@yielded/auth-simplewebauthn 0.1.0-beta.0

package/dist/internal/browser/simplewebauthn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.mjs","names":[],"sources":["../../../src/internal/browser/simplewebauthn.ts"],"sourcesContent":["import {\n  base64URLStringToBuffer,\n  browserSupportsWebAuthn,\n  browserSupportsWebAuthnAutofill,\n  bufferToBase64URLString,\n  platformAuthenticatorIsAvailable,\n} from \"@simplewebauthn/browser\";\nimport {\n  PasskeyAuthenticationStarted,\n  PasskeyProtocolCredentialId,\n  PasskeyRegistrationStarted,\n  snapshotPasskey,\n} from \"@yielded/auth/Passkey\";\nimport type { Context } from \"effect\";\nimport { DateTime, Effect, Layer, Predicate, Redacted, Schema } from \"effect\";\n\nimport {\n  PasskeyBrowserAuthentication,\n  PasskeyBrowserBusy,\n  PasskeyBrowserCapabilities,\n  type PasskeyBrowserFailure,\n  PasskeyBrowserInputRejected,\n  PasskeyBrowserNotCompleted,\n  PasskeyBrowserRegistration,\n  PasskeyBrowserUnavailable,\n  PasskeyBrowserUnsupported,\n} from \"./models\";\nimport { PasskeyBrowser } from \"./PasskeyBrowser\";\n\ntype Browser = Context.Service.Shape<typeof PasskeyBrowser>;\nconst unavailable = () => PasskeyBrowserUnavailable.make({});\nconst rejected = () => PasskeyBrowserInputRejected.make({});\nconst incomplete = () => PasskeyBrowserNotCompleted.make({});\n\nconst unexpected = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(Effect.catchDefect(() => Effect.fail(unavailable())));\n\nconst decode = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: unknown,\n) =>\n  // Native browser objects and maintained capability helpers are untyped boundaries.\n  // eslint-disable-next-line no-restricted-properties\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(unavailable));\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) => snapshotPasskey(schema, value).pipe(Effect.mapError(rejected));\n\nconst maintained = <A>(call: () => PromiseLike<A>) =>\n  Effect.tryPromise({ try: call, catch: unavailable });\n\nconst timeout = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 }));\n\nconst registrationInput = Schema.Struct({\n  ...PasskeyRegistrationStarted.fields,\n  options: Schema.Struct({ ...PasskeyRegistrationStarted.fields.options.fields, timeout }),\n});\n\nconst authenticationInput = Schema.Struct({\n  started: Schema.Struct({\n    ...PasskeyAuthenticationStarted.fields,\n    options: Schema.Struct({ ...PasskeyAuthenticationStarted.fields.options.fields, timeout }),\n  }),\n  mediation: Schema.Literals([\"required\", \"conditional\"]),\n});\n\nconst nativeCapabilities = Schema.Struct({\n  conditionalGet: Schema.UndefinedOr(Schema.Boolean),\n  userVerifyingPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),\n  hybridTransport: Schema.UndefinedOr(Schema.Boolean),\n  passkeyPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),\n});\n\nconst support = (value: boolean | undefined) =>\n  value === undefined\n    ? (\"unknown\" as const)\n    : value\n      ? (\"supported\" as const)\n      : (\"unsupported\" as const);\n\nconst readCapabilities = Effect.gen(function* () {\n  if (typeof globalThis.PublicKeyCredential.getClientCapabilities !== \"function\")\n    return {\n      conditionalGet: undefined,\n      userVerifyingPlatformAuthenticator: undefined,\n      hybridTransport: undefined,\n      passkeyPlatformAuthenticator: undefined,\n    };\n  const raw = yield* maintained(() => globalThis.PublicKeyCredential.getClientCapabilities());\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(raw)) throw unavailable();\n\n      return {\n        conditionalGet: raw.conditionalGet,\n        userVerifyingPlatformAuthenticator: raw.userVerifyingPlatformAuthenticator,\n        hybridTransport: raw.hybridTransport,\n        passkeyPlatformAuthenticator: raw.passkeyPlatformAuthenticator,\n      };\n    },\n    catch: unavailable,\n  });\n\n  return yield* decode(nativeCapabilities, fields);\n});\n\nconst booleanCapability = Effect.fn(\"passkeyBrowserBooleanCapability\")(function* (\n  call: () => PromiseLike<boolean>,\n) {\n  const value = yield* decode(Schema.Boolean, yield* maintained(call));\n\n  return value ? (\"supported\" as const) : (\"unsupported\" as const);\n});\n\nconst environment = Effect.try({\n  try: () => {\n    const secureContext = globalThis.isSecureContext === true;\n    const container = globalThis.navigator?.credentials;\n\n    const webAuthn =\n      secureContext &&\n      browserSupportsWebAuthn() &&\n      container !== undefined &&\n      typeof container.get === \"function\" &&\n      typeof container.create === \"function\" &&\n      typeof globalThis.AbortController === \"function\";\n\n    return { secureContext, webAuthn, container };\n  },\n  catch: unavailable,\n});\n\nconst capabilities = Effect.gen(function* () {\n  const env = yield* environment;\n\n  if (!env.webAuthn)\n    return yield* snapshotPasskey(PasskeyBrowserCapabilities, {\n      secureContext: env.secureContext,\n      webAuthn: false,\n      conditionalGet: \"unsupported\",\n      userVerifyingPlatformAuthenticator: \"unsupported\",\n      hybridTransport: \"unsupported\",\n      passkeyPlatformAuthenticator: \"unsupported\",\n    }).pipe(Effect.mapError(unavailable));\n  const raw = yield* readCapabilities;\n\n  const values = {\n    conditionalGet: support(raw.conditionalGet),\n    userVerifyingPlatformAuthenticator: support(raw.userVerifyingPlatformAuthenticator),\n    hybridTransport: support(raw.hybridTransport),\n    passkeyPlatformAuthenticator: support(raw.passkeyPlatformAuthenticator),\n  };\n\n  const conditionalGet =\n    values.conditionalGet === \"unknown\"\n      ? typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable === \"function\"\n        ? yield* booleanCapability(browserSupportsWebAuthnAutofill)\n        : (\"unsupported\" as const)\n      : values.conditionalGet;\n\n  const platform =\n    values.userVerifyingPlatformAuthenticator === \"unknown\" &&\n    typeof globalThis.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable ===\n      \"function\"\n      ? yield* booleanCapability(platformAuthenticatorIsAvailable)\n      : values.userVerifyingPlatformAuthenticator;\n\n  return yield* snapshotPasskey(PasskeyBrowserCapabilities, {\n    secureContext: env.secureContext,\n    webAuthn: true,\n    ...values,\n    conditionalGet,\n    userVerifyingPlatformAuthenticator: platform,\n  }).pipe(Effect.mapError(unavailable));\n}).pipe(\n  Effect.timeoutOrElse({ duration: 5000, orElse: () => Effect.fail(unavailable()) }),\n  unexpected,\n);\n\ninterface Lease {\n  readonly container: CredentialsContainer;\n  readonly controller: AbortController;\n  phase: \"pre-native\" | \"native\" | \"settled\";\n}\n// One installed module coordinates its instances. No third-party/global cancel.\nconst leases = new WeakMap<CredentialsContainer, Lease>();\n\nconst settle = (lease: Lease): void => {\n  lease.phase = \"settled\";\n  if (leases.get(lease.container) === lease) leases.delete(lease.container);\n};\n\nconst acquire = Effect.gen(function* () {\n  const env = yield* environment;\n\n  if (!env.webAuthn || env.container === undefined)\n    return yield* PasskeyBrowserUnsupported.make({});\n  if (leases.has(env.container)) return yield* PasskeyBrowserBusy.make({});\n\n  const lease: Lease = {\n    container: env.container,\n    controller: new AbortController(),\n    phase: \"pre-native\",\n  };\n\n  leases.set(env.container, lease);\n\n  return lease;\n});\n\nconst release = (lease: Lease) =>\n  Effect.sync(() => {\n    if (lease.phase === \"settled\") return;\n    // Abort requests cancellation; only raw native settlement releases a started call.\n    try {\n      lease.controller.abort();\n    } catch {\n      /* Cleanup cannot replace interruption with a defect. */\n    }\n    if (lease.phase === \"pre-native\") settle(lease);\n  });\n\nconst nativeFailure = (value: unknown): PasskeyBrowserNotCompleted | PasskeyBrowserUnavailable => {\n  try {\n    if (!Predicate.isObject(value)) return unavailable();\n    // Only the native error's standardized name is inspected; no message or cause.