegistrationStarted.fields.options.fields,
+		timeout
+	})
+});
+const authenticationInput = Schema.Struct({
+	started: Schema.Struct({
+		...PasskeyAuthenticationStarted.fields,
+		options: Schema.Struct({
+			...PasskeyAuthenticationStarted.fields.options.fields,
+			timeout
+		})
+	}),
+	mediation: Schema.Literals(["required", "conditional"])
+});
+const environment = Effect.sync(() => {
+	if (Platform.OS !== "ios") return {
+		supported: false,
+		exclusions: false
+	};
+	const [major = 0, minor = 0] = Schema.decodeUnknownSync(Schema.String.check(Schema.isPattern(/^\d+(?:\.\d+){0,2}$/)))(Platform.Version).split(".").map(Number);
+	const supported = Schema.decodeUnknownSync(Schema.Boolean)(Passkey.isSupported());
+	return {
+		supported: major >= 16 && supported,
+		exclusions: major > 17 || major === 17 && minor >= 4
+	};
+}).pipe(unexpected);
+let activeLease;
+const settle = (lease) => {
+	lease.phase = "settled";
+	if (activeLease === lease) activeLease = void 0;
+};
+const acquire = Effect.gen(function* () {
+	if (activeLease !== void 0) return yield* new PasskeyReactNativeBusy({});
+	const lease = {
+		phase: "pre-native",
+		listening: true
+	};
+	activeLease = lease;
+	return lease;
+});
+const release = (lease) => Effect.sync(() => {
+	lease.listening = false;
+	if (lease.phase === "pre-native") settle(lease);
+});
+const nativeFailure = (value) => Effect.suspend(() => {
+	if (!Predicate.isObject(value)) return Effect.die(value);
+	const code = Schema.decodeUnknownOption(Schema.String)(value.error);
+	if (code._tag === "None") return Effect.die(value);
+	switch (code.value) {
+		case "NotSupported": return Effect.fail(new PasskeyReactNativeUnsupported({}));
+		case "InvalidChallenge":
+		case "InvalidUserId": return Effect.fail(rejected());
+		case "UserCancelled": return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "cancelled" }));
+		case "NoCredentials": return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "no-credentials" }));
+		case "CredentialAlreadyExists": return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "credential-exists" }));
+		case "Interrupted": return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "interrupted" }));
+		case "TimedOut": return Effect.fail(timedOut());
+		case "RequestFailed": return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "request-failed" }));
+		default: return Effect.die(value);
+	}
+});
+const native = (lease, call) => Effect.callback((resume, signal) => {
+	if (signal.aborted || !lease.listening || lease.phase !== "pre-native" || activeLease !== lease) {
+		resume(Effect.die(/* @__PURE__ */ new Error("Invalid passkey native lease")));
+		return;
+	}
+	lease.phase = "native";
+	try {
+		Promise.resolve(call()).then((value) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && lease.listening) resume(Effect.succeed(value));
+			} catch {}
+		}, (error) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && lease.listening) resume(nativeFailure(error));
+			} catch {}
+		});
+	} catch (error) {
+		settle(lease);
+		resume(Effect.die(error));
+	}
+});
+const remaining = Effect.fnUntraced(function* (deadline) {
+	const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);
+	if (duration <= 0) return yield* timedOut();
+	return Math.max(1, Math.floor(duration));
+});
+const runCeremony = Effect.fnUntraced(function* (started, use) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (started.expiresAtMillis <= now) return yield* rejected();
+	const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const lease = yield* Effect.acquireRelease(acquire, release);
+		const duration = yield* remaining(deadline);
+		return yield* use(lease, deadline).pipe(Effect.timeoutOrElse({
+			duration,
+			orElse: () => Effect.fail(timedOut())
+		}));
+	}));
+});
+const decodeResponse = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(invalid), redactDefects(invalid));
+/** Creates the iOS adapter. Ceremonies own their scopes; construction performs no native I/O. */
+const make = () => Effect.sync(() => {
+	const register = Effect.fnUntraced(function* (input) {
+		const started = yield* snapshotPasskey(registrationInput, input).pipe(Effect.mapError(rejected));
+		const env = yield* environment;
+		if (!env.supported || !started.options.pubKeyCredParams.some(({ alg }) => alg === -7) || started.options.excludeCredentials.length > 0 && !env.exclusions) return yield* new PasskeyReactNativeUnsupported({});
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			const options = started.options;
+			const request = {
+				...options,
+				rp: { ...options.rp },
+				user: { ...options.user },
+				authenticatorSelection: { ...options.authenticatorSelection },
+				pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),
+				excludeCredentials: options.excludeCredentials.map((value) => ({ ...value })),
+				timeout: yield* remaining(deadline)
+			};
+			const credential = yield* decodeResponse(nativeRegistration, yield* native(lease, () => Passkey.createPlatformKey(request)));
+			const response = yield* Schema.encodeEffect(registrationWire)({
+				id: credential.id,
+				rawId: credential.rawId,
+				type: "public-key",
+				response: credential.response,
+				clientExtensionResults: {}
+			}).pipe(Effect.mapError(invalid));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyReactNativeRegistration, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(invalid));
+		}));
+	}, unexpected);
+	const authenticate = Effect.fnUntraced(function* (input) {
+		const { started, mediation } = yield* snapshotPasskey(authenticationInput, input).pipe(Effect.mapError(rejected));
+		if (mediation === "conditional" || !(yield* environment).supported) return yield* new PasskeyReactNativeUnsupported({});
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			const request = {
+				...started.options,
+				allowCredentials: started.options.allowCredentials.map((value) => ({ ...value })),
+				timeout: yield* remaining(deadline)
+			};
+			const credential = yield* decodeResponse(nativeAuthentication, yield* native(lease, () => Passkey.get(request)));
+			const { userHandle, ...responseFields } = credential.response;
+			const response = yield* Schema.encodeEffect(authenticationWire)({
+				id: credential.id,
+				rawId: credential.rawId ?? credential.id,
+				type: "public-key",
+				response: {
+					...responseFields,
+					...userHandle === null || userHandle === void 0 ? {} : { userHandle }
+				},
+				clientExtensionResults: {}
+			}).pipe(Effect.mapError(invalid));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyReactNativeAuthentication, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(invalid));
+		}));
+	}, unexpected);
+	return PasskeyReactNative.of({
+		register,
+		authenticate,
+		capabilities: environment.pipe(Effect.map(({ supported }) => ({
+			supported,
+			conditionalGet: "unsupported",
+			cancellation: "unsupported"
+		})))
+	});
+});
+const layer = Layer.effect(PasskeyReactNative, make());
+//#endregion
+export { layer, make };
+
+//# sourceMappingURL=react-native-passkey.mjs.map

