@yielded/auth 0.1.0-beta.1

package/dist/passkey/actions.d.mts

@@ -0,0 +1,50 @@
+import { AuthOperationResult } from "../operations/credentials.mjs";
+import { AuthenticationEvidence } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { RequestBindingConfig } from "../operations/RequestBindingConfig.mjs";
+import { RequestBindingFlowId, RequestBindingPublic } from "../operations/requestBindingModels.mjs";
+import { BindingModule, RequestBindingConfiguration, RequestBindingConfigurationError, RequestBindingInvalid, RequestBindingUnavailable, VerifiedRequestBinding } from "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Hooks.mjs";
+import "../Auth.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyComplete, PasskeyTarget } from "./models.mjs";
+import { PasskeyConfigurationError, PasskeyFailure } from "./errors.mjs";
+import { PasskeyCredentials } from "./PasskeyCredentials.mjs";
+import { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext.mjs";
+import { PasskeyMethodPolicy } from "./policy.mjs";
+import { PasskeyPersistence } from "./PasskeyPersistence.mjs";
+import { PasskeyProtocol } from "./PasskeyProtocol.mjs";
+import { Context, Crypto, DateTime, Effect, Layer, Redacted } from "effect";
+//#region src/passkey/actions.d.ts
+/** Trusted target adapters only. Possession of a public flow/digest is not target
+ * authorization; callers MUST resolve the private target capability each time. */
+declare const makePasskeyActions: <const Id extends string>(moduleId: Id, source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>) => Readonly<{
+  PasskeyActionAssertions: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "passkey-actions";
+  }, {
+    readonly begin: (input: PasskeyBegin, target: PasskeyTarget) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+    readonly complete: (input: PasskeyComplete, target: PasskeyTarget) => Effect.Effect<{
+      readonly evidence: AuthenticationEvidence;
+      readonly credentialCommands: AuthOperationResult<void>["credentialCommands"];
+    }, PasskeyFailure>;
+  }>;
+  binding: Readonly<{
+    RequestBinding: Context.Service<BindingModule<Id, "passkey-action">, {
+      readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+      readonly verify: (flowId: RequestBindingFlowId, credential: Redacted.Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+    }>;
+    signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, "passkey-action">, RequestBindingConfigurationError, Crypto.Crypto | SubtleCrypto>;
+    layer: Layer.Layer<BindingModule<Id, "passkey-action">, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
+  }>;
+  layer: Layer.Layer<{
+    readonly moduleId: Id;
+    readonly kind: "passkey-actions";
+  }, PasskeyConfigurationError, AuthenticationAuthority | BindingModule<Id, "passkey-action"> | Crypto.Crypto | LifecycleHooks | PasskeyCredentials | PasskeyEnrollmentContext | PasskeyPersistence | PasskeyProtocol>;
+}>;
+//#endregion
+export { makePasskeyActions };
+//# sourceMappingURL=actions.d.mts.map

package/dist/passkey/actions.mjs

@@ -0,0 +1,376 @@
+import { lifecycleSnapshot } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { AuthenticationFlowId } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { PasskeyCredentials } from "./PasskeyCredentials.mjs";
+import { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext.mjs";
+import { PasskeyPersistence } from "./PasskeyPersistence.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { PasskeyActionRequired, PasskeyConfigurationError, PasskeyMethodUnsupported, PasskeyProtocolRejected, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyAccess, PasskeyAssertion, PasskeyAssertionVerified, PasskeyAttestation, PasskeyAuthenticationOptions, PasskeyBegin, PasskeyCeremony, PasskeyClaimDecision, PasskeyComplete, PasskeyContext, PasskeyCredential, PasskeyEnrollmentSnapshot, PasskeyEvidence, PasskeyIssueDecision, PasskeyModuleId, PasskeyProfile, PasskeyProtocolCredentialId, PasskeyRegistrationComplete, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyRevision, PasskeyTarget, PasskeyUserHandle } from "./models.mjs";
+import { freezePasskey, samePasskey, snapshotPasskey, snapshotPasskeySync } from "./snapshot.mjs";
+import { PasskeyMethodPolicy, validatePasskeyPolicy } from "./policy.mjs";
+import { PasskeyProtocol } from "./PasskeyProtocol.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Fiber, Layer, Redacted, Schema } from "effect";
+//#region src/passkey/actions.ts
+const passkeyNoAmbient = Effect.fn("Passkey.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* PasskeyMethodUnsupported.make({});
+});
+const readPasskeyCommit = (receipt) => receipt.read.pipe(Effect.mapError(() => PasskeyUnavailable.make({})));
+const capturePasskeyPolicy = (input) => {
+	try {
+		return validatePasskeyPolicy(snapshotPasskeySync(PasskeyMethodPolicy, input));
+	} catch {
+		return Effect.fail(PasskeyConfigurationError.make({}));
+	}
+};
+const clear = {
+	_tag: "Clear",
+	slot: "request-binding"
+};
+const prepare = (value, journal) => journal.prepare(value);
+const now = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+const bounded = (operation, millis) => Effect.gen(function* () {
+	const fiber = yield* operation.pipe(Effect.interruptible, Effect.forkDetach);
+	return yield* Fiber.join(fiber).pipe(Effect.timeout(Math.max(1, millis)), Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)));
+});
+const passkeyUnexpected = (operation) => operation.pipe(Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-core", cause).pipe(Effect.andThen(Effect.fail(PasskeyUnavailable.make({})))) : Effect.failCause(cause)));
+const envelope = Schema.Struct({
+	id: PasskeyProtocolCredentialId,
+	rawId: PasskeyProtocolCredentialId,
+	type: Schema.Literal("public-key"),
+	response: Schema.Struct({ userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle)) })
+});
+const contextPurpose = {
+	SignIn: "sign-in",
+	Registration: "registration",
+	Enrollment: "enrollment",
+	Pending: "pending",
+	StepUp: "step-up",
+	Action: "action"
+};
+/** Private ceremony machinery shared by separately enabled facets. No generic
+* evidence operation is installed. Callers authenticate target contexts first. */
+const makePasskeyCeremony = (moduleId, source, purpose) => {
+	const binding = makeRequestBinding(moduleId, `passkey-${purpose}`);
+	return {
+		binding,
+		make: Effect.gen(function* () {
+			const policy = yield* source;
+			const id = yield* Schema.decodeEffect(PasskeyModuleId)(moduleId).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
+			const protocol = yield* PasskeyProtocol;
+			const persistence = yield* PasskeyPersistence;
+			const binder = yield* binding.RequestBinding;
+			const crypto = yield* Crypto.Crypto;
+			const hooks = yield* LifecycleHooks;
+			const random = () => crypto.randomBytes(32).pipe(Effect.map(Encoding.encodeBase64Url), Effect.mapError(() => PasskeyUnavailable.make({})));
+			const profile = (profileId) => Effect.fromNullishOr(policy.profiles.find((value) => value.profileId === profileId)).pipe(Effect.mapError(() => PasskeyRejected.make({})));
+			const access = Effect.fn("Passkey.access")(function* (input) {
+				const verified = yield* binder.verify(input.flowId, input.bindingCredential).pipe(Effect.mapError((error) => error._tag === "RequestBindingUnavailable" ? PasskeyUnavailable.make({}) : PasskeyRejected.make({})));
+				return yield* snapshotPasskey(PasskeyAccess, {
+					moduleId: id,
+					generation: policy.generation,
+					purpose,
+					flowId: input.flowId,
+					requestBindingVerifier: verified.verifier,
+					requestBindingExpiresAtMillis: verified.expiresAtMillis,
+					nowMillis: yield* now
+				});
+			});
+			const inspect = Effect.fn("Passkey.inspect")(function* (input, expected) {
+				yield* passkeyNoAmbient();
+				input = yield* snapshotPasskey(Schema.toType(Schema.Struct({
+					flowId: PasskeyComplete.fields.flowId,
+					bindingCredential: PasskeyComplete.fields.bindingCredential
+				})), input);
+				const key = yield* access(input), raw = yield* persistence.context(key);
+				if (raw === void 0) return yield* PasskeyRejected.make({});
+				const ceremony = yield* snapshotPasskey(PasskeyCeremony, raw), clock = yield* now;
+				if (ceremony.moduleId !== id || ceremony.generation !== policy.generation || ceremony.purpose !== purpose || contextPurpose[ceremony.context._tag] !== purpose || ceremony.flowId !== input.flowId || ceremony.requestBindingVerifier !== key.requestBindingVerifier || ceremony.requestBindingExpiresAtMillis !== key.requestBindingExpiresAtMillis || ceremony.issuedAtMillis > clock || ceremony.expiresAtMillis <= clock || ceremony.expiresAtMillis > ceremony.requestBindingExpiresAtMillis || ceremony.expiresAtMillis - ceremony.issuedAtMillis > policy.lifetimeMillis || ceremony.retentionUntilMillis !== ceremony.issuedAtMillis + policy.retentionMillis || ceremony.claimLifetimeMillis !== policy.claimLifetimeMillis) return yield* PasskeyRejected.make({});
+				if (!(yield* samePasskey(PasskeyProfile, ceremony.profile, yield* profile(ceremony.profile.profileId)))) return yield* PasskeyRejected.make({});
+				if (expected !== void 0 && !(yield* samePasskey(PasskeyContext, ceremony.context, expected))) return yield* PasskeyRejected.make({});
+				return {
+					key,
+					ceremony
+				};
+			});
+			const before = Effect.fn("Passkey.before")(function* (context) {
+				yield* hooks.before(lifecycleSnapshot({
+					action: purpose === "registration" ? "registration" : purpose === "enrollment" ? "credential-change" : purpose === "sign-in" ? "sign-in" : "proof-verification",
+					operation: `${moduleId}/passkey/${purpose}`,
+					method: "passkey",
+					identifiers: [],
+					...context._tag === "Enrollment" ? { subjectId: context.revision.subjectId } : "target" in context ? { subjectId: context.target.revision.subjectId } : {}
+				}));
+			});
+			const newCeremony = Effect.fn("Passkey.newCeremony")(function* (input, context, allowed) {
+				yield* passkeyNoAmbient();
+				const selected = yield* profile(input.profileId);
+				if (contextPurpose[context._tag] !== purpose) return yield* PasskeyRejected.make({});
