@yielded/auth 0.1.0-beta.1

package/dist/operations/requestBinding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestBinding.mjs","names":[],"sources":["../../src/operations/requestBinding.ts"],"sourcesContent":["import { Context, Crypto, DateTime, Effect, Encoding, Layer, Redacted, Schema } from \"effect\";\n\nimport { TokenDigest } from \"../Schema\";\nimport { makeSessionSigningCodec, type SessionSigningKeyring } from \"../sessions/crypto\";\nimport type { AuthOperationResult } from \"./credentials\";\nimport { RequestBindingConfig } from \"./RequestBindingConfig\";\nimport { RequestBindingFlowId, type RequestBindingPublic } from \"./requestBindingModels\";\n\nexport {\n  RequestBindingFlowId,\n  RequestBindingCredential,\n  RequestBindingPublic,\n} from \"./requestBindingModels\";\n\nexport class RequestBindingInvalid extends Schema.TaggedError<RequestBindingInvalid>()(\n  \"RequestBindingInvalid\",\n  {},\n) {}\n\nexport class RequestBindingUnavailable extends Schema.TaggedError<RequestBindingUnavailable>()(\n  \"RequestBindingUnavailable\",\n  {},\n) {}\n\nexport class RequestBindingConfigurationError extends Schema.TaggedError<RequestBindingConfigurationError>()(\n  \"RequestBindingConfigurationError\",\n  {},\n) {}\n\nexport interface VerifiedRequestBinding {\n  /** Internal correlation only; never an accepted substitute for the credential. */\n  readonly verifier: TokenDigest;\n  readonly expiresAtMillis: number;\n}\n\nexport interface RequestBindingConfiguration {\n  readonly lifetimeMillis: number;\n  readonly generation: number;\n  /** Dedicated binding keys; no implicit reuse of session signing keys. */\n  readonly keyring: SessionSigningKeyring;\n}\n\nconst configurationSchema = Schema.Struct({\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1_800_000 })),\n  generation: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n  keyring: Schema.Struct({\n    activeKeyId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/)),\n    keys: Schema.Array(\n      Schema.Struct({\n        id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/)),\n        material: Schema.Redacted(Schema.String.check(Schema.isMaxLength(172))),\n      }),\n    ).check(Schema.isMinLength(1), Schema.isMaxLength(8)),\n  }),\n});\n\nconst label = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._:/-]{1,128}$/));\n\nconst envelope = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/request-binding/v1\"),\n  moduleId: label,\n  purpose: label,\n  flowId: RequestBindingFlowId,\n  generation: Schema.Int,\n  nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  issuedAtMillis: Schema.Int,\n  expiresAtMillis: Schema.Int,\n});\n\nconst verifierMessage = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/request-binding-verifier/v1\"),\n    label,\n    label,\n    Schema.String,\n  ]),\n);\n\nexport interface BindingModule<Id extends string, Purpose extends string> {\n  readonly moduleId: Id;\n  readonly purpose: Purpose;\n}\n\n/** The scalar private slot supports one standard browser flow at a time. Native\n * consumers may explicitly retain credentials by flow in their own secure store.\n * Browser adapters inject this credential from private storage and reject URL/body\n * overrides. Every binding-bearing mutation, including issuance, requires CSRF\n * protection. GET/preview routes neither begin nor consume an authentication flow.\n */\nexport const makeRequestBinding = <const Id extends string, const Purpose extends string>(\n  moduleId: Id,\n  purpose: Purpose,\n) => {\n  const RequestBinding = Context.Service<\n    BindingModule<Id, Purpose>,\n    {\n      readonly issue: (\n        flowId: RequestBindingFlowId,\n      ) => Effect.Effect<\n        AuthOperationResult<RequestBindingPublic>,\n        RequestBindingUnavailable | RequestBindingInvalid\n      >;\n      readonly verify: (\n        flowId: RequestBindingFlowId,\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;\n    }\n  >(\n    `effect-auth/operations/RequestBinding/${moduleId.length}:${moduleId}/${purpose.length}:${purpose}`,\n  );\n\n  const signedLayer = (configuration: RequestBindingConfiguration) => {\n    if (!Schema.is(configurationSchema)(configuration))\n      return Layer.effect(RequestBinding, Effect.fail(RequestBindingConfigurationError.make({})));\n\n    const input = Object.freeze({\n      lifetimeMillis: configuration.lifetimeMillis,\n      generation: configuration.generation,\n      keyring: Object.freeze({\n        activeKeyId: configuration.keyring.activeKeyId,\n        keys: Object.freeze(\n          configuration.keyring.keys.map((entry) =>\n            Object.freeze({ id: entry.id, material: entry.material }),\n          ),\n        ),\n      }),\n    });\n\n    return Layer.effect(\n      RequestBinding,\n      Effect.gen(function* () {\n        yield* Schema.decodeEffect(label)(moduleId).pipe(\n          Effect.mapError(() => RequestBindingConfigurationError.make({})),\n        );\n        yield* Schema.decodeEffect(label)(purpose).pipe(\n          Effect.mapError(() => RequestBindingConfigurationError.make({})),\n        );\n\n        const policy = yield* Schema.decodeEffect(configurationSchema)(input).pipe(\n          Effect.mapError(() => RequestBindingConfigurationError.make({})),\n        );\n\n        const signer = yield* makeSessionSigningCodec(envelope, policy.keyring, 2048).pipe(\n          Effect.mapError(() => RequestBindingConfigurationError.make({})),\n        );\n\n        const crypto = yield* Crypto.Crypto;\n\n        return RequestBinding.of({\n          issue: Effect.fn(\"RequestBinding.issue\")(function* (flowId) {\n            yield* Schema.decodeEffect(RequestBindingFlowId)(flowId).pipe(\n              Effect.mapError(() => RequestBindingInvalid.make({})),\n            );\n            const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n            const nonce = yield* crypto\n              .randomBytes(32)\n              .pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));\n\n            const expiresAtMillis = now + policy.lifetimeMillis;\n\n            const credential = yield* signer\n              .encode({\n                namespace: \"effect-auth/request-binding/v1\",\n                moduleId,\n                purpose,\n                flowId,\n                generation: policy.generation,\n                nonce: Encoding.encodeBase64Url(nonce),\n                issuedAtMillis: now,\n                expiresAtMillis,\n              })\n              .pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));\n\n            return {\n              value: { flowId, expiresAtMillis },\n              credentialCommands: [\n                { _tag: \"Issue\", slot: \"request-binding\", credential, expiresAtMillis },\n              ],\n            };\n          }),\n          verify: Effect.fn(\"RequestBinding.verify\")(function* (flowId, credential) {\n            yield* Schema.decodeEffect(RequestBindingFlowId)(flowId).pipe(\n              Effect.mapError(() => RequestBindingInvalid.make({})),\n            );\n\n            const value = yield* signer\n              .decode(credential)\n              .pipe(\n                Effect.mapError((error) =>\n                  error._tag === \"SessionUnavailable\"\n                    ? RequestBindingUnavailable.make({})\n                    : RequestBindingInvalid.make({}),\n                ),\n              );\n\n            const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n            if (\n              value.moduleId !== moduleId ||\n              value.purpose !== purpose ||\n              value.flowId !== flowId ||\n              value.generation !== policy.generation ||\n              value.issuedAtMillis > now ||\n              value.expiresAtMillis <= now ||\n              value.expiresAtMillis <= value.issuedAtMillis ||\n              value.expiresAtMillis - value.issuedAtMillis > policy.lifetimeMillis\n            )\n              return yield* RequestBindingInvalid.make({});\n\n            const message = yield* Schema.encodeEffect(verifierMessage)([\n              \"effect-auth/request-binding-verifier/v1\",\n              moduleId,\n              purpose,\n              Redacted.value(credential),\n            ]).pipe(Effect.mapError(() => RequestBindingInvalid.make({})));\n\n            const digest = yield* crypto\n              .digest(\"SHA-256\", new TextEncoder().encode(message))\n              .pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));\n\n            // Entry verification deadline only. Final proof/action expiry is still\n            // enforced by the actual mutation owner; this is not a commit deadline.\n            return Object.freeze({\n              verifier: TokenDigest.make(Encoding.encodeBase64Url(digest)),\n              expiresAtMillis: value.expiresAtMillis,\n            });\n          }),\n        });\n      }),\n    );\n  };\n\n  const layer = Layer.unwrap(Effect.map(RequestBindingConfig, signedLayer));\n\n  return Object.freeze({ RequestBinding, signedLayer, layer });\n};\n"],"mappings":";;;;;;AAcA,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,mCAAb,cAAsD,OAAO,YAA8C,CAAC,CAC1G,oCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAeH,MAAM,sBAAsB,OAAO,OAAO;CACxC,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAU,CAAC,CAAC;CACxF,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CAC/F,SAAS,OAAO,OAAO;EACrB,aAAa,OAAO,OAAO,MAAM,OAAO,UAAU,uBAAuB,CAAC;EAC1E,MAAM,OAAO,MACX,OAAO,OAAO;GACZ,IAAI,OAAO,OAAO,MAAM,OAAO,UAAU,uBAAuB,CAAC;GACjE,UAAU,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;EACxE,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;CACtD,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO,MAAM,OAAO,UAAU,2BAA2B,CAAC;AAE/E,MAAM,WAAW,OAAO,OAAO;CAC7B,WAAW,OAAO,QAAQ,gCAAgC;CAC1D,UAAU;CACV,SAAS;CACT,QAAQ;CACR,YAAY,OAAO;CACnB,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAClE,gBAAgB,OAAO;CACvB,iBAAiB,OAAO;AAC1B,CAAC;AAED,MAAM,kBAAkB,OAAO,eAC7B,OAAO,MAAM;CACX,OAAO,QAAQ,yCAAyC;CACxD;CACA;CACA,OAAO;AACT,CAAC,CACH;;;;;;;AAaA,MAAa,sBACX,UACA,YACG;CACH,MAAM,iBAAiB,QAAQ,QAe7B,yCAAyC,SAAS,OAAO,GAAG,SAAS,GAAG,QAAQ,OAAO,GAAG,SAC5F;CAEA,MAAM,eAAe,kBAA+C;EAClE,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAC,CAAC,aAAa,GAC/C,OAAO,MAAM,OAAO,gBAAgB,OAAO,KAAK,iCAAiC,KAAK,CAAC,CAAC,CAAC,CAAC;EAE5F,MAAM,QAAQ,OAAO,OAAO;GAC1B,gBAAgB,cAAc;GAC9B,YAAY,cAAc;GAC1B,SAAS,OAAO,OAAO;IACrB,aAAa,cAAc,QAAQ;IACnC,MAAM,OAAO,OACX,cAAc,QAAQ,KAAK,KAAK,UAC9B,OAAO,OAAO;KAAE,IAAI,MAAM;KAAI,UAAU,MAAM;IAAS,CAAC,CAC1D,CACF;GACF,CAAC;EACH,CAAC;EAED,OAAO,MAAM,OACX,gBACA,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC1C,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;GACA,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,KACzC,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,SAAS,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,KACpE,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,SAAS,OAAO,wBAAwB,UAAU,OAAO,SAAS,IAAI,CAAC,CAAC,KAC5E,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,SAAS,OAAO,OAAO;GAE7B,OAAO,eAAe,GAAG;IACvB,OAAO,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,QAAQ;KAC1D,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,KACvD,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;KACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;KAEtD,MAAM,QAAQ,OAAO,OAClB,YAAY,EAAE,CAAC,CACf,KAAK,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC;KAEjE,MAAM,kBAAkB,MAAM,OAAO;KAErC,MAAM,aAAa,OAAO,OACvB,OAAO;MACN,WAAW;MACX;MACA;MACA;MACA,YAAY,OAAO;MACnB,OAAO,SAAS,gBAAgB,KAAK;MACrC,gBAAgB;MAChB;KACF,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC;KAEjE,OAAO;MACL,OAAO;OAAE;OAAQ;MAAgB;MACjC,oBAAoB,CAClB;OAAE,MAAM;OAAS,MAAM;OAAmB;OAAY;MAAgB,CACxE;KACF;IACF,CAAC;IACD,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,QAAQ,YAAY;KACxE,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,KACvD,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;KAEA,MAAM,QAAQ,OAAO,OAClB,OAAO,UAAU,CAAC,CAClB,KACC,OAAO,UAAU,UACf,MAAM,SAAS,uBACX,0BAA0B,KAAK,CAAC,CAAC,IACjC,sBAAsB,KAAK,CAAC,CAAC,CACnC,CACF;KAEF,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;KAEtD,IACE,MAAM,aAAa,YACnB,MAAM,YAAY,WAClB,MAAM,WAAW,UACjB,MAAM,eAAe,OAAO,cAC5B,MAAM,iBAAiB,OACvB,MAAM,mBAAmB,OACzB,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,iBAAiB,OAAO,gBAEtD,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;KAE7C,MAAM,UAAU,OAAO,OAAO,aAAa,eAAe,CAAC,CAAC;MAC1D;MACA;MACA;MACA,SAAS,MAAM,UAAU;KAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;KAE7D,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CACpD,KAAK,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC;KAIjE,OAAO,OAAO,OAAO;MACnB,UAAU,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;MAC3D,iBAAiB,MAAM;KACzB,CAAC;IACH,CAAC;GACH,CAAC;EACH,CAAC,CACH;CACF;CAEA,MAAM,QAAQ,MAAM,OAAO,OAAO,IAAI,sBAAsB,WAAW,CAAC;CAExE,OAAO,OAAO,OAAO;EAAE;EAAgB;EAAa;CAAM,CAAC;AAC7D"}