package/dist/internal/react-native-passkey.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-native-passkey.mjs","names":[],"sources":["../../src/internal/react-native-passkey.ts"],"sourcesContent":["import {\n  PasskeyAuthenticationStarted,\n  PasskeyRegistrationStarted,\n  snapshotPasskey,\n} from \"@yielded/auth/Passkey\";\nimport { reportAuthFailure } from \"@yielded/auth/Persistence\";\nimport { Cause, DateTime, Effect, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport { Platform } from \"react-native\";\nimport { Passkey, type PasskeyCreateRequest, type PasskeyGetRequest } from \"react-native-passkey\";\n\nimport {\n  PasskeyReactNativeAuthentication,\n  PasskeyReactNativeBusy,\n  type PasskeyReactNativeFailure,\n  PasskeyReactNativeInputRejected,\n  PasskeyReactNativeInvalidResponse,\n  PasskeyReactNativeNotCompleted,\n  PasskeyReactNativeRegistration,\n  PasskeyReactNativeUnavailable,\n  PasskeyReactNativeUnsupported,\n} from \"./models\";\nimport { PasskeyReactNative } from \"./PasskeyReactNative\";\nimport {\n  authenticationWire,\n  nativeAuthentication,\n  nativeRegistration,\n  registrationWire,\n} from \"./wire\";\n\ntype Native = PasskeyReactNative[\"Service\"];\nconst unavailable = () => new PasskeyReactNativeUnavailable({});\nconst rejected = () => new PasskeyReactNativeInputRejected({});\nconst invalid = () => new PasskeyReactNativeInvalidResponse({});\nconst timedOut = () => new PasskeyReactNativeNotCompleted({ reason: \"timed-out\" });\n\nconst redactDefects =\n  <Failure>(failure: () => Failure) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.catchCause((cause): Effect.Effect<never, E | Failure> =>\n        Cause.hasDies(cause)\n          ? reportAuthFailure(\"passkey-react-native\", cause).pipe(\n              Effect.andThen(Effect.fail(failure())),\n            )\n          : Effect.failCause(cause),\n      ),\n    );\n\nconst unexpected = redactDefects(unavailable);\n\nconst timeout = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 }));\n\nconst registrationInput = Schema.Struct({\n  ...PasskeyRegistrationStarted.fields,\n  options: Schema.Struct({ ...PasskeyRegistrationStarted.fields.options.fields, timeout }),\n});\n\nconst authenticationInput = Schema.Struct({\n  started: Schema.Struct({\n    ...PasskeyAuthenticationStarted.fields,\n    options: Schema.Struct({ ...PasskeyAuthenticationStarted.fields.options.fields, timeout }),\n  }),\n  mediation: Schema.Literals([\"required\", \"conditional\"]),\n});\n\nconst environment = Effect.sync(() => {\n  if (Platform.OS !== \"ios\") return { supported: false, exclusions: false };\n\n  // The maintained helper only checks OS version (and includes iOS 15).\n  // Decode platform metadata before applying this adapter's iOS 16 minimum.\n  // eslint-disable-next-line no-restricted-properties\n  const version = Schema.decodeUnknownSync(\n    Schema.String.check(Schema.isPattern(/^\\d+(?:\\.\\d+){0,2}$/)),\n  )(Platform.Version);\n\n  const [major = 0, minor = 0] = version.split(\".\").map(Number);\n  // eslint-disable-next-line no-restricted-properties\n  const supported = Schema.decodeUnknownSync(Schema.Boolean)(Passkey.isSupported());\n\n  return {\n    supported: major >= 16 && supported,\n    exclusions: major > 17 || (major === 17 && minor >= 4),\n  };\n}).pipe(unexpected);\n\ninterface Lease {\n  phase: \"pre-native\" | \"native\" | \"settled\";\n  listening: boolean;\n}\n// The peer has one native resolver. Coordinate every instance of this installed\n// module; callers must not also use the peer directly or load duplicate copies.\nlet activeLease: Lease | undefined;\n\nconst settle = (lease: Lease): void => {\n  lease.phase = \"settled\";\n  if (activeLease === lease) activeLease = undefined;\n};\n\nconst acquire = Effect.gen(function* () {\n  if (activeLease !== undefined) return yield* new PasskeyReactNativeBusy({});\n  const lease: Lease = { phase: \"pre-native\", listening: true };\n\n  activeLease = lease;\n\n  return lease;\n});\n\nconst release = (lease: Lease) =>\n  Effect.sync(() => {\n    lease.listening = false;\n    // There is no cancel API. Free only a request that has not reached native.\n    if (lease.phase === \"pre-native\") settle(lease);\n  });\n\nconst nativeFailure = (value: unknown): Effect.Effect<never, PasskeyReactNativeFailure> =>\n  Effect.suspend((): Effect.Effect<never, PasskeyReactNativeFailure> => {\n    if (!Predicate.isObject(value)) return Effect.die(value);\n    // Inspect only the normalized code; never copy message, native stack, or cause.\n    // eslint-disable-next-line no-restricted-properties\n    const code = Schema.decodeUnknownOption(Schema.String)(value.error);\n\n    if (code._tag === \"None\") return Effect.die(value);\n    switch (code.value) {\n      case \"NotSupported\":\n        return Effect.fail(new PasskeyReactNativeUnsupported({}));\n      case \"InvalidChallenge\":\n      case \"InvalidUserId\":\n        return Effect.fail(rejected());\n      case \"UserCancelled\":\n        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: \"cancelled\" }));\n      case \"NoCredentials\":\n        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: \"no-credentials\" }));\n      case \"CredentialAlreadyExists\":\n        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: \"credential-exists\" }));\n      case \"Interrupted\":\n        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: \"interrupted\" }));\n      case \"TimedOut\":\n        return Effect.fail(timedOut());\n      case \"RequestFailed\":\n        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: \"request-failed\" }));\n      default:\n        return Effect.die(value);\n    }\n  });\n\nconst native = (lease: Lease, call: () => Promise<unknown>) =>\n  Effect.callback<unknown, PasskeyReactNativeFailure>((resume, signal) => {\n    if (\n      signal.aborted ||\n      !lease.listening ||\n      lease.phase !== \"pre-native\" ||\n      activeLease !== lease\n    ) {\n      resume(Effect.die(new Error(\"Invalid passkey native lease\")));\n\n      return;\n    }\n    lease.phase = \"native\";\n    try {\n      // The caller owns classification and diagnostic reporting. Callbacks only\n      // settle the guard and resume a live caller. After interruption they discard\n      // the outcome without inspecting it or retaining/running a scoped logger.