+				const fixed = yield* snapshotPasskey(PasskeyContext, context);
+				yield* before(fixed);
+				const issued = yield* binder.issue(input.flowId).pipe(Effect.mapError(() => PasskeyUnavailable.make({})));
+				const command = issued.credentialCommands[0];
+				if (command?._tag !== "Issue") return yield* PasskeyUnavailable.make({});
+				const verified = yield* binder.verify(input.flowId, command.credential).pipe(Effect.mapError(() => PasskeyUnavailable.make({})));
+				const timestamp = yield* now;
+				const expiresAtMillis = Math.min(timestamp + policy.lifetimeMillis, verified.expiresAtMillis, "target" in fixed ? fixed.target.expiresAtMillis : Infinity, "target" in fixed && fixed.target.requirement !== void 0 ? timestamp + fixed.target.requirement.maximumAgeMillis : Infinity);
+				if (expiresAtMillis <= timestamp) return yield* PasskeyRejected.make({});
+				return {
+					ceremony: yield* snapshotPasskey(PasskeyCeremony, {
+						moduleId: id,
+						generation: policy.generation,
+						flowId: input.flowId,
+						commandId: input.commandId,
+						purpose,
+						profile: selected,
+						challenge: yield* random(),
+						requestBindingVerifier: verified.verifier,
+						requestBindingExpiresAtMillis: verified.expiresAtMillis,
+						issuedAtMillis: timestamp,
+						expiresAtMillis,
+						retentionUntilMillis: timestamp + policy.retentionMillis,
+						claimLifetimeMillis: policy.claimLifetimeMillis,
+						allowedCredentials: allowed,
+						context: fixed
+					}),
+					commands: issued.credentialCommands
+				};
+			});
+			const beginAuthentication = Effect.fn("Passkey.beginAuthentication")(function* (input, context, allowed = []) {
+				input = yield* snapshotPasskey(PasskeyBegin, input);
+				const { ceremony, commands } = yield* newCeremony(input, context, allowed);
+				if (context._tag === "SignIn" && (!ceremony.profile.primarySignIn || ceremony.profile.residentKey !== "required" || ceremony.profile.userVerification !== "required")) return yield* PasskeyRejected.make({});
+				const options = yield* snapshotPasskey(PasskeyAuthenticationOptions, yield* protocol.prepareAuthentication({
+					profile: ceremony.profile,
+					challenge: ceremony.challenge,
+					timeoutMillis: ceremony.expiresAtMillis - ceremony.issuedAtMillis,
+					allowedCredentials: ceremony.allowedCredentials
+				}).pipe(Effect.mapError(() => PasskeyUnavailable.make({}))));
+				if (options.challenge !== ceremony.challenge || options.rpId !== ceremony.profile.rpId || options.userVerification !== ceremony.profile.userVerification || options.timeout > ceremony.expiresAtMillis - ceremony.issuedAtMillis || options.timeout <= 0 || options.allowCredentials.length !== ceremony.allowedCredentials.length || options.allowCredentials.some((item, index) => item.id !== ceremony.allowedCredentials[index]?.id)) return yield* PasskeyUnavailable.make({});
+				const result = yield* snapshotPasskey(PasskeyIssueDecision, yield* readPasskeyCommit(yield* persistence.issue({
+					ceremony,
+					policy
+				}, prepare)));
+				if (result._tag !== "Issued") return yield* PasskeyRejected.make({});
+				if (!(yield* samePasskey(PasskeyCeremony, result.ceremony, ceremony)) || (yield* now) >= ceremony.expiresAtMillis) return yield* PasskeyUnavailable.make({});
+				return {
+					value: {
+						flowId: input.flowId,
+						expiresAtMillis: ceremony.expiresAtMillis,
+						options
+					},
+					credentialCommands: commands
+				};
+			}, passkeyUnexpected);
+			const prepareRegistration = Effect.fn("Passkey.prepareRegistration")(function* (input, context, excluded) {
+				input = yield* snapshotPasskey(PasskeyBegin, input);
+				context = yield* snapshotPasskey(Schema.Union([PasskeyContext.members[1], PasskeyContext.members[2]]), context);
+				const { ceremony, commands } = yield* newCeremony(input, context, excluded);
+				const options = yield* snapshotPasskey(PasskeyRegistrationOptions, yield* protocol.prepareRegistration({
+					profile: ceremony.profile,
+					challenge: ceremony.challenge,
+					timeoutMillis: ceremony.expiresAtMillis - ceremony.issuedAtMillis,
+					userHandle: context.userHandle,
+					name: context.name,
+					displayName: context._tag === "Registration" ? context.displayName : context.name,
+					excludedCredentials: excluded
+				}).pipe(Effect.mapError(() => PasskeyUnavailable.make({}))));
+				if (options.challenge !== ceremony.challenge || options.rp.id !== ceremony.profile.rpId || options.rp.name !== ceremony.profile.rpName || options.user.id !== context.userHandle || options.user.name !== context.name || options.user.displayName !== (context._tag === "Registration" ? context.displayName : context.name) || options.attestation !== "none" || options.timeout <= 0 || options.timeout > ceremony.expiresAtMillis - ceremony.issuedAtMillis || options.authenticatorSelection.userVerification !== ceremony.profile.userVerification || options.authenticatorSelection.residentKey !== ceremony.profile.residentKey || options.pubKeyCredParams.length !== ceremony.profile.algorithms.length || options.pubKeyCredParams.some((item, index) => item.alg !== ceremony.profile.algorithms[index]) || options.excludeCredentials.length !== excluded.length || options.excludeCredentials.some((item, index) => item.id !== excluded[index]?.id)) return yield* PasskeyUnavailable.make({});
+				const draft = {
+					ceremony,
+					started: {
+						flowId: input.flowId,
+						expiresAtMillis: ceremony.expiresAtMillis,
+						options
+					},
+					credentialCommands: commands
+				};
+				freezePasskey(draft);
+				return draft;
+			}, passkeyUnexpected);
+			const acceptRegistrationIssue = Effect.fn("Passkey.acceptRegistrationIssue")(function* (draft, decision) {
+				const result = yield* snapshotPasskey(PasskeyIssueDecision, decision);
+				if (result._tag !== "Issued") return yield* PasskeyRejected.make({});
+				if (!(yield* samePasskey(PasskeyCeremony, result.ceremony, draft.ceremony)) || (yield* now) >= draft.ceremony.expiresAtMillis) return yield* PasskeyUnavailable.make({});
+				return {
+					value: draft.started,
+					credentialCommands: draft.credentialCommands
+				};
+			}, passkeyUnexpected);
+			const claim = Effect.fn("Passkey.claim")(function* (inspected, credential) {
+				const claimId = yield* random();
+				const decision = yield* snapshotPasskey(PasskeyClaimDecision, yield* readPasskeyCommit(yield* persistence.claim({
+					...inspected,
+					access: inspected.key,
+					policy,
+					claimId,
+					...credential === void 0 ? {} : { credential }
+				}, prepare)));
+				if (decision._tag !== "Claimed") return yield* PasskeyRejected.make({});
+				const result = decision.claim, clock = yield* now;
+				if (result.claimId !== claimId || !(yield* samePasskey(PasskeyCeremony, result.ceremony, inspected.ceremony)) || result.claimedAtMillis > clock || result.claimedAtMillis < inspected.ceremony.issuedAtMillis || result.claimExpiresAtMillis !== Math.min(result.claimedAtMillis + policy.claimLifetimeMillis, inspected.ceremony.expiresAtMillis) || result.claimExpiresAtMillis <= clock) return yield* PasskeyUnavailable.make({});
+				return result;
+			});
+			const terminal = Effect.fn("Passkey.terminal")(function* (claimed, outcome) {
+				if ((yield* readPasskeyCommit(yield* persistence.settle({
+					claim: claimed,
+					outcome: { _tag: outcome },
+					nowMillis: yield* now
+				}, prepare))) !== outcome) return yield* PasskeyUnavailable.make({});
+			});
+			const verify = (claimed, operation) => Effect.gen(function* () {
+				const remaining = claimed.claimExpiresAtMillis - (yield* now);
+				if (remaining <= 0) return yield* PasskeyRejected.make({});
+				return yield* bounded(operation, remaining);
+			}).pipe(passkeyUnexpected, Effect.catch((error) => terminal(claimed, error instanceof PasskeyProtocolRejected || error instanceof PasskeyRejected ? "Rejected" : "Ambiguous").pipe(Effect.andThen(Effect.fail(error instanceof PasskeyProtocolRejected || error instanceof PasskeyRejected ? PasskeyRejected.make({}) : PasskeyUnavailable.make({}))))), Effect.onInterrupt(() => terminal(claimed, "Ambiguous").pipe(Effect.ignore)));
+			return {
+				policy,
+				profile,
+				random,
+				inspect,
+				beginAuthentication,
+				prepareRegistration,
+				acceptRegistrationIssue,
+				authentication: Effect.fn("Passkey.authentication")(function* (input, expected) {
+					input = yield* snapshotPasskey(Schema.toType(PasskeyComplete), input);
+					const inspected = yield* inspect(input, expected);
+					yield* before(inspected.ceremony.context);
+					yield* Schema.decodeEffect(Schema.toType(PasskeyAssertion))(input.response).pipe(Effect.mapError(() => PasskeyRejected.make({})));
+					const decoded = yield* Schema.decodeEffect(Schema.fromJsonString(envelope))(Redacted.value(input.response)).pipe(Effect.result);
+					let credential;
+					if (decoded._tag === "Success" && decoded.success.id === decoded.success.rawId) {
+						const found = yield* (yield* PasskeyCredentials).lookup({
+							rpId: inspected.ceremony.profile.rpId,
+							protocolCredentialId: decoded.success.id
+						});
+						if (found !== void 0) credential = yield* snapshotPasskey(PasskeyCredential, found);
+					}
+					const claimed = yield* claim(inspected, credential);
+					const verified = yield* verify(claimed, Effect.gen(function* () {
+						if (credential === void 0 || decoded._tag !== "Success") return yield* PasskeyRejected.make({});
+						const ceremony = claimed.ceremony, context = ceremony.context;
+						const supplied = decoded.success.response.userHandle ?? void 0;
+						if (!credential.active || credential.rpId !== ceremony.profile.rpId || credential.protocolCredentialId !== decoded.success.id || credential.profile.rpId !== credential.rpId || credential.backupState && !credential.backupEligible || !credential.revision.credentials.some((item) => item.credentialId === credential.credentialId)) return yield* PasskeyRejected.make({});
+						if (ceremony.allowedCredentials.length > 0 && !ceremony.allowedCredentials.some((item) => item.id === credential.protocolCredentialId)) return yield* PasskeyRejected.make({});