package/dist/operations/requestBindingModels.d.mts

@@ -0,0 +1,13 @@
+import { Schema } from "effect";
+//#region src/operations/requestBindingModels.d.ts
+declare const RequestBindingFlowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+type RequestBindingFlowId = typeof RequestBindingFlowId.Type;
+declare const RequestBindingCredential: Schema.RedactedFromValue<Schema.String>;
+declare const RequestBindingPublic: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly expiresAtMillis: Schema.Int;
+}>;
+type RequestBindingPublic = typeof RequestBindingPublic.Type;
+//#endregion
+export { RequestBindingCredential, RequestBindingFlowId, RequestBindingPublic };
+//# sourceMappingURL=requestBindingModels.d.mts.map

package/dist/operations/requestBindingModels.mjs

@@ -0,0 +1,12 @@
+import { Schema } from "effect";
+//#region src/operations/requestBindingModels.ts
+const RequestBindingFlowId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._:/-]{1,256}$/)).pipe(Schema.brand("effect-auth/RequestBindingFlowId"));
+const RequestBindingCredential = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(2048)));
+const RequestBindingPublic = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	expiresAtMillis: Schema.Int
+});
+//#endregion
+export { RequestBindingCredential, RequestBindingFlowId, RequestBindingPublic };
+
+//# sourceMappingURL=requestBindingModels.mjs.map

package/dist/operations/requestBindingModels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestBindingModels.mjs","names":[],"sources":["../../src/operations/requestBindingModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport const RequestBindingFlowId = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9._:/-]{1,256}$/),\n).pipe(Schema.brand(\"effect-auth/RequestBindingFlowId\"));\n\nexport type RequestBindingFlowId = typeof RequestBindingFlowId.Type;\n\nexport const RequestBindingCredential = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isMaxLength(2048)),\n);\n\nexport const RequestBindingPublic = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  expiresAtMillis: Schema.Int,\n});\n\nexport type RequestBindingPublic = typeof RequestBindingPublic.Type;\n"],"mappings":";;AAEA,MAAa,uBAAuB,OAAO,OAAO,MAChD,OAAO,UAAU,2BAA2B,CAC9C,CAAC,CAAC,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAIvD,MAAa,2BAA2B,OAAO,kBAC7C,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAC9C;AAEA,MAAa,uBAAuB,OAAO,OAAO;CAChD,QAAQ;CACR,iBAAiB,OAAO;AAC1B,CAAC"}