\n      void Promise.resolve(call()).then(\n        (value) => {\n          try {\n            settle(lease);\n            if (!signal.aborted && lease.listening) resume(Effect.succeed(value));\n          } catch {\n            /* A detached handler must not reject. */\n          }\n        },\n        (error) => {\n          try {\n            settle(lease);\n            if (!signal.aborted && lease.listening) resume(nativeFailure(error));\n          } catch {\n            /* A detached handler must not reject. */\n          }\n        },\n      );\n    } catch (error) {\n      settle(lease);\n      resume(Effect.die(error));\n    }\n  });\n\nconst remaining = Effect.fnUntraced(function* (deadline: number) {\n  const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (duration <= 0) return yield* timedOut();\n\n  return Math.max(1, Math.floor(duration));\n});\n\nconst runCeremony = Effect.fnUntraced(function* <A>(\n  started: { readonly expiresAtMillis: number; readonly options: { readonly timeout: number } },\n  use: (lease: Lease, deadline: number) => Effect.Effect<A, PasskeyReactNativeFailure>,\n) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (started.expiresAtMillis <= now) return yield* rejected();\n  const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);\n\n  return yield* Effect.scoped(\n    Effect.gen(function* () {\n      const lease = yield* Effect.acquireRelease(acquire, release);\n      const duration = yield* remaining(deadline);\n\n      return yield* use(lease, deadline).pipe(\n        Effect.timeoutOrElse({ duration, orElse: () => Effect.fail(timedOut()) }),\n      );\n    }),\n  );\n});\n\nconst decodeResponse = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: unknown,\n) =>\n  // Peer declarations are not validation. Parse bounded base64url fields and\n  // discard unknown fields before constructing the server's JSON envelope.\n  // eslint-disable-next-line no-restricted-properties\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(invalid), redactDefects(invalid));\n\n/** Creates the iOS adapter. Ceremonies own their scopes; construction performs no native I/O. */\nexport const make = (): Effect.Effect<Native> =>\n  Effect.sync(() => {\n    const register = Effect.fnUntraced(function* (input: Parameters<Native[\"register\"]>[0]) {\n      const started = yield* snapshotPasskey(registrationInput, input).pipe(\n        Effect.mapError(rejected),\n      );\n\n      const env = yield* environment;\n\n      if (\n        !env.supported ||\n        !started.options.pubKeyCredParams.some(({ alg }) => alg === -7) ||\n        (started.options.excludeCredentials.length > 0 && !env.exclusions)\n      )\n        return yield* new PasskeyReactNativeUnsupported({});\n\n      return yield* runCeremony(started, (lease, deadline) =>\n        Effect.gen(function* () {\n          const options = started.options;\n\n          const request: PasskeyCreateRequest = {\n            ...options,\n            rp: { ...options.rp },\n            user: { ...options.user },\n            authenticatorSelection: { ...options.authenticatorSelection },\n            pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),\n            excludeCredentials: options.excludeCredentials.map((value) => ({ ...value })),\n            timeout: yield* remaining(deadline),\n          };\n\n          // The platform path preserves the required attestation: \"none\" policy.\n          const credential = yield* decodeResponse(\n            nativeRegistration,\n            yield* native(lease, () => Passkey.createPlatformKey(request)),\n          );\n\n          const response = yield* Schema.encodeEffect(registrationWire)({\n            id: credential.id,\n            rawId: credential.rawId,\n            type: \"public-key\",\n            response: credential.response,\n            clientExtensionResults: {},\n          }).pipe(Effect.mapError(invalid));\n\n          yield* remaining(deadline);\n\n          return yield* snapshotPasskey(PasskeyReactNativeRegistration, {\n            flowId: started.flowId,\n            response: Redacted.make(response),\n          }).pipe(Effect.mapError(invalid));\n        }),\n      );\n    }, unexpected);\n\n    const authenticate = Effect.fnUntraced(function* (\n      input: Parameters<Native[\"authenticate\"]>[0],\n    ) {\n      const { started, mediation } = yield* snapshotPasskey(authenticationInput, input).pipe(\n        Effect.mapError(rejected),\n      );\n\n      if (mediation === \"conditional\" || !(yield* environment).supported)\n        return yield* new PasskeyReactNativeUnsupported({});\n\n      return yield* runCeremony(started, (lease, deadline) =>\n        Effect.gen(function* () {\n          const request: PasskeyGetRequest = {\n            ...started.options,\n            allowCredentials: started.options.allowCredentials.map((value) => ({ ...value })),\n            timeout: yield* remaining(deadline),\n          };\n\n          const credential = yield* decodeResponse(\n            nativeAuthentication,\n            yield* native(lease, () => Passkey.get(request)),\n          );\n\n          const { userHandle, ...responseFields } = credential.response;\n\n          const response = yield* Schema.encodeEffect(authenticationWire)({\n            id: credential.id,\n            rawId: credential.rawId ?? credential.id,\n            type: \"public-key\",\n            response: {\n              ...responseFields,\n              ...