+						if (supplied !== void 0 && supplied !== credential.userHandle || context._tag === "SignIn" && (supplied === void 0 || !credential.primarySignIn || !credential.enrollmentUserVerified || !credential.profile.primarySignIn || credential.profile.userVerification !== "required")) return yield* PasskeyRejected.make({});
+						if ("target" in context && context.target.revision.subjectId !== credential.revision.subjectId) return yield* PasskeyRejected.make({});
+						const original = "target" in context ? context.target.revision : credential.revision;
+						const ids = [.../* @__PURE__ */ new Set([...original.credentials.map((item) => item.credentialId), credential.credentialId])];
+						const revision = yield* snapshotPasskey(PasskeyRevision, yield* (yield* AuthenticationAuthority).capture(original.subjectId, ids).pipe(Effect.mapError((error) => error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : PasskeyRejected.make({}))));
+						if (revision.securityRevision !== original.securityRevision || revision.subjectId !== original.subjectId || original.credentials.some((item) => !revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision)) || credential.revision.securityRevision !== original.securityRevision || credential.revision.credentials.some((item) => item.credentialId === credential.credentialId && !revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return yield* PasskeyRejected.make({});
+						const result = yield* snapshotPasskey(PasskeyAssertionVerified, yield* protocol.verifyAuthentication({
+							ceremony,
+							credential,
+							response: input.response
+						}));
+						if (result.protocolCredentialId !== credential.protocolCredentialId || result.userHandle !== supplied || result.backupEligible !== credential.backupEligible || result.backupState && !result.backupEligible || ceremony.profile.userVerification === "required" && !result.userVerified || !credential.backupEligible && (credential.counter > 0 || result.counter > 0) && result.counter <= credential.counter || (yield* now) >= claimed.claimExpiresAtMillis) return yield* PasskeyRejected.make({});
+						return {
+							evidence: yield* snapshotPasskey(PasskeyEvidence, {
+								revision,
+								flowId: "target" in context ? context.target.flowId : AuthenticationFlowId.make(ceremony.flowId),
+								bindingDigest: "target" in context ? context.target.bindingDigest : ceremony.requestBindingVerifier,
+								proofs: [{
+									method: "passkey",
+									credentialId: credential.credentialId,
+									factors: ["possession"],
+									userVerified: result.userVerified,
+									phishingResistant: true,
+									verifiedAt: DateTime.makeUnsafe(ceremony.issuedAtMillis)
+								}]
+							}),
+							credential,
+							ceremony,
+							assertion: result
+						};
+					}));
+					if ((yield* readPasskeyCommit(yield* persistence.settle({
+						claim: claimed,
+						outcome: {
+							_tag: "Assertion",
+							credential: verified.credential,
+							assertion: verified.assertion,
+							evidence: verified.evidence
+						},
+						nowMillis: yield* now
+					}, prepare))) !== "Verified") return yield* PasskeyRejected.make({});
+					return {
+						...verified,
+						credentialCommands: [clear]
+					};
+				}, passkeyUnexpected),
+				verifyRegistration: Effect.fn("Passkey.verifyRegistration")(function* (input, expected) {
+					input = yield* snapshotPasskey(Schema.toType(PasskeyRegistrationComplete), input);
+					const inspected = yield* inspect(input, expected);
+					yield* before(inspected.ceremony.context);
+					if (inspected.ceremony.context._tag !== "Registration" && inspected.ceremony.context._tag !== "Enrollment") return yield* PasskeyRejected.make({});
+					yield* Schema.decodeEffect(Schema.toType(PasskeyAttestation))(input.response).pipe(Effect.mapError(() => PasskeyRejected.make({})));
+					const claimed = yield* claim(inspected);
+					const verified = yield* verify(claimed, Effect.gen(function* () {
+						const result = yield* snapshotPasskey(PasskeyRegistrationVerified, yield* protocol.verifyRegistration({
+							ceremony: claimed.ceremony,
+							response: input.response
+						}));
+						if (result.backupState && !result.backupEligible || claimed.ceremony.profile.userVerification === "required" && !result.userVerified || !claimed.ceremony.profile.algorithms.includes(result.algorithm) || (yield* now) >= claimed.claimExpiresAtMillis) return yield* PasskeyRejected.make({});
+						return result;
+					}));
+					return Object.freeze({
+						claim: claimed,
+						verified
+					});
+				}, passkeyUnexpected),
+				exclusions: Effect.fn("Passkey.exclusions")(function* (profileId, subjectId) {
+					const selected = yield* profile(profileId);
+					const captured = yield* (yield* PasskeyEnrollmentContext).capture({
+						moduleId: id,
+						rpId: selected.rpId,
+						subjectId
+					});
+					if (captured === void 0 || captured.revision.subjectId !== subjectId) return yield* PasskeyRejected.make({});
+					return yield* snapshotPasskey(PasskeyEnrollmentSnapshot, captured);
+				}),
+				clear
+			};
+		})
+	};
+};
+/** Trusted target adapters only. Possession of a public flow/digest is not target
+* authorization; callers MUST resolve the private target capability each time. */
+const makePasskeyActions = (moduleId, source) => {
+	const ceremony = makePasskeyCeremony(moduleId, source, "action");
+	const PasskeyActionAssertions = Context.Service(`effect-auth/PasskeyActionAssertions/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(PasskeyActionAssertions, Effect.gen(function* () {
+		const runtime = yield* ceremony.make, authority = yield* AuthenticationAuthority, credentials = yield* PasskeyCredentials, enrollment = yield* PasskeyEnrollmentContext;
+		return PasskeyActionAssertions.of({
+			begin: Effect.fn("PasskeyActionAssertions.begin")(function* (input, target) {
+				const authority = yield* AuthenticationAuthority;
+				const fixed = yield* snapshotPasskey(PasskeyTarget, target);
+				const captured = yield* runtime.exclusions(input.profileId, fixed.revision.subjectId);
+				const current = yield* authority.capture(fixed.revision.subjectId, fixed.revision.credentials.map((item) => item.credentialId)).pipe(Effect.mapError(() => PasskeyActionRequired.make({})));
+				if (!(yield* samePasskey(PasskeyRevision, current, fixed.revision)) || captured.revision.securityRevision !== fixed.revision.securityRevision) return yield* PasskeyActionRequired.make({});
+				return yield* runtime.beginAuthentication(input, {
+					_tag: "Action",
+					target: fixed
+				}, captured.credentials);
+			}, passkeyUnexpected, Effect.provideService(AuthenticationAuthority, authority), Effect.provideService(PasskeyEnrollmentContext, enrollment)),
+			complete: Effect.fn("PasskeyActionAssertions.complete")(function* (input, target) {
+				const fixed = yield* snapshotPasskey(PasskeyTarget, target);
+				return yield* runtime.authentication(input, {
+					_tag: "Action",
+					target: fixed
+				});
+			}, passkeyUnexpected, Effect.provideService(AuthenticationAuthority, authority), Effect.provideService(PasskeyCredentials, credentials))
+		});
+	}));
+	return Object.freeze({
+		PasskeyActionAssertions,
+		binding: ceremony.binding,
+		layer
+	});
+};
+//#endregion
+export { capturePasskeyPolicy, makePasskeyActions, makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit };
+
+//# sourceMappingURL=actions.mjs.map

package/dist/passkey/actions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.mjs","names":["PasskeyProfileSchema"],"sources":["../../src/passkey/actions.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Fiber,\n  Layer,\n  Redacted,\n  Schema,\n} from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { lifecycleSnapshot } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport { AuthenticationFlowId, type AuthenticationEvidence } from \"../sessions/models\";\nimport {\n  PasskeyActionRequired,\n  PasskeyConfigurationError,\n  type PasskeyFailure,\n  PasskeyMethodUnsupported,\n  PasskeyProtocolRejected,\n  PasskeyRejected,\n  PasskeyUnavailable,\n} from \"./errors\";\nimport {\n  type PasskeyClaim,\n  PasskeyProfile as PasskeyProfileSchema,\n  PasskeyAccess,\n  PasskeyAssertion,\n  PasskeyAssertionVerified,\n  PasskeyAttestation,\n  PasskeyAuthenticationOptions,\n  type PasskeyAuthenticationStarted,\n  PasskeyBegin,\n  PasskeyCeremony,\n  PasskeyClaimDecision,\n  PasskeyComplete,\n  PasskeyContext,\n  PasskeyCredential,\n  PasskeyEvidence,\n  PasskeyEnrollmentSnapshot,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProtocolCredentialId,\n  type PasskeyPurpose,\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationVerified,\n  PasskeyRevision,\n  PasskeyTarget,\n  PasskeyUserHandle,\n  PasskeyRegistrationComplete,\n  type PasskeyRegistrationStarted,\n  type PasskeyDescriptor,\n} from \"./models\";\nimport { PasskeyCredentials } from \"./PasskeyCredentials\";\nimport { PasskeyEnrollmentContext } from \"./PasskeyEnrollmentContext\";\nimport { PasskeyPersistence, type PreparePasskeyCommit } from \"./PasskeyPersistence\";\nimport { PasskeyProtocol } from \"./PasskeyProtocol\";\nimport { PasskeyMethodPolicy, validatePasskeyPolicy } from \"./policy\";\nimport { freezePasskey, samePasskey, snapshotPasskey, snapshotPasskeySync } from \"./snapshot\";\n\nexport const passkeyNoAmbient = Effect.fn(\"Passkey.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* PasskeyMethodUnsupported.make({});\n});\n\nexport const readPasskeyCommit = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => PasskeyUnavailable.make({})));\n\nexport const passkeyFailure = (error: { readonly _tag: string }) =>\n  error._tag === \"HookDenied\"\n    ? error\n    : error._tag === \"SessionUnavailable\"\n      ? PasskeyUnavailable.make({})\n      : PasskeyRejected.make({});\n\nexport const capturePasskeyPolicy = (input: PasskeyMethodPolicy) => {\n  try {\n    return validatePasskeyPolicy(snapshotPasskeySync(PasskeyMethodPolicy, input));\n  } catch {\n    return Effect.fail(PasskeyConfigurationError.make({}));\n  }\n};\n\nconst clear = { _tag: \"Clear\", slot: \"request-binding\" } as const;\n\nconst prepare = <A>(value: A, journal: Parameters<PreparePasskeyCommit<A, A>>[1]) =>\n  journal.prepare(value);\n\nconst now = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst bounded = <A, E, R>(operation: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* operation.