\n    // eslint-disable-next-line no-restricted-properties\n    const parsed = Schema.decodeUnknownOption(Schema.String)(value.name);\n\n    if (\n      parsed._tag === \"Some\" &&\n      [\n        \"NotAllowedError\",\n        \"InvalidStateError\",\n        \"ConstraintError\",\n        \"NotSupportedError\",\n        \"SecurityError\",\n        \"AbortError\",\n      ].includes(parsed.value)\n    )\n      return incomplete();\n  } catch {\n    /* Throwing extension error properties are unavailable. */\n  }\n\n  return unavailable();\n};\n\ntype NativeRequest =\n  | {\n      readonly _tag: \"Create\";\n      readonly publicKey: PublicKeyCredentialCreationOptions;\n    }\n  | {\n      readonly _tag: \"Get\";\n      readonly publicKey: PublicKeyCredentialRequestOptions;\n      readonly mediation: \"required\" | \"conditional\";\n    };\n\nconst native = (lease: Lease, request: NativeRequest) =>\n  Effect.callback<unknown, PasskeyBrowserNotCompleted | PasskeyBrowserUnavailable>(\n    (resume, signal) => {\n      if (\n        signal.aborted ||\n        lease.controller.signal.aborted ||\n        lease.phase !== \"pre-native\" ||\n        leases.get(lease.container) !== lease\n      ) {\n        resume(Effect.fail(incomplete()));\n\n        return;\n      }\n      lease.phase = \"native\";\n      try {\n        const promise =\n          request._tag === \"Create\"\n            ? lease.container.create({\n                publicKey: request.publicKey,\n                signal: lease.controller.signal,\n              })\n            : lease.container.get({\n                publicKey: request.publicKey,\n                mediation: request.mediation,\n                signal: lease.controller.signal,\n              });\n\n        // Both handlers always settle and never throw, including after interruption.\n        void Promise.resolve(promise).then(\n          (value) => {\n            try {\n              settle(lease);\n              if (!signal.aborted && !lease.controller.signal.aborted)\n                resume(Effect.succeed(value));\n            } catch {\n              /* Detached handlers cannot reject. */\n            }\n          },\n          (error) => {\n            try {\n              settle(lease);\n              if (!signal.aborted && !lease.controller.signal.aborted)\n                resume(Effect.fail(nativeFailure(error)));\n            } catch {\n              /* Detached handlers cannot reject. */\n            }\n          },\n        );\n      } catch (error) {\n        settle(lease);\n        resume(Effect.fail(nativeFailure(error)));\n      }\n    },\n  );\n\nconst remaining = Effect.fn(\"passkeyBrowserRemaining\")(function* (deadline: number) {\n  const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (duration <= 0) return yield* incomplete();\n\n  return Math.max(1, Math.floor(duration));\n});\n\nconst runCeremony = Effect.fn(\"passkeyBrowserRunCeremony\")(function* <A>(\n  started: { readonly expiresAtMillis: number; readonly options: { readonly timeout: number } },\n  use: (lease: Lease, deadline: number) => Effect.Effect<A, PasskeyBrowserFailure>,\n) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (started.expiresAtMillis <= now) return yield* rejected();\n  const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);\n\n  return yield* Effect.acquireUseRelease(\n    acquire,\n    (lease) =>\n      Effect.gen(function* () {\n        const duration = yield* remaining(deadline);\n\n        return yield* use(lease, deadline).pipe(\n          Effect.timeoutOrElse({ duration, orElse: () => Effect.fail(incomplete()) }),\n        );\n      }),\n    release,\n  );\n});\n\nconst nativeEnvelope = {\n  id: PasskeyProtocolCredentialId,\n  rawId: Schema.instanceOf(ArrayBuffer),\n  type: Schema.Literal(\"public-key\"),\n};\n\nconst nativeRegistration = Schema.Struct({\n  ...nativeEnvelope,\n  response: Schema.Struct({\n    attestationObject: Schema.instanceOf(ArrayBuffer),\n    clientDataJSON: Schema.instanceOf(ArrayBuffer),\n  }),\n});\n\nconst nativeAuthentication = Schema.Struct({\n  ...nativeEnvelope,\n  response: Schema.Struct({\n    authenticatorData: Schema.instanceOf(ArrayBuffer),\n    clientDataJSON: Schema.instanceOf(ArrayBuffer),\n    signature: Schema.instanceOf(ArrayBuffer),\n    userHandle: Schema.optionalKey(Schema.NullOr(Schema.instanceOf(ArrayBuffer))),\n  }),\n});\n\nconst buffer = Effect.fn(\"passkeyBrowserBuffer\")(function* (\n  value: ArrayBuffer,\n  minimum: number,\n  maximum: number,\n) {\n  // Slice with an upper bound before conversion, ignoring instance overrides.\n  const copied = yield* Effect.try({\n    try: () => ArrayBuffer.prototype.slice.call(value, 0, maximum + 1),\n    catch: unavailable,\n  });\n\n  if (copied.byteLength < minimum || copied.byteLength > maximum) return yield* unavailable();\n\n  return yield* Effect.try({ try: () => bufferToBase64URLString(copied), catch: unavailable });\n});\n\nconst registrationWire = Schema.fromJsonString(\n  Schema.Struct({\n    id: Schema.String,\n    rawId: Schema.String,\n    type: Schema.Literal(\"public-key\"),\n    response: Schema.Struct({ attestationObject: Schema.String, clientDataJSON: Schema.String }),\n    clientExtensionResults: Schema.Struct({}),\n  }),\n);\n\nconst authenticationWire = Schema.fromJsonString(\n  Schema.Struct({\n    id: Schema.String,\n    rawId: Schema.String,\n    type: Schema.Literal(\"public-key\"),\n    response: Schema.Struct({\n      authenticatorData: Schema.String,\n      clientDataJSON: Schema.String,\n      signature: Schema.String,\n      userHandle: Schema.optionalKey(Schema.String),\n    }),\n    clientExtensionResults: Schema.Struct({}),\n  }),\n);\n\nconst registrationResponse = Effect.fn(\"passkeyBrowserRegistrationResponse\")(function* (\n  value: unknown,\n) {\n  if (value === null) return yield* incomplete();\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(value)) throw unavailable();\n      const response = value.response;\n\n      if (!Predicate.isObject(response)) throw unavailable();\n\n      return {\n        id: value.id,\n        rawId: value.rawId,\n        type: value.type,\n        response: {\n          attestationObject: response.attestationObject,\n          clientDataJSON: response.clientDataJSON,\n        },\n      };\n    },\n    catch: unavailable,\n  });\n\n  const credential = yield* decode(nativeRegistration, fields);\n  const rawId = yield* buffer(credential.rawId, 1, 1023);\n\n  if (credential.id !== rawId) return yield* unavailable();\n\n  return yield* Schema.encodeEffect(registrationWire)({\n    id: credential.id,\n    rawId,\n    type: \"public-key\",\n    response: {\n      attestationObject: yield* buffer(credential.response.attestationObject, 1, 65536),\n      clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),\n    },\n    clientExtensionResults: {},\n  }).pipe(Effect.mapError(unavailable));\n});\n\nconst authenticationResponse = Effect.fn(\"passkeyBrowserAuthenticationResponse\")(function* (\n  value: unknown,\n) {\n  if (value === null) return yield* incomplete();\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(value)) throw unavailable();\n      const response = value.response;\n\n      if (!Predicate.isObject(response)) throw unavailable();\n      const userHandle = response.userHandle;\n\n      return {\n        id: value.id,\n        rawId: value.rawId,\n        type: value.type,\n        response: {\n          authenticatorData: response.authenticatorData,\n          clientDataJSON: response.clientDataJSON,\n          signature: response.signature,\n          ...(userHandle === undefined ? {} : { userHandle }),\n        },\n      };\n    },\n    catch: unavailable,\n  });\n\n  const credential = yield* decode(nativeAuthentication, fields);\n  const rawId = yield* buffer(credential.rawId, 1, 1023);\n\n  if (credential.id !