package/dist/operations/reveals.d.mts

@@ -0,0 +1,28 @@
+import { Effect, Schema } from "effect";
+//#region src/operations/reveals.d.ts
+declare const AuthRevealKind: Schema.Literals<readonly ["totp-enrollment", "recovery-codes"]>;
+type AuthRevealKind = typeof AuthRevealKind.Type;
+/** Private display data. Never use this schema as an operation's ordinary success. */
+declare const AuthRevealCommand: Schema.Union<readonly [Schema.Struct<{
+  readonly revealId: Schema.NonEmptyString;
+  readonly expiresAtMillis: Schema.Int;
+  readonly kind: Schema.Literal<"totp-enrollment">;
+  readonly payload: Schema.Redacted<Schema.Struct<{
+    readonly uri: Schema.NonEmptyString;
+    readonly manualKey: Schema.String;
+  }>>;
+}>, Schema.Struct<{
+  readonly revealId: Schema.NonEmptyString;
+  readonly expiresAtMillis: Schema.Int;
+  readonly kind: Schema.Literal<"recovery-codes">;
+  readonly payload: Schema.Redacted<Schema.$Array<Schema.String>>;
+}>]>;
+type AuthRevealCommand = typeof AuthRevealCommand.Type;
+/** Request-local memory acceptance. Invoked without a receiver; not physical delivery. */
+interface AuthRevealCommandCollector {
+  readonly supportedKinds: ReadonlyArray<AuthRevealKind>;
+  readonly accept: (commands: ReadonlyArray<AuthRevealCommand>) => Effect.Effect<void>;
+}
+//#endregion
+export { AuthRevealCommand, AuthRevealCommandCollector, AuthRevealKind };
+//# sourceMappingURL=reveals.d.mts.map

package/dist/operations/reveals.mjs

@@ -0,0 +1,88 @@
+import { Predicate, Redacted, Schema } from "effect";
+//#region src/operations/reveals.ts
+const AuthRevealKind = Schema.Literals(["totp-enrollment", "recovery-codes"]);
+const utf8 = new TextEncoder();
+const boundedText = (maximum) => Schema.NonEmptyString.check(Schema.makeFilter((value) => value.length <= maximum && !/[\uD800-\uDFFF]/u.test(value) && utf8.encode(value).byteLength <= maximum));
+const enrollment = Schema.Struct({
+	uri: boundedText(4096).check(Schema.isPattern(/^otpauth:\/\/totp\//), Schema.isPattern(/^[^\u0000-\u001f\u007f-\u009f]*$/)),
+	manualKey: Schema.String.check(Schema.isPattern(/^[A-Z2-7]{32}$/))
+});
+const recoveryCode = Schema.String.check(Schema.isPattern(/^rc1-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}$/));
+const recovery = Schema.Array(recoveryCode).check(Schema.isLengthBetween(10, 10), Schema.makeFilter((codes) => new Set(codes).size === codes.length));
+const fields = {
+	revealId: boundedText(256),
+	expiresAtMillis: Schema.Int.check(Schema.isBetween({
+		minimum: Number.MIN_SAFE_INTEGER,
+		maximum: Number.MAX_SAFE_INTEGER
+	}))
+};
+/** Private display data. Never use this schema as an operation's ordinary success. */
+const AuthRevealCommand = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("totp-enrollment"),
+	...fields,
+	payload: Schema.Redacted(enrollment, { disallowJsonEncode: true })
+}), Schema.Struct({
+	kind: Schema.Literal("recovery-codes"),
+	...fields,
+	payload: Schema.Redacted(recovery, { disallowJsonEncode: true })
+})]);
+const decodeKinds = Schema.decodeSync(Schema.Array(AuthRevealKind));
+const decodeCommand = Schema.decodeUnknownSync(AuthRevealCommand);
+const invalid = () => new globalThis.Error("Auth operation failed");
+/** Package-private: do not expose the snapshot mechanics through the public barrel. */
+const snapshotRevealKinds = (input) => {
+	if (!Array.isArray(input)) throw invalid();
+	const length = input.length;
+	if (!Number.isInteger(length) || length < 0 || length > 2) throw invalid();
+	const captured = [];
+	for (let index = 0; index < length; index++) captured.push(input[index]);
+	const kinds = decodeKinds(captured);
+	if (new Set(kinds).size !== kinds.length) throw invalid();
+	return Object.freeze([...kinds]);
+};
+/** Fully detach before a consumer's success Iso projection can suspend. */
+const snapshotRevealCommands = (input, declared) => {
+	if (input === void 0) return Object.freeze([]);
+	if (!Array.isArray(input)) throw invalid();
+	const length = input.length;
+	if (!Number.isInteger(length) || length < 0 || length > 2 || declared.length === 0 && length > 0) throw invalid();
+	const kinds = /* @__PURE__ */ new Set();
+	const ids = /* @__PURE__ */ new Set();
+	const commands = [];
+	for (let index = 0; index < length; index++) {
+		const command = input[index];
+		const kind = command.kind;
+		const revealId = command.revealId;
+		const expiresAtMillis = command.expiresAtMillis;
+		let payload;
+		if (kind === "totp-enrollment") {
+			const value = Redacted.value(command.payload);
+			if (!Predicate.isObject(value)) throw invalid();
+			payload = Object.freeze({
+				uri: value.uri,
+				manualKey: value.manualKey
+			});
+		} else if (kind === "recovery-codes") {
+			const source = Redacted.value(command.payload);
+			if (!Array.isArray(source) || source.length !== 10) throw invalid();
+			const codes = [];
+			for (let code = 0; code < 10; code++) codes.push(source[code]);
+			payload = Object.freeze(codes);
+		} else throw invalid();
+		const value = decodeCommand({
+			kind,
+			revealId,
+			expiresAtMillis,
+			payload: Redacted.make(payload, { label: "Auth reveal" })
+		});
+		if (!declared.includes(value.kind) || kinds.has(value.kind) || ids.has(value.revealId)) throw invalid();
+		kinds.add(value.kind);
+		ids.add(value.revealId);
+		commands.push(Object.freeze(value));
+	}
+	return Object.freeze(commands);
+};
+//#endregion
+export { AuthRevealCommand, AuthRevealKind, snapshotRevealCommands, snapshotRevealKinds };
+
+//# sourceMappingURL=reveals.mjs.map

