@yielded/auth-simplewebauthn 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel van der Merwe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @yielded/auth-simplewebauthn
+
+Browser WebAuthn ceremonies and server verification for Yielded Auth, backed by
+SimpleWebAuthn. Import `@yielded/auth-simplewebauthn/Browser` for `make()` and
+`layer`, or `/Server` for `make(options)` and `layer` using `PasskeyConfig`.
+Install the matching `@simplewebauthn/browser` or `@simplewebauthn/server` peer.
+
+Applications own challenges, credentials, request binding, sessions, and policy.
+The browser adapter runs only the local ceremony inside the caller's Scope.
+
+See the [passkey guide](https://yielded.dev/auth/guide/passkeys).

package/dist/Browser.d.mts

@@ -0,0 +1,4 @@
+import { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported } from "./internal/browser/models.mjs";
+import { PasskeyBrowser } from "./internal/browser/PasskeyBrowser.mjs";
+import { layerSimpleWebAuthnPasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser } from "./internal/browser/simplewebauthn.mjs";
+export { PasskeyBrowser, PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported, layerSimpleWebAuthnPasskeyBrowser as layer, makeSimpleWebAuthnPasskeyBrowser as make };

package/dist/Browser.mjs

@@ -0,0 +1,4 @@
+import { PasskeyBrowser } from "./internal/browser/PasskeyBrowser.mjs";
+import { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported } from "./internal/browser/models.mjs";
+import { layerSimpleWebAuthnPasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser } from "./internal/browser/simplewebauthn.mjs";
+export { PasskeyBrowser, PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported, layerSimpleWebAuthnPasskeyBrowser as layer, makeSimpleWebAuthnPasskeyBrowser as make };

package/dist/Server.d.mts

@@ -0,0 +1,3 @@
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./internal/server/models.mjs";
+import { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol } from "./internal/server/protocol.mjs";
+export { SimpleWebAuthnPasskeyProtocolOptions, layerSimpleWebAuthnPasskeyProtocol as layer, makeSimpleWebAuthnPasskeyProtocol as make };

package/dist/Server.mjs

@@ -0,0 +1,3 @@
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./internal/server/models.mjs";
+import { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol } from "./internal/server/protocol.mjs";
+export { SimpleWebAuthnPasskeyProtocolOptions, layerSimpleWebAuthnPasskeyProtocol as layer, makeSimpleWebAuthnPasskeyProtocol as make };

package/dist/internal/browser/PasskeyBrowser.d.mts

@@ -0,0 +1,17 @@
+import { PasskeyBrowserAuthentication, PasskeyBrowserCapabilities, PasskeyBrowserFailure, PasskeyBrowserRegistration, PasskeyBrowserUnavailable } from "./models.mjs";
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from "@yielded/auth/Passkey";
+import { Context, Effect } from "effect";
+//#region src/internal/browser/PasskeyBrowser.d.ts
+declare const PasskeyBrowser_base: Context.ServiceClass<PasskeyBrowser, "effect-auth/PasskeyBrowser", {
+  readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;
+  readonly register: (started: typeof PasskeyRegistrationStarted.Type) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;
+  readonly authenticate: (input: {
+    readonly started: typeof PasskeyAuthenticationStarted.Type;
+    readonly mediation: "required" | "conditional";
+  }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;
+}>;
+/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and
+ * request binding. Interrupt its Effect to request cancellation; no global cancel. */
+export declare class PasskeyBrowser extends PasskeyBrowser_base {}
+//#endregion
+//# sourceMappingURL=PasskeyBrowser.d.mts.map

package/dist/internal/browser/PasskeyBrowser.mjs

@@ -0,0 +1,10 @@
+import "@yielded/auth/Passkey";
+import { Context } from "effect";
+//#region src/internal/browser/PasskeyBrowser.ts
+/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and
+* request binding. Interrupt its Effect to request cancellation; no global cancel. */
+var PasskeyBrowser = class extends Context.Service()("effect-auth/PasskeyBrowser") {};
+//#endregion
+export { PasskeyBrowser };
+
+//# sourceMappingURL=PasskeyBrowser.mjs.map