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(Math.max(1, millis)),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nexport const passkeyUnexpected = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n  operation.pipe(\n    Effect.catchCause((cause): Effect.Effect<never, E | PasskeyUnavailable> =>\n      Cause.hasDies(cause)\n        ? reportAuthFailure(\"passkey-core\", cause).pipe(\n            Effect.andThen(Effect.fail(PasskeyUnavailable.make({}))),\n          )\n        : Effect.failCause(cause),\n    ),\n  );\n\ninterface RegistrationDraft {\n  readonly ceremony: PasskeyCeremony;\n  readonly started: PasskeyRegistrationStarted;\n  readonly credentialCommands: AuthOperationResult<void>[\"credentialCommands\"];\n}\n\nconst envelope = Schema.Struct({\n  id: PasskeyProtocolCredentialId,\n  rawId: PasskeyProtocolCredentialId,\n  type: Schema.Literal(\"public-key\"),\n  response: Schema.Struct({ userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle)) }),\n});\n\nconst contextPurpose = {\n  SignIn: \"sign-in\",\n  Registration: \"registration\",\n  Enrollment: \"enrollment\",\n  Pending: \"pending\",\n  StepUp: \"step-up\",\n  Action: \"action\",\n} as const;\n\n/** Private ceremony machinery shared by separately enabled facets. No generic\n * evidence operation is installed. Callers authenticate target contexts first. */\nexport const makePasskeyCeremony = <const Id extends string, const Purpose extends PasskeyPurpose>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n  purpose: Purpose,\n) => {\n  const binding = makeRequestBinding(moduleId, `passkey-${purpose}`);\n\n  const make = Effect.gen(function* () {\n    const policy = yield* source;\n\n    const id = yield* Schema.decodeEffect(PasskeyModuleId)(moduleId).pipe(\n      Effect.mapError(() => PasskeyConfigurationError.make({})),\n    );\n\n    const protocol = yield* PasskeyProtocol;\n    const persistence = yield* PasskeyPersistence;\n    const binder = yield* binding.RequestBinding;\n    const crypto = yield* Crypto.Crypto;\n    const hooks = yield* LifecycleHooks;\n\n    const random = () =>\n      crypto.randomBytes(32).pipe(\n        Effect.map(Encoding.encodeBase64Url),\n        Effect.mapError(() => PasskeyUnavailable.make({})),\n      );\n\n    const profile = (profileId: string) =>\n      Effect.fromNullishOr(policy.profiles.find((value) => value.profileId === profileId)).pipe(\n        Effect.mapError(() => PasskeyRejected.make({})),\n      );\n\n    const access = Effect.fn(\"Passkey.access\")(function* (\n      input: Pick<PasskeyComplete, \"flowId\" | \"bindingCredential\">,\n    ) {\n      const verified = yield* binder\n        .verify(input.flowId, input.bindingCredential)\n        .pipe(\n          Effect.mapError((error) =>\n            error._tag === \"RequestBindingUnavailable\"\n              ? PasskeyUnavailable.make({})\n              : PasskeyRejected.make({}),\n          ),\n        );\n\n      return yield* snapshotPasskey(PasskeyAccess, {\n        moduleId: id,\n        generation: policy.generation,\n        purpose,\n        flowId: input.flowId,\n        requestBindingVerifier: verified.verifier,\n        requestBindingExpiresAtMillis: verified.expiresAtMillis,\n        nowMillis: yield* now,\n      });\n    });\n\n    const inspect = Effect.fn(\"Passkey.inspect\")(function* (\n      input: Pick<PasskeyComplete, \"flowId\" | \"bindingCredential\">,\n      expected?: PasskeyContext,\n    ) {\n      yield* passkeyNoAmbient();\n      input = yield* snapshotPasskey(\n        Schema.toType(\n          Schema.Struct({\n            flowId: PasskeyComplete.fields.flowId,\n            bindingCredential: PasskeyComplete.fields.bindingCredential,\n          }),\n        ),\n        input,\n      );\n\n      const key = yield* access(input),\n        raw = yield* persistence.context(key);\n\n      if (raw === undefined) return yield* PasskeyRejected.make({});\n\n      const ceremony = yield* snapshotPasskey(PasskeyCeremony, raw),\n        clock = yield* now;\n\n      if (\n        ceremony.moduleId !== id ||\n        ceremony.generation !== policy.generation ||\n        ceremony.purpose !== purpose ||\n        contextPurpose[ceremony.context._tag] !== purpose ||\n        ceremony.flowId !== input.flowId ||\n        ceremony.requestBindingVerifier !== key.requestBindingVerifier ||\n        ceremony.requestBindingExpiresAtMillis !== key.requestBindingExpiresAtMillis ||\n        ceremony.issuedAtMillis > clock ||\n        ceremony.expiresAtMillis <= clock ||\n        ceremony.expiresAtMillis > ceremony.requestBindingExpiresAtMillis ||\n        ceremony.expiresAtMillis - ceremony.issuedAtMillis > policy.lifetimeMillis ||\n        ceremony.retentionUntilMillis !== ceremony.issuedAtMillis + policy.retentionMillis ||\n        ceremony.claimLifetimeMillis !== policy.claimLifetimeMillis\n      )\n        return yield* PasskeyRejected.make({});\n      if (\n        !(yield* samePasskey(\n          PasskeyProfileSchema,\n          ceremony.profile,\n          yield* profile(ceremony.profile.profileId),\n        ))\n      )\n        return yield* PasskeyRejected.make({});\n      if (\n        expected !== undefined &&\n        !(yield* samePasskey(PasskeyContext, ceremony.context, expected))\n      )\n        return yield* PasskeyRejected.make({});\n\n      return { key, ceremony };\n    });\n\n    const before = Effect.fn(\"Passkey.before\")(function* (context: PasskeyContext) {\n      yield* hooks.before(\n        lifecycleSnapshot({\n          action:\n            purpose === \"registration\"\n              ? \"registration\"\n              : purpose === \"enrollment\"\n                ? \"credential-change\"\n                : purpose === \"sign-in\"\n                  ? \"sign-in\"\n                  : \"proof-verification\",\n          operation: `${moduleId}/passkey/${purpose}`,\n          method: \"passkey\",\n          identifiers: [],\n          ...(context._tag === \"Enrollment\"\n            ? { subjectId: context.revision.subjectId }\n            : \"target\" in context\n              ? { subjectId: context.target.revision.subjectId }\n              : {}),\n        }),\n      );\n    });\n\n    const newCeremony = Effect.fn(\"Passkey.newCeremony\")(function* (\n      input: PasskeyBegin,\n      context: PasskeyContext,\n      allowed: ReadonlyArray<typeof PasskeyDescriptor.Type>,\n    ) {\n      yield* passkeyNoAmbient();\n      const selected = yield* profile(input.profileId);\n\n      if (contextPurpose[context._tag] !== purpose) return yield* PasskeyRejected.make({});\n      const fixed = yield* snapshotPasskey(PasskeyContext, context);\n\n      yield* before(fixed);\n\n      const issued = yield* binder\n        .issue(input.flowId)\n        .pipe(Effect.mapError(() => PasskeyUnavailable.make({})));\n\n      const command = issued.credentialCommands[0];\n\n      if (command?._tag !== \"Issue\") return yield* PasskeyUnavailable.make({});\n\n      const verified = yield* binder\n        .verify(input.flowId, command.credential)\n        .pipe(Effect.mapError(() => PasskeyUnavailable.make({})));\n\n      const timestamp = yield* now;\n\n      const expiresAtMillis = Math.min(\n        timestamp + policy.lifetimeMillis,\n        verified.expiresAtMillis,\n        \"target\" in fixed ? fixed.target.expiresAtMillis : Infinity,\n        \"target\" in fixed && fixed.target.requirement !== undefined\n          ? timestamp + fixed.target.requirement.maximumAgeMillis\n          : Infinity,\n      );\n\n      if (expiresAtMillis <= timestamp) return yield* PasskeyRejected.make({});\n\n      const ceremony = yield* snapshotPasskey(PasskeyCeremony, {\n        moduleId: id,\n        generation: policy.generation,\n        flowId: input.flowId,\n        commandId: input.commandId,\n        purpose,\n        profile: selected,\n        challenge: yield* random(),\n        requestBindingVerifier: verified.verifier,\n        requestBindingExpiresAtMillis: verified.expiresAtMillis,\n        issuedAtMillis: timestamp,\n        expiresAtMillis,\n        retentionUntilMillis: timestamp + policy.retentionMillis,\n        claimLifetimeMillis: policy.claimLifetimeMillis,\n        allowedCredentials: allowed,\n        context: fixed,\n      });\n\n      return { ceremony, commands: issued.credentialCommands };\n    });\n\n    const beginAuthentication = Effect.fn(\"Passkey.beginAuthentication\")(function* (\n      input: PasskeyBegin,\n      context: PasskeyContext,\n      allowed: ReadonlyArray<typeof PasskeyDescriptor.Type> = [],\n    ) {\n      input = yield* snapshotPasskey(PasskeyBegin, input);\n      const { ceremony, commands } = yield* newCeremony(input, context, allowed);\n\n      if (\n        context._tag === \"SignIn\" &&\n        (!ceremony.profile.primarySignIn ||\n          ceremony.profile.residentKey !== \"required\" ||\n          ceremony.profile.userVerification !== \"required\")\n      )\n        return yield* PasskeyRejected.make({});\n\n      const options = yield* snapshotPasskey(\n        PasskeyAuthenticationOptions,\n        yield* protocol\n          .prepareAuthentication({\n            profile: ceremony.profile,\n            challenge: ceremony.challenge,\n            timeoutMillis: ceremony.expiresAtMillis - ceremony.issuedAtMillis,\n            allowedCredentials: ceremony.allowedCredentials,\n          })\n          .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),\n      );\n\n      if (\n        options.challenge !== ceremony.challenge ||\n        options.rpId !== ceremony.profile.rpId ||\n        options.userVerification !== ceremony.profile.userVerification ||\n        options.timeout > ceremony.expiresAtMillis - ceremony.issuedAtMillis ||\n        options.timeout <= 0 ||\n        options.allowCredentials.length !== ceremony.allowedCredentials.length ||\n        options.allowCredentials.some(\n          (item, index) => item.id !