package/dist/operations/reveals.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveals.mjs","names":[],"sources":["../../src/operations/reveals.ts"],"sourcesContent":["import { type Effect, Predicate, Redacted, Schema } from \"effect\";\n\nexport const AuthRevealKind = Schema.Literals([\"totp-enrollment\", \"recovery-codes\"]);\nexport type AuthRevealKind = typeof AuthRevealKind.Type;\n\nconst utf8 = new TextEncoder();\n\nconst boundedText = (maximum: number) =>\n  Schema.NonEmptyString.check(\n    Schema.makeFilter(\n      (value) =>\n        value.length <= maximum &&\n        !/[\\uD800-\\uDFFF]/u.test(value) &&\n        utf8.encode(value).byteLength <= maximum,\n    ),\n  );\n\nconst enrollment = Schema.Struct({\n  uri: boundedText(4096).check(\n    Schema.isPattern(/^otpauth:\\/\\/totp\\//),\n    // oxlint-disable-next-line no-control-regex -- Private enrollment URIs must reject control characters.\n    Schema.isPattern(/^[^\\u0000-\\u001f\\u007f-\\u009f]*$/),\n  ),\n  manualKey: Schema.String.check(Schema.isPattern(/^[A-Z2-7]{32}$/)),\n});\n\nconst recoveryCode = Schema.String.check(\n  Schema.isPattern(/^rc1-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}$/),\n);\n\nconst recovery = Schema.Array(recoveryCode).check(\n  Schema.isLengthBetween(10, 10),\n  Schema.makeFilter((codes) => new Set(codes).size === codes.length),\n);\n\nconst fields = {\n  revealId: boundedText(256),\n  expiresAtMillis: Schema.Int.check(\n    Schema.isBetween({ minimum: Number.MIN_SAFE_INTEGER, maximum: Number.MAX_SAFE_INTEGER }),\n  ),\n};\n\n/** Private display data. Never use this schema as an operation's ordinary success. */\nexport const AuthRevealCommand = Schema.Union([\n  Schema.Struct({\n    kind: Schema.Literal(\"totp-enrollment\"),\n    ...fields,\n    payload: Schema.Redacted(enrollment, { disallowJsonEncode: true }),\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"recovery-codes\"),\n    ...fields,\n    payload: Schema.Redacted(recovery, { disallowJsonEncode: true }),\n  }),\n]);\n\nexport type AuthRevealCommand = typeof AuthRevealCommand.Type;\n\n/** Request-local memory acceptance. Invoked without a receiver; not physical delivery. */\nexport interface AuthRevealCommandCollector {\n  readonly supportedKinds: ReadonlyArray<AuthRevealKind>;\n  readonly accept: (commands: ReadonlyArray<AuthRevealCommand>) => Effect.Effect<void>;\n}\n\nconst decodeKinds = Schema.decodeSync(Schema.Array(AuthRevealKind));\n// oxlint-disable-next-line no-restricted-properties -- Provider output is captured as unknown before validating this closed private boundary.\nconst decodeCommand = Schema.decodeUnknownSync(AuthRevealCommand);\nconst invalid = () => new globalThis.Error(\"Auth operation failed\");\n\n/** Package-private: do not expose the snapshot mechanics through the public barrel. */\nexport const snapshotRevealKinds = (input: ReadonlyArray<AuthRevealKind>) => {\n  if (!Array.isArray(input)) throw invalid();\n  const length = input.length;\n\n  if (!Number.isInteger(length) || length < 0 || length > 2) throw invalid();\n  const captured = [];\n\n  for (let index = 0; index < length; index++) captured.push(input[index]);\n  const kinds = decodeKinds(captured);\n\n  if (new Set(kinds).size !== kinds.length) throw invalid();\n\n  return Object.freeze([...kinds]);\n};\n\n/** Fully detach before a consumer's success Iso projection can suspend. */\nexport const snapshotRevealCommands = (\n  input: ReadonlyArray<AuthRevealCommand> | undefined,\n  declared: ReadonlyArray<AuthRevealKind>,\n): ReadonlyArray<AuthRevealCommand> => {\n  if (input === undefined) return Object.freeze([]);\n  if (!Array.isArray(input)) throw invalid();\n  const length = input.length;\n\n  if (\n    !Number.isInteger(length) ||\n    length < 0 ||\n    length > 2 ||\n    (declared.length === 0 && length > 0)\n  )\n    throw invalid();\n  const kinds = new Set<AuthRevealKind>();\n  const ids = new Set<string>();\n  const commands: AuthRevealCommand[] = [];\n\n  for (let index = 0; index < length; index++) {\n    const command = input[index];\n    const kind = command.kind;\n    const revealId = command.revealId;\n    const expiresAtMillis = command.expiresAtMillis;\n    // Capture each caller-owned primitive once. Redacted's schema validates but\n    // preserves its wrapper, so validating the original would not detach it.\n    let payload: unknown;\n\n    if (kind === \"totp-enrollment\") {\n      const value = Redacted.value(command.payload);\n\n      if (!Predicate.isObject(value)) throw invalid();\n      payload = Object.freeze({ uri: value.uri, manualKey: value.manualKey });\n    } else if (kind === \"recovery-codes\") {\n      const source = Redacted.value(command.payload);\n\n      if (!Array.isArray(source) || source.length !== 10) throw invalid();\n      const codes: unknown[] = [];\n\n      for (let code = 0; code < 10; code++) codes.push(source[code]);\n      payload = Object.freeze(codes);\n    } else {\n      throw invalid();\n    }\n\n    const value = decodeCommand({\n      kind,\n      revealId,\n      expiresAtMillis,\n      payload: Redacted.make(payload, { label: \"Auth reveal\" }),\n    });\n\n    if (!declared.includes(value.kind) || kinds.has(value.kind) || ids.has(value.revealId))\n      throw invalid();\n    kinds.add(value.kind);\n    ids.add(value.revealId);\n    commands.push(Object.freeze(value));\n  }\n\n  return Object.freeze(commands);\n};\n"],"mappings":";;AAEA,MAAa,iBAAiB,OAAO,SAAS,CAAC,mBAAmB,gBAAgB,CAAC;AAGnF,MAAM,OAAO,IAAI,YAAY;AAE7B,MAAM,eAAe,YACnB,OAAO,eAAe,MACpB,OAAO,YACJ,UACC,MAAM,UAAU,WAChB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,KAAK,OAAO,KAAK,CAAC,CAAC,cAAc,OACrC,CACF;AAEF,MAAM,aAAa,OAAO,OAAO;CAC/B,KAAK,YAAY,IAAI,CAAC,CAAC,MACrB,OAAO,UAAU,qBAAqB,GAEtC,OAAO,UAAU,kCAAkC,CACrD;CACA,WAAW,OAAO,OAAO,MAAM,OAAO,UAAU,gBAAgB,CAAC;AACnE,CAAC;AAED,MAAM,eAAe,OAAO,OAAO,MACjC,OAAO,UAAU,uDAAuD,CAC1E;AAEA,MAAM,WAAW,OAAO,MAAM,YAAY,CAAC,CAAC,MAC1C,OAAO,gBAAgB,IAAI,EAAE,GAC7B,OAAO,YAAY,UAAU,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,MAAM,CACnE;AAEA,MAAM,SAAS;CACb,UAAU,YAAY,GAAG;CACzB,iBAAiB,OAAO,IAAI,MAC1B,OAAO,UAAU;EAAE,SAAS,OAAO;EAAkB,SAAS,OAAO;CAAiB,CAAC,CACzF;AACF;;AAGA,MAAa,oBAAoB,OAAO,MAAM,CAC5C,OAAO,OAAO;CACZ,MAAM,OAAO,QAAQ,iBAAiB;CACtC,GAAG;CACH,SAAS,OAAO,SAAS,YAAY,EAAE,oBAAoB,KAAK,CAAC;AACnE,CAAC,GACD,OAAO,OAAO;CACZ,MAAM,OAAO,QAAQ,gBAAgB;CACrC,GAAG;CACH,SAAS,OAAO,SAAS,UAAU,EAAE,oBAAoB,KAAK,CAAC;AACjE,CAAC,CACH,CAAC;AAUD,MAAM,cAAc,OAAO,WAAW,OAAO,MAAM,cAAc,CAAC;AAElE,MAAM,gBAAgB,OAAO,kBAAkB,iBAAiB;AAChE,MAAM,gBAAgB,IAAI,WAAW,MAAM,uBAAuB;;AAGlE,MAAa,uBAAuB,UAAyC;CAC3E,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,QAAQ;CACzC,MAAM,SAAS,MAAM;CAErB,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,GAAG,MAAM,QAAQ;CACzE,MAAM,WAAW,CAAC;CAElB,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,SAAS,SAAS,KAAK,MAAM,MAAM;CACvE,MAAM,QAAQ,YAAY,QAAQ;CAElC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAAQ,MAAM,QAAQ;CAExD,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC;AACjC;;AAGA,MAAa,0BACX,OACA,aACqC;CACrC,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,CAAC,CAAC;CAChD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,QAAQ;CACzC,MAAM,SAAS,MAAM;CAErB,IACE,CAAC,OAAO,UAAU,MAAM,KACxB,SAAS,KACT,SAAS,KACR,SAAS,WAAW,KAAK,SAAS,GAEnC,MAAM,QAAQ;CAChB,MAAM,wBAAQ,IAAI,IAAoB;CACtC,MAAM,sBAAM,IAAI,IAAY;CAC5B,MAAM,WAAgC,CAAC;CAEvC,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,SAAS;EAC3C,MAAM,UAAU,MAAM;EACtB,MAAM,OAAO,QAAQ;EACrB,MAAM,WAAW,QAAQ;EACzB,MAAM,kBAAkB,QAAQ;EAGhC,IAAI;EAEJ,IAAI,SAAS,mBAAmB;GAC9B,MAAM,QAAQ,SAAS,MAAM,QAAQ,OAAO;GAE5C,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,MAAM,QAAQ;GAC9C,UAAU,OAAO,OAAO;IAAE,KAAK,MAAM;IAAK,WAAW,MAAM;GAAU,CAAC;EACxE,OAAO,IAAI,SAAS,kBAAkB;GACpC,MAAM,SAAS,SAAS,MAAM,QAAQ,OAAO;GAE7C,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,QAAQ;GAClE,MAAM,QAAmB,CAAC;GAE1B,KAAK,IAAI,OAAO,GAAG,OAAO,IAAI,QAAQ,MAAM,KAAK,OAAO,KAAK;GAC7D,UAAU,OAAO,OAAO,KAAK;EAC/B,OACE,MAAM,QAAQ;EAGhB,MAAM,QAAQ,cAAc;GAC1B;GACA;GACA;GACA,SAAS,SAAS,KAAK,SAAS,EAAE,OAAO,cAAc,CAAC;EAC1D,CAAC;EAED,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,MAAM,QAAQ,GACnF,MAAM,QAAQ;EAChB,MAAM,IAAI,MAAM,IAAI;EACpB,IAAI,IAAI,MAAM,QAAQ;EACtB,SAAS,KAAK,OAAO,OAAO,KAAK,CAAC;CACpC;CAEA,OAAO,OAAO,OAAO,QAAQ;AAC/B"}