== rawId) return yield* unavailable();\n  const handle = credential.response.userHandle;\n\n  return yield* Schema.encodeEffect(authenticationWire)({\n    id: credential.id,\n    rawId,\n    type: \"public-key\",\n    response: {\n      authenticatorData: yield* buffer(credential.response.authenticatorData, 37, 16384),\n      clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),\n      signature: yield* buffer(credential.response.signature, 1, 1024),\n      ...(handle === null || handle === undefined\n        ? {}\n        : { userHandle: yield* buffer(handle, 1, 64) }),\n    },\n    clientExtensionResults: {},\n  }).pipe(Effect.mapError(unavailable));\n});\n\nconst conditional = Effect.gen(function* () {\n  if (typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable !== \"function\")\n    return yield* PasskeyBrowserUnsupported.make({});\n  if ((yield* booleanCapability(browserSupportsWebAuthnAutofill)) !== \"supported\")\n    return yield* PasskeyBrowserUnsupported.make({});\n\n  const present = yield* Effect.try({\n    try: () =>\n      Array.from(globalThis.document.querySelectorAll(\"input[autocomplete]\")).some(\n        (input) =>\n          input\n            .getAttribute(\"autocomplete\")\n            ?.split(/[\\t\\n\\f\\r ]+/)\n            .filter((token) => token.length > 0)\n            .at(-1)\n            ?.toLowerCase() === \"webauthn\",\n      ),\n    catch: unavailable,\n  });\n\n  if (!present) return yield* rejected();\n}).pipe(Effect.timeoutOrElse({ duration: 5000, orElse: () => Effect.fail(unavailable()) }));\n\nexport const makeSimpleWebAuthnPasskeyBrowser = Effect.fn(\"makeSimpleWebAuthnPasskeyBrowser\")(\n  (): Effect.Effect<Browser> =>\n    Effect.sync(() => {\n      const register = Effect.fn(\"PasskeyBrowser.register\")(function* (\n        input: Parameters<Browser[\"register\"]>[0],\n      ) {\n        const started = yield* capture(registrationInput, input);\n\n        return yield* runCeremony(started, (lease, deadline) =>\n          Effect.gen(function* () {\n            const timeoutMillis = yield* remaining(deadline);\n            const options = started.options;\n\n            const publicKey: PublicKeyCredentialCreationOptions = {\n              challenge: base64URLStringToBuffer(options.challenge),\n              rp: { ...options.rp },\n              user: { ...options.user, id: base64URLStringToBuffer(options.user.id) },\n              pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),\n              timeout: timeoutMillis,\n              attestation: options.attestation,\n              authenticatorSelection: { ...options.authenticatorSelection },\n              excludeCredentials: options.excludeCredentials.map((value) => ({\n                type: value.type,\n                id: base64URLStringToBuffer(value.id),\n              })),\n            };\n\n            yield* remaining(deadline);\n\n            const response = yield* registrationResponse(\n              yield* native(lease, { _tag: \"Create\", publicKey }),\n            );\n\n            yield* remaining(deadline);\n\n            return yield* snapshotPasskey(PasskeyBrowserRegistration, {\n              flowId: started.flowId,\n              response: Redacted.make(response),\n            }).pipe(Effect.mapError(unavailable));\n          }),\n        );\n      }, unexpected);\n\n      const authenticate = Effect.fn(\"PasskeyBrowser.authenticate\")(function* (\n        input: Parameters<Browser[\"authenticate\"]>[0],\n      ) {\n        const fixed = yield* capture(authenticationInput, input);\n        const { started, mediation } = fixed;\n\n        if (mediation === \"conditional\" && started.options.allowCredentials.length !== 0)\n          return yield* rejected();\n\n        return yield* runCeremony(started, (lease, deadline) =>\n          Effect.gen(function* () {\n            if (mediation === \"conditional\") yield* conditional;\n            const timeoutMillis = yield* remaining(deadline);\n            const options = started.options;\n\n            const publicKey: PublicKeyCredentialRequestOptions = {\n              challenge: base64URLStringToBuffer(options.challenge),\n              rpId: options.rpId,\n              userVerification: options.userVerification,\n              timeout: timeoutMillis,\n              allowCredentials: options.allowCredentials.map((value) => ({\n                type: value.type,\n                id: base64URLStringToBuffer(value.id),\n              })),\n            };\n\n            yield* remaining(deadline);\n\n            const response = yield* authenticationResponse(\n              yield* native(lease, { _tag: \"Get\", publicKey, mediation }),\n            );\n\n            yield* remaining(deadline);\n\n            return yield* snapshotPasskey(PasskeyBrowserAuthentication, {\n              flowId: started.flowId,\n              response: Redacted.make(response),\n            }).pipe(Effect.mapError(unavailable));\n          }),\n        );\n      }, unexpected);\n\n      return PasskeyBrowser.of({ capabilities, register, authenticate });\n    }),\n);\n\nexport const layerSimpleWebAuthnPasskeyBrowser: Layer.Layer<PasskeyBrowser> = Layer.effect(\n  PasskeyBrowser,\n  makeSimpleWebAuthnPasskeyBrowser(),\n);\n"],"mappings":";;;;;;AA8BA,MAAM,oBAAoB,0BAA0B,KAAK,CAAC,CAAC;AAC3D,MAAM,iBAAiB,4BAA4B,KAAK,CAAC,CAAC;AAC1D,MAAM,mBAAmB,2BAA2B,KAAK,CAAC,CAAC;AAE3D,MAAM,cAAuB,WAC3B,OAAO,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;AAElE,MAAM,UACJ,QACA,UAIA,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AAE7E,MAAM,WACJ,QACA,UACG,gBAAgB,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,CAAC;AAElE,MAAM,cAAiB,SACrB,OAAO,WAAW;CAAE,KAAK;CAAM,OAAO;AAAY,CAAC;AAErD,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAElF,MAAM,oBAAoB,OAAO,OAAO;CACtC,GAAG,2BAA2B;CAC9B,SAAS,OAAO,OAAO;EAAE,GAAG,2BAA2B,OAAO,QAAQ;EAAQ;CAAQ,CAAC;AACzF,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,OAAO,OAAO;EACrB,GAAG,6BAA6B;EAChC,SAAS,OAAO,OAAO;GAAE,GAAG,6BAA6B,OAAO,QAAQ;GAAQ;EAAQ,CAAC;CAC3F,CAAC;CACD,WAAW,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;AACxD,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO;CACvC,gBAAgB,OAAO,YAAY,OAAO,OAAO;CACjD,oCAAoC,OAAO,YAAY,OAAO,OAAO;CACrE,iBAAiB,OAAO,YAAY,OAAO,OAAO;CAClD,8BAA8B,OAAO,YAAY,OAAO,OAAO;AACjE,CAAC;AAED,MAAM,WAAW,UACf,UAAU,KAAA,IACL,YACD,QACG,cACA;AAET,MAAM,mBAAmB,OAAO,IAAI,aAAa;CAC/C,IAAI,OAAO,WAAW,oBAAoB,0BAA0B,YAClE,OAAO;EACL,gBAAgB,KAAA;EAChB,oCAAoC,KAAA;EACpC,iBAAiB,KAAA;EACjB,8BAA8B,KAAA;CAChC;CACF,MAAM,MAAM,OAAO,iBAAiB,WAAW,oBAAoB,sBAAsB,CAAC;CAE1F,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,GAAG,GAAG,MAAM,YAAY;GAEhD,OAAO;IACL,gBAAgB,IAAI;IACpB,oCAAoC,IAAI;IACxC,iBAAiB,IAAI;IACrB,8BAA8B,IAAI;GACpC;EACF;EACA,OAAO;CACT,CAAC;CAED,OAAO,OAAO,OAAO,oBAAoB,MAAM;AACjD,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACrE,MACA;CAGA,QAAO,OAFc,OAAO,OAAO,SAAS,OAAO,WAAW,IAAI,CAAC,KAEnD,cAAyB;AAC3C,CAAC;AAED,MAAM,cAAc,OAAO,IAAI;CAC7B,WAAW;EACT,MAAM,gBAAgB,WAAW,oBAAoB;EACrD,MAAM,YAAY,WAAW,WAAW;EAUxC,OAAO;GAAE;GAAe,UAPtB,iBACA,wBAAwB,KACxB,cAAc,KAAA,KACd,OAAO,UAAU,QAAQ,cACzB,OAAO,UAAU,WAAW,cAC5B,OAAO,WAAW,oBAAoB;GAEN;EAAU;CAC9C;CACA,OAAO;AACT,CAAC;AAED,MAAM,eAAe,OAAO,IAAI,aAAa;CAC3C,MAAM,MAAM,OAAO;CAEnB,IAAI,CAAC,IAAI,UACP,OAAO,OAAO,gBAAgB,4BAA4B;EACxD,eAAe,IAAI;EACnB,UAAU;EACV,gBAAgB;EAChB,oCAAoC;EACpC,iBAAiB;EACjB,8BAA8B;CAChC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,MAAM,OAAO;CAEnB,MAAM,SAAS;EACb,gBAAgB,QAAQ,IAAI,cAAc;EAC1C,oCAAoC,QAAQ,IAAI,kCAAkC;EAClF,iBAAiB,QAAQ,IAAI,eAAe;EAC5C,8BAA8B,QAAQ,IAAI,4BAA4B;CACxE;CAEA,MAAM,iBACJ,OAAO,mBAAmB,YACtB,OAAO,WAAW,oBAAoB,oCAAoC,aACxE,OAAO,kBAAkB,+BAA+B,IACvD,gBACH,OAAO;CAEb,MAAM,WACJ,OAAO,uCAAuC,aAC9C,OAAO,WAAW,oBAAoB,kDACpC,aACE,OAAO,kBAAkB,gCAAgC,IACzD,OAAO;CAEb,OAAO,OAAO,gBAAgB,4BAA4B;EACxD,eAAe,IAAI;EACnB,UAAU;EACV,GAAG;EACH;EACA,oCAAoC;CACtC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC,CAAC,CAAC,KACD,OAAO,cAAc;CAAE,UAAU;CAAM,cAAc,OAAO,KAAK,YAAY,CAAC;AAAE,CAAC,GACjF,UACF;AAQA,MAAM,yBAAS,IAAI,QAAqC;AAExD,MAAM,UAAU,UAAuB;CACrC,MAAM,QAAQ;CACd,IAAI,OAAO,IAAI,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,MAAM,SAAS;AAC1E;