package/dist/internal/browser/PasskeyBrowser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyBrowser.mjs","names":[],"sources":["../../../src/internal/browser/PasskeyBrowser.ts"],"sourcesContent":["import {\n  type PasskeyAuthenticationStarted,\n  type PasskeyRegistrationStarted,\n} from \"@yielded/auth/Passkey\";\nimport { Context, type Effect } from \"effect\";\n\nimport type {\n  PasskeyBrowserAuthentication,\n  PasskeyBrowserCapabilities,\n  PasskeyBrowserFailure,\n  PasskeyBrowserRegistration,\n  PasskeyBrowserUnavailable,\n} from \"./models\";\n\n/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and\n * request binding. Interrupt its Effect to request cancellation; no global cancel. */\nexport class PasskeyBrowser extends Context.Service<\n  PasskeyBrowser,\n  {\n    readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;\n    readonly register: (\n      started: typeof PasskeyRegistrationStarted.Type,\n    ) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;\n    readonly authenticate: (input: {\n      readonly started: typeof PasskeyAuthenticationStarted.Type;\n      readonly mediation: \"required\" | \"conditional\";\n    }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;\n  }\n>()(\"effect-auth/PasskeyBrowser\") {}\n"],"mappings":";;;;;AAgBA,IAAa,iBAAb,cAAoC,QAAQ,QAY1C,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC"}

package/dist/internal/browser/models.d.mts

@@ -0,0 +1,37 @@
+import { Schema } from "effect";
+//#region src/internal/browser/models.d.ts
+export declare const PasskeyBrowserCapability: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+export type PasskeyBrowserCapability = typeof PasskeyBrowserCapability.Type;
+export declare const PasskeyBrowserCapabilities: Schema.Struct<{
+  readonly secureContext: Schema.Boolean;
+  readonly webAuthn: Schema.Boolean;
+  readonly conditionalGet: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly userVerifyingPlatformAuthenticator: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly hybridTransport: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly passkeyPlatformAuthenticator: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+}>;
+export type PasskeyBrowserCapabilities = typeof PasskeyBrowserCapabilities.Type;
+export declare const PasskeyBrowserRegistration: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+export type PasskeyBrowserRegistration = typeof PasskeyBrowserRegistration.Type;
+export declare const PasskeyBrowserAuthentication: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+export type PasskeyBrowserAuthentication = typeof PasskeyBrowserAuthentication.Type;
+declare const PasskeyBrowserInputRejected_base: Schema.Class<PasskeyBrowserInputRejected, Schema.TaggedStruct<"PasskeyBrowserInputRejected", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyBrowserInputRejected extends PasskeyBrowserInputRejected_base {}
+declare const PasskeyBrowserUnsupported_base: Schema.Class<PasskeyBrowserUnsupported, Schema.TaggedStruct<"PasskeyBrowserUnsupported", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyBrowserUnsupported extends PasskeyBrowserUnsupported_base {}
+declare const PasskeyBrowserBusy_base: Schema.Class<PasskeyBrowserBusy, Schema.TaggedStruct<"PasskeyBrowserBusy", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyBrowserBusy extends PasskeyBrowserBusy_base {}
+declare const PasskeyBrowserNotCompleted_base: Schema.Class<PasskeyBrowserNotCompleted, Schema.TaggedStruct<"PasskeyBrowserNotCompleted", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyBrowserNotCompleted extends PasskeyBrowserNotCompleted_base {}
+declare const PasskeyBrowserUnavailable_base: Schema.Class<PasskeyBrowserUnavailable, Schema.TaggedStruct<"PasskeyBrowserUnavailable", {}>, import("effect/Cause").YieldableError>;
+export declare class PasskeyBrowserUnavailable extends PasskeyBrowserUnavailable_base {}
+export declare const PasskeyBrowserFailure: Schema.Union<readonly [typeof PasskeyBrowserInputRejected, typeof PasskeyBrowserUnsupported, typeof PasskeyBrowserBusy, typeof PasskeyBrowserNotCompleted, typeof PasskeyBrowserUnavailable]>;
+export type PasskeyBrowserFailure = typeof PasskeyBrowserFailure.Type;
+//#endregion
+//# sourceMappingURL=models.d.mts.map