package/dist/passkey/PasskeyActionEvidence.d.mts

@@ -0,0 +1,22 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../sessions/models.mjs";
+import { PasskeyActionChallenge } from "./models.mjs";
+import { PasskeyActionRequired, PasskeyUnavailable } from "./errors.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/passkey/PasskeyActionEvidence.d.ts
+declare const PasskeyActionEvidence_base: Context.ServiceClass<PasskeyActionEvidence, "effect-auth/PasskeyActionEvidence", {
+  readonly verify: (input: {
+    readonly invocation: AuthInvocation;
+    readonly challenge: PasskeyActionChallenge;
+    readonly proof?: Redacted.Redacted<string>;
+  }) => Effect.Effect<{
+    readonly evidence: AuthenticationEvidence;
+    readonly requirement: AuthenticationRequirement;
+  }, PasskeyActionRequired | PasskeyUnavailable>;
+}>;
+/** Independent current action authority. Consume replay-sensitive input in its
+ * own authority; later enrollment/removal failure never refunds it. No default. */
+declare class PasskeyActionEvidence extends PasskeyActionEvidence_base {}
+//#endregion
+export { PasskeyActionEvidence };
+//# sourceMappingURL=PasskeyActionEvidence.d.mts.map

package/dist/passkey/PasskeyActionEvidence.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyActionEvidence.ts
+/** Independent current action authority. Consume replay-sensitive input in its
+* own authority; later enrollment/removal failure never refunds it. No default. */
+var PasskeyActionEvidence = class extends Context.Service()("effect-auth/PasskeyActionEvidence") {};
+//#endregion
+export { PasskeyActionEvidence };
+
+//# sourceMappingURL=PasskeyActionEvidence.mjs.map

package/dist/passkey/PasskeyActionEvidence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyActionEvidence.mjs","names":[],"sources":["../../src/passkey/PasskeyActionEvidence.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../sessions/models\";\nimport type { PasskeyActionRequired, PasskeyUnavailable } from \"./errors\";\nimport type { PasskeyActionChallenge } from \"./models\";\n\n/** Independent current action authority. Consume replay-sensitive input in its\n * own authority; later enrollment/removal failure never refunds it. No default. */\nexport class PasskeyActionEvidence extends Context.Service<\n  PasskeyActionEvidence,\n  {\n    readonly verify: (input: {\n      readonly invocation: AuthInvocation;\n      readonly challenge: PasskeyActionChallenge;\n      readonly proof?: Redacted.Redacted<string>;\n    }) => Effect.Effect<\n      {\n        readonly evidence: AuthenticationEvidence;\n        readonly requirement: AuthenticationRequirement;\n      },\n      PasskeyActionRequired | PasskeyUnavailable\n    >;\n  }\n>()(\"effect-auth/PasskeyActionEvidence\") {}\n"],"mappings":";;;;AASA,IAAa,wBAAb,cAA2C,QAAQ,QAejD,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC"}

package/dist/passkey/PasskeyCredentials.d.mts

@@ -0,0 +1,16 @@
+import { PasskeyCredential, PasskeyProtocolCredentialId } from "./models.mjs";
+import { PasskeyUnavailable } from "./errors.mjs";
+import { Context, Effect } from "effect";
+//#region src/passkey/PasskeyCredentials.d.ts
+declare const PasskeyCredentials_base: Context.ServiceClass<PasskeyCredentials, "effect-auth/PasskeyCredentials", {
+  readonly lookup: (input: {
+    readonly rpId: string;
+    readonly protocolCredentialId: PasskeyProtocolCredentialId;
+  }) => Effect.Effect<PasskeyCredential | undefined, PasskeyUnavailable>;
+}>;
+/** Minimum read capability. The tuple is RP-global across module/profile aliases;
+ * protocol ID and opaque handle never become application subject identifiers. */
+declare class PasskeyCredentials extends PasskeyCredentials_base {}
+//#endregion
+export { PasskeyCredentials };
+//# sourceMappingURL=PasskeyCredentials.d.mts.map

package/dist/passkey/PasskeyCredentials.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyCredentials.ts
+/** Minimum read capability. The tuple is RP-global across module/profile aliases;
+* protocol ID and opaque handle never become application subject identifiers. */
+var PasskeyCredentials = class extends Context.Service()("effect-auth/PasskeyCredentials") {};
+//#endregion
+export { PasskeyCredentials };
+
+//# sourceMappingURL=PasskeyCredentials.mjs.map

package/dist/passkey/PasskeyCredentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyCredentials.mjs","names":[],"sources":["../../src/passkey/PasskeyCredentials.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PasskeyUnavailable } from \"./errors\";\nimport type { PasskeyCredential, PasskeyProtocolCredentialId } from \"./models\";\n\n/** Minimum read capability. The tuple is RP-global across module/profile aliases;\n * protocol ID and opaque handle never become application subject identifiers. */\nexport class PasskeyCredentials extends Context.Service<\n  PasskeyCredentials,\n  {\n    readonly lookup: (input: {\n      readonly rpId: string;\n      readonly protocolCredentialId: PasskeyProtocolCredentialId;\n    }) => Effect.Effect<PasskeyCredential | undefined, PasskeyUnavailable>;\n  }\n>()(\"effect-auth/PasskeyCredentials\") {}\n"],"mappings":";;;;AAOA,IAAa,qBAAb,cAAwC,QAAQ,QAQ9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/passkey/PasskeyEnrollmentContext.d.mts

@@ -0,0 +1,22 @@
+import { SubjectId } from "../Schema.mjs";
+import { PasskeyDescriptor, PasskeyRevision, PasskeyUserHandle } from "./models.mjs";
+import { PasskeyUnavailable } from "./errors.mjs";
+import { Context, Effect } from "effect";
+//#region src/passkey/PasskeyEnrollmentContext.d.ts
+declare const PasskeyEnrollmentContext_base: Context.ServiceClass<PasskeyEnrollmentContext, "effect-auth/PasskeyEnrollmentContext", {
+  readonly capture: (input: {
+    readonly moduleId: string;
+    readonly rpId: string;
+    readonly subjectId: SubjectId;
+  }) => Effect.Effect<{
+    readonly revision: typeof PasskeyRevision.Type;
+    readonly userHandle?: PasskeyUserHandle;
+    readonly credentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  } | undefined, PasskeyUnavailable>;
+}>;
+/** Current active subject, original revisions and every same-RP exclusion. An
+ * absent handle is installed conditionally with issue, never by this read. */
+declare class PasskeyEnrollmentContext extends PasskeyEnrollmentContext_base {}
+//#endregion
+export { PasskeyEnrollmentContext };
+//# sourceMappingURL=PasskeyEnrollmentContext.d.mts.map

package/dist/passkey/PasskeyEnrollmentContext.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyEnrollmentContext.ts
+/** Current active subject, original revisions and every same-RP exclusion. An
+* absent handle is installed conditionally with issue, never by this read. */
+var PasskeyEnrollmentContext = class extends Context.Service()("effect-auth/PasskeyEnrollmentContext") {};
+//#endregion
+export { PasskeyEnrollmentContext };
+
+//# sourceMappingURL=PasskeyEnrollmentContext.mjs.map