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,MAAM,OAAO;CAEnB,IAAI,CAAC,IAAI,YAAY,IAAI,cAAc,KAAA,GACrC,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CACjD,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAEvE,MAAM,QAAe;EACnB,WAAW,IAAI;EACf,YAAY,IAAI,gBAAgB;EAChC,OAAO;CACT;CAEA,OAAO,IAAI,IAAI,WAAW,KAAK;CAE/B,OAAO;AACT,CAAC;AAED,MAAM,WAAW,UACf,OAAO,WAAW;CAChB,IAAI,MAAM,UAAU,WAAW;CAE/B,IAAI;EACF,MAAM,WAAW,MAAM;CACzB,QAAQ,CAER;CACA,IAAI,MAAM,UAAU,cAAc,OAAO,KAAK;AAChD,CAAC;AAEH,MAAM,iBAAiB,UAA2E;CAChG,IAAI;EACF,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,OAAO,YAAY;EAGnD,MAAM,SAAS,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,MAAM,IAAI;EAEnE,IACE,OAAO,SAAS,UAChB;GACE;GACA;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,SAAS,OAAO,KAAK,GAEvB,OAAO,WAAW;CACtB,QAAQ,CAER;CAEA,OAAO,YAAY;AACrB;AAaA,MAAM,UAAU,OAAc,YAC5B,OAAO,UACJ,QAAQ,WAAW;CAClB,IACE,OAAO,WACP,MAAM,WAAW,OAAO,WACxB,MAAM,UAAU,gBAChB,OAAO,IAAI,MAAM,SAAS,MAAM,OAChC;EACA,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC;EAEhC;CACF;CACA,MAAM,QAAQ;CACd,IAAI;EACF,MAAM,UACJ,QAAQ,SAAS,WACb,MAAM,UAAU,OAAO;GACrB,WAAW,QAAQ;GACnB,QAAQ,MAAM,WAAW;EAC3B,CAAC,IACD,MAAM,UAAU,IAAI;GAClB,WAAW,QAAQ;GACnB,WAAW,QAAQ;GACnB,QAAQ,MAAM,WAAW;EAC3B,CAAC;EAGP,QAAa,QAAQ,OAAO,CAAC,CAAC,MAC3B,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,WAAW,OAAO,SAC9C,OAAO,OAAO,QAAQ,KAAK,CAAC;GAChC,QAAQ,CAER;EACF,IACC,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,WAAW,OAAO,SAC9C,OAAO,OAAO,KAAK,cAAc,KAAK,CAAC,CAAC;GAC5C,QAAQ,CAER;EACF,CACF;CACF,SAAS,OAAO;EACd,OAAO,KAAK;EACZ,OAAO,OAAO,KAAK,cAAc,KAAK,CAAC,CAAC;CAC1C;AACF,CACF;AAEF,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,UAAkB;CAClF,MAAM,WAAW,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtE,IAAI,YAAY,GAAG,OAAO,OAAO,WAAW;CAE5C,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,cAAc,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACzD,SACA,KACA;CACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IAAI,QAAQ,mBAAmB,KAAK,OAAO,OAAO,SAAS;CAC3D,MAAM,WAAW,KAAK,IAAI,QAAQ,iBAAiB,MAAM,QAAQ,QAAQ,OAAO;CAEhF,OAAO,OAAO,OAAO,kBACnB,UACC,UACC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,UAAU,QAAQ;EAE1C,OAAO,OAAO,IAAI,OAAO,QAAQ,CAAC,CAAC,KACjC,OAAO,cAAc;GAAE;GAAU,cAAc,OAAO,KAAK,WAAW,CAAC;EAAE,CAAC,CAC5E;CACF,CAAC,GACH,OACF;AACF,CAAC;AAED,MAAM,iBAAiB;CACrB,IAAI;CACJ,OAAO,OAAO,WAAW,WAAW;CACpC,MAAM,OAAO,QAAQ,YAAY;AACnC;AAEA,MAAM,qBAAqB,OAAO,OAAO;CACvC,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO,WAAW,WAAW;EAChD,gBAAgB,OAAO,WAAW,WAAW;CAC/C,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,OAAO,OAAO;CACzC,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO,WAAW,WAAW;EAChD,gBAAgB,OAAO,WAAW,WAAW;EAC7C,WAAW,OAAO,WAAW,WAAW;EACxC,YAAY,OAAO,YAAY,OAAO,OAAO,OAAO,WAAW,WAAW,CAAC,CAAC;CAC9E,CAAC;AACH,CAAC;AAED,MAAM,SAAS,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC/C,OACA,SACA,SACA;CAEA,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW,YAAY,UAAU,MAAM,KAAK,OAAO,GAAG,UAAU,CAAC;EACjE,OAAO;CACT,CAAC;CAED,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAS,OAAO,OAAO,YAAY;CAE1F,OAAO,OAAO,OAAO,IAAI;EAAE,WAAW,wBAAwB,MAAM;EAAG,OAAO;CAAY,CAAC;AAC7F,CAAC;AAED,MAAM,mBAAmB,OAAO,eAC9B,OAAO,OAAO;CACZ,IAAI,OAAO;CACX,OAAO,OAAO;CACd,MAAM,OAAO,QAAQ,YAAY;CACjC,UAAU,OAAO,OAAO;EAAE,mBAAmB,OAAO;EAAQ,gBAAgB,OAAO;CAAO,CAAC;CAC3F,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAC1C,CAAC,CACH;AAEA,MAAM,qBAAqB,OAAO,eAChC,OAAO,OAAO;CACZ,IAAI,OAAO;CACX,OAAO,OAAO;CACd,MAAM,OAAO,QAAQ,YAAY;CACjC,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO;EAC1B,gBAAgB,OAAO;EACvB,WAAW,OAAO;EAClB,YAAY,OAAO,YAAY,OAAO,MAAM;CAC9C,CAAC;CACD,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAC1C,CAAC,CACH;AAEA,MAAM,uBAAuB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAC3E,OACA;CACA,IAAI,UAAU,MAAM,OAAO,OAAO,WAAW;CAE7C,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,MAAM,YAAY;GAClD,MAAM,WAAW,MAAM;GAEvB,IAAI,CAAC,UAAU,SAAS,QAAQ,GAAG,MAAM,YAAY;GAErD,OAAO;IACL,IAAI,MAAM;IACV,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,UAAU;KACR,mBAAmB,SAAS;KAC5B,gBAAgB,SAAS;IAC3B;GACF;EACF;EACA,OAAO;CACT,CAAC;CAED,MAAM,aAAa,OAAO,OAAO,oBAAoB,MAAM;CAC3D,MAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,GAAG,IAAI;CAErD,IAAI,WAAW,OAAO,OAAO,OAAO,OAAO,YAAY;CAEvD,OAAO,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC;EAClD,IAAI,WAAW;EACf;EACA,MAAM;EACN,UAAU;GACR,mBAAmB,OAAO,OAAO,WAAW,SAAS,mBAAmB,GAAG,KAAK;GAChF,gBAAgB,OAAO,OAAO,WAAW,SAAS,gBAAgB,GAAG,IAAI;EAC3E;EACA,wBAAwB,CAAC;CAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC;AAED,MAAM,yBAAyB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/E,OACA;CACA,IAAI,UAAU,MAAM,OAAO,OAAO,WAAW;CAE7C,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,MAAM,YAAY;GAClD,MAAM,WAAW,MAAM;GAEvB,IAAI,CAAC,UAAU,SAAS,QAAQ,GAAG,MAAM,YAAY;GACrD,MAAM,aAAa,SAAS;GAE5B,OAAO;IACL,IAAI,MAAM;IACV,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,UAAU;KACR,mBAAmB,SAAS;KAC5B,gBAAgB,SAAS;KACzB,WAAW,SAAS;KACpB,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACnD;GACF;EACF;EACA,OAAO;CACT,CAAC;CAED,MAAM,aAAa,OAAO,OAAO,sBAAsB,MAAM;CAC7D,MAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,GAAG,IAAI;CAErD,IAAI,WAAW,OAAO,OAAO,OAAO,OAAO,YAAY;CACvD,MAAM,SAAS,WAAW,SAAS;CAEnC,OAAO,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAAC;EACpD,IAAI,WAAW;EACf;EACA,MAAM;EACN,UAAU;GACR,mBAAmB,OAAO,OAAO,WAAW,SAAS,mBAAmB,IAAI,KAAK;GACjF,gBAAgB,OAAO,OAAO,WAAW,SAAS,gBAAgB,GAAG,IAAI;GACzE,WAAW,OAAO,OAAO,WAAW,SAAS,WAAW,GAAG,IAAI;GAC/D,GAAI,WAAW,QAAQ,WAAW,KAAA,IAC9B,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,QAAQ,GAAG,EAAE,EAAE;EACjD;EACA,wBAAwB,CAAC;CAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,OAAO,IAAI,aAAa;CAC1C,IAAI,OAAO,WAAW,oBAAoB,oCAAoC,YAC5E,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CACjD,KAAK,OAAO,kBAAkB,+BAA+B,OAAO,aAClE,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAgBjD,IAAI,EAAC,OAdkB,OAAO,IAAI;EAChC,WACE,MAAM,KAAK,WAAW,SAAS,iBAAiB,qBAAqB,CAAC,CAAC,CAAC,MACrE,UACC,MACG,aAAa,cAAc,CAAC,EAC3B,MAAM,cAAc,CAAC,CACtB,QAAQ,UAAU,MAAM,SAAS,CAAC,CAAC,CACnC,GAAG,EAAE,CAAC,EACL,YAAY,MAAM,UAC1B;EACF,OAAO;CACT,CAAC,IAEa,OAAO,OAAO,SAAS;AACvC,CAAC,CAAC,CAAC,KAAK,OAAO,cAAc;CAAE,UAAU;CAAM,cAAc,OAAO,KAAK,YAAY,CAAC;AAAE,CAAC,CAAC;AAE1F,MAAa,mCAAmC,OAAO,GAAG,kCAAkC,CAAC,OAEzF,OAAO,WAAW;CAChB,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,OACA;EACA,MAAM,UAAU,OAAO,QAAQ,mBAAmB,KAAK;EAEvD,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,UAAU,QAAQ;GAC/C,MAAM,UAAU,QAAQ;GAExB,MAAM,YAAgD;IACpD,WAAW,wBAAwB,QAAQ,SAAS;IACpD,IAAI,EAAE,GAAG,QAAQ,GAAG;IACpB,MAAM;KAAE,GAAG,QAAQ;KAAM,IAAI,wBAAwB,QAAQ,KAAK,EAAE;IAAE;IACtE,kBAAkB,QAAQ,iBAAiB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IACxE,SAAS;IACT,aAAa,QAAQ;IACrB,wBAAwB,EAAE,GAAG,QAAQ,uBAAuB;IAC5D,oBAAoB,QAAQ,mBAAmB,KAAK,WAAW;KAC7D,MAAM,MAAM;KACZ,IAAI,wBAAwB,MAAM,EAAE;IACtC,EAAE;GACJ;GAEA,OAAO,UAAU,QAAQ;GAEzB,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO,OAAO;IAAE,MAAM;IAAU;GAAU,CAAC,CACpD;GAEA,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,4BAA4B;IACxD,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACtC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,OACA;EAEA,MAAM,EAAE,SAAS,cAAc,OADV,QAAQ,qBAAqB,KAAK;EAGvD,IAAI,cAAc,iBAAiB,QAAQ,QAAQ,iBAAiB,WAAW,GAC7E,OAAO,OAAO,SAAS;EAEzB,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,IAAI,cAAc,eAAe,OAAO;GACxC,MAAM,gBAAgB,OAAO,UAAU,QAAQ;GAC/C,MAAM,UAAU,QAAQ;GAExB,MAAM,YAA+C;IACnD,WAAW,wBAAwB,QAAQ,SAAS;IACpD,MAAM,QAAQ;IACd,kBAAkB,QAAQ;IAC1B,SAAS;IACT,kBAAkB,QAAQ,iBAAiB,KAAK,WAAW;KACzD,MAAM,MAAM;KACZ,IAAI,wBAAwB,MAAM,EAAE;IACtC,EAAE;GACJ;GAEA,OAAO,UAAU,QAAQ;GAEzB,MAAM,WAAW,OAAO,uBACtB,OAAO,OAAO,OAAO;IAAE,MAAM;IAAO;IAAW;GAAU,CAAC,CAC5D;GAEA,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,8BAA8B;IAC1D,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACtC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,OAAO,eAAe,GAAG;EAAE;EAAc;EAAU;CAAa,CAAC;AACnE,CAAC,CACL;AAEA,MAAa,oCAAiE,MAAM,OAClF,gBACA,iCAAiC,CACnC"}

package/dist/internal/server/configuration.mjs

@@ -0,0 +1,43 @@
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./models.mjs";
