@yielded/auth 0.1.0-beta.1

package/dist/passkey/browser/models.mjs

@@ -0,0 +1,41 @@
+import { RequestBindingFlowId } from "../../operations/requestBindingModels.mjs";
+import { PasskeyAssertion, PasskeyAttestation } from "../models.mjs";
+import { Schema } from "effect";
+//#region src/passkey/browser/models.ts
+const PasskeyBrowserCapability = Schema.Literals([
+	"supported",
+	"unsupported",
+	"unknown"
+]);
+const PasskeyBrowserCapabilities = Schema.Struct({
+	secureContext: Schema.Boolean,
+	webAuthn: Schema.Boolean,
+	conditionalGet: PasskeyBrowserCapability,
+	userVerifyingPlatformAuthenticator: PasskeyBrowserCapability,
+	hybridTransport: PasskeyBrowserCapability,
+	passkeyPlatformAuthenticator: PasskeyBrowserCapability
+});
+const PasskeyBrowserRegistration = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	response: PasskeyAttestation
+});
+const PasskeyBrowserAuthentication = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	response: PasskeyAssertion
+});
+var PasskeyBrowserInputRejected = class extends Schema.TaggedError()("PasskeyBrowserInputRejected", {}) {};
+var PasskeyBrowserUnsupported = class extends Schema.TaggedError()("PasskeyBrowserUnsupported", {}) {};
+var PasskeyBrowserBusy = class extends Schema.TaggedError()("PasskeyBrowserBusy", {}) {};
+var PasskeyBrowserNotCompleted = class extends Schema.TaggedError()("PasskeyBrowserNotCompleted", {}) {};
+var PasskeyBrowserUnavailable = class extends Schema.TaggedError()("PasskeyBrowserUnavailable", {}) {};
+const PasskeyBrowserFailure = Schema.Union([
+	PasskeyBrowserInputRejected,
+	PasskeyBrowserUnsupported,
+	PasskeyBrowserBusy,
+	PasskeyBrowserNotCompleted,
+	PasskeyBrowserUnavailable
+]);
+//#endregion
+export { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserCapability, PasskeyBrowserFailure, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported };
+
+//# sourceMappingURL=models.mjs.map

package/dist/passkey/browser/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/passkey/browser/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingFlowId } from \"../../operations/requestBindingModels\";\nimport { PasskeyAssertion, PasskeyAttestation } from \"../models\";\n\nexport const PasskeyBrowserCapability = Schema.Literals([\"supported\", \"unsupported\", \"unknown\"]);\nexport type PasskeyBrowserCapability = typeof PasskeyBrowserCapability.Type;\n\nexport const PasskeyBrowserCapabilities = Schema.Struct({\n  secureContext: Schema.Boolean,\n  webAuthn: Schema.Boolean,\n  conditionalGet: PasskeyBrowserCapability,\n  userVerifyingPlatformAuthenticator: PasskeyBrowserCapability,\n  hybridTransport: PasskeyBrowserCapability,\n  passkeyPlatformAuthenticator: PasskeyBrowserCapability,\n});\n\nexport type PasskeyBrowserCapabilities = typeof PasskeyBrowserCapabilities.Type;\n\nexport const PasskeyBrowserRegistration = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  response: PasskeyAttestation,\n});\n\nexport type PasskeyBrowserRegistration = typeof PasskeyBrowserRegistration.Type;\n\nexport const PasskeyBrowserAuthentication = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  response: PasskeyAssertion,\n});\n\nexport type PasskeyBrowserAuthentication = typeof PasskeyBrowserAuthentication.Type;\n\nexport class PasskeyBrowserInputRejected extends Schema.TaggedError<PasskeyBrowserInputRejected>()(\n  \"PasskeyBrowserInputRejected\",\n  {},\n) {}\n\nexport class PasskeyBrowserUnsupported extends Schema.TaggedError<PasskeyBrowserUnsupported>()(\n  \"PasskeyBrowserUnsupported\",\n  {},\n) {}\n\nexport class PasskeyBrowserBusy extends Schema.TaggedError<PasskeyBrowserBusy>()(\n  \"PasskeyBrowserBusy\",\n  {},\n) {}\n\nexport class PasskeyBrowserNotCompleted extends Schema.TaggedError<PasskeyBrowserNotCompleted>()(\n  \"PasskeyBrowserNotCompleted\",\n  {},\n) {}\n\nexport class PasskeyBrowserUnavailable extends Schema.TaggedError<PasskeyBrowserUnavailable>()(\n  \"PasskeyBrowserUnavailable\",\n  {},\n) {}\n\nexport const PasskeyBrowserFailure = Schema.Union([\n  PasskeyBrowserInputRejected,\n  PasskeyBrowserUnsupported,\n  PasskeyBrowserBusy,\n  PasskeyBrowserNotCompleted,\n  PasskeyBrowserUnavailable,\n]);\n\nexport type PasskeyBrowserFailure = typeof PasskeyBrowserFailure.Type;\n"],"mappings":";;;;AAKA,MAAa,2BAA2B,OAAO,SAAS;CAAC;CAAa;CAAe;AAAS,CAAC;AAG/F,MAAa,6BAA6B,OAAO,OAAO;CACtD,eAAe,OAAO;CACtB,UAAU,OAAO;CACjB,gBAAgB;CAChB,oCAAoC;CACpC,iBAAiB;CACjB,8BAA8B;AAChC,CAAC;AAID,MAAa,6BAA6B,OAAO,OAAO;CACtD,QAAQ;CACR,UAAU;AACZ,CAAC;AAID,MAAa,+BAA+B,OAAO,OAAO;CACxD,QAAQ;CACR,UAAU;AACZ,CAAC;AAID,IAAa,8BAAb,cAAiD,OAAO,YAAyC,CAAC,CAChG,+BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,6BAAb,cAAgD,OAAO,YAAwC,CAAC,CAC9F,8BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,wBAAwB,OAAO,MAAM;CAChD;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/passkey/browser/simplewebauthn.d.mts

@@ -0,0 +1,17 @@
+import { PasskeyAuthenticationStarted, PasskeyRegistrationStarted } from "../models.mjs";
+import { PasskeyBrowserAuthentication, PasskeyBrowserCapabilities, PasskeyBrowserFailure, PasskeyBrowserRegistration, PasskeyBrowserUnavailable } from "./models.mjs";
+import { PasskeyBrowser } from "./PasskeyBrowser.mjs";
+import { Effect, Layer } from "effect";
+//#region src/passkey/browser/simplewebauthn.d.ts
+declare const makeSimpleWebAuthnPasskeyBrowser: () => Effect.Effect<{
+  readonly capabilities: Effect.Effect<PasskeyBrowserCapabilities, PasskeyBrowserUnavailable>;
+  readonly register: (started: typeof PasskeyRegistrationStarted.Type) => Effect.Effect<PasskeyBrowserRegistration, PasskeyBrowserFailure>;
+  readonly authenticate: (input: {
+    readonly started: typeof PasskeyAuthenticationStarted.Type;
+    readonly mediation: "required" | "conditional";
+  }) => Effect.Effect<PasskeyBrowserAuthentication, PasskeyBrowserFailure>;
+}, never, never>;
+declare const layerSimpleWebAuthnPasskeyBrowser: Layer.Layer<PasskeyBrowser>;
+//#endregion
+export { layerSimpleWebAuthnPasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser };
+//# sourceMappingURL=simplewebauthn.d.mts.map

package/dist/passkey/browser/simplewebauthn.mjs

@@ -0,0 +1,411 @@
+import { PasskeyAuthenticationStarted, PasskeyProtocolCredentialId, PasskeyRegistrationStarted } from "../models.mjs";
+import { snapshotPasskey } from "../snapshot.mjs";
+import { PasskeyBrowser } from "./PasskeyBrowser.mjs";
+import { PasskeyBrowserAuthentication, PasskeyBrowserBusy, PasskeyBrowserCapabilities, PasskeyBrowserInputRejected, PasskeyBrowserNotCompleted, PasskeyBrowserRegistration, PasskeyBrowserUnavailable, PasskeyBrowserUnsupported } from "./models.mjs";
+import { DateTime, Effect, Layer, Predicate, Redacted, Schema } from "effect";
+import { base64URLStringToBuffer, browserSupportsWebAuthn, browserSupportsWebAuthnAutofill, bufferToBase64URLString, platformAuthenticatorIsAvailable } from "@simplewebauthn/browser";