package/dist/passkey/PasskeyEnrollmentContext.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyEnrollmentContext.mjs","names":[],"sources":["../../src/passkey/PasskeyEnrollmentContext.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport type { PasskeyUnavailable } from \"./errors\";\nimport type { PasskeyDescriptor, PasskeyRevision, PasskeyUserHandle } from \"./models\";\n\n/** Current active subject, original revisions and every same-RP exclusion. An\n * absent handle is installed conditionally with issue, never by this read. */\nexport class PasskeyEnrollmentContext extends Context.Service<\n  PasskeyEnrollmentContext,\n  {\n    readonly capture: (input: {\n      readonly moduleId: string;\n      readonly rpId: string;\n      readonly subjectId: SubjectId;\n    }) => Effect.Effect<\n      | {\n          readonly revision: typeof PasskeyRevision.Type;\n          readonly userHandle?: PasskeyUserHandle;\n          readonly credentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;\n        }\n      | undefined,\n      PasskeyUnavailable\n    >;\n  }\n>()(\"effect-auth/PasskeyEnrollmentContext\") {}\n"],"mappings":";;;;AAQA,IAAa,2BAAb,cAA8C,QAAQ,QAiBpD,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/passkey/PasskeyManagementPersistence.d.mts

@@ -0,0 +1,106 @@
+import { SubjectId } from "../Schema.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyClaim, PasskeyCredential, PasskeyCredentialSummary, PasskeyIssueDecision, PasskeyRegistrationVerified, PasskeyRemoved } from "./models.mjs";
+import { PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyManagementPolicy, PasskeyMethodPolicy } from "./policy.mjs";
+import { PreparePasskeyCommit } from "./PasskeyPersistence.mjs";
+import { Context, Effect } from "effect";
+//#region src/passkey/PasskeyManagementPersistence.d.ts
+declare const PasskeyManagementPersistence_base: Context.ServiceClass<PasskeyManagementPersistence, "effect-auth/PasskeyManagementPersistence", {
+  /** Active current metadata-access policy and ownership, including replay. */
+  readonly list: (input: {
+    readonly moduleId: string;
+    readonly subjectId: SubjectId;
+    readonly cursor?: string;
+    readonly limit: number;
+  }) => Effect.Effect<{
+    readonly credentials: ReadonlyArray<PasskeyCredentialSummary>;
+    readonly cursor?: string;
+  }, PasskeyUnavailable>;
+  /** Exact action authority, exclusion set, proposed existing/absent handle and
+   * credential cap + durable admission + Pending ceremony in one owner. */
+  readonly issueEnrollment: <A>(input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly policy: PasskeyMethodPolicy;
+    readonly management: PasskeyManagementPolicy;
+    readonly authorization: PasskeyActionAuthorization;
+  }, prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  /** Repeat original+current requirements and all revisions/freshness at final
+   * clock, exact claim/key/handle/RP/global uniqueness and count. Join credential,
+   * shared factor, subject revision, session/pending invalidation + terminal event.
+   * Enrollment never creates AuthenticationEvidence/session. Primary eligibility
+   * requires the persisted enrollment profile AND verified UV, never later promotion. */
+  readonly completeEnrollment: <A>(input: {
+    readonly claim: PasskeyClaim;
+    readonly verified: PasskeyRegistrationVerified;
+    readonly authorization: PasskeyActionAuthorization;
+    readonly management: PasskeyManagementPolicy;
+    readonly invalidation: SessionInvalidationWindow;
+    readonly nowMillis: number;
+  }, prepare: PreparePasskeyCommit<{
+    readonly _tag: "Enrolled";
+    readonly credential: PasskeyCredentialSummary;
+  } | {
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  /** Authenticated exact command replay before fresh action input is consumed.
+   * Wrong command/subject/target reuse rejects; missing row never proves rollback. */
+  readonly inspectRemove: (input: {
+    readonly moduleId: string;
+    readonly subjectId: SubjectId;
+    readonly commandId: string;
+    readonly credentialId: string;
+  }) => Effect.Effect<{
+    readonly _tag: "Target";
+    readonly credential: PasskeyCredential;
+  } | {
+    readonly _tag: "Replay";
+    readonly result: typeof PasskeyRemoved.Type;
+  } | {
+    readonly _tag: "Rejected";
+  }, PasskeyUnavailable>;
+  /** Current independent action authority and last usable primary/recovery/factor
+   * policy in SAME owner; factor-only and connected grants are not alternatives.
+   * Concurrent removals leave a usable path. Remove credential/shared factor,
+   * bump semantic+subject revisions, terminalize dependent ceremonies, invalidate
+   * under declared strategy, retain exact command. Repeat postconditions last. */
+  readonly remove: <A>(input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly credential: PasskeyCredential;
+    readonly authorization: PasskeyActionAuthorization;
+    readonly management: PasskeyManagementPolicy;
+    readonly invalidation: SessionInvalidationWindow;
+    readonly nowMillis: number;
+    readonly retentionUntilMillis: number;
+  }, prepare: PreparePasskeyCommit<{
+    readonly _tag: "Removed";
+    readonly result: typeof PasskeyRemoved.Type;
+  } | {
+    readonly _tag: "Rejected" | "LastSignInMethod";
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  /** Safe metadata only, no semantic revision bump. Current active owner/policy
+   * and exact original name/target on replay; conflicting command reuse rejects. */
+  readonly rename: <A>(input: {
+    readonly moduleId: string;
+    readonly subjectId: SubjectId;
+    readonly commandId: string;
+    readonly credentialId: string;
+    readonly name: string;
+    readonly nowMillis: number;
+    readonly retentionUntilMillis: number;
+  }, prepare: PreparePasskeyCommit<{
+    readonly _tag: "Renamed";
+    readonly credential: PasskeyCredentialSummary;
+    readonly replayed: boolean;
+  } | {
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+}>;
+/** Optional same-owner composites. Global (rpId,id)/(rpId,handle) ownership spans
+ * all modules/profile aliases and unresolved registrations. No network or Claims. */
+declare class PasskeyManagementPersistence extends PasskeyManagementPersistence_base {}
+//#endregion
+export { PasskeyManagementPersistence };
+//# sourceMappingURL=PasskeyManagementPersistence.d.mts.map

package/dist/passkey/PasskeyManagementPersistence.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyManagementPersistence.ts
+/** Optional same-owner composites. Global (rpId,id)/(rpId,handle) ownership spans
+* all modules/profile aliases and unresolved registrations. No network or Claims. */
+var PasskeyManagementPersistence = class extends Context.Service()("effect-auth/PasskeyManagementPersistence") {};
+//#endregion
+export { PasskeyManagementPersistence };
+
+//# sourceMappingURL=PasskeyManagementPersistence.mjs.map