+import { PasskeyConfigurationError, PasskeyProfile, PasskeyProtocolRejected, samePasskey, snapshotPasskey } from "@yielded/auth/Passkey";
+import { Cause, Effect } from "effect";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+import { parse } from "tldts";
+//#region src/internal/server/configuration.ts
+const captureSimpleWebAuthnProfiles = Effect.fn("captureSimpleWebAuthnProfiles")(function* (options) {
+	const captured = yield* snapshotPasskey(SimpleWebAuthnPasskeyProtocolOptions, options).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
+	const keys = /* @__PURE__ */ new Set();
+	for (const profile of captured.profiles) {
+		const key = `${profile.rpId}/${profile.profileId}/${profile.generation}`;
+		if (keys.has(key) || new Set(profile.origins).size !== profile.origins.length || new Set(profile.algorithms).size !== profile.algorithms.length || profile.primarySignIn && (profile.residentKey !== "required" || profile.userVerification !== "required")) return yield* PasskeyConfigurationError.make({});
+		keys.add(key);
+		if (!(yield* Effect.try({
+			try: () => {
+				const host = new URL(`https://${profile.rpId}`).hostname;
+				if (host !== profile.rpId) return false;
+				const domain = parse(host, {
+					allowIcannDomains: true,
+					allowPrivateDomains: true,
+					extractHostname: false,
+					validateHostname: true,
+					detectIp: true
+				});
+				if (host === "localhost" ? !profile.developmentLocalhost : domain.isIp || domain.domain === null || domain.publicSuffix === host) return false;
+				return profile.origins.every((origin) => {
+					const url = new URL(origin);
+					return url.origin === origin && url.username === "" && url.password === "" && (url.protocol === "https:" || profile.developmentLocalhost && profile.rpId === "localhost" && url.hostname === "localhost" && url.protocol === "http:") && (url.hostname === profile.rpId || profile.rpId !== "localhost" && url.hostname.endsWith(`.${profile.rpId}`));
+				});
+			},
+			catch: () => PasskeyConfigurationError.make({})
+		}))) return yield* PasskeyConfigurationError.make({});
+	}
+	return Effect.fn("selectSimpleWebAuthnProfile")(function* (input) {
+		const profile = captured.profiles.find((value) => value.rpId === input.rpId && value.profileId === input.profileId && value.generation === input.generation);
+		if (profile === void 0 || !(yield* samePasskey(PasskeyProfile, profile, input))) return yield* PasskeyProtocolRejected.make({});
+		return profile;
+	});
+}, Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-protocol", cause).pipe(Effect.andThen(Effect.fail(PasskeyConfigurationError.make({})))) : Effect.failCause(cause)));
+//#endregion
+export { captureSimpleWebAuthnProfiles };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/internal/server/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../src/internal/server/configuration.ts"],"sourcesContent":["import {\n  PasskeyConfigurationError,\n  PasskeyProtocolRejected,\n  PasskeyProfile,\n  samePasskey,\n  snapshotPasskey,\n} from \"@yielded/auth/Passkey\";\nimport { reportAuthFailure } from \"@yielded/auth/Persistence\";\nimport { Cause, Effect } from \"effect\";\nimport { parse } from \"tldts\";\n\nimport { SimpleWebAuthnPasskeyProtocolOptions } from \"./models\";\n\nexport const captureSimpleWebAuthnProfiles = Effect.fn(\"captureSimpleWebAuthnProfiles\")(\n  function* (options: SimpleWebAuthnPasskeyProtocolOptions) {\n    const captured = yield* snapshotPasskey(SimpleWebAuthnPasskeyProtocolOptions, options).pipe(\n      Effect.mapError(() => PasskeyConfigurationError.make({})),\n    );\n\n    const keys = new Set<string>();\n\n    for (const profile of captured.profiles) {\n      const key = `${profile.rpId}/${profile.profileId}/${profile.generation}`;\n\n      if (\n        keys.has(key) ||\n        new Set(profile.origins).size !== profile.origins.length ||\n        new Set(profile.algorithms).size !== profile.algorithms.length ||\n        (profile.primarySignIn &&\n          (profile.residentKey !== \"required\" || profile.userVerification !== \"required\"))\n      ) {\n        return yield* PasskeyConfigurationError.make({});\n      }\n      keys.add(key);\n\n      const valid = yield* Effect.try({\n        try: () => {\n          const host = new URL(`https://${profile.rpId}`).hostname;\n\n          if (host !== profile.rpId) return false;\n\n          const domain = parse(host, {\n            allowIcannDomains: true,\n            allowPrivateDomains: true,\n            extractHostname: false,\n            validateHostname: true,\n            detectIp: true,\n          });\n\n          if (\n            host === \"localhost\"\n              ? !profile.developmentLocalhost\n              : domain.isIp || domain.domain === null || domain.publicSuffix === host\n          )\n            return false;\n\n          return profile.origins.every((origin) => {\n            const url = new URL(origin);\n\n            return (\n              url.origin === origin &&\n              url.username === \"\" &&\n              url.password === \"\" &&\n              (url.protocol === \"https:\" ||\n                (profile.developmentLocalhost &&\n                  profile.rpId === \"localhost\" &&\n                  url.hostname === \"localhost\" &&\n                  url.protocol === \"http:\")) &&\n              (url.hostname === profile.rpId ||\n                (profile.rpId !== \"localhost\" && url.hostname.endsWith(`.${profile.rpId}`)))\n            );\n          });\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      });\n\n      if (!valid) return yield* PasskeyConfigurationError.make({});\n    }\n\n    return Effect.fn(\"selectSimpleWebAuthnProfile\")(function* (input: PasskeyProfile) {\n      const profile = captured.profiles.find(\n        (value) =>\n          value.rpId === input.rpId &&\n          value.profileId === input.profileId &&\n          value.generation === input.generation,\n      );\n\n      if (profile === undefined || !(yield* samePasskey(PasskeyProfile, profile, input)))\n        return yield* PasskeyProtocolRejected.make({});\n\n      return profile;\n    });\n  },\n  Effect.catchCause((cause) =>\n    Cause.hasDies(cause)\n      ? reportAuthFailure(\"passkey-protocol\", cause).pipe(\n          Effect.andThen(Effect.fail(PasskeyConfigurationError.make({}))),\n        )\n      : Effect.failCause(cause),\n  ),\n);\n"],"mappings":";;;;;;AAaA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CACrF,WAAW,SAA+C;CACxD,MAAM,WAAW,OAAO,gBAAgB,sCAAsC,OAAO,CAAC,CAAC,KACrF,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;CAEA,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,WAAW,SAAS,UAAU;EACvC,MAAM,MAAM,GAAG,QAAQ,KAAK,GAAG,QAAQ,UAAU,GAAG,QAAQ;EAE5D,IACE,KAAK,IAAI,GAAG,KACZ,IAAI,IAAI,QAAQ,OAAO,CAAC,CAAC,SAAS,QAAQ,QAAQ,UAClD,IAAI,IAAI,QAAQ,UAAU,CAAC,CAAC,SAAS,QAAQ,WAAW,UACvD,QAAQ,kBACN,QAAQ,gBAAgB,cAAc,QAAQ,qBAAqB,aAEtE,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;EAEjD,KAAK,IAAI,GAAG;EA2CZ,IAAI,EAAC,OAzCgB,OAAO,IAAI;GAC9B,WAAW;IACT,MAAM,OAAO,IAAI,IAAI,WAAW,QAAQ,MAAM,CAAC,CAAC;IAEhD,IAAI,SAAS,QAAQ,MAAM,OAAO;IAElC,MAAM,SAAS,MAAM,MAAM;KACzB,mBAAmB;KACnB,qBAAqB;KACrB,iBAAiB;KACjB,kBAAkB;KAClB,UAAU;IACZ,CAAC;IAED,IACE,SAAS,cACL,CAAC,QAAQ,uBACT,OAAO,QAAQ,OAAO,WAAW,QAAQ,OAAO,iBAAiB,MAErE,OAAO;IAET,OAAO,QAAQ,QAAQ,OAAO,WAAW;KACvC,MAAM,MAAM,IAAI,IAAI,MAAM;KAE1B,OACE,IAAI,WAAW,UACf,IAAI,aAAa,MACjB,IAAI,aAAa,OAChB,IAAI,aAAa,YACf,QAAQ,wBACP,QAAQ,SAAS,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,aACpB,IAAI,aAAa,QAAQ,QACvB,QAAQ,SAAS,eAAe,IAAI,SAAS,SAAS,IAAI,QAAQ,MAAM;IAE/E,CAAC;GACH;GACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;EAChD,CAAC,IAEW,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAC7D;CAEA,OAAO,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,OAAuB;EAChF,MAAM,UAAU,SAAS,SAAS,MAC/B,UACC,MAAM,SAAS,MAAM,QACrB,MAAM,cAAc,MAAM,aAC1B,MAAM,eAAe,MAAM,UAC/B;EAEA,IAAI,YAAY,KAAA,KAAa,EAAE,OAAO,YAAY,gBAAgB,SAAS,KAAK,IAC9E,OAAO,OAAO,wBAAwB,KAAK,CAAC,CAAC;EAE/C,OAAO;CACT,CAAC;AACH,GACA,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,oBAAoB,KAAK,CAAC,CAAC,KAC3C,OAAO,QAAQ,OAAO,KAAK,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC,CAChE,IACA,OAAO,UAAU,KAAK,CAC5B,CACF"}