== ceremony.allowedCredentials[index]?.id,\n        )\n      )\n        return yield* PasskeyUnavailable.make({});\n\n      const result = yield* snapshotPasskey(\n        PasskeyIssueDecision,\n        yield* readPasskeyCommit(yield* persistence.issue({ ceremony, policy }, prepare)),\n      );\n\n      if (result._tag !== \"Issued\") return yield* PasskeyRejected.make({});\n      if (\n        !(yield* samePasskey(PasskeyCeremony, result.ceremony, ceremony)) ||\n        (yield* now) >= ceremony.expiresAtMillis\n      )\n        return yield* PasskeyUnavailable.make({});\n\n      return {\n        value: { flowId: input.flowId, expiresAtMillis: ceremony.expiresAtMillis, options },\n        credentialCommands: commands,\n      } satisfies AuthOperationResult<PasskeyAuthenticationStarted>;\n    }, passkeyUnexpected);\n\n    const prepareRegistration = Effect.fn(\"Passkey.prepareRegistration\")(function* (\n      input: PasskeyBegin,\n      context: Extract<PasskeyContext, { readonly _tag: \"Registration\" | \"Enrollment\" }>,\n      excluded: ReadonlyArray<typeof PasskeyDescriptor.Type>,\n    ) {\n      input = yield* snapshotPasskey(PasskeyBegin, input);\n      context = yield* snapshotPasskey(\n        Schema.Union([PasskeyContext.members[1], PasskeyContext.members[2]]),\n        context,\n      );\n      const { ceremony, commands } = yield* newCeremony(input, context, excluded);\n\n      const options = yield* snapshotPasskey(\n        PasskeyRegistrationOptions,\n        yield* protocol\n          .prepareRegistration({\n            profile: ceremony.profile,\n            challenge: ceremony.challenge,\n            timeoutMillis: ceremony.expiresAtMillis - ceremony.issuedAtMillis,\n            userHandle: context.userHandle,\n            name: context.name,\n            displayName: context._tag === \"Registration\" ? context.displayName : context.name,\n            excludedCredentials: excluded,\n          })\n          .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),\n      );\n\n      if (\n        options.challenge !== ceremony.challenge ||\n        options.rp.id !== ceremony.profile.rpId ||\n        options.rp.name !== ceremony.profile.rpName ||\n        options.user.id !== context.userHandle ||\n        options.user.name !== context.name ||\n        options.user.displayName !==\n          (context._tag === \"Registration\" ? context.displayName : context.name) ||\n        options.attestation !== \"none\" ||\n        options.timeout <= 0 ||\n        options.timeout > ceremony.expiresAtMillis - ceremony.issuedAtMillis ||\n        options.authenticatorSelection.userVerification !== ceremony.profile.userVerification ||\n        options.authenticatorSelection.residentKey !== ceremony.profile.residentKey ||\n        options.pubKeyCredParams.length !== ceremony.profile.algorithms.length ||\n        options.pubKeyCredParams.some(\n          (item, index) => item.alg !== ceremony.profile.algorithms[index],\n        ) ||\n        options.excludeCredentials.length !== excluded.length ||\n        options.excludeCredentials.some((item, index) => item.id !== excluded[index]?.id)\n      )\n        return yield* PasskeyUnavailable.make({});\n\n      const draft: RegistrationDraft = {\n        ceremony,\n        started: { flowId: input.flowId, expiresAtMillis: ceremony.expiresAtMillis, options },\n        credentialCommands: commands,\n      };\n\n      freezePasskey(draft);\n\n      return draft;\n    }, passkeyUnexpected);\n\n    const acceptRegistrationIssue = Effect.fn(\"Passkey.acceptRegistrationIssue\")(function* (\n      draft: RegistrationDraft,\n      decision: PasskeyIssueDecision,\n    ) {\n      const result = yield* snapshotPasskey(PasskeyIssueDecision, decision);\n\n      if (result._tag !== \"Issued\") return yield* PasskeyRejected.make({});\n      if (\n        !(yield* samePasskey(PasskeyCeremony, result.ceremony, draft.ceremony)) ||\n        (yield* now) >= draft.ceremony.expiresAtMillis\n      )\n        return yield* PasskeyUnavailable.make({});\n\n      return {\n        value: draft.started,\n        credentialCommands: draft.credentialCommands,\n      } satisfies AuthOperationResult<PasskeyRegistrationStarted>;\n    }, passkeyUnexpected);\n\n    const claim = Effect.fn(\"Passkey.claim\")(function* (\n      inspected: Effect.Success<ReturnType<typeof inspect>>,\n      credential?: PasskeyCredential,\n    ) {\n      const claimId = yield* random();\n\n      const decision = yield* snapshotPasskey(\n        PasskeyClaimDecision,\n        yield* readPasskeyCommit(\n          yield* persistence.claim(\n            {\n              ...inspected,\n              access: inspected.key,\n              policy,\n              claimId,\n              ...(credential === undefined ? {} : { credential }),\n            },\n            prepare,\n          ),\n        ),\n      );\n\n      if (decision._tag !== \"Claimed\") return yield* PasskeyRejected.make({});\n\n      const result = decision.claim,\n        clock = yield* now;\n\n      if (\n        result.claimId !== claimId ||\n        !(yield* samePasskey(PasskeyCeremony, result.ceremony, inspected.ceremony)) ||\n        result.claimedAtMillis > clock ||\n        result.claimedAtMillis < inspected.ceremony.issuedAtMillis ||\n        result.claimExpiresAtMillis !==\n          Math.min(\n            result.claimedAtMillis + policy.claimLifetimeMillis,\n            inspected.ceremony.expiresAtMillis,\n          ) ||\n        result.claimExpiresAtMillis <= clock\n      )\n        return yield* PasskeyUnavailable.make({});\n\n      return result;\n    });\n\n    const terminal = Effect.fn(\"Passkey.terminal\")(function* (\n      claimed: PasskeyClaim,\n      outcome: \"Rejected\" | \"Ambiguous\",\n    ) {\n      const result = yield* readPasskeyCommit(\n        yield* persistence.settle(\n          { claim: claimed, outcome: { _tag: outcome }, nowMillis: yield* now },\n          prepare,\n        ),\n      );\n\n      if (result !== outcome) return yield* PasskeyUnavailable.make({});\n    });\n\n    const verify = <A, E, R>(claimed: PasskeyClaim, operation: Effect.Effect<A, E, R>) =>\n      Effect.gen(function* () {\n        const remaining = claimed.claimExpiresAtMillis - (yield* now);\n\n        if (remaining <= 0) return yield* PasskeyRejected.make({});\n\n        return yield* bounded(operation, remaining);\n      }).pipe(\n        passkeyUnexpected,\n        Effect.catch((error) =>\n          terminal(\n            claimed,\n            error instanceof PasskeyProtocolRejected || error instanceof PasskeyRejected\n              ? \"Rejected\"\n              : \"Ambiguous\",\n          ).pipe(\n            Effect.andThen(\n              Effect.fail(\n                error instanceof PasskeyProtocolRejected || error instanceof PasskeyRejected\n                  ? PasskeyRejected.make({})\n                  : PasskeyUnavailable.make({}),\n              ),\n            ),\n          ),\n        ),\n        Effect.onInterrupt(() => terminal(claimed, \"Ambiguous\").pipe(Effect.ignore)),\n      );\n\n    const authentication = Effect.fn(\"Passkey.authentication\")(function* (\n      input: PasskeyComplete,\n      expected: PasskeyContext,\n    ) {\n      input = yield* snapshotPasskey(Schema.toType(PasskeyComplete), input);\n      const inspected = yield* inspect(input, expected);\n\n      yield* before(inspected.ceremony.context);\n\n      yield* Schema.decodeEffect(Schema.toType(PasskeyAssertion))(input.response).pipe(\n        Effect.mapError(() => PasskeyRejected.make({})),\n      );\n\n      const decoded = yield* Schema.decodeEffect(Schema.fromJsonString(envelope))(\n        Redacted.value(input.response),\n      ).pipe(Effect.result);\n\n      let credential: PasskeyCredential | undefined;\n\n      if (decoded._tag === \"Success\" && decoded.success.id === decoded.success.rawId) {\n        const found = yield* (yield* PasskeyCredentials).lookup({\n          rpId: inspected.ceremony.profile.rpId,\n          protocolCredentialId: decoded.success.id,\n        });\n\n        if (found !== undefined) credential = yield* snapshotPasskey(PasskeyCredential, found);\n      }\n      const claimed = yield* claim(inspected, credential);\n\n      const verified = yield* verify(\n        claimed,\n        Effect.gen(function* () {\n          if (credential === undefined || decoded._tag !== \"Success\")\n            return yield* PasskeyRejected.make({});\n\n          const ceremony = claimed.ceremony,\n            context = ceremony.context;\n\n          const supplied = decoded.success.response.userHandle ?? undefined;\n\n          if (\n            !credential.active ||\n            credential.rpId !== ceremony.profile.rpId ||\n            credential.protocolCredentialId !== decoded.success.id ||\n            credential.profile.rpId !== credential.rpId ||\n            (credential.backupState && !credential.backupEligible) ||\n            !credential.revision.credentials.some(\n              (item) => item.credentialId === credential.credentialId,\n            )\n          )\n            return yield* PasskeyRejected.make({});\n          if (\n            ceremony.allowedCredentials.length > 0 &&\n            !ceremony.allowedCredentials.some((item) => item.id === credential.protocolCredentialId)\n          )\n            return yield* PasskeyRejected.make({});\n          if (\n            (supplied !== undefined && supplied !== credential.userHandle) ||\n            (context._tag === \"SignIn\" &&\n              (supplied === undefined ||\n                !credential.primarySignIn ||\n                !credential.enrollmentUserVerified ||\n                !credential.profile.primarySignIn ||\n                credential.profile.userVerification !== \"required\"))\n          )\n            return yield* PasskeyRejected.make({});\n          if (\n            \"target\" in context &&\n            context.target.revision.subjectId !