(userHandle === null || userHandle === undefined ? {} : { userHandle }),\n            },\n            clientExtensionResults: {},\n          }).pipe(Effect.mapError(invalid));\n\n          yield* remaining(deadline);\n\n          return yield* snapshotPasskey(PasskeyReactNativeAuthentication, {\n            flowId: started.flowId,\n            response: Redacted.make(response),\n          }).pipe(Effect.mapError(invalid));\n        }),\n      );\n    }, unexpected);\n\n    return PasskeyReactNative.of({\n      register,\n      authenticate,\n      capabilities: environment.pipe(\n        Effect.map(({ supported }) => ({\n          supported,\n          conditionalGet: \"unsupported\" as const,\n          cancellation: \"unsupported\" as const,\n        })),\n      ),\n    });\n  });\n\nexport const layer: Layer.Layer<PasskeyReactNative> = Layer.effect(PasskeyReactNative, make());\n"],"mappings":";;;;;;;;;AA8BA,MAAM,oBAAoB,IAAI,8BAA8B,CAAC,CAAC;AAC9D,MAAM,iBAAiB,IAAI,gCAAgC,CAAC,CAAC;AAC7D,MAAM,gBAAgB,IAAI,kCAAkC,CAAC,CAAC;AAC9D,MAAM,iBAAiB,IAAI,+BAA+B,EAAE,QAAQ,YAAY,CAAC;AAEjF,MAAM,iBACM,aACA,WACR,OAAO,KACL,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,wBAAwB,KAAK,CAAC,CAAC,KAC/C,OAAO,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,CACvC,IACA,OAAO,UAAU,KAAK,CAC5B,CACF;AAEJ,MAAM,aAAa,cAAc,WAAW;AAE5C,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAElF,MAAM,oBAAoB,OAAO,OAAO;CACtC,GAAG,2BAA2B;CAC9B,SAAS,OAAO,OAAO;EAAE,GAAG,2BAA2B,OAAO,QAAQ;EAAQ;CAAQ,CAAC;AACzF,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,OAAO,OAAO;EACrB,GAAG,6BAA6B;EAChC,SAAS,OAAO,OAAO;GAAE,GAAG,6BAA6B,OAAO,QAAQ;GAAQ;EAAQ,CAAC;CAC3F,CAAC;CACD,WAAW,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;AACxD,CAAC;AAED,MAAM,cAAc,OAAO,WAAW;CACpC,IAAI,SAAS,OAAO,OAAO,OAAO;EAAE,WAAW;EAAO,YAAY;CAAM;CASxE,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAJV,OAAO,kBACrB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D,CAAC,CAAC,SAAS,OAE0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAE5D,MAAM,YAAY,OAAO,kBAAkB,OAAO,OAAO,CAAC,CAAC,QAAQ,YAAY,CAAC;CAEhF,OAAO;EACL,WAAW,SAAS,MAAM;EAC1B,YAAY,QAAQ,MAAO,UAAU,MAAM,SAAS;CACtD;AACF,CAAC,CAAC,CAAC,KAAK,UAAU;AAQlB,IAAI;AAEJ,MAAM,UAAU,UAAuB;CACrC,MAAM,QAAQ;CACd,IAAI,gBAAgB,OAAO,cAAc,KAAA;AAC3C;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,IAAI,gBAAgB,KAAA,GAAW,OAAO,OAAO,IAAI,uBAAuB,CAAC,CAAC;CAC1E,MAAM,QAAe;EAAE,OAAO;EAAc,WAAW;CAAK;CAE5D,cAAc;CAEd,OAAO;AACT,CAAC;AAED,MAAM,WAAW,UACf,OAAO,WAAW;CAChB,MAAM,YAAY;CAElB,IAAI,MAAM,UAAU,cAAc,OAAO,KAAK;AAChD,CAAC;AAEH,MAAM,iBAAiB,UACrB,OAAO,cAA+D;CACpE,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,OAAO,OAAO,IAAI,KAAK;CAGvD,MAAM,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,MAAM,KAAK;CAElE,IAAI,KAAK,SAAS,QAAQ,OAAO,OAAO,IAAI,KAAK;CACjD,QAAQ,KAAK,OAAb;EACE,KAAK,gBACH,OAAO,OAAO,KAAK,IAAI,8BAA8B,CAAC,CAAC,CAAC;EAC1D,KAAK;EACL,KAAK,iBACH,OAAO,OAAO,KAAK,SAAS,CAAC;EAC/B,KAAK,iBACH,OAAO,OAAO,KAAK,IAAI,+BAA+B,EAAE,QAAQ,YAAY,CAAC,CAAC;EAChF,KAAK,iBACH,OAAO,OAAO,KAAK,IAAI,+BAA+B,EAAE,QAAQ,iBAAiB,CAAC,CAAC;EACrF,KAAK,2BACH,OAAO,OAAO,KAAK,IAAI,+BAA+B,EAAE,QAAQ,oBAAoB,CAAC,CAAC;EACxF,KAAK,eACH,OAAO,OAAO,KAAK,IAAI,+BAA+B,EAAE,QAAQ,cAAc,CAAC,CAAC;EAClF,KAAK,YACH,OAAO,OAAO,KAAK,SAAS,CAAC;EAC/B,KAAK,iBACH,OAAO,OAAO,KAAK,IAAI,+BAA+B,EAAE,QAAQ,iBAAiB,CAAC,CAAC;EACrF,SACE,OAAO,OAAO,IAAI,KAAK;CAC3B;AACF,CAAC;AAEH,MAAM,UAAU,OAAc,SAC5B,OAAO,UAA8C,QAAQ,WAAW;CACtE,IACE,OAAO,WACP,CAAC,MAAM,aACP,MAAM,UAAU,gBAChB,gBAAgB,OAChB;EACA,OAAO,OAAO,oBAAI,IAAI,MAAM,8BAA8B,CAAC,CAAC;EAE5D;CACF;CACA,MAAM,QAAQ;CACd,IAAI;EAIF,QAAa,QAAQ,KAAK,CAAC,CAAC,CAAC,MAC1B,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,MAAM,WAAW,OAAO,OAAO,QAAQ,KAAK,CAAC;GACtE,QAAQ,CAER;EACF,IACC,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,MAAM,WAAW,OAAO,cAAc,KAAK,CAAC;GACrE,QAAQ,CAER;EACF,CACF;CACF,SAAS,OAAO;EACd,OAAO,KAAK;EACZ,OAAO,OAAO,IAAI,KAAK,CAAC;CAC1B;AACF,CAAC;AAEH,MAAM,YAAY,OAAO,WAAW,WAAW,UAAkB;CAC/D,MAAM,WAAW,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtE,IAAI,YAAY,GAAG,OAAO,OAAO,SAAS;CAE1C,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,WACpC,SACA,KACA;CACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IAAI,QAAQ,mBAAmB,KAAK,OAAO,OAAO,SAAS;CAC3D,MAAM,WAAW,KAAK,IAAI,QAAQ,iBAAiB,MAAM,QAAQ,QAAQ,OAAO;CAEhF,OAAO,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,eAAe,SAAS,OAAO;EAC3D,MAAM,WAAW,OAAO,UAAU,QAAQ;EAE1C,OAAO,OAAO,IAAI,OAAO,QAAQ,CAAC,CAAC,KACjC,OAAO,cAAc;GAAE;GAAU,cAAc,OAAO,KAAK,SAAS,CAAC;EAAE,CAAC,CAC1E;CACF,CAAC,CACH;AACF,CAAC;AAED,MAAM,kBACJ,QACA,UAKA,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,GAAG,cAAc,OAAO,CAAC;;AAGjG,MAAa,aACX,OAAO,WAAW;CAChB,MAAM,WAAW,OAAO,WAAW,WAAW,OAA0C;EACtF,MAAM,UAAU,OAAO,gBAAgB,mBAAmB,KAAK,CAAC,CAAC,KAC/D,OAAO,SAAS,QAAQ,CAC1B;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,IAAI,aACL,CAAC,QAAQ,QAAQ,iBAAiB,MAAM,EAAE,UAAU,QAAQ,EAAE,KAC7D,QAAQ,QAAQ,mBAAmB,SAAS,KAAK,CAAC,IAAI,YAEvD,OAAO,OAAO,IAAI,8BAA8B,CAAC,CAAC;EAEpD,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,QAAQ;GAExB,MAAM,UAAgC;IACpC,GAAG;IACH,IAAI,EAAE,GAAG,QAAQ,GAAG;IACpB,MAAM,EAAE,GAAG,QAAQ,KAAK;IACxB,wBAAwB,EAAE,GAAG,QAAQ,uBAAuB;IAC5D,kBAAkB,QAAQ,iBAAiB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IACxE,oBAAoB,QAAQ,mBAAmB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IAC5E,SAAS,OAAO,UAAU,QAAQ;GACpC;GAGA,MAAM,aAAa,OAAO,eACxB,oBACA,OAAO,OAAO,aAAa,QAAQ,kBAAkB,OAAO,CAAC,CAC/D;GAEA,MAAM,WAAW,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC;IAC5D,IAAI,WAAW;IACf,OAAO,WAAW;IAClB,MAAM;IACN,UAAU,WAAW;IACrB,wBAAwB,CAAC;GAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAEhC,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,gCAAgC;IAC5D,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;EAClC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,MAAM,eAAe,OAAO,WAAW,WACrC,OACA;EACA,MAAM,EAAE,SAAS,cAAc,OAAO,gBAAgB,qBAAqB,KAAK,CAAC,CAAC,KAChF,OAAO,SAAS,QAAQ,CAC1B;EAEA,IAAI,cAAc,iBAAiB,EAAE,OAAO,YAAA,CAAa,WACvD,OAAO,OAAO,IAAI,8BAA8B,CAAC,CAAC;EAEpD,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,MAAM,UAA6B;IACjC,GAAG,QAAQ;IACX,kBAAkB,QAAQ,QAAQ,iBAAiB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IAChF,SAAS,OAAO,UAAU,QAAQ;GACpC;GAEA,MAAM,aAAa,OAAO,eACxB,sBACA,OAAO,OAAO,aAAa,QAAQ,IAAI,OAAO,CAAC,CACjD;GAEA,MAAM,EAAE,YAAY,GAAG,mBAAmB,WAAW;GAErD,MAAM,WAAW,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAAC;IAC9D,IAAI,WAAW;IACf,OAAO,WAAW,SAAS,WAAW;IACtC,MAAM;IACN,UAAU;KACR,GAAG;KACH,GAAI,eAAe,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IAC1E;IACA,wBAAwB,CAAC;GAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAEhC,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,kCAAkC;IAC9D,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;EAClC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,OAAO,mBAAmB,GAAG;EAC3B;EACA;EACA,cAAc,YAAY,KACxB,OAAO,KAAK,EAAE,iBAAiB;GAC7B;GACA,gBAAgB;GAChB,cAAc;EAChB,EAAE,CACJ;CACF,CAAC;AACH,CAAC;AAEH,MAAa,QAAyC,MAAM,OAAO,oBAAoB,KAAK,CAAC"}