package/dist/internal/browser/models.mjs

@@ -0,0 +1,41 @@
+import { PasskeyAssertion, PasskeyAttestation } from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+import { RequestBindingFlowId } from "@yielded/auth/Operations";
+//#region src/internal/browser/models.ts
+const PasskeyBrowserCapability = Schema.Literals([
+	"supported",
+	"unsupported",
+	"unknown"
+]);
+const PasskeyBrowserCapabilities = Schema.Struct({
+	secureContext: Schema.Boolean,
+	webAuthn: Schema.Boolean,
+	conditionalGet: PasskeyBrowserCapability,
+	userVerifyingPlatformAuthenticator: PasskeyBrowserCapability,
+	hybridTransport: PasskeyBrowserCapability,
+	passkeyPlatformAuthenticator: PasskeyBrowserCapability
+});
+const PasskeyBrowserRegistration = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	response: PasskeyAttestation
+});
+const PasskeyBrowserAuthentication = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	response: PasskeyAssertion
+});
+var PasskeyBrowserInputRejected = class extends Schema.TaggedError()("PasskeyBrowserInputRejected", {}) {};
+var PasskeyBrowserUnsupported = class extends Schema.TaggedError()("PasskeyBrowserUnsupported", {}) {};
+var PasskeyBrowserBusy = class extends Schema.TaggedError()("PasskeyBrowserBusy", {}) {};
+var PasskeyBrowserNotCompleted = class extends Schema.TaggedError()("PasskeyBrowserNotCompleted", {}) {};
+var PasskeyBrowserUnavailable = class extends Schema.TaggedError()("PasskeyBrowserUnavailable", {}) {};
+const PasskeyBrowserFailure = Schema.Union([
+	PasskeyBrowserInputRejected,
+	PasskeyBrowserUnsupported,
+	PasskeyBrowserBusy,
+	PasskeyBrowserNotCompleted,
+	PasskeyBrowserUnavailable
+]);
+//#endregion
+export { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported };
+
+//# sourceMappingURL=models.mjs.map