+//#region src/passkey/browser/simplewebauthn.ts
+const unavailable = () => PasskeyBrowserUnavailable.make({});
+const rejected = () => PasskeyBrowserInputRejected.make({});
+const incomplete = () => PasskeyBrowserNotCompleted.make({});
+const unexpected = (effect) => effect.pipe(Effect.catchDefect(() => Effect.fail(unavailable())));
+const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(unavailable));
+const capture = (schema, value) => snapshotPasskey(schema, value).pipe(Effect.mapError(rejected));
+const maintained = (call) => Effect.tryPromise({
+	try: call,
+	catch: unavailable
+});
+const timeout = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 3e5
+}));
+const registrationInput = Schema.Struct({
+	...PasskeyRegistrationStarted.fields,
+	options: Schema.Struct({
+		...PasskeyRegistrationStarted.fields.options.fields,
+		timeout
+	})
+});
+const authenticationInput = Schema.Struct({
+	started: Schema.Struct({
+		...PasskeyAuthenticationStarted.fields,
+		options: Schema.Struct({
+			...PasskeyAuthenticationStarted.fields.options.fields,
+			timeout
+		})
+	}),
+	mediation: Schema.Literals(["required", "conditional"])
+});
+const nativeCapabilities = Schema.Struct({
+	conditionalGet: Schema.UndefinedOr(Schema.Boolean),
+	userVerifyingPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),
+	hybridTransport: Schema.UndefinedOr(Schema.Boolean),
+	passkeyPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean)
+});
+const support = (value) => value === void 0 ? "unknown" : value ? "supported" : "unsupported";
+const readCapabilities = Effect.gen(function* () {
+	if (typeof globalThis.PublicKeyCredential.getClientCapabilities !== "function") return {
+		conditionalGet: void 0,
+		userVerifyingPlatformAuthenticator: void 0,
+		hybridTransport: void 0,
+		passkeyPlatformAuthenticator: void 0
+	};
+	const raw = yield* maintained(() => globalThis.PublicKeyCredential.getClientCapabilities());
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(raw)) throw unavailable();
+			return {
+				conditionalGet: raw.conditionalGet,
+				userVerifyingPlatformAuthenticator: raw.userVerifyingPlatformAuthenticator,
+				hybridTransport: raw.hybridTransport,
+				passkeyPlatformAuthenticator: raw.passkeyPlatformAuthenticator
+			};
+		},
+		catch: unavailable
+	});
+	return yield* decode(nativeCapabilities, fields);
+});
+const booleanCapability = Effect.fn("passkeyBrowserBooleanCapability")(function* (call) {
+	return (yield* decode(Schema.Boolean, yield* maintained(call))) ? "supported" : "unsupported";
+});
+const environment = Effect.try({
+	try: () => {
+		const secureContext = globalThis.isSecureContext === true;
+		const container = globalThis.navigator?.credentials;
+		return {
+			secureContext,
+			webAuthn: secureContext && browserSupportsWebAuthn() && container !== void 0 && typeof container.get === "function" && typeof container.create === "function" && typeof globalThis.AbortController === "function",
+			container
+		};
+	},
+	catch: unavailable
+});
+const capabilities = Effect.gen(function* () {
+	const env = yield* environment;
+	if (!env.webAuthn) return yield* snapshotPasskey(PasskeyBrowserCapabilities, {
+		secureContext: env.secureContext,
+		webAuthn: false,
+		conditionalGet: "unsupported",
+		userVerifyingPlatformAuthenticator: "unsupported",
+		hybridTransport: "unsupported",
+		passkeyPlatformAuthenticator: "unsupported"
+	}).pipe(Effect.mapError(unavailable));
+	const raw = yield* readCapabilities;
+	const values = {
+		conditionalGet: support(raw.conditionalGet),
+		userVerifyingPlatformAuthenticator: support(raw.userVerifyingPlatformAuthenticator),
+		hybridTransport: support(raw.hybridTransport),
+		passkeyPlatformAuthenticator: support(raw.passkeyPlatformAuthenticator)
+	};
+	const conditionalGet = values.conditionalGet === "unknown" ? typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable === "function" ? yield* booleanCapability(browserSupportsWebAuthnAutofill) : "unsupported" : values.conditionalGet;
+	const platform = values.userVerifyingPlatformAuthenticator === "unknown" && typeof globalThis.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable === "function" ? yield* booleanCapability(platformAuthenticatorIsAvailable) : values.userVerifyingPlatformAuthenticator;
+	return yield* snapshotPasskey(PasskeyBrowserCapabilities, {
+		secureContext: env.secureContext,
+		webAuthn: true,
+		...values,
+		conditionalGet,
+		userVerifyingPlatformAuthenticator: platform
+	}).pipe(Effect.mapError(unavailable));
+}).pipe(Effect.timeoutOrElse({
+	duration: 5e3,
+	orElse: () => Effect.fail(unavailable())
+}), unexpected);
+const leases = /* @__PURE__ */ new WeakMap();
+const settle = (lease) => {
+	lease.phase = "settled";
+	if (leases.get(lease.container) === lease) leases.delete(lease.container);
+};
+const acquire = Effect.gen(function* () {
+	const env = yield* environment;
+	if (!env.webAuthn || env.container === void 0) return yield* PasskeyBrowserUnsupported.make({});
+	if (leases.has(env.container)) return yield* PasskeyBrowserBusy.make({});
+	const lease = {
+		container: env.container,
+		controller: new AbortController(),
+		phase: "pre-native"
+	};
+	leases.set(env.container, lease);
+	return lease;
+});
+const release = (lease) => Effect.sync(() => {
+	if (lease.phase === "settled") return;
+	try {
+		lease.controller.abort();
+	} catch {}
+	if (lease.phase === "pre-native") settle(lease);
+});
+const nativeFailure = (value) => {
+	try {
+		if (!Predicate.isObject(value)) return unavailable();
+		const parsed = Schema.decodeUnknownOption(Schema.String)(value.name);
+		if (parsed._tag === "Some" && [
+			"NotAllowedError",
+			"InvalidStateError",
+			"ConstraintError",
+			"NotSupportedError",
+			"SecurityError",
+			"AbortError"
+		].includes(parsed.value)) return incomplete();
+	} catch {}
+	return unavailable();
+};
+const native = (lease, request) => Effect.callback((resume, signal) => {
+	if (signal.aborted || lease.controller.signal.aborted || lease.phase !== "pre-native" || leases.get(lease.container) !== lease) {
+		resume(Effect.fail(incomplete()));
+		return;
+	}
+	lease.phase = "native";
+	try {
+		const promise = request._tag === "Create" ? lease.container.create({
+			publicKey: request.publicKey,
+			signal: lease.controller.signal
+		}) : lease.container.get({
+			publicKey: request.publicKey,
+			mediation: request.mediation,
+			signal: lease.controller.signal
+		});
+		Promise.resolve(promise).then((value) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && !lease.controller.signal.aborted) resume(Effect.succeed(value));
+			} catch {}
+		}, (error) => {
+			try {
+				settle(lease);
+				if (!signal.aborted && !lease.controller.signal.aborted) resume(Effect.fail(nativeFailure(error)));