package/dist/internal/wire.mjs

@@ -0,0 +1,52 @@
+import { Schema } from "effect";
+import { PasskeyProtocolCredentialId, PasskeyUserHandle } from "@yielded/auth/Passkey";
+import { Base64Url } from "effect/encoding";
+//#region src/internal/wire.ts
+const bytes = (minimum, maximum) => Schema.String.check(Schema.isMaxLength(Math.ceil(maximum * 4 / 3)), Schema.makeFilter((value) => {
+	const decoded = Base64Url.decode(value);
+	return decoded._tag === "Success" && decoded.success.length >= minimum && decoded.success.length <= maximum && Base64Url.encode(decoded.success) === value;
+}));
+const envelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: Schema.optionalKey(PasskeyProtocolCredentialId),
+	type: Schema.optionalKey(Schema.Literal("public-key"))
+};
+const matchingId = Schema.makeFilter((value) => value.rawId === void 0 || value.rawId === value.id);
+const nativeRegistration = Schema.Struct({
+	...envelope,
+	rawId: PasskeyProtocolCredentialId,
+	response: Schema.Struct({
+		clientDataJSON: bytes(1, 8192),
+		attestationObject: bytes(1, 65536)
+	})
+}).check(matchingId);
+const nativeAuthentication = Schema.Struct({
+	...envelope,
+	response: Schema.Struct({
+		clientDataJSON: bytes(1, 8192),
+		authenticatorData: bytes(37, 16384),
+		signature: bytes(1, 1024),
+		userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle))
+	})
+}).check(matchingId);
+const wireEnvelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: PasskeyProtocolCredentialId,
+	type: Schema.Literal("public-key"),
+	clientExtensionResults: Schema.Struct({})
+};
+const registrationWire = Schema.fromJsonString(Schema.Struct({
+	...wireEnvelope,
+	response: nativeRegistration.fields.response
+}));
+const authenticationWire = Schema.fromJsonString(Schema.Struct({
+	...wireEnvelope,
+	response: Schema.Struct({
+		...nativeAuthentication.fields.response.fields,
+		userHandle: Schema.optionalKey(PasskeyUserHandle)
+	})
+}));
+//#endregion
+export { authenticationWire, nativeAuthentication, nativeRegistration, registrationWire };
+
+//# sourceMappingURL=wire.mjs.map

package/dist/internal/wire.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.mjs","names":[],"sources":["../../src/internal/wire.ts"],"sourcesContent":["import { PasskeyProtocolCredentialId, PasskeyUserHandle } from \"@yielded/auth/Passkey\";\nimport { Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nconst bytes = (minimum: number, maximum: number) =>\n  Schema.String.check(\n    Schema.isMaxLength(Math.ceil((maximum * 4) / 3)),\n    Schema.makeFilter((value) => {\n      const decoded = Base64Url.decode(value);\n\n      return (\n        decoded._tag === \"Success\" &&\n        decoded.success.length >= minimum &&\n        decoded.success.length <= maximum &&\n        Base64Url.encode(decoded.success) === value\n      );\n    }),\n  );\n\n// The peer allows omitted type/rawId in assertions. Normalize only missing fields;\n// a supplied mismatch must fail. Never forward unsolicited extensions or metadata.\nconst envelope = {\n  id: PasskeyProtocolCredentialId,\n  rawId: Schema.optionalKey(PasskeyProtocolCredentialId),\n  type: Schema.optionalKey(Schema.Literal(\"public-key\")),\n};\n\nconst matchingId = Schema.makeFilter<{ readonly id: string; readonly rawId?: string }>(\n  (value) => value.rawId === undefined || value.rawId === value.id,\n);\n\nexport const nativeRegistration = Schema.Struct({\n  ...envelope,\n  rawId: PasskeyProtocolCredentialId,\n  response: Schema.Struct({\n    clientDataJSON: bytes(1, 8192),\n    attestationObject: bytes(1, 65536),\n  }),\n}).check(matchingId);\n\nexport const nativeAuthentication = Schema.Struct({\n  ...envelope,\n  response: Schema.Struct({\n    clientDataJSON: bytes(1, 8192),\n    authenticatorData: bytes(37, 16384),\n    signature: bytes(1, 1024),\n    userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle)),\n  }),\n}).check(matchingId);\n\nconst wireEnvelope = {\n  id: PasskeyProtocolCredentialId,\n  rawId: PasskeyProtocolCredentialId,\n  type: Schema.Literal(\"public-key\"),\n  clientExtensionResults: Schema.Struct({}),\n};\n\nexport const registrationWire = Schema.fromJsonString(\n  Schema.Struct({\n    ...wireEnvelope,\n    response: nativeRegistration.fields.response,\n  }),\n);\n\nexport const authenticationWire = Schema.fromJsonString(\n  Schema.Struct({\n    ...wireEnvelope,\n    response: Schema.Struct({\n      ...nativeAuthentication.fields.response.fields,\n      userHandle: Schema.optionalKey(PasskeyUserHandle),\n    }),\n  }),\n);\n"],"mappings":";;;;AAIA,MAAM,SAAS,SAAiB,YAC9B,OAAO,OAAO,MACZ,OAAO,YAAY,KAAK,KAAM,UAAU,IAAK,CAAC,CAAC,GAC/C,OAAO,YAAY,UAAU;CAC3B,MAAM,UAAU,UAAU,OAAO,KAAK;CAEtC,OACE,QAAQ,SAAS,aACjB,QAAQ,QAAQ,UAAU,WAC1B,QAAQ,QAAQ,UAAU,WAC1B,UAAU,OAAO,QAAQ,OAAO,MAAM;AAE1C,CAAC,CACH;AAIF,MAAM,WAAW;CACf,IAAI;CACJ,OAAO,OAAO,YAAY,2BAA2B;CACrD,MAAM,OAAO,YAAY,OAAO,QAAQ,YAAY,CAAC;AACvD;AAEA,MAAM,aAAa,OAAO,YACvB,UAAU,MAAM,UAAU,KAAA,KAAa,MAAM,UAAU,MAAM,EAChE;AAEA,MAAa,qBAAqB,OAAO,OAAO;CAC9C,GAAG;CACH,OAAO;CACP,UAAU,OAAO,OAAO;EACtB,gBAAgB,MAAM,GAAG,IAAI;EAC7B,mBAAmB,MAAM,GAAG,KAAK;CACnC,CAAC;AACH,CAAC,CAAC,CAAC,MAAM,UAAU;AAEnB,MAAa,uBAAuB,OAAO,OAAO;CAChD,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,gBAAgB,MAAM,GAAG,IAAI;EAC7B,mBAAmB,MAAM,IAAI,KAAK;EAClC,WAAW,MAAM,GAAG,IAAI;EACxB,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC;CACjE,CAAC;AACH,CAAC,CAAC,CAAC,MAAM,UAAU;AAEnB,MAAM,eAAe;CACnB,IAAI;CACJ,OAAO;CACP,MAAM,OAAO,QAAQ,YAAY;CACjC,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAC1C;AAEA,MAAa,mBAAmB,OAAO,eACrC,OAAO,OAAO;CACZ,GAAG;CACH,UAAU,mBAAmB,OAAO;AACtC,CAAC,CACH;AAEA,MAAa,qBAAqB,OAAO,eACvC,OAAO,OAAO;CACZ,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,GAAG,qBAAqB,OAAO,SAAS;EACxC,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;AACH,CAAC,CACH"}