package/dist/passkey/PasskeyManagementPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyManagementPersistence.mjs","names":[],"sources":["../../src/passkey/PasskeyManagementPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { SubjectId } from \"../Schema\";\nimport type { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport type { PasskeyUnavailable } from \"./errors\";\nimport type {\n  PasskeyActionAuthorization,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyIssueDecision,\n  PasskeyRegistrationVerified,\n  PasskeyRemoved,\n} from \"./models\";\nimport type { PreparePasskeyCommit } from \"./PasskeyPersistence\";\nimport type { PasskeyManagementPolicy, PasskeyMethodPolicy } from \"./policy\";\n\n/** Optional same-owner composites. Global (rpId,id)/(rpId,handle) ownership spans\n * all modules/profile aliases and unresolved registrations. No network or Claims. */\nexport class PasskeyManagementPersistence extends Context.Service<\n  PasskeyManagementPersistence,\n  {\n    /** Active current metadata-access policy and ownership, including replay. */\n    readonly list: (input: {\n      readonly moduleId: string;\n      readonly subjectId: SubjectId;\n      readonly cursor?: string;\n      readonly limit: number;\n    }) => Effect.Effect<\n      { readonly credentials: ReadonlyArray<PasskeyCredentialSummary>; readonly cursor?: string },\n      PasskeyUnavailable\n    >;\n    /** Exact action authority, exclusion set, proposed existing/absent handle and\n     * credential cap + durable admission + Pending ceremony in one owner. */\n    readonly issueEnrollment: <A>(\n      input: {\n        readonly ceremony: PasskeyCeremony;\n        readonly policy: PasskeyMethodPolicy;\n        readonly management: PasskeyManagementPolicy;\n        readonly authorization: PasskeyActionAuthorization;\n      },\n      prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    /** Repeat original+current requirements and all revisions/freshness at final\n     * clock, exact claim/key/handle/RP/global uniqueness and count. Join credential,\n     * shared factor, subject revision, session/pending invalidation + terminal event.\n     * Enrollment never creates AuthenticationEvidence/session. Primary eligibility\n     * requires the persisted enrollment profile AND verified UV, never later promotion. */\n    readonly completeEnrollment: <A>(\n      input: {\n        readonly claim: PasskeyClaim;\n        readonly verified: PasskeyRegistrationVerified;\n        readonly authorization: PasskeyActionAuthorization;\n        readonly management: PasskeyManagementPolicy;\n        readonly invalidation: SessionInvalidationWindow;\n        readonly nowMillis: number;\n      },\n      prepare: PreparePasskeyCommit<\n        | { readonly _tag: \"Enrolled\"; readonly credential: PasskeyCredentialSummary }\n        | { readonly _tag: \"Rejected\" },\n        A\n      >,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    /** Authenticated exact command replay before fresh action input is consumed.\n     * Wrong command/subject/target reuse rejects; missing row never proves rollback. */\n    readonly inspectRemove: (input: {\n      readonly moduleId: string;\n      readonly subjectId: SubjectId;\n      readonly commandId: string;\n      readonly credentialId: string;\n    }) => Effect.Effect<\n      | { readonly _tag: \"Target\"; readonly credential: PasskeyCredential }\n      | { readonly _tag: \"Replay\"; readonly result: typeof PasskeyRemoved.Type }\n      | { readonly _tag: \"Rejected\" },\n      PasskeyUnavailable\n    >;\n    /** Current independent action authority and last usable primary/recovery/factor\n     * policy in SAME owner; factor-only and connected grants are not alternatives.\n     * Concurrent removals leave a usable path. Remove credential/shared factor,\n     * bump semantic+subject revisions, terminalize dependent ceremonies, invalidate\n     * under declared strategy, retain exact command. Repeat postconditions last. */\n    readonly remove: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly commandId: string;\n        readonly credential: PasskeyCredential;\n        readonly authorization: PasskeyActionAuthorization;\n        readonly management: PasskeyManagementPolicy;\n        readonly invalidation: SessionInvalidationWindow;\n        readonly nowMillis: number;\n        readonly retentionUntilMillis: number;\n      },\n      prepare: PreparePasskeyCommit<\n        | { readonly _tag: \"Removed\"; readonly result: typeof PasskeyRemoved.Type }\n        | { readonly _tag: \"Rejected\" | \"LastSignInMethod\" },\n        A\n      >,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    /** Safe metadata only, no semantic revision bump. Current active owner/policy\n     * and exact original name/target on replay; conflicting command reuse rejects. */\n    readonly rename: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly subjectId: SubjectId;\n        readonly commandId: string;\n        readonly credentialId: string;\n        readonly name: string;\n        readonly nowMillis: number;\n        readonly retentionUntilMillis: number;\n      },\n      prepare: PreparePasskeyCommit<\n        | {\n            readonly _tag: \"Renamed\";\n            readonly credential: PasskeyCredentialSummary;\n            readonly replayed: boolean;\n          }\n        | { readonly _tag: \"Rejected\" },\n        A\n      >,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  }\n>()(\"effect-auth/PasskeyManagementPersistence\") {}\n"],"mappings":";;;;AAqBA,IAAa,+BAAb,cAAkD,QAAQ,QAsGxD,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC"}

package/dist/passkey/PasskeyPersistence.d.mts

@@ -0,0 +1,63 @@
+import { CommitJournal, PreparedCommit } from "../hooks/commit.mjs";
+import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim, PasskeyClaimDecision, PasskeyCleanupResult, PasskeyCredential, PasskeyEvidence, PasskeyIssueDecision, PasskeySettlement } from "./models.mjs";
+import { PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyMethodPolicy } from "./policy.mjs";
+import { Context, Effect } from "effect";
+//#region src/passkey/PasskeyPersistence.d.ts
+type PreparePasskeyCommit<Value, A> = (value: Value, journal: CommitJournal) => PreparedCommit<A>;
+declare const PasskeyPersistence_base: Context.ServiceClass<PasskeyPersistence, "effect-auth/PasskeyPersistence", {
+  /** Unique module/flow + command. Exact challenge, context and binder; durable
+   * global/subject/target rolling budgets and pending caps at authority time.
+   * Duplicate never returns old ceremony with a new binder. Retain charge windows. */
+  readonly issue: <A>(input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly policy: PasskeyMethodPolicy;
+  }, prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  readonly context: (input: PasskeyAccess) => Effect.Effect<PasskeyCeremony | undefined, PasskeyUnavailable>;
+  /** Recheck exact Pending/context/config/binder/current revisions/expiry and
+   * the immutable issue policy. Atomically charge the newly resolved subject
+   * for discoverable flows whose subject was unknown at issue; retain known
+   * subject/target issue charges through full physical rolling windows. Serialize
+   * the subject budget decision with claim so different flows cannot bypass it.
+   * Optional credential authority is captured before signature verification.
+   * One fixed claim; no takeover, lease renewal or return to Pending. */
+  readonly claim: <A>(input: {
+    readonly access: PasskeyAccess;
+    readonly policy: PasskeyMethodPolicy;
+    readonly ceremony: PasskeyCeremony;
+    readonly claimId: string;
+    readonly credential?: PasskeyCredential;
+  }, prepare: PreparePasskeyCommit<PasskeyClaimDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  /** Every outcome terminalizes. Verified checks original active subject, full
+   * credential/key/profile/handle/BE and semantic revisions at final engine time.
+   * Single-device: zero/zero or strict positive increase against current counter.
+   * Multi-device: allow zero/reset/out-of-order; atomically merge max and BS without
+   * telemetry CAS rejecting another valid challenge. No semantic revision bump.
+   * Recheck all postconditions AFTER final writes; failures roll back everything. */
+  readonly settle: <A>(input: {
+    readonly claim: PasskeyClaim;
+    readonly outcome: {
+      readonly _tag: "Rejected" | "Ambiguous";
+    } | {
+      readonly _tag: "Assertion";
+      readonly credential: PasskeyCredential;
+      readonly assertion: PasskeyAssertionVerified;
+      readonly evidence: typeof PasskeyEvidence.Type;
+    };
+    readonly nowMillis: number;
+  }, prepare: PreparePasskeyCommit<PasskeySettlement, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  /** Expired Pending->Rejected, Claimed->Ambiguous, never reopen. Keep claim and
+   * charge/replay horizons and unresolved registration; bounded authority-time CAS. */
+  readonly cleanup: <A>(input: {
+    readonly moduleId: string;
+    readonly nowMillis: number;
+    readonly limit: number;
+  }, prepare: PreparePasskeyCommit<PasskeyCleanupResult, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+}>;
+/** Same-owner authority. Synchronous generic prepare precedes physical commit.
+ * Unknown/caught-child/rollback discards all receipts and events; no owner retry.
+ * Claim-before-verifier is mandatory. Nothing accepts raw response or bearer. */
+declare class PasskeyPersistence extends PasskeyPersistence_base {}
+//#endregion
+export { PasskeyPersistence, PreparePasskeyCommit };
+//# sourceMappingURL=PasskeyPersistence.d.mts.map

package/dist/passkey/PasskeyPersistence.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyPersistence.ts
+/** Same-owner authority. Synchronous generic prepare precedes physical commit.
+* Unknown/caught-child/rollback discards all receipts and events; no owner retry.
+* Claim-before-verifier is mandatory. Nothing accepts raw response or bearer. */
+var PasskeyPersistence = class extends Context.Service()("effect-auth/PasskeyPersistence") {};
+//#endregion
+export { PasskeyPersistence };
+
+//# sourceMappingURL=PasskeyPersistence.mjs.map