+			} catch {}
+		});
+	} catch (error) {
+		settle(lease);
+		resume(Effect.fail(nativeFailure(error)));
+	}
+});
+const remaining = Effect.fn("passkeyBrowserRemaining")(function* (deadline) {
+	const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);
+	if (duration <= 0) return yield* incomplete();
+	return Math.max(1, Math.floor(duration));
+});
+const runCeremony = Effect.fn("passkeyBrowserRunCeremony")(function* (started, use) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (started.expiresAtMillis <= now) return yield* rejected();
+	const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);
+	return yield* Effect.acquireUseRelease(acquire, (lease) => Effect.gen(function* () {
+		const duration = yield* remaining(deadline);
+		return yield* use(lease, deadline).pipe(Effect.timeoutOrElse({
+			duration,
+			orElse: () => Effect.fail(incomplete())
+		}));
+	}), release);
+});
+const nativeEnvelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: Schema.instanceOf(ArrayBuffer),
+	type: Schema.Literal("public-key")
+};
+const nativeRegistration = Schema.Struct({
+	...nativeEnvelope,
+	response: Schema.Struct({
+		attestationObject: Schema.instanceOf(ArrayBuffer),
+		clientDataJSON: Schema.instanceOf(ArrayBuffer)
+	})
+});
+const nativeAuthentication = Schema.Struct({
+	...nativeEnvelope,
+	response: Schema.Struct({
+		authenticatorData: Schema.instanceOf(ArrayBuffer),
+		clientDataJSON: Schema.instanceOf(ArrayBuffer),
+		signature: Schema.instanceOf(ArrayBuffer),
+		userHandle: Schema.optionalKey(Schema.NullOr(Schema.instanceOf(ArrayBuffer)))
+	})
+});
+const buffer = Effect.fn("passkeyBrowserBuffer")(function* (value, minimum, maximum) {
+	const copied = yield* Effect.try({
+		try: () => ArrayBuffer.prototype.slice.call(value, 0, maximum + 1),
+		catch: unavailable
+	});
+	if (copied.byteLength < minimum || copied.byteLength > maximum) return yield* unavailable();
+	return yield* Effect.try({
+		try: () => bufferToBase64URLString(copied),
+		catch: unavailable
+	});
+});
+const registrationWire = Schema.fromJsonString(Schema.Struct({
+	id: Schema.String,
+	rawId: Schema.String,
+	type: Schema.Literal("public-key"),
+	response: Schema.Struct({
+		attestationObject: Schema.String,
+		clientDataJSON: Schema.String
+	}),
+	clientExtensionResults: Schema.Struct({})
+}));
+const authenticationWire = Schema.fromJsonString(Schema.Struct({
+	id: Schema.String,
+	rawId: Schema.String,
+	type: Schema.Literal("public-key"),
+	response: Schema.Struct({
+		authenticatorData: Schema.String,
+		clientDataJSON: Schema.String,
+		signature: Schema.String,
+		userHandle: Schema.optionalKey(Schema.String)
+	}),
+	clientExtensionResults: Schema.Struct({})
+}));
+const registrationResponse = Effect.fn("passkeyBrowserRegistrationResponse")(function* (value) {
+	if (value === null) return yield* incomplete();
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(value)) throw unavailable();
+			const response = value.response;
+			if (!Predicate.isObject(response)) throw unavailable();
+			return {
+				id: value.id,
+				rawId: value.rawId,
+				type: value.type,
+				response: {
+					attestationObject: response.attestationObject,
+					clientDataJSON: response.clientDataJSON
+				}
+			};
+		},
+		catch: unavailable
+	});
+	const credential = yield* decode(nativeRegistration, fields);
+	const rawId = yield* buffer(credential.rawId, 1, 1023);
+	if (credential.id !== rawId) return yield* unavailable();
+	return yield* Schema.encodeEffect(registrationWire)({
+		id: credential.id,
+		rawId,
+		type: "public-key",
+		response: {
+			attestationObject: yield* buffer(credential.response.attestationObject, 1, 65536),
+			clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192)
+		},
+		clientExtensionResults: {}
+	}).pipe(Effect.mapError(unavailable));
+});
+const authenticationResponse = Effect.fn("passkeyBrowserAuthenticationResponse")(function* (value) {
+	if (value === null) return yield* incomplete();
+	const fields = yield* Effect.try({
+		try: () => {
+			if (!Predicate.isObject(value)) throw unavailable();
+			const response = value.response;
+			if (!Predicate.isObject(response)) throw unavailable();
+			const userHandle = response.userHandle;
+			return {
+				id: value.id,
+				rawId: value.rawId,
+				type: value.type,
+				response: {
+					authenticatorData: response.authenticatorData,
+					clientDataJSON: response.clientDataJSON,
+					signature: response.signature,
+					...userHandle === void 0 ? {} : { userHandle }
+				}
+			};
+		},
+		catch: unavailable
+	});
+	const credential = yield* decode(nativeAuthentication, fields);
+	const rawId = yield* buffer(credential.rawId, 1, 1023);
+	if (credential.id !== rawId) return yield* unavailable();
+	const handle = credential.response.userHandle;
+	return yield* Schema.encodeEffect(authenticationWire)({
+		id: credential.id,
+		rawId,
+		type: "public-key",
+		response: {
+			authenticatorData: yield* buffer(credential.response.authenticatorData, 37, 16384),
+			clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),
+			signature: yield* buffer(credential.response.signature, 1, 1024),
+			...handle === null || handle === void 0 ? {} : { userHandle: yield* buffer(handle, 1, 64) }
+		},
+		clientExtensionResults: {}
+	}).pipe(Effect.mapError(unavailable));
+});
+const conditional = Effect.gen(function* () {
+	if (typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable !== "function") return yield* PasskeyBrowserUnsupported.make({});
+	if ((yield* booleanCapability(browserSupportsWebAuthnAutofill)) !== "supported") return yield* PasskeyBrowserUnsupported.make({});
+	if (!(yield* Effect.try({
+		try: () => Array.from(globalThis.document.querySelectorAll("input[autocomplete]")).some((input) => input.getAttribute("autocomplete")?.split(/[\t\n\f\r ]+/).filter((token) => token.length > 0).at(-1)?.toLowerCase() === "webauthn"),
+		catch: unavailable
+	}))) return yield* rejected();
+}).pipe(Effect.timeoutOrElse({
+	duration: 5e3,
+	orElse: () => Effect.fail(unavailable())
+}));
+const makeSimpleWebAuthnPasskeyBrowser = Effect.fn("makeSimpleWebAuthnPasskeyBrowser")(() => Effect.sync(() => {
+	const register = Effect.fn("PasskeyBrowser.register")(function* (input) {
+		const started = yield* capture(registrationInput, input);
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			const timeoutMillis = yield* remaining(deadline);
+			const options = started.options;
+			const publicKey = {
+				challenge: base64URLStringToBuffer(options.challenge),
+				rp: { ...options.rp },
+				user: {
+					...options.user,
+					id: base64URLStringToBuffer(options.user.id)
+				},
+				pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),
+				timeout: timeoutMillis,
+				attestation: options.attestation,