package/dist/internal/server/models.d.mts

@@ -0,0 +1,20 @@
+import { Schema } from "effect";
+//#region src/internal/server/models.d.ts
+export declare const SimpleWebAuthnPasskeyProtocolOptions: Schema.Struct<{
+  readonly profiles: Schema.NonEmptyArray<Schema.Struct<{
+    readonly profileId: Schema.String;
+    readonly generation: Schema.Int;
+    readonly rpId: Schema.String;
+    readonly rpName: Schema.NonEmptyString;
+    readonly origins: Schema.NonEmptyArray<Schema.NonEmptyString>;
+    readonly developmentLocalhost: Schema.Boolean;
+    readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+    readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+    readonly primarySignIn: Schema.Boolean;
+    readonly attestation: Schema.Literal<"none">;
+    readonly algorithms: Schema.NonEmptyArray<Schema.Literals<readonly [-7, -257]>>;
+  }>>;
+}>;
+export type SimpleWebAuthnPasskeyProtocolOptions = typeof SimpleWebAuthnPasskeyProtocolOptions.Type;
+//#endregion
+//# sourceMappingURL=models.d.mts.map

package/dist/internal/server/models.mjs

@@ -0,0 +1,8 @@
+import { PasskeyProfile } from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+//#region src/internal/server/models.ts
+const SimpleWebAuthnPasskeyProtocolOptions = Schema.Struct({ profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(64)) });
+//#endregion
+export { SimpleWebAuthnPasskeyProtocolOptions };
+
+//# sourceMappingURL=models.mjs.map

package/dist/internal/server/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/internal/server/models.ts"],"sourcesContent":["import { PasskeyProfile } from \"@yielded/auth/Passkey\";\nimport { Schema } from \"effect\";\n\nexport const SimpleWebAuthnPasskeyProtocolOptions = Schema.Struct({\n  profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(64)),\n});\n\nexport type SimpleWebAuthnPasskeyProtocolOptions = typeof SimpleWebAuthnPasskeyProtocolOptions.Type;\n"],"mappings":";;;AAGA,MAAa,uCAAuC,OAAO,OAAO,EAChE,UAAU,OAAO,cAAc,cAAc,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,EAC7E,CAAC"}

package/dist/internal/server/protocol.d.mts

@@ -0,0 +1,59 @@
+import { PasskeyAssertionVerified, PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyConfig, PasskeyConfigurationError, PasskeyCredential, PasskeyDescriptor, PasskeyProfile, PasskeyProtocol, PasskeyProtocolRejected, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyUnavailable, PasskeyUserHandle } from "@yielded/auth/Passkey";
+import { Effect, Layer, Redacted } from "effect";
+//#region src/internal/server/protocol.d.ts
+export declare const makeSimpleWebAuthnPasskeyProtocol: (options: {
+  readonly profiles: readonly [{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }, ...{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }[]];
+}) => Effect.Effect<{
+  readonly prepareAuthentication: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly allowedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyAuthenticationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly prepareRegistration: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly userHandle: PasskeyUserHandle;
+    readonly name: string;
+    readonly displayName: string;
+    readonly excludedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyRegistrationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyAuthentication: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly credential: PasskeyCredential;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyAssertionVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyRegistration: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyRegistrationVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+}, PasskeyConfigurationError, never>;
+/** Requires the same host profiles as the strategy. */
+export declare const layerSimpleWebAuthnPasskeyProtocol: Layer.Layer<PasskeyProtocol, PasskeyConfigurationError, PasskeyConfig>;
+//#endregion
+//# sourceMappingURL=protocol.d.mts.map

package/dist/internal/server/protocol.mjs

@@ -0,0 +1,400 @@
+import { captureSimpleWebAuthnProfiles } from "./configuration.mjs";
+import { PasskeyAssertion, PasskeyAssertionVerified, PasskeyAttestation, PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyChallenge, PasskeyConfig, PasskeyCounter, PasskeyCredential, PasskeyDescriptor, PasskeyLabel, PasskeyProfile, PasskeyProtocol, PasskeyProtocolCredentialId, PasskeyProtocolRejected, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyUnavailable, PasskeyUserHandle, samePasskey, snapshotPasskey } from "@yielded/auth/Passkey";
+import { Cause, DateTime, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { decodeAttestationObject, decodeClientDataJSON, decodeCredentialPublicKey, isoCBOR, parseAuthenticatorData } from "@simplewebauthn/server/helpers";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+//#region src/internal/server/protocol.ts
+const rejected = () => PasskeyProtocolRejected.make({});
+const unavailable = () => PasskeyUnavailable.make({});
+const unexpected = (effect) => effect.pipe(Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-protocol", cause).pipe(Effect.andThen(Effect.fail(unavailable()))) : Effect.failCause(cause)));
+const maintained = (call) => Effect.tryPromise(call).pipe(Effect.onError((cause) => reportAuthFailure("passkey-protocol", cause)), Effect.mapError(unavailable));
+const parsed = (call) => Effect.try({
+	try: call,
+	catch: rejected
+});
+const decode = (schema, input) => Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError(rejected));
+const capture = (schema, input) => snapshotPasskey(schema, input).pipe(Effect.mapError(rejected));
+const sameBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
+const binary = (minimum, maximum) => Schema.String.check(Schema.isMaxLength(Math.ceil(maximum * 4 / 3)), Schema.makeFilter((value) => {
+	const result = Encoding.decodeBase64Url(value);
+	return result._tag === "Success" && result.success.length >= minimum && result.success.length <= maximum && Encoding.encodeBase64Url(result.success) === value;
+}));
+const bytes = Effect.fn("simpleWebAuthnBytes")(function* (value) {
+	const result = Encoding.decodeBase64Url(value);
+	if (result._tag === "Failure") return yield* rejected();
+	return new Uint8Array(result.success);
+});
+const duration = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 3e5
+}));
+const prepareAuthenticationInput = Schema.Struct({
+	profile: PasskeyProfile,
+	challenge: PasskeyChallenge,
+	timeoutMillis: duration,
+	allowedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64))
+});
+const prepareRegistrationInput = Schema.Struct({
+	profile: PasskeyProfile,
+	challenge: PasskeyChallenge,
+	timeoutMillis: duration,
+	userHandle: PasskeyUserHandle,
+	name: PasskeyLabel,
+	displayName: PasskeyLabel,
+	excludedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64))
+});
+const authenticationInput = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	credential: PasskeyCredential,
+	response: PasskeyAssertion
+});
+const registrationInput = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	response: PasskeyAttestation
+});
+const envelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: PasskeyProtocolCredentialId,
+	type: Schema.Literal("public-key")
+};
+const authenticationResponse = Schema.Struct({
+	...envelope,
+	response: Schema.Struct({
+		clientDataJSON: binary(1, 8192),
+		authenticatorData: binary(37, 16384),
+		signature: binary(1, 1024),
+		userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle))
+	})
+});
+const registrationResponse = Schema.Struct({
+	...envelope,
+	response: Schema.Struct({
+		clientDataJSON: binary(1, 8192),
+		attestationObject: binary(1, 65536)
+	})
+});
+const clientData = Schema.Struct({
+	type: Schema.String,
+	challenge: PasskeyChallenge,
+	origin: Schema.String.check(Schema.isMaxLength(2048)),
+	crossOrigin: Schema.optionalKey(Schema.Boolean),