package/dist/internal/browser/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/internal/browser/models.ts"],"sourcesContent":["import { RequestBindingFlowId } from \"@yielded/auth/Operations\";\nimport { PasskeyAssertion, PasskeyAttestation } from \"@yielded/auth/Passkey\";\nimport { Schema } from \"effect\";\n\nexport const PasskeyBrowserCapability = Schema.Literals([\"supported\", \"unsupported\", \"unknown\"]);\nexport type PasskeyBrowserCapability = typeof PasskeyBrowserCapability.Type;\n\nexport const PasskeyBrowserCapabilities = Schema.Struct({\n  secureContext: Schema.Boolean,\n  webAuthn: Schema.Boolean,\n  conditionalGet: PasskeyBrowserCapability,\n  userVerifyingPlatformAuthenticator: PasskeyBrowserCapability,\n  hybridTransport: PasskeyBrowserCapability,\n  passkeyPlatformAuthenticator: PasskeyBrowserCapability,\n});\n\nexport type PasskeyBrowserCapabilities = typeof PasskeyBrowserCapabilities.Type;\n\nexport const PasskeyBrowserRegistration = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  response: PasskeyAttestation,\n});\n\nexport type PasskeyBrowserRegistration = typeof PasskeyBrowserRegistration.Type;\n\nexport const PasskeyBrowserAuthentication = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  response: PasskeyAssertion,\n});\n\nexport type PasskeyBrowserAuthentication = typeof PasskeyBrowserAuthentication.Type;\n\nexport class PasskeyBrowserInputRejected extends Schema.TaggedError<PasskeyBrowserInputRejected>()(\n  \"PasskeyBrowserInputRejected\",\n  {},\n) {}\n\nexport class PasskeyBrowserUnsupported extends Schema.TaggedError<PasskeyBrowserUnsupported>()(\n  \"PasskeyBrowserUnsupported\",\n  {},\n) {}\n\nexport class PasskeyBrowserBusy extends Schema.TaggedError<PasskeyBrowserBusy>()(\n  \"PasskeyBrowserBusy\",\n  {},\n) {}\n\nexport class PasskeyBrowserNotCompleted extends Schema.TaggedError<PasskeyBrowserNotCompleted>()(\n  \"PasskeyBrowserNotCompleted\",\n  {},\n) {}\n\nexport class PasskeyBrowserUnavailable extends Schema.TaggedError<PasskeyBrowserUnavailable>()(\n  \"PasskeyBrowserUnavailable\",\n  {},\n) {}\n\nexport const PasskeyBrowserFailure = Schema.Union([\n  PasskeyBrowserInputRejected,\n  PasskeyBrowserUnsupported,\n  PasskeyBrowserBusy,\n  PasskeyBrowserNotCompleted,\n  PasskeyBrowserUnavailable,\n]);\n\nexport type PasskeyBrowserFailure = typeof PasskeyBrowserFailure.Type;\n"],"mappings":";;;;AAIA,MAAa,2BAA2B,OAAO,SAAS;CAAC;CAAa;CAAe;AAAS,CAAC;AAG/F,MAAa,6BAA6B,OAAO,OAAO;CACtD,eAAe,OAAO;CACtB,UAAU,OAAO;CACjB,gBAAgB;CAChB,oCAAoC;CACpC,iBAAiB;CACjB,8BAA8B;AAChC,CAAC;AAID,MAAa,6BAA6B,OAAO,OAAO;CACtD,QAAQ;CACR,UAAU;AACZ,CAAC;AAID,MAAa,+BAA+B,OAAO,OAAO;CACxD,QAAQ;CACR,UAAU;AACZ,CAAC;AAID,IAAa,8BAAb,cAAiD,OAAO,YAAyC,CAAC,CAChG,+BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,6BAAb,cAAgD,OAAO,YAAwC,CAAC,CAC9F,8BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,wBAAwB,OAAO,MAAM;CAChD;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/internal/browser/simplewebauthn.d.mts

@@ -0,0 +1,16 @@
+import { PasskeyBrowserAuthentication, PasskeyBrowserCapabilities, PasskeyBrowserFailure, PasskeyBrowserRegistration, PasskeyBrowserUnavailable } from "./models.mjs";
+import { PasskeyBrowser } from "./PasskeyBrowser.mjs";
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from "@yielded/auth/Passkey";
+import { Effect, Layer } from "effect";
+//#region src/internal/browser/simplewebauthn.d.ts
+export declare const makeSimpleWebAuthnPasskeyBrowser: () => Effect.Effect<{
+  readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;
+  readonly register: (started: typeof PasskeyRegistrationStarted.Type) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;
+  readonly authenticate: (input: {
+    readonly started: typeof PasskeyAuthenticationStarted.Type;
+    readonly mediation: "required" | "conditional";
+  }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;
+}, never, never>;
+export declare const layerSimpleWebAuthnPasskeyBrowser: Layer.Layer<PasskeyBrowser>;
+//#endregion
+//# sourceMappingURL=simplewebauthn.d.mts.map