package/package.json

@@ -0,0 +1 @@
+{"name":"@yielded/auth-react-native","version":"0.1.0-beta.12","dependencies":{"@yielded/auth":"0.1.0-beta.12"},"devDependencies":{"@effect/vitest":"4.0.0","effect":"4.0.0","react-native":"0.81.4","react-native-passkey":"3.6.2","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0","react-native":">=0.81 <1","react-native-passkey":"~3.6.2"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"}},"description":"iOS passkey ceremonies for Yielded Auth and React Native.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-react-native"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}

package/src/index.ts

@@ -0,0 +1,16 @@
+export { PasskeyReactNative } from "./internal/PasskeyReactNative";
+
+export {
+  PasskeyReactNativeAuthentication,
+  PasskeyReactNativeBusy,
+  PasskeyReactNativeCapabilities,
+  PasskeyReactNativeFailure,
+  PasskeyReactNativeInputRejected,
+  PasskeyReactNativeInvalidResponse,
+  PasskeyReactNativeNotCompleted,
+  PasskeyReactNativeRegistration,
+  PasskeyReactNativeUnavailable,
+  PasskeyReactNativeUnsupported,
+} from "./internal/models";
+
+export { make, layer } from "./internal/react-native-passkey";

package/src/internal/PasskeyReactNative.ts

@@ -0,0 +1,36 @@
+import type {
+  PasskeyAuthenticationStarted,
+  PasskeyRegistrationStarted,
+} from "@yielded/auth/Passkey";
+import { Context, type Effect } from "effect";
+
+import type {
+  PasskeyReactNativeAuthentication,
+  PasskeyReactNativeCapabilities,
+  PasskeyReactNativeFailure,
+  PasskeyReactNativeRegistration,
+  PasskeyReactNativeUnavailable,
+} from "./models";
+
+/** Client-local iOS ceremonies. Applications own Begin/Complete and request binding.
+ * Interruption stops delivery, but cannot dismiss OS UI. A started native request
+ * retains the shared busy guard until its promise settles, even after interruption.
+ * The calling fiber owns failure diagnostics; late settlement only clears the guard. */
+export class PasskeyReactNative extends Context.Service<
+  PasskeyReactNative,
+  {
+    readonly capabilities: Effect.Effect<
+      PasskeyReactNativeCapabilities,
+      PasskeyReactNativeUnavailable
+    >;
+    /** Registers a platform passkey; requested algorithms must include ES256 (-7). */
+    readonly register: (
+      started: typeof PasskeyRegistrationStarted.Type,
+    ) => Effect.Effect<PasskeyReactNativeRegistration, PasskeyReactNativeFailure>;
+    /** Conditional mediation is accepted for port compatibility but fails Unsupported. */
+    readonly authenticate: (input: {
+      readonly started: typeof PasskeyAuthenticationStarted.Type;
+      readonly mediation: "required" | "conditional";
+    }) => Effect.Effect<PasskeyReactNativeAuthentication, PasskeyReactNativeFailure>;
+  }
+>()("effect-auth/PasskeyReactNative") {}

package/src/internal/models.ts

@@ -0,0 +1,81 @@
+import {
+  PasskeyAssertion,
+  PasskeyAttestation,
+  PasskeyAuthenticationStarted,
+} from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+
+/** OS availability only; does not attest to entitlements, linking, or a saved key. */
+export const PasskeyReactNativeCapabilities = Schema.Struct({
+  supported: Schema.Boolean,
+  conditionalGet: Schema.Literal("unsupported"),
+  cancellation: Schema.Literal("unsupported"),
+});
+
+export type PasskeyReactNativeCapabilities = typeof PasskeyReactNativeCapabilities.Type;
+
+export const PasskeyReactNativeRegistration = Schema.Struct({
+  flowId: PasskeyAuthenticationStarted.fields.flowId,
+  response: PasskeyAttestation,
+});
+
+export type PasskeyReactNativeRegistration = typeof PasskeyReactNativeRegistration.Type;
+
+export const PasskeyReactNativeAuthentication = Schema.Struct({
+  flowId: PasskeyAuthenticationStarted.fields.flowId,
+  response: PasskeyAssertion,
+});
+
+export type PasskeyReactNativeAuthentication = typeof PasskeyReactNativeAuthentication.Type;
+
+export class PasskeyReactNativeInputRejected extends Schema.TaggedError<PasskeyReactNativeInputRejected>()(
+  "PasskeyReactNativeInputRejected",
+  {},
+) {}
+
+export class PasskeyReactNativeUnsupported extends Schema.TaggedError<PasskeyReactNativeUnsupported>()(
+  "PasskeyReactNativeUnsupported",
+  {},
+) {}
+
+export class PasskeyReactNativeBusy extends Schema.TaggedError<PasskeyReactNativeBusy>()(
+  "PasskeyReactNativeBusy",
+  {},
+) {}
+
+/** A local outcome, never evidence that a credential was not created. */
+export class PasskeyReactNativeNotCompleted extends Schema.TaggedError<PasskeyReactNativeNotCompleted>()(
+  "PasskeyReactNativeNotCompleted",
+  {
+    reason: Schema.Literals([
+      "cancelled",
+      "no-credentials",
+      "credential-exists",
+      "interrupted",
+      "timed-out",
+      "request-failed",
+    ]),
+  },
+) {}
+
+export class PasskeyReactNativeInvalidResponse extends Schema.TaggedError<PasskeyReactNativeInvalidResponse>()(
+  "PasskeyReactNativeInvalidResponse",
+  {},
+) {}
+
+/** Configuration failures, native defects, and unrecognized failures; no native message/cause. */
+export class PasskeyReactNativeUnavailable extends Schema.TaggedError<PasskeyReactNativeUnavailable>()(
+  "PasskeyReactNativeUnavailable",
+  {},
+) {}
+
+export const PasskeyReactNativeFailure = Schema.Union([
+  PasskeyReactNativeInputRejected,
+  PasskeyReactNativeUnsupported,
+  PasskeyReactNativeBusy,
+  PasskeyReactNativeNotCompleted,
+  PasskeyReactNativeInvalidResponse,
+  PasskeyReactNativeUnavailable,
+]);
+
+export type PasskeyReactNativeFailure = typeof PasskeyReactNativeFailure.Type;