== credential.revision.subjectId\n          )\n            return yield* PasskeyRejected.make({});\n          const original = \"target\" in context ? context.target.revision : credential.revision;\n\n          const ids = [\n            ...new Set([\n              ...original.credentials.map((item) => item.credentialId),\n              credential.credentialId,\n            ]),\n          ];\n\n          const revision = yield* snapshotPasskey(\n            PasskeyRevision,\n            yield* (yield* AuthenticationAuthority)\n              .capture(original.subjectId, ids)\n              .pipe(\n                Effect.mapError((error) =>\n                  error._tag === \"SessionUnavailable\"\n                    ? PasskeyUnavailable.make({})\n                    : PasskeyRejected.make({}),\n                ),\n              ),\n          );\n\n          if (\n            revision.securityRevision !== original.securityRevision ||\n            revision.subjectId !== original.subjectId ||\n            original.credentials.some(\n              (item) =>\n                !revision.credentials.some(\n                  (current) =>\n                    current.credentialId === item.credentialId &&\n                    current.revision === item.revision,\n                ),\n            ) ||\n            credential.revision.securityRevision !== original.securityRevision ||\n            credential.revision.credentials.some(\n              (item) =>\n                item.credentialId === credential.credentialId &&\n                !revision.credentials.some(\n                  (current) =>\n                    current.credentialId === item.credentialId &&\n                    current.revision === item.revision,\n                ),\n            )\n          )\n            return yield* PasskeyRejected.make({});\n\n          const result = yield* snapshotPasskey(\n            PasskeyAssertionVerified,\n            yield* protocol.verifyAuthentication({\n              ceremony,\n              credential,\n              response: input.response,\n            }),\n          );\n\n          if (\n            result.protocolCredentialId !== credential.protocolCredentialId ||\n            result.userHandle !== supplied ||\n            result.backupEligible !== credential.backupEligible ||\n            (result.backupState && !result.backupEligible) ||\n            (ceremony.profile.userVerification === \"required\" && !result.userVerified) ||\n            (!credential.backupEligible &&\n              (credential.counter > 0 || result.counter > 0) &&\n              result.counter <= credential.counter) ||\n            (yield* now) >= claimed.claimExpiresAtMillis\n          )\n            return yield* PasskeyRejected.make({});\n\n          const evidence = yield* snapshotPasskey(PasskeyEvidence, {\n            revision,\n            flowId:\n              \"target\" in context\n                ? context.target.flowId\n                : AuthenticationFlowId.make(ceremony.flowId),\n            bindingDigest:\n              \"target\" in context ? context.target.bindingDigest : ceremony.requestBindingVerifier,\n            proofs: [\n              {\n                method: \"passkey\",\n                credentialId: credential.credentialId,\n                factors: [\"possession\"],\n                userVerified: result.userVerified,\n                phishingResistant: true,\n                verifiedAt: DateTime.makeUnsafe(ceremony.issuedAtMillis),\n              },\n            ],\n          });\n\n          return { evidence, credential, ceremony, assertion: result };\n        }),\n      );\n\n      const settled = yield* readPasskeyCommit(\n        yield* persistence.settle(\n          {\n            claim: claimed,\n            outcome: {\n              _tag: \"Assertion\",\n              credential: verified.credential,\n              assertion: verified.assertion,\n              evidence: verified.evidence,\n            },\n            nowMillis: yield* now,\n          },\n          prepare,\n        ),\n      );\n\n      if (settled !== \"Verified\") return yield* PasskeyRejected.make({});\n\n      return { ...verified, credentialCommands: [clear] as const };\n    }, passkeyUnexpected);\n\n    const verifyRegistration = Effect.fn(\"Passkey.verifyRegistration\")(function* (\n      input: PasskeyRegistrationComplete,\n      expected: PasskeyContext | undefined,\n    ) {\n      input = yield* snapshotPasskey(Schema.toType(PasskeyRegistrationComplete), input);\n      const inspected = yield* inspect(input, expected);\n\n      yield* before(inspected.ceremony.context);\n\n      if (\n        inspected.ceremony.context._tag !== \"Registration\" &&\n        inspected.ceremony.context._tag !== \"Enrollment\"\n      )\n        return yield* PasskeyRejected.make({});\n      yield* Schema.decodeEffect(Schema.toType(PasskeyAttestation))(input.response).pipe(\n        Effect.mapError(() => PasskeyRejected.make({})),\n      );\n      const claimed = yield* claim(inspected);\n\n      const verified = yield* verify(\n        claimed,\n        Effect.gen(function* () {\n          const result = yield* snapshotPasskey(\n            PasskeyRegistrationVerified,\n            yield* protocol.verifyRegistration({\n              ceremony: claimed.ceremony,\n              response: input.response,\n            }),\n          );\n\n          if (\n            (result.backupState && !result.backupEligible) ||\n            (claimed.ceremony.profile.userVerification === \"required\" && !result.userVerified) ||\n            !claimed.ceremony.profile.algorithms.includes(result.algorithm) ||\n            (yield* now) >= claimed.claimExpiresAtMillis\n          )\n            return yield* PasskeyRejected.make({});\n\n          return result;\n        }),\n      );\n\n      return Object.freeze({ claim: claimed, verified });\n    }, passkeyUnexpected);\n\n    const exclusions = Effect.fn(\"Passkey.exclusions\")(function* (\n      profileId: string,\n      subjectId: (typeof PasskeyRevision.Type)[\"subjectId\"],\n    ) {\n      const selected = yield* profile(profileId);\n\n      const captured = yield* (yield* PasskeyEnrollmentContext).capture({\n        moduleId: id,\n        rpId: selected.rpId,\n        subjectId,\n      });\n\n      if (captured === undefined || captured.revision.subjectId !== subjectId)\n        return yield* PasskeyRejected.make({});\n\n      return yield* snapshotPasskey(PasskeyEnrollmentSnapshot, captured);\n    });\n\n    return {\n      policy,\n      profile,\n      random,\n      inspect,\n      beginAuthentication,\n      prepareRegistration,\n      acceptRegistrationIssue,\n      authentication,\n      verifyRegistration,\n      exclusions,\n      clear,\n    };\n  });\n\n  return { binding, make };\n};\n\n/** Trusted target adapters only. Possession of a public flow/digest is not target\n * authorization; callers MUST resolve the private target capability each time. */\nexport const makePasskeyActions = <const Id extends string>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n) => {\n  const ceremony = makePasskeyCeremony(moduleId, source, \"action\");\n\n  const PasskeyActionAssertions = Context.Service<\n    { readonly moduleId: Id; readonly kind: \"passkey-actions\" },\n    {\n      readonly begin: (\n        input: PasskeyBegin,\n        target: PasskeyTarget,\n      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;\n      readonly complete: (\n        input: PasskeyComplete,\n        target: PasskeyTarget,\n      ) => Effect.Effect<\n        {\n          readonly evidence: AuthenticationEvidence;\n          readonly credentialCommands: AuthOperationResult<void>[\"credentialCommands\"];\n        },\n        PasskeyFailure\n      >;\n    }\n  >(`effect-auth/PasskeyActionAssertions/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    PasskeyActionAssertions,\n    Effect.gen(function* () {\n      const runtime = yield* ceremony.make,\n        authority = yield* AuthenticationAuthority,\n        credentials = yield* PasskeyCredentials,\n        enrollment = yield* PasskeyEnrollmentContext;\n\n      return PasskeyActionAssertions.of({\n        begin: Effect.fn(\"PasskeyActionAssertions.begin\")(\n          function* (input, target) {\n            const authority = yield* AuthenticationAuthority;\n            const fixed = yield* snapshotPasskey(PasskeyTarget, target);\n            const captured = yield* runtime.exclusions(input.profileId, fixed.revision.subjectId);\n\n            const current = yield* authority\n              .capture(\n                fixed.revision.subjectId,\n                fixed.revision.credentials.map((item) => item.credentialId),\n              )\n              .pipe(Effect.mapError(() => PasskeyActionRequired.make({})));\n\n            if (\n              !(yield* samePasskey(PasskeyRevision, current, fixed.revision)) ||\n              captured.revision.securityRevision !== fixed.revision.securityRevision\n            )\n              return yield* PasskeyActionRequired.make({});\n\n            return yield* runtime.beginAuthentication(\n              input,\n              { _tag: \"Action\", target: fixed },\n              captured.credentials,\n            );\n          },\n          passkeyUnexpected,\n          Effect.provideService(AuthenticationAuthority, authority),\n          Effect.provideService(PasskeyEnrollmentContext, enrollment),\n        ),\n        complete: Effect.fn(\"PasskeyActionAssertions.complete\")(\n          function* (input, target) {\n            const fixed = yield* snapshotPasskey(PasskeyTarget, target);\n\n            return yield* runtime.authentication(input, { _tag: \"Action\", target: fixed });\n          },\n          passkeyUnexpected,\n          Effect.provideService(AuthenticationAuthority, authority),\n          Effect.provideService(PasskeyCredentials, credentials),\n        ),\n      });\n    }),\n  );\n\n  return Object.freeze({ PasskeyActionAssertions, binding: ceremony.binding, layer });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAmEA,MAAa,mBAAmB,OAAO,GAAG,mBAAmB,CAAC,CAAC,aAAa;CAC1E,IAAI,OAAO,gBAAgB,OAAO,OAAO,yBAAyB,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAa,qBAAwB,YACnC,QAAQ,KAAK,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;AAStE,MAAa,wBAAwB,UAA+B;CAClE,IAAI;EACF,OAAO,sBAAsB,oBAAoB,qBAAqB,KAAK,CAAC;CAC9E,QAAQ;EACN,OAAO,OAAO,KAAK,0BAA0B,KAAK,CAAC,CAAC,CAAC;CACvD;AACF;AAEA,MAAM,QAAQ;CAAE,MAAM;CAAS,MAAM;AAAkB;AAEvD,MAAM,WAAc,OAAU,YAC5B,QAAQ,QAAQ,KAAK;AAEvB,MAAM,MAAM,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEhE,MAAM,WAAoB,WAAmC,WAC3D,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,UAAU,KAAK,OAAO,eAAe,OAAO,UAAU;CAE3E,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,KAAK,IAAI,GAAG,MAAM,CAAC,GAClC,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAa,qBAA8B,cACzC,UAAU,KACR,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,gBAAgB,KAAK,CAAC,CAAC,KACvC,OAAO,QAAQ,OAAO,KAAK,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CACzD,IACA,OAAO,UAAU,KAAK,CAC5B,CACF;AAQF,MAAM,WAAW,OAAO,OAAO;CAC7B,IAAI;CACJ,OAAO;CACP,MAAM,OAAO,QAAQ,YAAY;CACjC,UAAU,OAAO,OAAO,EAAE,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,iBAAiB;CACrB,QAAQ;CACR,cAAc;CACd,YAAY;CACZ,SAAS;CACT,QAAQ;CACR,QAAQ;AACV;;;AAIA,MAAa,uBACX,UACA,QACA,YACG;CACH,MAAM,UAAU,mBAAmB,UAAU,WAAW,SAAS;CAkqBjE,OAAO;EAAE;EAAS,MAhqBL,OAAO,IAAI,aAAa;GACnC,MAAM,SAAS,OAAO;GAEtB,MAAM,KAAK,OAAO,OAAO,aAAa,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC/D,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;GAEA,MAAM,WAAW,OAAO;GACxB,MAAM,cAAc,OAAO;GAC3B,MAAM,SAAS,OAAO,QAAQ;GAC9B,MAAM,SAAS,OAAO,OAAO;GAC7B,MAAM,QAAQ,OAAO;GAErB,MAAM,eACJ,OAAO,YAAY,EAAE,CAAC,CAAC,KACrB,OAAO,IAAI,SAAS,eAAe,GACnC,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;GAEF,MAAM,WAAW,cACf,OAAO,cAAc,OAAO,SAAS,MAAM,UAAU,MAAM,cAAc,SAAS,CAAC,CAAC,CAAC,KACnF,OAAO,eAAe,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAChD;GAEF,MAAM,SAAS,OAAO,GAAG,gBAAgB,CAAC,CAAC,WACzC,OACA;IACA,MAAM,WAAW,OAAO,OACrB,OAAO,MAAM,QAAQ,MAAM,iBAAiB,CAAC,CAC7C,KACC,OAAO,UAAU,UACf,MAAM,SAAS,8BACX,mBAAmB,KAAK,CAAC,CAAC,IAC1B,gBAAgB,KAAK,CAAC,CAAC,CAC7B,CACF;IAEF,OAAO,OAAO,gBAAgB,eAAe;KAC3C,UAAU;KACV,YAAY,OAAO;KACnB;KACA,QAAQ,MAAM;KACd,wBAAwB,SAAS;KACjC,+BAA+B,SAAS;KACxC,WAAW,OAAO;IACpB,CAAC;GACH,CAAC;GAED,MAAM,UAAU,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAC3C,OACA,UACA;IACA,OAAO,iBAAiB;IACxB,QAAQ,OAAO,gBACb,OAAO,OACL,OAAO,OAAO;KACZ,QAAQ,gBAAgB,OAAO;KAC/B,mBAAmB,gBAAgB,OAAO;IAC5C,CAAC,CACH,GACA,KACF;IAEA,MAAM,MAAM,OAAO,OAAO,KAAK,GAC7B,MAAM,OAAO,YAAY,QAAQ,GAAG;IAEtC,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAE5D,MAAM,WAAW,OAAO,gBAAgB,iBAAiB,GAAG,GAC1D,QAAQ,OAAO;IAEjB,IACE,SAAS,aAAa,MACtB,SAAS,eAAe,OAAO,cAC/B,SAAS,YAAY,WACrB,eAAe,SAAS,QAAQ,UAAU,WAC1C,SAAS,WAAW,MAAM,UAC1B,SAAS,2BAA2B,IAAI,0BACxC,SAAS,kCAAkC,IAAI,iCAC/C,SAAS,iBAAiB,SAC1B,SAAS,mBAAmB,SAC5B,SAAS,kBAAkB,SAAS,iCACpC,SAAS,kBAAkB,SAAS,iBAAiB,OAAO,kBAC5D,SAAS,yBAAyB,SAAS,iBAAiB,OAAO,mBACnE,SAAS,wBAAwB,OAAO,qBAExC,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,IACE,EAAE,OAAO,YACPA,gBACA,SAAS,SACT,OAAO,QAAQ,SAAS,QAAQ,SAAS,CAC3C,IAEA,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,IACE,aAAa,KAAA,KACb,EAAE,OAAO,YAAY,gBAAgB,SAAS,SAAS,QAAQ,IAE/D,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,OAAO;KAAE;KAAK;IAAS;GACzB,CAAC;GAED,MAAM,SAAS,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,SAAyB;IAC7E,OAAO,MAAM,OACX,kBAAkB;KAChB,QACE,YAAY,iBACR,iBACA,YAAY,eACV,sBACA,YAAY,YACV,YACA;KACV,WAAW,GAAG,SAAS,WAAW;KAClC,QAAQ;KACR,aAAa,CAAC;KACd,GAAI,QAAQ,SAAS,eACjB,EAAE,WAAW,QAAQ,SAAS,UAAU,IACxC,YAAY,UACV,EAAE,WAAW,QAAQ,OAAO,SAAS,UAAU,IAC/C,CAAC;IACT,CAAC,CACH;GACF,CAAC;GAED,MAAM,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,OACA,SACA,SACA;IACA,OAAO,iBAAiB;IACxB,MAAM,WAAW,OAAO,QAAQ,MAAM,SAAS;IAE/C,IAAI,eAAe,QAAQ,UAAU,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACnF,MAAM,QAAQ,OAAO,gBAAgB,gBAAgB,OAAO;IAE5D,OAAO,OAAO,KAAK;IAEnB,MAAM,SAAS,OAAO,OACnB,MAAM,MAAM,MAAM,CAAC,CACnB,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1D,MAAM,UAAU,OAAO,mBAAmB;IAE1C,IAAI,SAAS,SAAS,SAAS,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAEvE,MAAM,WAAW,OAAO,OACrB,OAAO,MAAM,QAAQ,QAAQ,UAAU,CAAC,CACxC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1D,MAAM,YAAY,OAAO;IAEzB,MAAM,kBAAkB,KAAK,IAC3B,YAAY,OAAO,gBACnB,SAAS,iBACT,YAAY,QAAQ,MAAM,OAAO,kBAAkB,UACnD,YAAY,SAAS,MAAM,OAAO,gBAAgB,KAAA,IAC9C,YAAY,MAAM,OAAO,YAAY,mBACrC,QACN;IAEA,IAAI,mBAAmB,WAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAoBvE,OAAO;KAAE,UAAA,OAlBe,gBAAgB,iBAAiB;MACvD,UAAU;MACV,YAAY,OAAO;MACnB,QAAQ,MAAM;MACd,WAAW,MAAM;MACjB;MACA,SAAS;MACT,WAAW,OAAO,OAAO;MACzB,wBAAwB,SAAS;MACjC,+BAA+B,SAAS;MACxC,gBAAgB;MAChB;MACA,sBAAsB,YAAY,OAAO;MACzC,qBAAqB,OAAO;MAC5B,oBAAoB;MACpB,SAAS;KACX,CAAC;KAEkB,UAAU,OAAO;IAAmB;GACzD,CAAC;GAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,OACA,SACA,UAAwD,CAAC,GACzD;IACA,QAAQ,OAAO,gBAAgB,cAAc,KAAK;IAClD,MAAM,EAAE,UAAU,aAAa,OAAO,YAAY,OAAO,SAAS,OAAO;IAEzE,IACE,QAAQ,SAAS,aAChB,CAAC,SAAS,QAAQ,iBACjB,SAAS,QAAQ,gBAAgB,cACjC,SAAS,QAAQ,qBAAqB,aAExC,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,UAAU,OAAO,gBACrB,8BACA,OAAO,SACJ,sBAAsB;KACrB,SAAS,SAAS;KAClB,WAAW,SAAS;KACpB,eAAe,SAAS,kBAAkB,SAAS;KACnD,oBAAoB,SAAS;IAC/B,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5D;IAEA,IACE,QAAQ,cAAc,SAAS,aAC/B,QAAQ,SAAS,SAAS,QAAQ,QAClC,QAAQ,qBAAqB,SAAS,QAAQ,oBAC9C,QAAQ,UAAU,SAAS,kBAAkB,SAAS,kBACtD,QAAQ,WAAW,KACnB,QAAQ,iBAAiB,WAAW,SAAS,mBAAmB,UAChE,QAAQ,iBAAiB,MACtB,MAAM,UAAU,KAAK,OAAO,SAAS,mBAAmB,MAAM,EAAE,EACnE,GAEA,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAE1C,MAAM,SAAS,OAAO,gBACpB,sBACA,OAAO,kBAAkB,OAAO,YAAY,MAAM;KAAE;KAAU;IAAO,GAAG,OAAO,CAAC,CAClF;IAEA,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACnE,IACE,EAAE,OAAO,YAAY,iBAAiB,OAAO,UAAU,QAAQ,OAC9D,OAAO,QAAQ,SAAS,iBAEzB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAE1C,OAAO;KACL,OAAO;MAAE,QAAQ,MAAM;MAAQ,iBAAiB,SAAS;MAAiB;KAAQ;KAClF,oBAAoB;IACtB;GACF,GAAG,iBAAiB;GAEpB,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,OACA,SACA,UACA;IACA,QAAQ,OAAO,gBAAgB,cAAc,KAAK;IAClD,UAAU,OAAO,gBACf,OAAO,MAAM,CAAC,eAAe,QAAQ,IAAI,eAAe,QAAQ,EAAE,CAAC,GACnE,OACF;IACA,MAAM,EAAE,UAAU,aAAa,OAAO,YAAY,OAAO,SAAS,QAAQ;IAE1E,MAAM,UAAU,OAAO,gBACrB,4BACA,OAAO,SACJ,oBAAoB;KACnB,SAAS,SAAS;KAClB,WAAW,SAAS;KACpB,eAAe,SAAS,kBAAkB,SAAS;KACnD,YAAY,QAAQ;KACpB,MAAM,QAAQ;KACd,aAAa,QAAQ,SAAS,iBAAiB,QAAQ,cAAc,QAAQ;KAC7E,qBAAqB;IACvB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5D;IAEA,IACE,QAAQ,cAAc,SAAS,aAC/B,QAAQ,GAAG,OAAO,SAAS,QAAQ,QACnC,QAAQ,GAAG,SAAS,SAAS,QAAQ,UACrC,QAAQ,KAAK,OAAO,QAAQ,cAC5B,QAAQ,KAAK,SAAS,QAAQ,QAC9B,QAAQ,KAAK,iBACV,QAAQ,SAAS,iBAAiB,QAAQ,cAAc,QAAQ,SACnE,QAAQ,gBAAgB,UACxB,QAAQ,WAAW,KACnB,QAAQ,UAAU,SAAS,kBAAkB,SAAS,kBACtD,QAAQ,uBAAuB,qBAAqB,SAAS,QAAQ,oBACrE,QAAQ,uBAAuB,gBAAgB,SAAS,QAAQ,eAChE,QAAQ,iBAAiB,WAAW,SAAS,QAAQ,WAAW,UAChE,QAAQ,iBAAiB,MACtB,MAAM,UAAU,KAAK,QAAQ,SAAS,QAAQ,WAAW,MAC5D,KACA,QAAQ,mBAAmB,WAAW,SAAS,UAC/C,QAAQ,mBAAmB,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,MAAM,EAAE,EAAE,GAEhF,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAE1C,MAAM,QAA2B;KAC/B;KACA,SAAS;MAAE,QAAQ,MAAM;MAAQ,iBAAiB,SAAS;MAAiB;KAAQ;KACpF,oBAAoB;IACtB;IAEA,cAAc,KAAK;IAEnB,OAAO;GACT,GAAG,iBAAiB;GAEpB,MAAM,0BAA0B,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,OACA,UACA;IACA,MAAM,SAAS,OAAO,gBAAgB,sBAAsB,QAAQ;IAEpE,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACnE,IACE,EAAE,OAAO,YAAY,iBAAiB,OAAO,UAAU,MAAM,QAAQ,OACpE,OAAO,QAAQ,MAAM,SAAS,iBAE/B,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAE1C,OAAO;KACL,OAAO,MAAM;KACb,oBAAoB,MAAM;IAC5B;GACF,GAAG,iBAAiB;GAEpB,MAAM,QAAQ,OAAO,GAAG,eAAe,CAAC,CAAC,WACvC,WACA,YACA;IACA,MAAM,UAAU,OAAO,OAAO;IAE9B,MAAM,WAAW,OAAO,gBACtB,sBACA,OAAO,kBACL,OAAO,YAAY,MACjB;KACE,GAAG;KACH,QAAQ,UAAU;KAClB;KACA;KACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACnD,GACA,OACF,CACF,CACF;IAEA,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEtE,MAAM,SAAS,SAAS,OACtB,QAAQ,OAAO;IAEjB,IACE,OAAO,YAAY,WACnB,EAAE,OAAO,YAAY,iBAAiB,OAAO,UAAU,UAAU,QAAQ,MACzE,OAAO,kBAAkB,SACzB,OAAO,kBAAkB,UAAU,SAAS,kBAC5C,OAAO,yBACL,KAAK,IACH,OAAO,kBAAkB,OAAO,qBAChC,UAAU,SAAS,eACrB,KACF,OAAO,wBAAwB,OAE/B,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;IAE1C,OAAO;GACT,CAAC;GAED,MAAM,WAAW,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAC7C,SACA,SACA;IAQA,KAAI,OAPkB,kBACpB,OAAO,YAAY,OACjB;KAAE,OAAO;KAAS,SAAS,EAAE,MAAM,QAAQ;KAAG,WAAW,OAAO;IAAI,GACpE,OACF,CACF,OAEe,SAAS,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;GAClE,CAAC;GAED,MAAM,UAAmB,SAAuB,cAC9C,OAAO,IAAI,aAAa;IACtB,MAAM,YAAY,QAAQ,wBAAwB,OAAO;IAEzD,IAAI,aAAa,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEzD,OAAO,OAAO,QAAQ,WAAW,SAAS;GAC5C,CAAC,CAAC,CAAC,KACD,mBACA,OAAO,OAAO,UACZ,SACE,SACA,iBAAiB,2BAA2B,iBAAiB,kBACzD,aACA,WACN,CAAC,CAAC,KACA,OAAO,QACL,OAAO,KACL,iBAAiB,2BAA2B,iBAAiB,kBACzD,gBAAgB,KAAK,CAAC,CAAC,IACvB,mBAAmB,KAAK,CAAC,CAAC,CAChC,CACF,CACF,CACF,GACA,OAAO,kBAAkB,SAAS,SAAS,WAAW,CAAC,CAAC,KAAK,OAAO,MAAM,CAAC,CAC7E;GAyPF,OAAO;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA,gBA/PqB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,OACA,UACA;KACA,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAAe,GAAG,KAAK;KACpE,MAAM,YAAY,OAAO,QAAQ,OAAO,QAAQ;KAEhD,OAAO,OAAO,UAAU,SAAS,OAAO;KAExC,OAAO,OAAO,aAAa,OAAO,OAAO,gBAAgB,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,KAC1E,OAAO,eAAe,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAChD;KAEA,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,eAAe,QAAQ,CAAC,CAAC,CACzE,SAAS,MAAM,MAAM,QAAQ,CAC/B,CAAC,CAAC,KAAK,OAAO,MAAM;KAEpB,IAAI;KAEJ,IAAI,QAAQ,SAAS,aAAa,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;MAC9E,MAAM,QAAQ,QAAQ,OAAO,mBAAA,CAAoB,OAAO;OACtD,MAAM,UAAU,SAAS,QAAQ;OACjC,sBAAsB,QAAQ,QAAQ;MACxC,CAAC;MAED,IAAI,UAAU,KAAA,GAAW,aAAa,OAAO,gBAAgB,mBAAmB,KAAK;KACvF;KACA,MAAM,UAAU,OAAO,MAAM,WAAW,UAAU;KAElD,MAAM,WAAW,OAAO,OACtB,SACA,OAAO,IAAI,aAAa;MACtB,IAAI,eAAe,KAAA,KAAa,QAAQ,SAAS,WAC/C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAEvC,MAAM,WAAW,QAAQ,UACvB,UAAU,SAAS;MAErB,MAAM,WAAW,QAAQ,QAAQ,SAAS,cAAc,KAAA;MAExD,IACE,CAAC,WAAW,UACZ,WAAW,SAAS,SAAS,QAAQ,QACrC,WAAW,yBAAyB,QAAQ,QAAQ,MACpD,WAAW,QAAQ,SAAS,WAAW,QACtC,WAAW,eAAe,CAAC,WAAW,kBACvC,CAAC,WAAW,SAAS,YAAY,MAC9B,SAAS,KAAK,iBAAiB,WAAW,YAC7C,GAEA,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MACvC,IACE,SAAS,mBAAmB,SAAS,KACrC,CAAC,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,WAAW,oBAAoB,GAEvF,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MACvC,IACG,aAAa,KAAA,KAAa,aAAa,WAAW,cAClD,QAAQ,SAAS,aACf,aAAa,KAAA,KACZ,CAAC,WAAW,iBACZ,CAAC,WAAW,0BACZ,CAAC,WAAW,QAAQ,iBACpB,WAAW,QAAQ,qBAAqB,aAE5C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