package/dist/internal/browser/simplewebauthn.mjs

@@ -0,0 +1,410 @@
+import { PasskeyBrowser } from "./PasskeyBrowser.mjs";
+import { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported } from "./models.mjs";
+import { PasskeyAuthenticationStarted, PasskeyProtocolCredentialId, PasskeyRegistrationStarted, snapshotPasskey } from "@yielded/auth/Passkey";
+import { DateTime, Effect, Layer, Predicate, Redacted, Schema } from "effect";
+import { base64URLStringToBuffer, browserSupportsWebAuthn, browserSupportsWebAuthnAutofill, bufferToBase64URLString, platformAuthenticatorIsAvailable } from "@simplewebauthn/browser";
+//#region src/internal/browser/simplewebauthn.ts
+const unavailable = () => PasskeyBrowserUnavailable.make({});
+const rejected = () => PasskeyBrowserInputRejected.make({});
+const incomplete = () => PasskeyBrowserNotCompleted.make({});
+const unexpected = (effect) => effect.pipe(Effect.catchDefect(() => Effect.fail(unavailable())));
+const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(unavailable));
+const capture = (schema, value) => snapshotPasskey(schema, value).pipe(Effect.mapError(rejected));
+const maintained = (call) => Effect.tryPromise({
+	try: call,
+	catch: unavailable
+});
+const timeout = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 3e5
+}));
+const registrationInput = Schema.Struct({
+	...PasskeyRegistrationStarted.fields,
+	options: Schema.Struct({
+		...PasskeyRegistrationStarted.fields.options.fields,
+		timeout
+	})
+});
+const authenticationInput = Schema.Struct({
+	started: Schema.Struct({
+		...PasskeyAuthenticationStarted.fields,
+		options: Schema.Struct({
+			...PasskeyAuthenticationStarted.fields.options.fields,
+			timeout
+		})
+	}),
+	mediation: Schema.Literals(["required", "conditional"])
+});
+const nativeCapabilities = Schema.Struct({
+	conditionalGet: Schema.UndefinedOr(Schema.Boolean),
+	userVerifyingPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),
+	hybridTransport: Schema.UndefinedOr(Schema.Boolean),
+	passkeyPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean)
+});
+const support = (value) => value === void 0 ? "unknown" : value ? "supported" : "unsupported";
+const readCapabilities = Effect.gen(function* () {
+	if (typeof globalThis.PublicKeyCredential.getClientCapabilities !== "function") return {
+		conditionalGet: void 0,
+		userVerifyingPlatformAuthenticator: void 0,
+		hybridTransport: void 0,
+		passkeyPlatformAuthenticator: void 0
+	};
+	const raw = yield* maintained(() => globalThis.PublicKeyCredential.getClientCapabilities());
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(raw)) throw unavailable();
+			return {
+				conditionalGet: raw.conditionalGet,
+				userVerifyingPlatformAuthenticator: raw.userVerifyingPlatformAuthenticator,
+				hybridTransport: raw.hybridTransport,
+				passkeyPlatformAuthenticator: raw.passkeyPlatformAuthenticator
+			};
+		},
+		catch: unavailable
+	});
+	return yield* decode(nativeCapabilities, fields);
+});
+const booleanCapability = Effect.fn("passkeyBrowserBooleanCapability")(function* (call) {
+	return (yield* decode(Schema.Boolean, yield* maintained(call))) ? "supported" : "unsupported";
+});
+const environment = Effect.try({
+	try: () => {
+		const secureContext = globalThis.isSecureContext === true;
+		const container = globalThis.navigator?.credentials;
+		return {
+			secureContext,
+			webAuthn: secureContext && browserSupportsWebAuthn() && container !== void 0 && typeof container.get === "function" && typeof container.create === "function" && typeof globalThis.AbortController === "function",
+			container
+		};
+	},
+	catch: unavailable
+});
+const capabilities = Effect.gen(function* () {
+	const env = yield* environment;
+	if (!env.webAuthn) return yield* snapshotPasskey(PasskeyBrowserCapabilities, {
+		secureContext: env.secureContext,
+		webAuthn: false,
+		conditionalGet: "unsupported",
+		userVerifyingPlatformAuthenticator: "unsupported",
+		hybridTransport: "unsupported",
+		passkeyPlatformAuthenticator: "unsupported"