package/src/internal/react-native-passkey.ts

@@ -0,0 +1,339 @@
+import {
+  PasskeyAuthenticationStarted,
+  PasskeyRegistrationStarted,
+  snapshotPasskey,
+} from "@yielded/auth/Passkey";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+import { Cause, DateTime, Effect, Layer, Predicate, Redacted, Schema } from "effect";
+import { Platform } from "react-native";
+import { Passkey, type PasskeyCreateRequest, type PasskeyGetRequest } from "react-native-passkey";
+
+import {
+  PasskeyReactNativeAuthentication,
+  PasskeyReactNativeBusy,
+  type PasskeyReactNativeFailure,
+  PasskeyReactNativeInputRejected,
+  PasskeyReactNativeInvalidResponse,
+  PasskeyReactNativeNotCompleted,
+  PasskeyReactNativeRegistration,
+  PasskeyReactNativeUnavailable,
+  PasskeyReactNativeUnsupported,
+} from "./models";
+import { PasskeyReactNative } from "./PasskeyReactNative";
+import {
+  authenticationWire,
+  nativeAuthentication,
+  nativeRegistration,
+  registrationWire,
+} from "./wire";
+
+type Native = PasskeyReactNative["Service"];
+const unavailable = () => new PasskeyReactNativeUnavailable({});
+const rejected = () => new PasskeyReactNativeInputRejected({});
+const invalid = () => new PasskeyReactNativeInvalidResponse({});
+const timedOut = () => new PasskeyReactNativeNotCompleted({ reason: "timed-out" });
+
+const redactDefects =
+  <Failure>(failure: () => Failure) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    effect.pipe(
+      Effect.catchCause((cause): Effect.Effect<never, E | Failure> =>
+        Cause.hasDies(cause)
+          ? reportAuthFailure("passkey-react-native", cause).pipe(
+              Effect.andThen(Effect.fail(failure())),
+            )
+          : Effect.failCause(cause),
+      ),
+    );
+
+const unexpected = redactDefects(unavailable);
+
+const timeout = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 }));
+
+const registrationInput = Schema.Struct({
+  ...PasskeyRegistrationStarted.fields,
+  options: Schema.Struct({ ...PasskeyRegistrationStarted.fields.options.fields, timeout }),
+});
+
+const authenticationInput = Schema.Struct({
+  started: Schema.Struct({
+    ...PasskeyAuthenticationStarted.fields,
+    options: Schema.Struct({ ...PasskeyAuthenticationStarted.fields.options.fields, timeout }),
+  }),
+  mediation: Schema.Literals(["required", "conditional"]),
+});
+
+const environment = Effect.sync(() => {
+  if (Platform.OS !== "ios") return { supported: false, exclusions: false };
+
+  // The maintained helper only checks OS version (and includes iOS 15).
+  // Decode platform metadata before applying this adapter's iOS 16 minimum.
+  // eslint-disable-next-line no-restricted-properties
+  const version = Schema.decodeUnknownSync(
+    Schema.String.check(Schema.isPattern(/^\d+(?:\.\d+){0,2}$/)),
+  )(Platform.Version);
+
+  const [major = 0, minor = 0] = version.split(".").map(Number);
+  // eslint-disable-next-line no-restricted-properties
+  const supported = Schema.decodeUnknownSync(Schema.Boolean)(Passkey.isSupported());
+
+  return {
+    supported: major >= 16 && supported,
+    exclusions: major > 17 || (major === 17 && minor >= 4),
+  };
+}).pipe(unexpected);
+
+interface Lease {
+  phase: "pre-native" | "native" | "settled";
+  listening: boolean;
+}
+// The peer has one native resolver. Coordinate every instance of this installed
+// module; callers must not also use the peer directly or load duplicate copies.
+let activeLease: Lease | undefined;
+
+const settle = (lease: Lease): void => {
+  lease.phase = "settled";
+  if (activeLease === lease) activeLease = undefined;
+};
+
+const acquire = Effect.gen(function* () {
+  if (activeLease !== undefined) return yield* new PasskeyReactNativeBusy({});
+  const lease: Lease = { phase: "pre-native", listening: true };
+
+  activeLease = lease;
+
+  return lease;
+});
+
+const release = (lease: Lease) =>
+  Effect.sync(() => {
+    lease.listening = false;
+    // There is no cancel API. Free only a request that has not reached native.
+    if (lease.phase === "pre-native") settle(lease);
+  });
+
+const nativeFailure = (value: unknown): Effect.Effect<never, PasskeyReactNativeFailure> =>
+  Effect.suspend((): Effect.Effect<never, PasskeyReactNativeFailure> => {
+    if (!Predicate.isObject(value)) return Effect.die(value);
+    // Inspect only the normalized code; never copy message, native stack, or cause.
+    // eslint-disable-next-line no-restricted-properties
+    const code = Schema.decodeUnknownOption(Schema.String)(value.error);
+
+    if (code._tag === "None") return Effect.die(value);
+    switch (code.value) {
+      case "NotSupported":
+        return Effect.fail(new PasskeyReactNativeUnsupported({}));
+      case "InvalidChallenge":
+      case "InvalidUserId":
+        return Effect.fail(rejected());
+      case "UserCancelled":
+        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "cancelled" }));
+      case "NoCredentials":
+        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "no-credentials" }));
+      case "CredentialAlreadyExists":
+        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "credential-exists" }));
+      case "Interrupted":
+        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "interrupted" }));
+      case "TimedOut":
+        return Effect.fail(timedOut());
+      case "RequestFailed":
+        return Effect.fail(new PasskeyReactNativeNotCompleted({ reason: "request-failed" }));
+      default:
+        return Effect.die(value);
+    }
+  });
+
+const native = (lease: Lease, call: () => Promise<unknown>) =>
+  Effect.callback<unknown, PasskeyReactNativeFailure>((resume, signal) => {
+    if (
+      signal.aborted ||
+      !lease.listening ||
+      lease.phase !== "pre-native" ||
+      activeLease !== lease
+    ) {
+      resume(Effect.die(new Error("Invalid passkey native lease")));
+
+      return;
+    }
+    lease.phase = "native";
+    try {
+      // The caller owns classification and diagnostic reporting. Callbacks only
+      // settle the guard and resume a live caller. After interruption they discard
+      // the outcome without inspecting it or retaining/running a scoped logger.
+      void Promise.resolve(call()).then(
+        (value) => {
+          try {
+            settle(lease);
+            if (!signal.aborted && lease.listening) resume(Effect.succeed(value));
+          } catch {
+            /* A detached handler must not reject. */
+          }
+        },
+        (error) => {
+          try {
+            settle(lease);
+            if (!signal.aborted && lease.listening) resume(nativeFailure(error));
+          } catch {
+            /* A detached handler must not reject. */
+          }
+        },
+      );
+    } catch (error) {
+      settle(lease);
+      resume(Effect.die(error));
+    }
+  });
+
+const remaining = Effect.fnUntraced(function* (deadline: number) {
+  const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);
+
+  if (duration <= 0) return yield* timedOut();
+
+  return Math.max(1, Math.floor(duration));
+});
+
+const runCeremony = Effect.fnUntraced(function* <A>(
+  started: { readonly expiresAtMillis: number; readonly options: { readonly timeout: number } },
+  use: (lease: Lease, deadline: number) => Effect.Effect<A, PasskeyReactNativeFailure>,
+) {
+  const now = DateTime.toEpochMillis(yield* DateTime.now);
+
+  if (started.expiresAtMillis <= now) return yield* rejected();
+  const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);
+
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const lease = yield* Effect.acquireRelease(acquire, release);
+      const duration = yield* remaining(deadline);
+
+      return yield* use(lease, deadline).pipe(
+        Effect.timeoutOrElse({ duration, orElse: () => Effect.fail(timedOut()) }),
+      );
+    }),
+  );
+});
+
+const decodeResponse = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+  value: unknown,
+) =>
+  // Peer declarations are not validation. Parse bounded base64url fields and
+  // discard unknown fields before constructing the server's JSON envelope.
+  // eslint-disable-next-line no-restricted-properties
+  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(invalid), redactDefects(invalid));
+
+/** Creates the iOS adapter. Ceremonies own their scopes; construction performs no native I/O. */
+export const make = (): Effect.Effect<Native> =>
+  Effect.sync(() => {
+    const register = Effect.fnUntraced(function* (input: Parameters<Native["register"]>[0]) {
+      const started = yield* snapshotPasskey(registrationInput, input).pipe(
+        Effect.mapError(rejected),
+      );
+
+      const env = yield* environment;
+
+      if (
+        !env.supported ||
+        !started.options.pubKeyCredParams.some(({ alg }) => alg === -7) ||
+        (started.options.excludeCredentials.length > 0 && !env.exclusions)
+      )
+        return yield* new PasskeyReactNativeUnsupported({});
+
+      return yield* runCeremony(started, (lease, deadline) =>
+        Effect.gen(function* () {
+          const options = started.options;
+
+          const request: PasskeyCreateRequest = {
+            ...options,
+            rp: { ...options.rp },
+            user: { ...options.user },
+            authenticatorSelection: { ...options.authenticatorSelection },
+            pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),
+            excludeCredentials: options.excludeCredentials.map((value) => ({ ...value })),
+            timeout: yield* remaining(deadline),
+          };
+
+          // The platform path preserves the required attestation: "none" policy.
+          const credential = yield* decodeResponse(
+            nativeRegistration,
+            yield* native(lease, () => Passkey.createPlatformKey(request)),
+          );
+
+          const response = yield* Schema.encodeEffect(registrationWire)({
+            id: credential.id,
+            rawId: credential.rawId,
+            type: "public-key",
+            response: credential.response,
+            clientExtensionResults: {},
+          }).pipe(Effect.mapError(invalid));
+
+          yield* remaining(deadline);
+
+          return yield* snapshotPasskey(PasskeyReactNativeRegistration, {
+            flowId: started.flowId,
+            response: Redacted.make(response),
+          }).pipe(Effect.mapError(invalid));
+        }),
+      );
+    }, unexpected);
+
+    const authenticate = Effect.fnUntraced(function* (
+      input: Parameters<Native["authenticate"]>[0],
+    ) {
+      const { started, mediation } = yield* snapshotPasskey(authenticationInput, input).pipe(
+        Effect.mapError(rejected),
+      );
+
+      if (mediation === "conditional" || !(yield* environment).supported)
+        return yield* new PasskeyReactNativeUnsupported({});
+
+      return yield* runCeremony(started, (lease, deadline) =>
+        Effect.gen(function* () {
+          const request: PasskeyGetRequest = {
+            ...started.options,
+            allowCredentials: started.options.allowCredentials.map((value) => ({ ...value })),
+            timeout: yield* remaining(deadline),
+          };
+
+          const credential = yield* decodeResponse(
+            nativeAuthentication,
+            yield* native(lease, () => Passkey.get(request)),
+          );
+
+          const { userHandle, ...responseFields } = credential.response;
+
+          const response = yield* Schema.encodeEffect(authenticationWire)({
+            id: credential.id,
+            rawId: credential.rawId ?? credential.id,
+            type: "public-key",
+            response: {
+              ...responseFields,
+              ...(userHandle === null || userHandle === undefined ? {} : { userHandle }),
+            },
+            clientExtensionResults: {},
+          }).pipe(Effect.mapError(invalid));
+
+          yield* remaining(deadline);
+
+          return yield* snapshotPasskey(PasskeyReactNativeAuthentication, {
+            flowId: started.flowId,
+            response: Redacted.make(response),
+          }).pipe(Effect.mapError(invalid));
+        }),
+      );
+    }, unexpected);
+
+    return PasskeyReactNative.of({
+      register,
+      authenticate,
+      capabilities: environment.pipe(
+        Effect.map(({ supported }) => ({
+          supported,
+          conditionalGet: "unsupported" as const,
+          cancellation: "unsupported" as const,
+        })),
+      ),
+    });
+  });
+
+export const layer: Layer.Layer<PasskeyReactNative> = Layer.effect(PasskeyReactNative, make());