+	topOrigin: Schema.optionalKey(Schema.Unknown)
+});
+const cborLeaf = Schema.Union([
+	Schema.String.check(Schema.isMaxLength(8192)),
+	Schema.Number.check(Schema.isFinite()),
+	Schema.Boolean,
+	Schema.Null,
+	Schema.Uint8Array.check(Schema.makeFilter((value) => value.length <= 16384))
+]);
+const cborValue = (depth) => {
+	if (depth === 0) return cborLeaf;
+	const child = cborValue(depth - 1);
+	return Schema.Union([
+		cborLeaf,
+		Schema.Array(child).check(Schema.isMaxLength(64)),
+		Schema.ReadonlyMap(Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]), child).check(Schema.makeFilter((value) => value.size <= 32))
+	]);
+};
+const cborMap = Schema.ReadonlyMap(Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]), cborValue(4)).check(Schema.makeFilter((value) => value.size <= 32));
+const encodeCbor = (value) => {
+	return isoCBOR.encode(value);
+};
+const exactMap = Effect.fn("simpleWebAuthnExactMap")(function* (input, value) {
+	const result = yield* decode(cborMap, value);
+	const encoded = yield* parsed(() => encodeCbor(result));
+	if (!sameBytes(input, encoded)) return yield* rejected();
+	return result;
+});
+const byteValue = (minimum, maximum) => Schema.Uint8Array.check(Schema.makeFilter((value) => value.length >= minimum && value.length <= maximum));
+const fresh = Effect.fn("simpleWebAuthnFresh")(function* (ceremony) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (ceremony.issuedAtMillis > now || now >= ceremony.expiresAtMillis || now >= ceremony.requestBindingExpiresAtMillis || ceremony.expiresAtMillis <= ceremony.issuedAtMillis) return yield* rejected();
+});
+const checkClient = Effect.fn("simpleWebAuthnClientData")(function* (value, ceremony, type) {
+	const client = yield* decode(clientData, yield* parsed(() => decodeClientDataJSON(value)));
+	if (client.type !== type || client.challenge !== ceremony.challenge || !ceremony.profile.origins.includes(client.origin) || client.crossOrigin === true || "topOrigin" in client) return yield* rejected();
+	return client;
+});
+const checkAuthenticator = Effect.fn("simpleWebAuthnAuthenticatorData")(function* (original, registration, profile) {
+	if (original.length < 37 || original.length > 16384 || Boolean(original[32] & 64) !== registration) return yield* rejected();
+	let prefix = 37;
+	if (registration) {
+		if (original.length < 55) return yield* rejected();
+		const length = new DataView(original.buffer, original.byteOffset, original.byteLength).getUint16(53, false);
+		if (length < 1 || length > 1023 || original.length < 55 + length) return yield* rejected();
+		prefix = 55 + length;
+	}
+	const result = yield* parsed(() => parseAuthenticatorData(new Uint8Array(original)));
+	if (!result.flags.up || profile.userVerification === "required" && !result.flags.uv || result.flags.bs && !result.flags.be || result.flags.at !== registration || result.flags.flagsInt !== original[32]) return yield* rejected();
+	yield* decode(PasskeyCounter, result.counter);
+	const chunks = [original.slice(0, prefix)];
+	if (registration) {
+		const id = yield* decode(byteValue(1, 1023), result.credentialID);
+		const key = yield* decode(byteValue(1, 8192), result.credentialPublicKey);
+		if (!sameBytes(id, original.slice(55, prefix))) return yield* rejected();
+		chunks.push(key);
+	}
+	if (result.flags.ed) {
+		const extension = yield* decode(byteValue(1, 16384), result.extensionsDataBuffer);
+		yield* exactMap(extension, yield* parsed(() => isoCBOR.decodeFirst(new Uint8Array(extension))));
+		chunks.push(extension);
+	} else if (result.extensionsDataBuffer !== void 0) return yield* rejected();
+	if (chunks.reduce((sum, chunk) => sum + chunk.length, 0) !== original.length) return yield* rejected();
+	let offset = 0;
+	for (const chunk of chunks) {
+		if (!sameBytes(chunk, original.slice(offset, offset + chunk.length))) return yield* rejected();
+		offset += chunk.length;
+	}
+	const rpHash = new Uint8Array(yield* maintained(() => globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(profile.rpId))));
+	if (!sameBytes(rpHash, original.slice(0, 32))) return yield* rejected();
+	return result;
+});
+const checkKey = Effect.fn("simpleWebAuthnPublicKey")(function* (input, allowed, expected) {
+	const map = yield* exactMap(input, yield* parsed(() => decodeCredentialPublicKey(new Uint8Array(input))));
+	const algorithmId = yield* decode(Schema.Literals([-7, -257]), map.get(3));
+	if (!allowed.includes(algorithmId) || expected !== void 0 && algorithmId !== expected) return yield* rejected();
+	let jwk;
+	let algorithm;
+	if (algorithmId === -7) {
+		if (map.size !== 5 || ![
+			1,
+			3,
+			-1,
+			-2,
+			-3
+		].every((key) => map.has(key)) || map.get(1) !== 2 || map.get(-1) !== 1) return yield* rejected();
+		const x = yield* decode(byteValue(32, 32), map.get(-2));
+		const y = yield* decode(byteValue(32, 32), map.get(-3));
+		jwk = {
+			kty: "EC",
+			crv: "P-256",
+			x: Encoding.encodeBase64Url(x),
+			y: Encoding.encodeBase64Url(y),
+			ext: false
+		};
+		algorithm = {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		};
+	} else {
+		if (map.size !== 4 || ![
+			1,
+			3,
+			-1,
+			-2
+		].every((key) => map.has(key)) || map.get(1) !== 3) return yield* rejected();
+		const n = yield* decode(byteValue(256, 512), map.get(-1));
+		const e = yield* decode(byteValue(1, 4), map.get(-2));
+		const exponent = e.reduce((value, byte) => value * 256 + byte, 0);
+		if (n[0] < 128 || (n[n.length - 1] & 1) === 0 || e[0] === 0 || exponent < 3 || exponent % 2 !== 1) return yield* rejected();
+		jwk = {
+			kty: "RSA",
+			alg: "RS256",
+			n: Encoding.encodeBase64Url(n),
+			e: Encoding.encodeBase64Url(e),
+			ext: false
+		};
+		algorithm = {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		};
+	}
+	yield* maintained(() => globalThis.crypto.subtle.importKey("jwk", jwk, algorithm, false, ["verify"]));
+	return algorithmId;
+});
+const makeSimpleWebAuthnPasskeyProtocol = Effect.fn("makeSimpleWebAuthnPasskeyProtocol")(function* (options) {
+	const select = yield* captureSimpleWebAuthnProfiles(options);
+	const prepareAuthentication = Effect.fn("SimpleWebAuthnPasskeyProtocol.prepareAuthentication")(function* (input) {
+		const fixed = yield* capture(prepareAuthenticationInput, input);
+		const profile = yield* select(fixed.profile);
+		const challenge = yield* bytes(fixed.challenge);
+		const result = yield* maintained(() => generateAuthenticationOptions({
+			rpID: profile.rpId,
+			challenge,
+			timeout: fixed.timeoutMillis,
+			userVerification: profile.userVerification,
+			allowCredentials: fixed.allowedCredentials.map((value) => ({ ...value }))
+		}));
+		const value = yield* decode(PasskeyAuthenticationOptions, {
+			challenge: result.challenge,
+			rpId: result.rpId,
+			timeout: result.timeout,
+			userVerification: result.userVerification,
+			allowCredentials: result.allowCredentials ?? []
+		});
+		if (!(yield* samePasskey(PasskeyAuthenticationOptions, value, {
+			challenge: fixed.challenge,
+			rpId: profile.rpId,
+			timeout: fixed.timeoutMillis,
+			userVerification: profile.userVerification,
+			allowCredentials: fixed.allowedCredentials
+		}))) return yield* unavailable();
+		return yield* capture(PasskeyAuthenticationOptions, value);
+	}, unexpected);
+	const prepareRegistration = Effect.fn("SimpleWebAuthnPasskeyProtocol.prepareRegistration")(function* (input) {
+		const fixed = yield* capture(prepareRegistrationInput, input);
+		const profile = yield* select(fixed.profile);
+		const challenge = yield* bytes(fixed.challenge), userID = yield* bytes(fixed.userHandle);
+		const result = yield* maintained(() => generateRegistrationOptions({
+			rpName: profile.rpName,
+			rpID: profile.rpId,
+			userName: fixed.name,
+			userDisplayName: fixed.displayName,
+			userID,
+			challenge,
+			timeout: fixed.timeoutMillis,
+			attestationType: "none",
+			supportedAlgorithmIDs: [...profile.algorithms],
+			authenticatorSelection: {
+				residentKey: profile.residentKey,
+				userVerification: profile.userVerification
+			},