+	}).pipe(Effect.mapError(unavailable));
+	const raw = yield* readCapabilities;
+	const values = {
+		conditionalGet: support(raw.conditionalGet),
+		userVerifyingPlatformAuthenticator: support(raw.userVerifyingPlatformAuthenticator),
+		hybridTransport: support(raw.hybridTransport),
+		passkeyPlatformAuthenticator: support(raw.passkeyPlatformAuthenticator)
+	};
+	const conditionalGet = values.conditionalGet === "unknown" ? typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable === "function" ? yield* booleanCapability(browserSupportsWebAuthnAutofill) : "unsupported" : values.conditionalGet;
+	const platform = values.userVerifyingPlatformAuthenticator === "unknown" && typeof globalThis.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable === "function" ? yield* booleanCapability(platformAuthenticatorIsAvailable) : values.userVerifyingPlatformAuthenticator;
+	return yield* snapshotPasskey(PasskeyBrowserCapabilities, {
+		secureContext: env.secureContext,
+		webAuthn: true,
+		...values,
+		conditionalGet,
+		userVerifyingPlatformAuthenticator: platform
+	}).pipe(Effect.mapError(unavailable));
+}).pipe(Effect.timeoutOrElse({
+	duration: 5e3,
+	orElse: () => Effect.fail(unavailable())
+}), unexpected);
+const leases = /* @__PURE__ */ new WeakMap();
+const settle = (lease) => {
+	lease.phase = "settled";
+	if (leases.get(lease.container) === lease) leases.delete(lease.container);
+};
+const acquire = Effect.gen(function* () {
+	const env = yield* environment;
+	if (!env.webAuthn || env.container === void 0) return yield* PasskeyBrowserUnsupported.make({});
+	if (leases.has(env.container)) return yield* PasskeyBrowserBusy.make({});
+	const lease = {
+		container: env.container,
+		controller: new AbortController(),
+		phase: "pre-native"
+	};
+	leases.set(env.container, lease);
+	return lease;
+});
+const release = (lease) => Effect.sync(() => {
+	if (lease.phase === "settled") return;
+	try {
+		lease.controller.abort();
+	} catch {}
+	if (lease.phase === "pre-native") settle(lease);
+});
+const nativeFailure = (value) => {
+	try {
+		if (!Predicate.isObject(value)) return unavailable();
+		const parsed = Schema.decodeUnknownOption(Schema.String)(value.name);
+		if (parsed._tag === "Some" && [
+			"NotAllowedError",
+			"InvalidStateError",
+			"ConstraintError",
+			"NotSupportedError",
+			"SecurityError",
+			"AbortError"
+		].includes(parsed.value)) return incomplete();
+	} catch {}
+	return unavailable();
+};
+const native = (lease, request) => Effect.callback((resume, signal) => {
+	if (signal.aborted || lease.controller.signal.aborted || lease.phase !== "pre-native" || leases.get(lease.container) !== lease) {
+		resume(Effect.fail(incomplete()));
+		return;
+	}
+	lease.phase = "native";
+	try {
+		const promise = request._tag === "Create" ? lease.container.create({
+			publicKey: request.publicKey,
+			signal: lease.controller.signal
+		}) : lease.container.get({
+			publicKey: request.publicKey,
+			mediation: request.mediation,
+			signal: lease.controller.signal
+		});
+		Promise.resolve(promise).then((value) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && !lease.controller.signal.aborted) resume(Effect.succeed(value));
+			} catch {}
+		}, (error) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && !lease.controller.signal.aborted) resume(Effect.fail(nativeFailure(error)));
+			} catch {}
+		});
+	} catch (error) {
+		settle(lease);
+		resume(Effect.fail(nativeFailure(error)));
+	}
+});
+const remaining = Effect.fn("passkeyBrowserRemaining")(function* (deadline) {
+	const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);
+	if (duration <= 0) return yield* incomplete();
+	return Math.max(1, Math.floor(duration));
+});
+const runCeremony = Effect.fn("passkeyBrowserRunCeremony")(function* (started, use) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (started.expiresAtMillis <= now) return yield* rejected();
+	const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);
+	return yield* Effect.acquireUseRelease(acquire, (lease) => Effect.gen(function* () {