package/src/internal/wire.ts

@@ -0,0 +1,73 @@
+import { PasskeyProtocolCredentialId, PasskeyUserHandle } from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+
+const bytes = (minimum: number, maximum: number) =>
+  Schema.String.check(
+    Schema.isMaxLength(Math.ceil((maximum * 4) / 3)),
+    Schema.makeFilter((value) => {
+      const decoded = Base64Url.decode(value);
+
+      return (
+        decoded._tag === "Success" &&
+        decoded.success.length >= minimum &&
+        decoded.success.length <= maximum &&
+        Base64Url.encode(decoded.success) === value
+      );
+    }),
+  );
+
+// The peer allows omitted type/rawId in assertions. Normalize only missing fields;
+// a supplied mismatch must fail. Never forward unsolicited extensions or metadata.
+const envelope = {
+  id: PasskeyProtocolCredentialId,
+  rawId: Schema.optionalKey(PasskeyProtocolCredentialId),
+  type: Schema.optionalKey(Schema.Literal("public-key")),
+};
+
+const matchingId = Schema.makeFilter<{ readonly id: string; readonly rawId?: string }>(
+  (value) => value.rawId === undefined || value.rawId === value.id,
+);
+
+export const nativeRegistration = Schema.Struct({
+  ...envelope,
+  rawId: PasskeyProtocolCredentialId,
+  response: Schema.Struct({
+    clientDataJSON: bytes(1, 8192),
+    attestationObject: bytes(1, 65536),
+  }),
+}).check(matchingId);
+
+export const nativeAuthentication = Schema.Struct({
+  ...envelope,
+  response: Schema.Struct({
+    clientDataJSON: bytes(1, 8192),
+    authenticatorData: bytes(37, 16384),
+    signature: bytes(1, 1024),
+    userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle)),
+  }),
+}).check(matchingId);
+
+const wireEnvelope = {
+  id: PasskeyProtocolCredentialId,
+  rawId: PasskeyProtocolCredentialId,
+  type: Schema.Literal("public-key"),
+  clientExtensionResults: Schema.Struct({}),
+};
+
+export const registrationWire = Schema.fromJsonString(
+  Schema.Struct({
+    ...wireEnvelope,
+    response: nativeRegistration.fields.response,
+  }),
+);
+
+export const authenticationWire = Schema.fromJsonString(
+  Schema.Struct({
+    ...wireEnvelope,
+    response: Schema.Struct({
+      ...nativeAuthentication.fields.response.fields,
+      userHandle: Schema.optionalKey(PasskeyUserHandle),
+    }),
+  }),
+);