+				authenticatorSelection: { ...options.authenticatorSelection },
+				excludeCredentials: options.excludeCredentials.map((value) => ({
+					type: value.type,
+					id: base64URLStringToBuffer(value.id)
+				}))
+			};
+			yield* remaining(deadline);
+			const response = yield* registrationResponse(yield* native(lease, {
+				_tag: "Create",
+				publicKey
+			}));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyBrowserRegistration, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(unavailable));
+		}));
+	}, unexpected);
+	const authenticate = Effect.fn("PasskeyBrowser.authenticate")(function* (input) {
+		const { started, mediation } = yield* capture(authenticationInput, input);
+		if (mediation === "conditional" && started.options.allowCredentials.length !== 0) return yield* rejected();
+		return yield* runCeremony(started, (lease, deadline) => Effect.gen(function* () {
+			if (mediation === "conditional") yield* conditional;
+			const timeoutMillis = yield* remaining(deadline);
+			const options = started.options;
+			const publicKey = {
+				challenge: base64URLStringToBuffer(options.challenge),
+				rpId: options.rpId,
+				userVerification: options.userVerification,
+				timeout: timeoutMillis,
+				allowCredentials: options.allowCredentials.map((value) => ({
+					type: value.type,
+					id: base64URLStringToBuffer(value.id)
+				}))
+			};
+			yield* remaining(deadline);
+			const response = yield* authenticationResponse(yield* native(lease, {
+				_tag: "Get",
+				publicKey,
+				mediation
+			}));
+			yield* remaining(deadline);
+			return yield* snapshotPasskey(PasskeyBrowserAuthentication, {
+				flowId: started.flowId,
+				response: Redacted.make(response)
+			}).pipe(Effect.mapError(unavailable));
+		}));
+	}, unexpected);
+	return PasskeyBrowser.of({
+		capabilities,
+		register,
+		authenticate
+	});
+}));
+const layerSimpleWebAuthnPasskeyBrowser = Layer.effect(PasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser());
+//#endregion
+export { layerSimpleWebAuthnPasskeyBrowser, makeSimpleWebAuthnPasskeyBrowser };
+
+//# sourceMappingURL=simplewebauthn.mjs.map

package/dist/passkey/browser/simplewebauthn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.mjs","names":[],"sources":["../../../src/passkey/browser/simplewebauthn.ts"],"sourcesContent":["import {\n  base64URLStringToBuffer,\n  browserSupportsWebAuthn,\n  browserSupportsWebAuthnAutofill,\n  bufferToBase64URLString,\n  platformAuthenticatorIsAvailable,\n} from \"@simplewebauthn/browser\";\nimport type { Context } from \"effect\";\nimport { DateTime, Effect, Layer, Predicate, Redacted, Schema } from \"effect\";\n\nimport {\n  PasskeyAuthenticationStarted,\n  PasskeyProtocolCredentialId,\n  PasskeyRegistrationStarted,\n} from \"../models\";\nimport { snapshotPasskey } from \"../snapshot\";\nimport {\n  PasskeyBrowserAuthentication,\n  PasskeyBrowserBusy,\n  PasskeyBrowserCapabilities,\n  type PasskeyBrowserFailure,\n  PasskeyBrowserInputRejected,\n  PasskeyBrowserNotCompleted,\n  PasskeyBrowserRegistration,\n  PasskeyBrowserUnavailable,\n  PasskeyBrowserUnsupported,\n} from \"./models\";\nimport { PasskeyBrowser } from \"./PasskeyBrowser\";\n\ntype Browser = Context.Service.Shape<typeof PasskeyBrowser>;\nconst unavailable = () => PasskeyBrowserUnavailable.make({});\nconst rejected = () => PasskeyBrowserInputRejected.make({});\nconst incomplete = () => PasskeyBrowserNotCompleted.make({});\n\nconst unexpected = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(Effect.catchDefect(() => Effect.fail(unavailable())));\n\nconst decode = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: unknown,\n) =>\n  // Native browser objects and maintained capability helpers are untyped boundaries.\n  // eslint-disable-next-line no-restricted-properties\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(unavailable));\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) => snapshotPasskey(schema, value).pipe(Effect.mapError(rejected));\n\nconst maintained = <A>(call: () => PromiseLike<A>) =>\n  Effect.tryPromise({ try: call, catch: unavailable });\n\nconst timeout = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 }));\n\nconst registrationInput = Schema.Struct({\n  ...PasskeyRegistrationStarted.fields,\n  options: Schema.Struct({ ...PasskeyRegistrationStarted.fields.options.fields, timeout }),\n});\n\nconst authenticationInput = Schema.Struct({\n  started: Schema.Struct({\n    ...PasskeyAuthenticationStarted.fields,\n    options: Schema.Struct({ ...PasskeyAuthenticationStarted.fields.options.fields, timeout }),\n  }),\n  mediation: Schema.Literals([\"required\", \"conditional\"]),\n});\n\nconst nativeCapabilities = Schema.Struct({\n  conditionalGet: Schema.UndefinedOr(Schema.Boolean),\n  userVerifyingPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),\n  hybridTransport: Schema.UndefinedOr(Schema.Boolean),\n  passkeyPlatformAuthenticator: Schema.UndefinedOr(Schema.Boolean),\n});\n\nconst support = (value: boolean | undefined) =>\n  value === undefined\n    ? (\"unknown\" as const)\n    : value\n      ? (\"supported\" as const)\n      : (\"unsupported\" as const);\n\nconst readCapabilities = Effect.gen(function* () {\n  if (typeof globalThis.PublicKeyCredential.getClientCapabilities !== \"function\")\n    return {\n      conditionalGet: undefined,\n      userVerifyingPlatformAuthenticator: undefined,\n      hybridTransport: undefined,\n      passkeyPlatformAuthenticator: undefined,\n    };\n  const raw = yield* maintained(() => globalThis.PublicKeyCredential.getClientCapabilities());\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(raw)) throw unavailable();\n\n      return {\n        conditionalGet: raw.conditionalGet,\n        userVerifyingPlatformAuthenticator: raw.userVerifyingPlatformAuthenticator,\n        hybridTransport: raw.hybridTransport,\n        passkeyPlatformAuthenticator: raw.passkeyPlatformAuthenticator,\n      };\n    },\n    catch: unavailable,\n  });\n\n  return yield* decode(nativeCapabilities, fields);\n});\n\nconst booleanCapability = Effect.fn(\"passkeyBrowserBooleanCapability\")(function* (\n  call: () => PromiseLike<boolean>,\n) {\n  const value = yield* decode(Schema.Boolean, yield* maintained(call));\n\n  return value ? (\"supported\" as const) : (\"unsupported\" as const);\n});\n\nconst environment = Effect.try({\n  try: () => {\n    const secureContext = globalThis.isSecureContext === true;\n    const container = globalThis.navigator?.credentials;\n\n    const webAuthn =\n      secureContext &&\n      browserSupportsWebAuthn() &&\n      container !