+		const duration = yield* remaining(deadline);
+		return yield* use(lease, deadline).pipe(Effect.timeoutOrElse({
+			duration,
+			orElse: () => Effect.fail(incomplete())
+		}));
+	}), release);
+});
+const nativeEnvelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: Schema.instanceOf(ArrayBuffer),
+	type: Schema.Literal("public-key")
+};
+const nativeRegistration = Schema.Struct({
+	...nativeEnvelope,
+	response: Schema.Struct({
+		attestationObject: Schema.instanceOf(ArrayBuffer),
+		clientDataJSON: Schema.instanceOf(ArrayBuffer)
+	})
+});
+const nativeAuthentication = Schema.Struct({
+	...nativeEnvelope,
+	response: Schema.Struct({
+		authenticatorData: Schema.instanceOf(ArrayBuffer),
+		clientDataJSON: Schema.instanceOf(ArrayBuffer),
+		signature: Schema.instanceOf(ArrayBuffer),
+		userHandle: Schema.optionalKey(Schema.NullOr(Schema.instanceOf(ArrayBuffer)))
+	})
+});
+const buffer = Effect.fn("passkeyBrowserBuffer")(function* (value, minimum, maximum) {
+	const copied = yield* Effect.try({
+		try: () => ArrayBuffer.prototype.slice.call(value, 0, maximum + 1),
+		catch: unavailable
+	});
+	if (copied.byteLength < minimum || copied.byteLength > maximum) return yield* unavailable();
+	return yield* Effect.try({
+		try: () => bufferToBase64URLString(copied),
+		catch: unavailable
+	});
+});
+const registrationWire = Schema.fromJsonString(Schema.Struct({
+	id: Schema.String,
+	rawId: Schema.String,
+	type: Schema.Literal("public-key"),
+	response: Schema.Struct({
+		attestationObject: Schema.String,
+		clientDataJSON: Schema.String
+	}),
+	clientExtensionResults: Schema.Struct({})
+}));
+const authenticationWire = Schema.fromJsonString(Schema.Struct({
+	id: Schema.String,
+	rawId: Schema.String,
+	type: Schema.Literal("public-key"),
+	response: Schema.Struct({
+		authenticatorData: Schema.String,
+		clientDataJSON: Schema.String,
+		signature: Schema.String,
+		userHandle: Schema.optionalKey(Schema.String)
+	}),
+	clientExtensionResults: Schema.Struct({})
+}));
+const registrationResponse = Effect.fn("passkeyBrowserRegistrationResponse")(function* (value) {
+	if (value === null) return yield* incomplete();
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(value)) throw unavailable();
+			const response = value.response;
+			if (!Predicate.isObject(response)) throw unavailable();
+			return {
+				id: value.id,
+				rawId: value.rawId,
+				type: value.type,
+				response: {
+					attestationObject: response.attestationObject,
+					clientDataJSON: response.clientDataJSON
+				}
+			};
+		},
+		catch: unavailable
+	});
+	const credential = yield* decode(nativeRegistration, fields);
+	const rawId = yield* buffer(credential.rawId, 1, 1023);
+	if (credential.id !== rawId) return yield* unavailable();
+	return yield* Schema.encodeEffect(registrationWire)({
+		id: credential.id,
+		rawId,
+		type: "public-key",
+		response: {
+			attestationObject: yield* buffer(credential.response.attestationObject, 1, 65536),
+			clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192)
+		},
+		clientExtensionResults: {}
+	}).pipe(Effect.mapError(unavailable));
+});
+const authenticationResponse = Effect.fn("passkeyBrowserAuthenticationResponse")(function* (value) {
+	if (value === null) return yield* incomplete();
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(value)) throw unavailable();
+			const response = value.response;
+			if (!Predicate.isObject(response)) throw unavailable();
+			const userHandle = response.userHandle;
+			return {
+				id: value.id,
+				rawId: value.rawId,
+				type: value.type,
+				response: {
+					authenticatorData: response.authenticatorData,
+					clientDataJSON: response.clientDataJSON,
+					signature: response.signature,
+					...userHandle === void 0 ? {} : { userHandle }
+				}
+			};
+		},
+		catch: unavailable
+	});
+	const credential = yield* decode(nativeAuthentication, fields);
+	const rawId = yield* buffer(credential.rawId, 1, 1023);
+	if (credential.id !== rawId) return yield* unavailable();
+	const handle = credential.response.userHandle;