package/dist/passkey/PasskeyPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyPersistence.mjs","names":[],"sources":["../../src/passkey/PasskeyPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { CommitJournal, PreparedCommit } from \"../hooks/commit\";\nimport type { PasskeyUnavailable } from \"./errors\";\nimport type {\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEvidence,\n  PasskeyIssueDecision,\n  PasskeySettlement,\n} from \"./models\";\nimport type { PasskeyMethodPolicy } from \"./policy\";\n\nexport type PreparePasskeyCommit<Value, A> = (\n  value: Value,\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\n/** Same-owner authority. Synchronous generic prepare precedes physical commit.\n * Unknown/caught-child/rollback discards all receipts and events; no owner retry.\n * Claim-before-verifier is mandatory. Nothing accepts raw response or bearer. */\nexport class PasskeyPersistence extends Context.Service<\n  PasskeyPersistence,\n  {\n    /** Unique module/flow + command. Exact challenge, context and binder; durable\n     * global/subject/target rolling budgets and pending caps at authority time.\n     * Duplicate never returns old ceremony with a new binder. Retain charge windows. */\n    readonly issue: <A>(\n      input: { readonly ceremony: PasskeyCeremony; readonly policy: PasskeyMethodPolicy },\n      prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    readonly context: (\n      input: PasskeyAccess,\n    ) => Effect.Effect<PasskeyCeremony | undefined, PasskeyUnavailable>;\n    /** Recheck exact Pending/context/config/binder/current revisions/expiry and\n     * the immutable issue policy. Atomically charge the newly resolved subject\n     * for discoverable flows whose subject was unknown at issue; retain known\n     * subject/target issue charges through full physical rolling windows. Serialize\n     * the subject budget decision with claim so different flows cannot bypass it.\n     * Optional credential authority is captured before signature verification.\n     * One fixed claim; no takeover, lease renewal or return to Pending. */\n    readonly claim: <A>(\n      input: {\n        readonly access: PasskeyAccess;\n        readonly policy: PasskeyMethodPolicy;\n        readonly ceremony: PasskeyCeremony;\n        readonly claimId: string;\n        readonly credential?: PasskeyCredential;\n      },\n      prepare: PreparePasskeyCommit<PasskeyClaimDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    /** Every outcome terminalizes. Verified checks original active subject, full\n     * credential/key/profile/handle/BE and semantic revisions at final engine time.\n     * Single-device: zero/zero or strict positive increase against current counter.\n     * Multi-device: allow zero/reset/out-of-order; atomically merge max and BS without\n     * telemetry CAS rejecting another valid challenge. No semantic revision bump.\n     * Recheck all postconditions AFTER final writes; failures roll back everything. */\n    readonly settle: <A>(\n      input: {\n        readonly claim: PasskeyClaim;\n        readonly outcome:\n          | { readonly _tag: \"Rejected\" | \"Ambiguous\" }\n          | {\n              readonly _tag: \"Assertion\";\n              readonly credential: PasskeyCredential;\n              readonly assertion: PasskeyAssertionVerified;\n              readonly evidence: typeof PasskeyEvidence.Type;\n            };\n        readonly nowMillis: number;\n      },\n      prepare: PreparePasskeyCommit<PasskeySettlement, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    /** Expired Pending->Rejected, Claimed->Ambiguous, never reopen. Keep claim and\n     * charge/replay horizons and unresolved registration; bounded authority-time CAS. */\n    readonly cleanup: <A>(\n      input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n      prepare: PreparePasskeyCommit<PasskeyCleanupResult, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  }\n>()(\"effect-auth/PasskeyPersistence\") {}\n"],"mappings":";;;;;AA0BA,IAAa,qBAAb,cAAwC,QAAQ,QA0D9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/passkey/PasskeyProtocol.d.mts

@@ -0,0 +1,38 @@
+import { PasskeyAssertionVerified, PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyCredential, PasskeyDescriptor, PasskeyProfile, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyUserHandle } from "./models.mjs";
+import { PasskeyProtocolRejected, PasskeyUnavailable } from "./errors.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/passkey/PasskeyProtocol.d.ts
+declare const PasskeyProtocol_base: Context.ServiceClass<PasskeyProtocol, "effect-auth/PasskeyProtocol", {
+  readonly prepareAuthentication: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly allowedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyAuthenticationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly prepareRegistration: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly userHandle: PasskeyUserHandle;
+    readonly name: string;
+    readonly displayName: string;
+    readonly excludedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyRegistrationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyAuthentication: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly credential: PasskeyCredential;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyAssertionVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyRegistration: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyRegistrationVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+}>;
+/** Maintained WebAuthn boundary. Validate the configured RP against a maintained
+ * public-suffix/domain authority; no permissive default or hand-written verifier.
+ * Exact type/challenge/origin/RP/id/rawId/handle, UP/UV, signature and immutable BE.
+ * None-only attestation. No global settings, identity lookup, persistence or tokens. */
+declare class PasskeyProtocol extends PasskeyProtocol_base {}
+//#endregion
+export { PasskeyProtocol };
+//# sourceMappingURL=PasskeyProtocol.d.mts.map

package/dist/passkey/PasskeyProtocol.mjs

@@ -0,0 +1,11 @@
+import { Context } from "effect";
+//#region src/passkey/PasskeyProtocol.ts
+/** Maintained WebAuthn boundary. Validate the configured RP against a maintained
+* public-suffix/domain authority; no permissive default or hand-written verifier.
+* Exact type/challenge/origin/RP/id/rawId/handle, UP/UV, signature and immutable BE.
+* None-only attestation. No global settings, identity lookup, persistence or tokens. */
+var PasskeyProtocol = class extends Context.Service()("effect-auth/PasskeyProtocol") {};
+//#endregion
+export { PasskeyProtocol };
+
+//# sourceMappingURL=PasskeyProtocol.mjs.map

package/dist/passkey/PasskeyProtocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyProtocol.mjs","names":[],"sources":["../../src/passkey/PasskeyProtocol.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { PasskeyProtocolRejected, PasskeyUnavailable } from \"./errors\";\nimport type {\n  PasskeyAssertionVerified,\n  PasskeyAuthenticationOptions,\n  PasskeyCeremony,\n  PasskeyCredential,\n  PasskeyDescriptor,\n  PasskeyProfile,\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationVerified,\n  PasskeyUserHandle,\n} from \"./models\";\n\n/** Maintained WebAuthn boundary. Validate the configured RP against a maintained\n * public-suffix/domain authority; no permissive default or hand-written verifier.\n * Exact type/challenge/origin/RP/id/rawId/handle, UP/UV, signature and immutable BE.\n * None-only attestation. No global settings, identity lookup, persistence or tokens. */\nexport class PasskeyProtocol extends Context.Service<\n  PasskeyProtocol,\n  {\n    readonly prepareAuthentication: (input: {\n      readonly profile: PasskeyProfile;\n      readonly challenge: string;\n      readonly timeoutMillis: number;\n      readonly allowedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;\n    }) => Effect.Effect<PasskeyAuthenticationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;\n    readonly prepareRegistration: (input: {\n      readonly profile: PasskeyProfile;\n      readonly challenge: string;\n      readonly timeoutMillis: number;\n      readonly userHandle: PasskeyUserHandle;\n      readonly name: string;\n      readonly displayName: string;\n      readonly excludedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;\n    }) => Effect.Effect<PasskeyRegistrationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;\n    readonly verifyAuthentication: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly credential: PasskeyCredential;\n      readonly response: Redacted.Redacted<string>;\n    }) => Effect.Effect<PasskeyAssertionVerified, PasskeyProtocolRejected | PasskeyUnavailable>;\n    readonly verifyRegistration: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly response: Redacted.Redacted<string>;\n    }) => Effect.Effect<PasskeyRegistrationVerified, PasskeyProtocolRejected | PasskeyUnavailable>;\n  }\n>()(\"effect-auth/PasskeyProtocol\") {}\n"],"mappings":";;;;;;AAmBA,IAAa,kBAAb,cAAqC,QAAQ,QA4B3C,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC"}