== undefined &&\n      typeof container.get === \"function\" &&\n      typeof container.create === \"function\" &&\n      typeof globalThis.AbortController === \"function\";\n\n    return { secureContext, webAuthn, container };\n  },\n  catch: unavailable,\n});\n\nconst capabilities = Effect.gen(function* () {\n  const env = yield* environment;\n\n  if (!env.webAuthn)\n    return yield* snapshotPasskey(PasskeyBrowserCapabilities, {\n      secureContext: env.secureContext,\n      webAuthn: false,\n      conditionalGet: \"unsupported\",\n      userVerifyingPlatformAuthenticator: \"unsupported\",\n      hybridTransport: \"unsupported\",\n      passkeyPlatformAuthenticator: \"unsupported\",\n    }).pipe(Effect.mapError(unavailable));\n  const raw = yield* readCapabilities;\n\n  const values = {\n    conditionalGet: support(raw.conditionalGet),\n    userVerifyingPlatformAuthenticator: support(raw.userVerifyingPlatformAuthenticator),\n    hybridTransport: support(raw.hybridTransport),\n    passkeyPlatformAuthenticator: support(raw.passkeyPlatformAuthenticator),\n  };\n\n  const conditionalGet =\n    values.conditionalGet === \"unknown\"\n      ? typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable === \"function\"\n        ? yield* booleanCapability(browserSupportsWebAuthnAutofill)\n        : (\"unsupported\" as const)\n      : values.conditionalGet;\n\n  const platform =\n    values.userVerifyingPlatformAuthenticator === \"unknown\" &&\n    typeof globalThis.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable ===\n      \"function\"\n      ? yield* booleanCapability(platformAuthenticatorIsAvailable)\n      : values.userVerifyingPlatformAuthenticator;\n\n  return yield* snapshotPasskey(PasskeyBrowserCapabilities, {\n    secureContext: env.secureContext,\n    webAuthn: true,\n    ...values,\n    conditionalGet,\n    userVerifyingPlatformAuthenticator: platform,\n  }).pipe(Effect.mapError(unavailable));\n}).pipe(\n  Effect.timeoutOrElse({ duration: 5000, orElse: () => Effect.fail(unavailable()) }),\n  unexpected,\n);\n\ninterface Lease {\n  readonly container: CredentialsContainer;\n  readonly controller: AbortController;\n  phase: \"pre-native\" | \"native\" | \"settled\";\n}\n// One installed module coordinates its instances. No third-party/global cancel.\nconst leases = new WeakMap<CredentialsContainer, Lease>();\n\nconst settle = (lease: Lease): void => {\n  lease.phase = \"settled\";\n  if (leases.get(lease.container) === lease) leases.delete(lease.container);\n};\n\nconst acquire = Effect.gen(function* () {\n  const env = yield* environment;\n\n  if (!env.webAuthn || env.container === undefined)\n    return yield* PasskeyBrowserUnsupported.make({});\n  if (leases.has(env.container)) return yield* PasskeyBrowserBusy.make({});\n\n  const lease: Lease = {\n    container: env.container,\n    controller: new AbortController(),\n    phase: \"pre-native\",\n  };\n\n  leases.set(env.container, lease);\n\n  return lease;\n});\n\nconst release = (lease: Lease) =>\n  Effect.sync(() => {\n    if (lease.phase === \"settled\") return;\n    // Abort requests cancellation; only raw native settlement releases a started call.\n    try {\n      lease.controller.abort();\n    } catch {\n      /* Cleanup cannot replace interruption with a defect. */\n    }\n    if (lease.phase === \"pre-native\") settle(lease);\n  });\n\nconst nativeFailure = (value: unknown): PasskeyBrowserNotCompleted | PasskeyBrowserUnavailable => {\n  try {\n    if (!Predicate.isObject(value)) return unavailable();\n    // Only the native error's standardized name is inspected; no message or cause.\n    // eslint-disable-next-line no-restricted-properties\n    const parsed = Schema.decodeUnknownOption(Schema.String)(value.name);\n\n    if (\n      parsed._tag === \"Some\" &&\n      [\n        \"NotAllowedError\",\n        \"InvalidStateError\",\n        \"ConstraintError\",\n        \"NotSupportedError\",\n        \"SecurityError\",\n        \"AbortError\",\n      ].includes(parsed.value)\n    )\n      return incomplete();\n  } catch {\n    /* Throwing extension error properties are unavailable. */\n  }\n\n  return unavailable();\n};\n\ntype NativeRequest =\n  | {\n      readonly _tag: \"Create\";\n      readonly publicKey: PublicKeyCredentialCreationOptions;\n    }\n  | {\n      readonly _tag: \"Get\";\n      readonly publicKey: PublicKeyCredentialRequestOptions;\n      readonly mediation: \"required\" | \"conditional\";\n    };\n\nconst native = (lease: Lease, request: NativeRequest) =>\n  Effect.callback<unknown, PasskeyBrowserNotCompleted | PasskeyBrowserUnavailable>(\n    (resume, signal) => {\n      if (\n        signal.aborted ||\n        lease.controller.signal.aborted ||\n        lease.phase !== \"pre-native\" ||\n        leases.get(lease.container) !== lease\n      ) {\n        resume(Effect.fail(incomplete()));\n\n        return;\n      }\n      lease.phase = \"native\";\n      try {\n        const promise =\n          request._tag === \"Create\"\n            ? lease.container.create({\n                publicKey: request.publicKey,\n                signal: lease.controller.signal,\n              })\n            : lease.container.get({\n                publicKey: request.publicKey,\n                mediation: request.mediation,\n                signal: lease.controller.signal,\n              });\n\n        // Both handlers always settle and never throw, including after interruption.\n        void Promise.resolve(promise).then(\n          (value) => {\n            try {\n              settle(lease);\n              if (!signal.aborted && !lease.controller.signal.aborted)\n                resume(Effect.succeed(value));\n            } catch {\n              /* Detached handlers cannot reject. */\n            }\n          },\n          (error) => {\n            try {\n              settle(lease);\n              if (!signal.aborted && !lease.controller.signal.aborted)\n                resume(Effect.fail(nativeFailure(error)));\n            } catch {\n              /* Detached handlers cannot reject. */\n            }\n          },\n        );\n      } catch (error) {\n        settle(lease);\n        resume(Effect.fail(nativeFailure(error)));\n      }\n    },\n  );\n\nconst remaining = Effect.fn(\"passkeyBrowserRemaining\")(function* (deadline: number) {\n  const duration = deadline - DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (duration <= 0) return yield* incomplete();\n\n  return Math.max(1, Math.floor(duration));\n});\n\nconst runCeremony = Effect.fn(\"passkeyBrowserRunCeremony\")(function* <A>(\n  started: { readonly expiresAtMillis: number; readonly options: { readonly timeout: number } },\n  use: (lease: Lease, deadline: number) => Effect.Effect<A, PasskeyBrowserFailure>,\n) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (started.expiresAtMillis <= now) return yield* rejected();\n  const deadline = Math.min(started.expiresAtMillis, now + started.options.timeout);\n\n  return