+	return yield* Schema.encodeEffect(authenticationWire)({
+		id: credential.id,
+		rawId,
+		type: "public-key",
+		response: {
+			authenticatorData: yield* buffer(credential.response.authenticatorData, 37, 16384),
+			clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),
+			signature: yield* buffer(credential.response.signature, 1, 1024),
+			...handle === null || handle === void 0 ? {} : { userHandle: yield* buffer(handle, 1, 64) }
+		},
+		clientExtensionResults: {}
+	}).pipe(Effect.mapError(unavailable));
+});
+const conditional = Effect.gen(function* () {
+	if (typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable !== "function") return yield* PasskeyBrowserUnsupported.make({});
+	if ((yield* booleanCapability(browserSupportsWebAuthnAutofill)) !== "supported") return yield* PasskeyBrowserUnsupported.make({});
+	if (!(yield* Effect.try({
+		try: () => Array.from(globalThis.document.querySelectorAll("input[autocomplete]")).some((input) => input.getAttribute("autocomplete")?.split(/[\t\n\f\r ]+/).filter((token) => token.length > 0).at(-1)?.toLowerCase() === "webauthn"),
+		catch: unavailable
+	}))) return yield* rejected();
+}).pipe(Effect.timeoutOrElse({
+	duration: 5e3,
+	orElse: () => Effect.fail(unavailable())
+}));
+const makeSimpleWebAuthnPasskeyBrowser = Effect.fn("makeSimpleWebAuthnPasskeyBrowser")(() => Effect.sync(() => {
+	const register = Effect.fn("PasskeyBrowser.register")(function* (input) {
+		const started = yield* capture(registrationInput, input);
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			const timeoutMillis = yield* remaining(deadline);
+			const options = started.options;
+			const publicKey = {
+				challenge: base64URLStringToBuffer(options.challenge),
+				rp: { ...options.rp },
+				user: {
+					...options.user,
+					id: base64URLStringToBuffer(options.user.id)
+				},
+				pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),
+				timeout: timeoutMillis,
+				attestation: options.attestation,
+				authenticatorSelection: { ...options.authenticatorSelection },
+				excludeCredentials: options.excludeCredentials.map((value) => ({
+					type: value.type,
+					id: base64URLStringToBuffer(value.id)
+				}))
+			};
+			yield* remaining(deadline);
+			const response = yield* registrationResponse(yield* native(lease, {
+				_tag: "Create",
+				publicKey
+			}));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyBrowserRegistration, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(unavailable));
+		}));
+	}, unexpected);
+	const authenticate = Effect.fn("PasskeyBrowser.authenticate")(function* (input) {
+		const { started, mediation } = yield* capture(authenticationInput, input);
+		if (mediation === "conditional" && started.options.allowCredentials.length !== 0) return yield* rejected();
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			if (mediation === "conditional") yield* conditional;
+			const timeoutMillis = yield* remaining(deadline);
+			const options = started.options;
+			const publicKey = {
+				challenge: base64URLStringToBuffer(options.challenge),
+				rpId: options.rpId,
+				userVerification: options.userVerification,
+				timeout: timeoutMillis,
+				allowCredentials: options.allowCredentials.map((value) => ({
+					type: value.type,
+					id: base64URLStringToBuffer(value.id)
+				}))
+			};
+			yield* remaining(deadline);
+			const response = yield* authenticationResponse(yield* native(lease, {
+				_tag: "Get",
+				publicKey,
+				mediation
+			}));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyBrowserAuthentication, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(unavailable));
+		}));
+	}, unexpected);
+	return PasskeyBrowser.of({
+		capabilities,
+		register,
+		authenticate
+	});
+}));
+const layerSimpleWebAuthnPasskeyBrowser = Layer.effect(PasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser());
+//#endregion
+export { layerSimpleWebAuthnPasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser };
+
+//# sourceMappingURL=simplewebauthn.mjs.map