+			excludeCredentials: fixed.excludedCredentials.map((value) => ({ ...value }))
+		}));
+		const value = yield* decode(PasskeyRegistrationOptions, {
+			challenge: result.challenge,
+			rp: result.rp,
+			user: result.user,
+			pubKeyCredParams: result.pubKeyCredParams,
+			timeout: result.timeout,
+			attestation: result.attestation,
+			authenticatorSelection: result.authenticatorSelection,
+			excludeCredentials: result.excludeCredentials ?? []
+		});
+		const expected = {
+			challenge: fixed.challenge,
+			rp: {
+				id: profile.rpId,
+				name: profile.rpName
+			},
+			user: {
+				id: fixed.userHandle,
+				name: fixed.name,
+				displayName: fixed.displayName
+			},
+			pubKeyCredParams: profile.algorithms.map((alg) => ({
+				type: "public-key",
+				alg
+			})),
+			timeout: fixed.timeoutMillis,
+			attestation: "none",
+			authenticatorSelection: {
+				residentKey: profile.residentKey,
+				userVerification: profile.userVerification
+			},
+			excludeCredentials: fixed.excludedCredentials
+		};
+		if (!(yield* samePasskey(PasskeyRegistrationOptions, value, yield* decode(PasskeyRegistrationOptions, expected)))) return yield* unavailable();
+		return yield* capture(PasskeyRegistrationOptions, value);
+	}, unexpected);
+	const verifyRegistration = Effect.fn("SimpleWebAuthnPasskeyProtocol.verifyRegistration")(function* (input) {
+		const fixed = yield* capture(registrationInput, input), ceremony = fixed.ceremony;
+		const profile = yield* select(ceremony.profile);
+		if ((ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration") && (ceremony.purpose !== "enrollment" || ceremony.context._tag !== "Enrollment")) return yield* rejected();
+		yield* fresh(ceremony);
+		const wire = yield* decode(Schema.fromJsonString(registrationResponse), Redacted.value(fixed.response));
+		if (wire.id !== wire.rawId) return yield* rejected();
+		const client = yield* checkClient(wire.response.clientDataJSON, ceremony, "webauthn.create");
+		const attestationBytes = yield* bytes(wire.response.attestationObject);
+		const attestation = yield* exactMap(attestationBytes, yield* parsed(() => decodeAttestationObject(new Uint8Array(attestationBytes))));
+		if (attestation.size !== 3 || attestation.get("fmt") !== "none" || !attestation.has("attStmt") || !attestation.has("authData")) return yield* rejected();
+		if ((yield* decode(cborMap, attestation.get("attStmt"))).size !== 0) return yield* rejected();
+		const authenticatorBytes = yield* decode(byteValue(37, 16384), attestation.get("authData"));
+		const auth = yield* checkAuthenticator(authenticatorBytes, true, profile);
+		const id = yield* decode(byteValue(1, 1023), auth.credentialID);
+		const key = yield* decode(byteValue(1, 8192), auth.credentialPublicKey);
+		if (Encoding.encodeBase64Url(id) !== wire.id) return yield* rejected();
+		const algorithm = yield* checkKey(key, profile.algorithms);
+		const result = yield* maintained(() => verifyRegistrationResponse({
+			response: {
+				...wire,
+				clientExtensionResults: {}
+			},
+			expectedChallenge: ceremony.challenge,
+			expectedOrigin: [...profile.origins],
+			expectedRPID: profile.rpId,
+			expectedType: "webauthn.create",
+			requireUserPresence: true,
+			requireUserVerification: profile.userVerification === "required",
+			supportedAlgorithmIDs: [...profile.algorithms]
+		}));
+		if (!result.verified || result.registrationInfo === void 0) return yield* rejected();
+		const info = result.registrationInfo;
+		if (info.fmt !== "none" || info.origin !== client.origin || info.rpID !== profile.rpId || info.credential.id !== wire.id || !sameBytes(info.credential.publicKey, key) || info.credential.counter !== auth.counter || info.userVerified !== auth.flags.uv || info.credentialDeviceType === "multiDevice" !== auth.flags.be || info.credentialBackedUp !== auth.flags.bs) return yield* rejected();
+		yield* fresh(ceremony);
+		return yield* capture(PasskeyRegistrationVerified, yield* decode(PasskeyRegistrationVerified, {
+			protocolCredentialId: info.credential.id,
+			publicKey: Encoding.encodeBase64Url(info.credential.publicKey),
+			algorithm,
+			counter: info.credential.counter,
+			userVerified: info.userVerified,
+			backupEligible: info.credentialDeviceType === "multiDevice",
+			backupState: info.credentialBackedUp
+		}));
+	}, unexpected);
+	const verifyAuthentication = Effect.fn("SimpleWebAuthnPasskeyProtocol.verifyAuthentication")(function* (input) {
+		const fixed = yield* capture(authenticationInput, input), ceremony = fixed.ceremony, credential = fixed.credential;
+		const profile = yield* select(ceremony.profile), original = yield* select(credential.profile);
+		if (ceremony.purpose === "registration" || ceremony.purpose === "enrollment" || {
+			"sign-in": "SignIn",
+			pending: "Pending",
+			"step-up": "StepUp",
+			action: "Action"
+		}[ceremony.purpose] !== ceremony.context._tag || !credential.active || credential.rpId !== profile.rpId || original.rpId !== profile.rpId || !original.algorithms.includes(credential.algorithm) || !profile.algorithms.includes(credential.algorithm)) return yield* rejected();
+		yield* fresh(ceremony);
+		const wire = yield* decode(Schema.fromJsonString(authenticationResponse), Redacted.value(fixed.response));
+		const userHandle = wire.response.userHandle ?? void 0;
+		if (wire.id !== wire.rawId || wire.id !== credential.protocolCredentialId || userHandle !== void 0 && userHandle !== credential.userHandle || ceremony.context._tag === "SignIn" && userHandle === void 0 || ceremony.allowedCredentials.length > 0 && !ceremony.allowedCredentials.some((value) => value.id === wire.id)) return yield* rejected();
+		const client = yield* checkClient(wire.response.clientDataJSON, ceremony, "webauthn.get");
+		const auth = yield* checkAuthenticator(yield* bytes(wire.response.authenticatorData), false, profile);
+		if (auth.flags.be !== credential.backupEligible || !credential.backupEligible && (credential.counter > 0 || auth.counter > 0) && auth.counter <= credential.counter) return yield* rejected();
+		const publicKey = yield* bytes(credential.publicKey);
+		yield* checkKey(publicKey, profile.algorithms, credential.algorithm);
+		const result = yield* maintained(() => verifyAuthenticationResponse({
+			response: {
+				...wire,
+				response: {
+					...wire.response,
+					userHandle
+				},
+				clientExtensionResults: {}
+			},
+			expectedChallenge: ceremony.challenge,
+			expectedOrigin: [...profile.origins],
+			expectedRPID: profile.rpId,
+			expectedType: "webauthn.get",
+			requireUserVerification: profile.userVerification === "required",
+			credential: {
+				id: credential.protocolCredentialId,
+				publicKey,
+				counter: credential.backupEligible ? 0 : credential.counter
+			}
+		}));
+		if (!result.verified) return yield* rejected();
+		const info = result.authenticationInfo;
+		if (info.credentialID !== wire.id || info.origin !== client.origin || info.rpID !== profile.rpId || info.newCounter !== auth.counter || info.userVerified !== auth.flags.uv || info.credentialDeviceType === "multiDevice" !== credential.backupEligible || info.credentialBackedUp !== auth.flags.bs) return yield* rejected();
+		yield* fresh(ceremony);
+		return yield* capture(PasskeyAssertionVerified, yield* decode(PasskeyAssertionVerified, {
+			protocolCredentialId: info.credentialID,
+			...userHandle === void 0 ? {} : { userHandle },
+			counter: info.newCounter,
+			userVerified: info.userVerified,
+			backupEligible: info.credentialDeviceType === "multiDevice",
+			backupState: info.credentialBackedUp
+		}));
+	}, unexpected);
+	return PasskeyProtocol.of({
+		prepareAuthentication,
+		prepareRegistration,
+		verifyRegistration,
+		verifyAuthentication
+	});
+});
+/** Requires the same host profiles as the strategy. */
+const layerSimpleWebAuthnPasskeyProtocol = Layer.effect(PasskeyProtocol, Effect.flatMap(PasskeyConfig, makeSimpleWebAuthnPasskeyProtocol));
+//#endregion
+export { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol };
+
+//# sourceMappingURL=protocol.mjs.map