MACvC,IACE,YAAY,WACZ,QAAQ,OAAO,SAAS,cAAc,WAAW,SAAS,WAE1D,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MACvC,MAAM,WAAW,YAAY,UAAU,QAAQ,OAAO,WAAW,WAAW;MAE5E,MAAM,MAAM,CACV,mBAAG,IAAI,IAAI,CACT,GAAG,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GACvD,WAAW,YACb,CAAC,CACH;MAEA,MAAM,WAAW,OAAO,gBACtB,iBACA,QAAQ,OAAO,wBAAA,CACZ,QAAQ,SAAS,WAAW,GAAG,CAAC,CAChC,KACC,OAAO,UAAU,UACf,MAAM,SAAS,uBACX,mBAAmB,KAAK,CAAC,CAAC,IAC1B,gBAAgB,KAAK,CAAC,CAAC,CAC7B,CACF,CACJ;MAEA,IACE,SAAS,qBAAqB,SAAS,oBACvC,SAAS,cAAc,SAAS,aAChC,SAAS,YAAY,MAClB,SACC,CAAC,SAAS,YAAY,MACnB,YACC,QAAQ,iBAAiB,KAAK,gBAC9B,QAAQ,aAAa,KAAK,QAC9B,CACJ,KACA,WAAW,SAAS,qBAAqB,SAAS,oBAClD,WAAW,SAAS,YAAY,MAC7B,SACC,KAAK,iBAAiB,WAAW,gBACjC,CAAC,SAAS,YAAY,MACnB,YACC,QAAQ,iBAAiB,KAAK,gBAC9B,QAAQ,aAAa,KAAK,QAC9B,CACJ,GAEA,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAEvC,MAAM,SAAS,OAAO,gBACpB,0BACA,OAAO,SAAS,qBAAqB;OACnC;OACA;OACA,UAAU,MAAM;MAClB,CAAC,CACH;MAEA,IACE,OAAO,yBAAyB,WAAW,wBAC3C,OAAO,eAAe,YACtB,OAAO,mBAAmB,WAAW,kBACpC,OAAO,eAAe,CAAC,OAAO,kBAC9B,SAAS,QAAQ,qBAAqB,cAAc,CAAC,OAAO,gBAC5D,CAAC,WAAW,mBACV,WAAW,UAAU,KAAK,OAAO,UAAU,MAC5C,OAAO,WAAW,WAAW,YAC9B,OAAO,QAAQ,QAAQ,sBAExB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAsBvC,OAAO;OAAE,UAAA,OApBe,gBAAgB,iBAAiB;QACvD;QACA,QACE,YAAY,UACR,QAAQ,OAAO,SACf,qBAAqB,KAAK,SAAS,MAAM;QAC/C,eACE,YAAY,UAAU,QAAQ,OAAO,gBAAgB,SAAS;QAChE,QAAQ,CACN;SACE,QAAQ;SACR,cAAc,WAAW;SACzB,SAAS,CAAC,YAAY;SACtB,cAAc,OAAO;SACrB,mBAAmB;SACnB,YAAY,SAAS,WAAW,SAAS,cAAc;QACzD,CACF;OACF,CAAC;OAEkB;OAAY;OAAU,WAAW;MAAO;KAC7D,CAAC,CACH;KAkBA,KAAI,OAhBmB,kBACrB,OAAO,YAAY,OACjB;MACE,OAAO;MACP,SAAS;OACP,MAAM;OACN,YAAY,SAAS;OACrB,WAAW,SAAS;OACpB,UAAU,SAAS;MACrB;MACA,WAAW,OAAO;KACpB,GACA,OACF,CACF,OAEgB,YAAY,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAEjE,OAAO;MAAE,GAAG;MAAU,oBAAoB,CAAC,KAAK;KAAW;IAC7D,GAAG,iBAyEY;IACb,oBAxEyB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,OACA,UACA;KACA,QAAQ,OAAO,gBAAgB,OAAO,OAAO,2BAA2B,GAAG,KAAK;KAChF,MAAM,YAAY,OAAO,QAAQ,OAAO,QAAQ;KAEhD,OAAO,OAAO,UAAU,SAAS,OAAO;KAExC,IACE,UAAU,SAAS,QAAQ,SAAS,kBACpC,UAAU,SAAS,QAAQ,SAAS,cAEpC,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KACvC,OAAO,OAAO,aAAa,OAAO,OAAO,kBAAkB,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,KAC5E,OAAO,eAAe,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAChD;KACA,MAAM,UAAU,OAAO,MAAM,SAAS;KAEtC,MAAM,WAAW,OAAO,OACtB,SACA,OAAO,IAAI,aAAa;MACtB,MAAM,SAAS,OAAO,gBACpB,6BACA,OAAO,SAAS,mBAAmB;OACjC,UAAU,QAAQ;OAClB,UAAU,MAAM;MAClB,CAAC,CACH;MAEA,IACG,OAAO,eAAe,CAAC,OAAO,kBAC9B,QAAQ,SAAS,QAAQ,qBAAqB,cAAc,CAAC,OAAO,gBACrE,CAAC,QAAQ,SAAS,QAAQ,WAAW,SAAS,OAAO,SAAS,MAC7D,OAAO,QAAQ,QAAQ,sBAExB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAEvC,OAAO;KACT,CAAC,CACH;KAEA,OAAO,OAAO,OAAO;MAAE,OAAO;MAAS;KAAS,CAAC;IACnD,GAAG,iBA6BgB;IACjB,YA5BiB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,WACA,WACA;KACA,MAAM,WAAW,OAAO,QAAQ,SAAS;KAEzC,MAAM,WAAW,QAAQ,OAAO,yBAAA,CAA0B,QAAQ;MAChE,UAAU;MACV,MAAM,SAAS;MACf;KACF,CAAC;KAED,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,cAAc,WAC5D,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAEvC,OAAO,OAAO,gBAAgB,2BAA2B,QAAQ;IACnE,CAYW;IACT;GACF;EACF,CAEqB;CAAE;AACzB;;;AAIA,MAAa,sBACX,UACA,WACG;CACH,MAAM,WAAW,oBAAoB,UAAU,QAAQ,QAAQ;CAE/D,MAAM,0BAA0B,QAAQ,QAkBtC,uCAAuC,SAAS,OAAO,GAAG,UAAU;CAEtE,MAAM,QAAQ,MAAM,OAClB,yBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,MAC9B,YAAY,OAAO,yBACnB,cAAc,OAAO,oBACrB,aAAa,OAAO;EAEtB,OAAO,wBAAwB,GAAG;GAChC,OAAO,OAAO,GAAG,+BAA+B,CAAC,CAC/C,WAAW,OAAO,QAAQ;IACxB,MAAM,YAAY,OAAO;IACzB,MAAM,QAAQ,OAAO,gBAAgB,eAAe,MAAM;IAC1D,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,WAAW,MAAM,SAAS,SAAS;IAEpF,MAAM,UAAU,OAAO,UACpB,QACC,MAAM,SAAS,WACf,MAAM,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAC5D,CAAC,CACA,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,IACE,EAAE,OAAO,YAAY,iBAAiB,SAAS,MAAM,QAAQ,MAC7D,SAAS,SAAS,qBAAqB,MAAM,SAAS,kBAEtD,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;IAE7C,OAAO,OAAO,QAAQ,oBACpB,OACA;KAAE,MAAM;KAAU,QAAQ;IAAM,GAChC,SAAS,WACX;GACF,GACA,mBACA,OAAO,eAAe,yBAAyB,SAAS,GACxD,OAAO,eAAe,0BAA0B,UAAU,CAC5D;GACA,UAAU,OAAO,GAAG,kCAAkC,CAAC,CACrD,WAAW,OAAO,QAAQ;IACxB,MAAM,QAAQ,OAAO,gBAAgB,eAAe,MAAM;IAE1D,OAAO,OAAO,QAAQ,eAAe,OAAO;KAAE,MAAM;KAAU,QAAQ;IAAM,CAAC;GAC/E,GACA,mBACA,OAAO,eAAe,yBAAyB,SAAS,GACxD,OAAO,eAAe,oBAAoB,WAAW,CACvD;EACF,CAAC;CACH,CAAC,CACH;CAEA,OAAO,OAAO,OAAO;EAAE;EAAyB,SAAS,SAAS;EAAS;CAAM,CAAC;AACpF"}

package/dist/passkey/browser/PasskeyBrowser.d.mts

@@ -0,0 +1,18 @@
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from "../models.mjs";
+import { PasskeyBrowserAuthentication, PasskeyBrowserCapabilities, PasskeyBrowserFailure, PasskeyBrowserRegistration, PasskeyBrowserUnavailable } from "./models.mjs";
+import { Context, Effect } from "effect";
+//#region src/passkey/browser/PasskeyBrowser.d.ts
+declare const PasskeyBrowser_base: Context.ServiceClass<PasskeyBrowser, "effect-auth/PasskeyBrowser", {
+  readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;
+  readonly register: (started: typeof PasskeyRegistrationStarted.Type) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;
+  readonly authenticate: (input: {
+    readonly started: typeof PasskeyAuthenticationStarted.Type;
+    readonly mediation: "required" | "conditional";
+  }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;
+}>;
+/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and
+ * request binding. Interrupt its Effect to request cancellation; no global cancel. */
+declare class PasskeyBrowser extends PasskeyBrowser_base {}
+//#endregion
+export { PasskeyBrowser };
+//# sourceMappingURL=PasskeyBrowser.d.mts.map

package/dist/passkey/browser/PasskeyBrowser.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/passkey/browser/PasskeyBrowser.ts
+/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and
+* request binding. Interrupt its Effect to request cancellation; no global cancel. */
+var PasskeyBrowser = class extends Context.Service()("effect-auth/PasskeyBrowser") {};
+//#endregion
+export { PasskeyBrowser };
+
+//# sourceMappingURL=PasskeyBrowser.mjs.map

package/dist/passkey/browser/PasskeyBrowser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyBrowser.mjs","names":[],"sources":["../../../src/passkey/browser/PasskeyBrowser.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from \"../models\";\nimport type {\n  PasskeyBrowserAuthentication,\n  PasskeyBrowserCapabilities,\n  PasskeyBrowserFailure,\n  PasskeyBrowserRegistration,\n  PasskeyBrowserUnavailable,\n} from \"./models\";\n\n/** Client-local ceremony capability. The caller owns Begin/Complete RPCs and\n * request binding. Interrupt its Effect to request cancellation; no global cancel. */\nexport class PasskeyBrowser extends Context.Service<\n  PasskeyBrowser,\n  {\n    readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;\n    readonly register: (\n      started: typeof PasskeyRegistrationStarted.Type,\n    ) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;\n    readonly authenticate: (input: {\n      readonly started: typeof PasskeyAuthenticationStarted.Type;\n      readonly mediation: \"required\" | \"conditional\";\n    }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;\n  }\n>()(\"effect-auth/PasskeyBrowser\") {}\n"],"mappings":";;;;AAaA,IAAa,iBAAb,cAAoC,QAAQ,QAY1C,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC"}

package/dist/passkey/browser/models.d.mts

@@ -0,0 +1,38 @@
+import { Schema } from "effect";
+//#region src/passkey/browser/models.d.ts
+declare const PasskeyBrowserCapability: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+type PasskeyBrowserCapability = typeof PasskeyBrowserCapability.Type;
+declare const PasskeyBrowserCapabilities: Schema.Struct<{
+  readonly secureContext: Schema.Boolean;
+  readonly webAuthn: Schema.Boolean;
+  readonly conditionalGet: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly userVerifyingPlatformAuthenticator: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly hybridTransport: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+  readonly passkeyPlatformAuthenticator: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+}>;
+type PasskeyBrowserCapabilities = typeof PasskeyBrowserCapabilities.Type;
+declare const PasskeyBrowserRegistration: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+type PasskeyBrowserRegistration = typeof PasskeyBrowserRegistration.Type;
+declare const PasskeyBrowserAuthentication: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+}>;
+type PasskeyBrowserAuthentication = typeof PasskeyBrowserAuthentication.Type;
+declare const PasskeyBrowserInputRejected_base: Schema.Class<PasskeyBrowserInputRejected, Schema.TaggedStruct<"PasskeyBrowserInputRejected", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyBrowserInputRejected extends PasskeyBrowserInputRejected_base {}
+declare const PasskeyBrowserUnsupported_base: Schema.Class<PasskeyBrowserUnsupported, Schema.TaggedStruct<"PasskeyBrowserUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyBrowserUnsupported extends PasskeyBrowserUnsupported_base {}
+declare const PasskeyBrowserBusy_base: Schema.Class<PasskeyBrowserBusy, Schema.TaggedStruct<"PasskeyBrowserBusy", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyBrowserBusy extends PasskeyBrowserBusy_base {}
+declare const PasskeyBrowserNotCompleted_base: Schema.Class<PasskeyBrowserNotCompleted, Schema.TaggedStruct<"PasskeyBrowserNotCompleted", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyBrowserNotCompleted extends PasskeyBrowserNotCompleted_base {}
+declare const PasskeyBrowserUnavailable_base: Schema.Class<PasskeyBrowserUnavailable, Schema.TaggedStruct<"PasskeyBrowserUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyBrowserUnavailable extends PasskeyBrowserUnavailable_base {}
+declare const PasskeyBrowserFailure: Schema.Union<readonly [typeof PasskeyBrowserInputRejected, typeof PasskeyBrowserUnsupported, typeof PasskeyBrowserBusy, typeof PasskeyBrowserNotCompleted, typeof PasskeyBrowserUnavailable]>;
+type PasskeyBrowserFailure = typeof PasskeyBrowserFailure.Type;
+//#endregion
+export { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported };
+//# sourceMappingURL=models.d.mts.map