yield* Effect.acquireUseRelease(\n    acquire,\n    (lease) =>\n      Effect.gen(function* () {\n        const duration = yield* remaining(deadline);\n\n        return yield* use(lease, deadline).pipe(\n          Effect.timeoutOrElse({ duration, orElse: () => Effect.fail(incomplete()) }),\n        );\n      }),\n    release,\n  );\n});\n\nconst nativeEnvelope = {\n  id: PasskeyProtocolCredentialId,\n  rawId: Schema.instanceOf(ArrayBuffer),\n  type: Schema.Literal(\"public-key\"),\n};\n\nconst nativeRegistration = Schema.Struct({\n  ...nativeEnvelope,\n  response: Schema.Struct({\n    attestationObject: Schema.instanceOf(ArrayBuffer),\n    clientDataJSON: Schema.instanceOf(ArrayBuffer),\n  }),\n});\n\nconst nativeAuthentication = Schema.Struct({\n  ...nativeEnvelope,\n  response: Schema.Struct({\n    authenticatorData: Schema.instanceOf(ArrayBuffer),\n    clientDataJSON: Schema.instanceOf(ArrayBuffer),\n    signature: Schema.instanceOf(ArrayBuffer),\n    userHandle: Schema.optionalKey(Schema.NullOr(Schema.instanceOf(ArrayBuffer))),\n  }),\n});\n\nconst buffer = Effect.fn(\"passkeyBrowserBuffer\")(function* (\n  value: ArrayBuffer,\n  minimum: number,\n  maximum: number,\n) {\n  // Slice with an upper bound before conversion, ignoring instance overrides.\n  const copied = yield* Effect.try({\n    try: () => ArrayBuffer.prototype.slice.call(value, 0, maximum + 1),\n    catch: unavailable,\n  });\n\n  if (copied.byteLength < minimum || copied.byteLength > maximum) return yield* unavailable();\n\n  return yield* Effect.try({ try: () => bufferToBase64URLString(copied), catch: unavailable });\n});\n\nconst registrationWire = Schema.fromJsonString(\n  Schema.Struct({\n    id: Schema.String,\n    rawId: Schema.String,\n    type: Schema.Literal(\"public-key\"),\n    response: Schema.Struct({ attestationObject: Schema.String, clientDataJSON: Schema.String }),\n    clientExtensionResults: Schema.Struct({}),\n  }),\n);\n\nconst authenticationWire = Schema.fromJsonString(\n  Schema.Struct({\n    id: Schema.String,\n    rawId: Schema.String,\n    type: Schema.Literal(\"public-key\"),\n    response: Schema.Struct({\n      authenticatorData: Schema.String,\n      clientDataJSON: Schema.String,\n      signature: Schema.String,\n      userHandle: Schema.optionalKey(Schema.String),\n    }),\n    clientExtensionResults: Schema.Struct({}),\n  }),\n);\n\nconst registrationResponse = Effect.fn(\"passkeyBrowserRegistrationResponse\")(function* (\n  value: unknown,\n) {\n  if (value === null) return yield* incomplete();\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(value)) throw unavailable();\n      const response = value.response;\n\n      if (!Predicate.isObject(response)) throw unavailable();\n\n      return {\n        id: value.id,\n        rawId: value.rawId,\n        type: value.type,\n        response: {\n          attestationObject: response.attestationObject,\n          clientDataJSON: response.clientDataJSON,\n        },\n      };\n    },\n    catch: unavailable,\n  });\n\n  const credential = yield* decode(nativeRegistration, fields);\n  const rawId = yield* buffer(credential.rawId, 1, 1023);\n\n  if (credential.id !== rawId) return yield* unavailable();\n\n  return yield* Schema.encodeEffect(registrationWire)({\n    id: credential.id,\n    rawId,\n    type: \"public-key\",\n    response: {\n      attestationObject: yield* buffer(credential.response.attestationObject, 1, 65536),\n      clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),\n    },\n    clientExtensionResults: {},\n  }).pipe(Effect.mapError(unavailable));\n});\n\nconst authenticationResponse = Effect.fn(\"passkeyBrowserAuthenticationResponse\")(function* (\n  value: unknown,\n) {\n  if (value === null) return yield* incomplete();\n\n  const fields = yield* Effect.try({\n    try: () => {\n      if (!Predicate.isObject(value)) throw unavailable();\n      const response = value.response;\n\n      if (!Predicate.isObject(response)) throw unavailable();\n      const userHandle = response.userHandle;\n\n      return {\n        id: value.id,\n        rawId: value.rawId,\n        type: value.type,\n        response: {\n          authenticatorData: response.authenticatorData,\n          clientDataJSON: response.clientDataJSON,\n          signature: response.signature,\n          ...(userHandle === undefined ? {} : { userHandle }),\n        },\n      };\n    },\n    catch: unavailable,\n  });\n\n  const credential = yield* decode(nativeAuthentication, fields);\n  const rawId = yield* buffer(credential.rawId, 1, 1023);\n\n  if (credential.id !== rawId) return yield* unavailable();\n  const handle = credential.response.userHandle;\n\n  return yield* Schema.encodeEffect(authenticationWire)({\n    id: credential.id,\n    rawId,\n    type: \"public-key\",\n    response: {\n      authenticatorData: yield* buffer(credential.response.authenticatorData, 37, 16384),\n      clientDataJSON: yield* buffer(credential.response.clientDataJSON, 1, 8192),\n      signature: yield* buffer(credential.response.signature, 1, 1024),\n      ...(handle === null || handle === undefined\n        ? {}\n        : { userHandle: yield* buffer(handle, 1, 64) }),\n    },\n    clientExtensionResults: {},\n  }).pipe(Effect.mapError(unavailable));\n});\n\nconst conditional = Effect.gen(function* () {\n  if (typeof globalThis.PublicKeyCredential.isConditionalMediationAvailable !== \"function\")\n    return yield* PasskeyBrowserUnsupported.make({});\n  if ((yield* booleanCapability(browserSupportsWebAuthnAutofill)) !== \"supported\")\n    return yield* PasskeyBrowserUnsupported.make({});\n\n  const present = yield* Effect.try({\n    try: () =>\n      Array.from(globalThis.document.querySelectorAll(\"input[autocomplete]\")).some(\n        (input) =>\n          input\n            .getAttribute(\"autocomplete\")\n            ?.split(/[\\t\\n\\f\\r ]+/)\n            .filter((token) => token.length > 0)\n            .at(-1)\n            ?.toLowerCase() === \"webauthn\",\n      ),\n    catch: unavailable,\n  });\n\n  if (!present) return yield* rejected();\n}).pipe(Effect.timeoutOrElse({ duration: 5000, orElse: () => Effect.fail(unavailable()) }));\n\nexport const makeSimpleWebAuthnPasskeyBrowser = Effect.fn(\"makeSimpleWebAuthnPasskeyBrowser\")(\n  (): Effect.Effect<Browser> =>\n    Effect.sync(() => {\n      const register = Effect.fn(\"PasskeyBrowser.register\")(function* (\n        input: Parameters<Browser[\"register\"]>[0],\n      ) {\n        const started = yield* capture(registrationInput, input);\n\n        return yield* runCeremony(started, (lease, deadline) =>\n          Effect.gen(function* () {\n            const timeoutMillis = yield* remaining(deadline);\n            const options = started.options;\n\n            const publicKey: PublicKeyCredentialCreationOptions = {\n              challenge: base64URLStringToBuffer(options.challenge),\n              rp: { ...options.rp },\n              user: { ...options.user, id: base64URLStringToBuffer(options.user.id) },\n              pubKeyCredParams: options.pubKeyCredParams.map((value) => ({ ...value })),\n              timeout: timeoutMillis,\n              attestation: options.attestation,\n              authenticatorSelection: { ...options.authenticatorSelection },\n              excludeCredentials: options.excludeCredentials.map((value) => ({\n                type: value.type,\n                id: base64URLStringToBuffer(value.id),\n              })),\n            };\n\n            yield* remaining(deadline);\n\n            const response = yield* registrationResponse(\n              yield* native(lease, { _tag: \"Create\", publicKey }),\n            );\n\n            yield* remaining(deadline);\n\n            return yield* snapshotPasskey(PasskeyBrowserRegistration, {\n              flowId: started.flowId,\n              response: Redacted.make(response),\n            }).pipe(Effect.mapError(unavailable));\n          }),\n        );\n      }, unexpected);\n\n      const authenticate = Effect.fn(\"PasskeyBrowser.authenticate\")(function* (\n        input: Parameters<Browser[\"authenticate\"]>[0],\n      ) {\n        const fixed = yield* capture(authenticationInput, input);\n        const { started, mediation } = fixed;\n\n        if (mediation === \"conditional\" && started.options.allowCredentials.length !== 0)\n          return yield* rejected();\n\n        return yield* runCeremony(started, (lease, deadline) =>\n          Effect.gen(function* () {\n            if (mediation === \"conditional\") yield* conditional;\n            const timeoutMillis = yield* remaining(deadline);\n            const options = started.options;\n\n            const publicKey: PublicKeyCredentialRequestOptions = {\n              challenge: base64URLStringToBuffer(options.challenge),\n              rpId: options.rpId,\n              userVerification: options.userVerification,\n              timeout: timeoutMillis,\n              allowCredentials: options.allowCredentials.map((value) => ({\n                type: value.type,\n                id: base64URLStringToBuffer(value.id),\n              })),\n            };\n\n            yield* remaining(deadline);\n\n            const response = yield* authenticationResponse(\n              yield* native(lease, { _tag: \"Get\", publicKey, mediation }),\n            );\n\n            yield* remaining(deadline);\n\n            return yield* snapshotPasskey(PasskeyBrowserAuthentication, {\n              flowId: started.flowId,\n              response: Redacted.make(response),\n            }).pipe(Effect.mapError(unavailable));\n          }),\n        );\n      }, unexpected);\n\n      return PasskeyBrowser.of({ capabilities, register, authenticate });\n    }),\n);\n\nexport const layerSimpleWebAuthnPasskeyBrowser: Layer.Layer<PasskeyBrowser> = Layer.effect(\n  PasskeyBrowser,\n  makeSimpleWebAuthnPasskeyBrowser(),\n);\n"],"mappings":";;;;;;;AA8BA,MAAM,oBAAoB,0BAA0B,KAAK,CAAC,CAAC;AAC3D,MAAM,iBAAiB,4BAA4B,KAAK,CAAC,CAAC;AAC1D,MAAM,mBAAmB,2BAA2B,KAAK,CAAC,CAAC;AAE3D,MAAM,cAAuB,WAC3B,OAAO,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;AAElE,MAAM,UACJ,QACA,UAIA,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AAE7E,MAAM,WACJ,QACA,UACG,gBAAgB,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,CAAC;AAElE,MAAM,cAAiB,SACrB,OAAO,WAAW;CAAE,KAAK;CAAM,OAAO;AAAY,CAAC;AAErD,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAElF,MAAM,oBAAoB,OAAO,OAAO;CACtC,GAAG,2BAA2B;CAC9B,SAAS,OAAO,OAAO;EAAE,GAAG,2BAA2B,OAAO,QAAQ;EAAQ;CAAQ,CAAC;AACzF,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,OAAO,OAAO;EACrB,GAAG,6BAA6B;EAChC,SAAS,OAAO,OAAO;GAAE,GAAG,6BAA6B,OAAO,QAAQ;GAAQ;EAAQ,CAAC;CAC3F,CAAC;CACD,WAAW,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;AACxD,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO;CACvC,gBAAgB,OAAO,YAAY,OAAO,OAAO;CACjD,oCAAoC,OAAO,YAAY,OAAO,OAAO;CACrE,iBAAiB,OAAO,YAAY,OAAO,OAAO;CAClD,8BAA8B,OAAO,YAAY,OAAO,OAAO;AACjE,CAAC;AAED,MAAM,WAAW,UACf,UAAU,KAAA,IACL,YACD,QACG,cACA;AAET,MAAM,mBAAmB,OAAO,IAAI,aAAa;CAC/C,IAAI,OAAO,WAAW,oBAAoB,0BAA0B,YAClE,OAAO;EACL,gBAAgB,KAAA;EAChB,oCAAoC,KAAA;EACpC,iBAAiB,KAAA;EACjB,8BAA8B,KAAA;CAChC;CACF,MAAM,MAAM,OAAO,iBAAiB,WAAW,oBAAoB,sBAAsB,CAAC;CAE1F,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,GAAG,GAAG,MAAM,YAAY;GAEhD,OAAO;IACL,gBAAgB,IAAI;IACpB,oCAAoC,IAAI;IACxC,iBAAiB,IAAI;IACrB,8BAA8B,IAAI;GACpC;EACF;EACA,OAAO;CACT,CAAC;CAED,OAAO,OAAO,OAAO,oBAAoB,MAAM;AACjD,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACrE,MACA;CAGA,QAAO,OAFc,OAAO,OAAO,SAAS,OAAO,WAAW,IAAI,CAAC,KAEnD,cAAyB;AAC3C,CAAC;AAED,MAAM,cAAc,OAAO,IAAI;CAC7B,WAAW;EACT,MAAM,gBAAgB,WAAW,oBAAoB;EACrD,MAAM,YAAY,WAAW,WAAW;EAUxC,OAAO;GAAE;GAAe,UAPtB,iBACA,wBAAwB,KACxB,cAAc,KAAA,KACd,OAAO,UAAU,QAAQ,cACzB,OAAO,UAAU,WAAW,cAC5B,OAAO,WAAW,oBAAoB;GAEN;EAAU;CAC9C;CACA,OAAO;AACT,CAAC;AAED,MAAM,eAAe,OAAO,IAAI,aAAa;CAC3C,MAAM,MAAM,OAAO;CAEnB,IAAI,CAAC,IAAI,UACP,OAAO,OAAO,gBAAgB,4BAA4B;EACxD,eAAe,IAAI;EACnB,UAAU;EACV,gBAAgB;EAChB,oCAAoC;EACpC,iBAAiB;EACjB,8BAA8B;CAChC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,MAAM,OAAO;CAEnB,MAAM,SAAS;EACb,gBAAgB,QAAQ,IAAI,cAAc;EAC1C,oCAAoC,QAAQ,IAAI,kCAAkC;EAClF,iBAAiB,QAAQ,IAAI,eAAe;EAC5C,8BAA8B,QAAQ,IAAI,4BAA4B;CACxE;CAEA,MAAM,iBACJ,OAAO,mBAAmB,YACtB,OAAO,WAAW,oBAAoB,oCAAoC,aACxE,OAAO,kBAAkB,+BAA+B,IACvD,gBACH,OAAO;CAEb,MAAM,WACJ,OAAO,uCAAuC,aAC9C,OAAO,WAAW,oBAAoB,kDACpC,aACE,OAAO,kBAAkB,gCAAgC,IACzD,OAAO;CAEb,OAAO,OAAO,gBAAgB,4BAA4B;EACxD,eAAe,IAAI;EACnB,UAAU;EACV,GAAG;EACH;EACA,oCAAoC;CACtC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC,CAAC,CAAC,KACD,OAAO,cAAc;CAAE,UAAU;CAAM,cAAc,OAAO,KAAK,YAAY,CAAC;AAAE,CAAC,GACjF,UACF;AAQA,MAAM,yBAAS,IAAI,QAAqC;AAExD,MAAM,UAAU,UAAuB;CACrC,MAAM,QAAQ;CACd,IAAI,OAAO,IAAI,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,MAAM,SAAS;AAC1E;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,MAAM,OAAO;CAEnB,IAAI,CAAC,IAAI,YAAY,IAAI,cAAc,KAAA,GACrC,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CACjD,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAEvE,MAAM,QAAe;EACnB,WAAW,IAAI;EACf,YAAY,IAAI,gBAAgB;EAChC,OAAO;CACT;CAEA,OAAO,IAAI,IAAI,WAAW,KAAK;CAE/B,OAAO;AACT,CAAC;AAED,MAAM,WAAW,UACf,OAAO,WAAW;CAChB,IAAI,MAAM,UAAU,WAAW;CAE/B,IAAI;EACF,MAAM,WAAW,MAAM;CACzB,QAAQ,CAER;CACA,IAAI,MAAM,UAAU,cAAc,OAAO,KAAK;AAChD,CAAC;AAEH,MAAM,iBAAiB,UAA2E;CAChG,IAAI;EACF,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,OAAO,YAAY;EAGnD,MAAM,SAAS,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,MAAM,IAAI;EAEnE,IACE,OAAO,SAAS,UAChB;GACE;GACA;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,SAAS,OAAO,KAAK,GAEvB,OAAO,WAAW;CACtB,QAAQ,CAER;CAEA,OAAO,YAAY;AACrB;AAaA,MAAM,UAAU,OAAc,YAC5B,OAAO,UACJ,QAAQ,WAAW;CAClB,IACE,OAAO,WACP,MAAM,WAAW,OAAO,WACxB,MAAM,UAAU,gBAChB,OAAO,IAAI,MAAM,SAAS,MAAM,OAChC;EACA,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC;EAEhC;CACF;CACA,MAAM,QAAQ;CACd,IAAI;EACF,MAAM,UACJ,QAAQ,SAAS,WACb,MAAM,UAAU,OAAO;GACrB,WAAW,QAAQ;GACnB,QAAQ,MAAM,WAAW;EAC3B,CAAC,IACD,MAAM,UAAU,IAAI;GAClB,WAAW,QAAQ;GACnB,WAAW,QAAQ;GACnB,QAAQ,MAAM,WAAW;EAC3B,CAAC;EAGP,QAAa,QAAQ,OAAO,CAAC,CAAC,MAC3B,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,WAAW,OAAO,SAC9C,OAAO,OAAO,QAAQ,KAAK,CAAC;GAChC,QAAQ,CAER;EACF,IACC,UAAU;GACT,IAAI;IACF,OAAO,KAAK;IACZ,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,WAAW,OAAO,SAC9C,OAAO,OAAO,KAAK,cAAc,KAAK,CAAC,CAAC;GAC5C,QAAQ,CAER;EACF,CACF;CACF,SAAS,OAAO;EACd,OAAO,KAAK;EACZ,OAAO,OAAO,KAAK,cAAc,KAAK,CAAC,CAAC;CAC1C;AACF,CACF;AAEF,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,UAAkB;CAClF,MAAM,WAAW,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtE,IAAI,YAAY,GAAG,OAAO,OAAO,WAAW;CAE5C,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,cAAc,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACzD,SACA,KACA;CACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IAAI,QAAQ,mBAAmB,KAAK,OAAO,OAAO,SAAS;CAC3D,MAAM,WAAW,KAAK,IAAI,QAAQ,iBAAiB,MAAM,QAAQ,QAAQ,OAAO;CAEhF,OAAO,OAAO,OAAO,kBACnB,UACC,UACC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,UAAU,QAAQ;EAE1C,OAAO,OAAO,IAAI,OAAO,QAAQ,CAAC,CAAC,KACjC,OAAO,cAAc;GAAE;GAAU,cAAc,OAAO,KAAK,WAAW,CAAC;EAAE,CAAC,CAC5E;CACF,CAAC,GACH,OACF;AACF,CAAC;AAED,MAAM,iBAAiB;CACrB,IAAI;CACJ,OAAO,OAAO,WAAW,WAAW;CACpC,MAAM,OAAO,QAAQ,YAAY;AACnC;AAEA,MAAM,qBAAqB,OAAO,OAAO;CACvC,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO,WAAW,WAAW;EAChD,gBAAgB,OAAO,WAAW,WAAW;CAC/C,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,OAAO,OAAO;CACzC,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO,WAAW,WAAW;EAChD,gBAAgB,OAAO,WAAW,WAAW;EAC7C,WAAW,OAAO,WAAW,WAAW;EACxC,YAAY,OAAO,YAAY,OAAO,OAAO,OAAO,WAAW,WAAW,CAAC,CAAC;CAC9E,CAAC;AACH,CAAC;AAED,MAAM,SAAS,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC/C,OACA,SACA,SACA;CAEA,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW,YAAY,UAAU,MAAM,KAAK,OAAO,GAAG,UAAU,CAAC;EACjE,OAAO;CACT,CAAC;CAED,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAS,OAAO,OAAO,YAAY;CAE1F,OAAO,OAAO,OAAO,IAAI;EAAE,WAAW,wBAAwB,MAAM;EAAG,OAAO;CAAY,CAAC;AAC7F,CAAC;AAED,MAAM,mBAAmB,OAAO,eAC9B,OAAO,OAAO;CACZ,IAAI,OAAO;CACX,OAAO,OAAO;CACd,MAAM,OAAO,QAAQ,YAAY;CACjC,UAAU,OAAO,OAAO;EAAE,mBAAmB,OAAO;EAAQ,gBAAgB,OAAO;CAAO,CAAC;CAC3F,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAC1C,CAAC,CACH;AAEA,MAAM,qBAAqB,OAAO,eAChC,OAAO,OAAO;CACZ,IAAI,OAAO;CACX,OAAO,OAAO;CACd,MAAM,OAAO,QAAQ,YAAY;CACjC,UAAU,OAAO,OAAO;EACtB,mBAAmB,OAAO;EAC1B,gBAAgB,OAAO;EACvB,WAAW,OAAO;EAClB,YAAY,OAAO,YAAY,OAAO,MAAM;CAC9C,CAAC;CACD,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAC1C,CAAC,CACH;AAEA,MAAM,uBAAuB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAC3E,OACA;CACA,IAAI,UAAU,MAAM,OAAO,OAAO,WAAW;CAE7C,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,MAAM,YAAY;GAClD,MAAM,WAAW,MAAM;GAEvB,IAAI,CAAC,UAAU,SAAS,QAAQ,GAAG,MAAM,YAAY;GAErD,OAAO;IACL,IAAI,MAAM;IACV,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,UAAU;KACR,mBAAmB,SAAS;KAC5B,gBAAgB,SAAS;IAC3B;GACF;EACF;EACA,OAAO;CACT,CAAC;CAED,MAAM,aAAa,OAAO,OAAO,oBAAoB,MAAM;CAC3D,MAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,GAAG,IAAI;CAErD,IAAI,WAAW,OAAO,OAAO,OAAO,OAAO,YAAY;CAEvD,OAAO,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC;EAClD,IAAI,WAAW;EACf;EACA,MAAM;EACN,UAAU;GACR,mBAAmB,OAAO,OAAO,WAAW,SAAS,mBAAmB,GAAG,KAAK;GAChF,gBAAgB,OAAO,OAAO,WAAW,SAAS,gBAAgB,GAAG,IAAI;EAC3E;EACA,wBAAwB,CAAC;CAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC;AAED,MAAM,yBAAyB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/E,OACA;CACA,IAAI,UAAU,MAAM,OAAO,OAAO,WAAW;CAE7C,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WAAW;GACT,IAAI,CAAC,UAAU,SAAS,KAAK,GAAG,MAAM,YAAY;GAClD,MAAM,WAAW,MAAM;GAEvB,IAAI,CAAC,UAAU,SAAS,QAAQ,GAAG,MAAM,YAAY;GACrD,MAAM,aAAa,SAAS;GAE5B,OAAO;IACL,IAAI,MAAM;IACV,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,UAAU;KACR,mBAAmB,SAAS;KAC5B,gBAAgB,SAAS;KACzB,WAAW,SAAS;KACpB,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACnD;GACF;EACF;EACA,OAAO;CACT,CAAC;CAED,MAAM,aAAa,OAAO,OAAO,sBAAsB,MAAM;CAC7D,MAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,GAAG,IAAI;CAErD,IAAI,WAAW,OAAO,OAAO,OAAO,OAAO,YAAY;CACvD,MAAM,SAAS,WAAW,SAAS;CAEnC,OAAO,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAAC;EACpD,IAAI,WAAW;EACf;EACA,MAAM;EACN,UAAU;GACR,mBAAmB,OAAO,OAAO,WAAW,SAAS,mBAAmB,IAAI,KAAK;GACjF,gBAAgB,OAAO,OAAO,WAAW,SAAS,gBAAgB,GAAG,IAAI;GACzE,WAAW,OAAO,OAAO,WAAW,SAAS,WAAW,GAAG,IAAI;GAC/D,GAAI,WAAW,QAAQ,WAAW,KAAA,IAC9B,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,QAAQ,GAAG,EAAE,EAAE;EACjD;EACA,wBAAwB,CAAC;CAC3B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,OAAO,IAAI,aAAa;CAC1C,IAAI,OAAO,WAAW,oBAAoB,oCAAoC,YAC5E,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CACjD,KAAK,OAAO,kBAAkB,+BAA+B,OAAO,aAClE,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAgBjD,IAAI,EAAC,OAdkB,OAAO,IAAI;EAChC,WACE,MAAM,KAAK,WAAW,SAAS,iBAAiB,qBAAqB,CAAC,CAAC,CAAC,MACrE,UACC,MACG,aAAa,cAAc,CAAC,EAC3B,MAAM,cAAc,CAAC,CACtB,QAAQ,UAAU,MAAM,SAAS,CAAC,CAAC,CACnC,GAAG,EAAE,CAAC,EACL,YAAY,MAAM,UAC1B;EACF,OAAO;CACT,CAAC,IAEa,OAAO,OAAO,SAAS;AACvC,CAAC,CAAC,CAAC,KAAK,OAAO,cAAc;CAAE,UAAU;CAAM,cAAc,OAAO,KAAK,YAAY,CAAC;AAAE,CAAC,CAAC;AAE1F,MAAa,mCAAmC,OAAO,GAAG,kCAAkC,CAAC,OAEzF,OAAO,WAAW;CAChB,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,OACA;EACA,MAAM,UAAU,OAAO,QAAQ,mBAAmB,KAAK;EAEvD,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,UAAU,QAAQ;GAC/C,MAAM,UAAU,QAAQ;GAExB,MAAM,YAAgD;IACpD,WAAW,wBAAwB,QAAQ,SAAS;IACpD,IAAI,EAAE,GAAG,QAAQ,GAAG;IACpB,MAAM;KAAE,GAAG,QAAQ;KAAM,IAAI,wBAAwB,QAAQ,KAAK,EAAE;IAAE;IACtE,kBAAkB,QAAQ,iBAAiB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IACxE,SAAS;IACT,aAAa,QAAQ;IACrB,wBAAwB,EAAE,GAAG,QAAQ,uBAAuB;IAC5D,oBAAoB,QAAQ,mBAAmB,KAAK,WAAW;KAC7D,MAAM,MAAM;KACZ,IAAI,wBAAwB,MAAM,EAAE;IACtC,EAAE;GACJ;GAEA,OAAO,UAAU,QAAQ;GAEzB,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO,OAAO;IAAE,MAAM;IAAU;GAAU,CAAC,CACpD;GAEA,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,4BAA4B;IACxD,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACtC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,OACA;EAEA,MAAM,EAAE,SAAS,cAAc,OADV,QAAQ,qBAAqB,KAAK;EAGvD,IAAI,cAAc,iBAAiB,QAAQ,QAAQ,iBAAiB,WAAW,GAC7E,OAAO,OAAO,SAAS;EAEzB,OAAO,OAAO,YAAY,UAAU,OAAO,aACzC,OAAO,IAAI,aAAa;GACtB,IAAI,cAAc,eAAe,OAAO;GACxC,MAAM,gBAAgB,OAAO,UAAU,QAAQ;GAC/C,MAAM,UAAU,QAAQ;GAExB,MAAM,YAA+C;IACnD,WAAW,wBAAwB,QAAQ,SAAS;IACpD,MAAM,QAAQ;IACd,kBAAkB,QAAQ;IAC1B,SAAS;IACT,kBAAkB,QAAQ,iBAAiB,KAAK,WAAW;KACzD,MAAM,MAAM;KACZ,IAAI,wBAAwB,MAAM,EAAE;IACtC,EAAE;GACJ;GAEA,OAAO,UAAU,QAAQ;GAEzB,MAAM,WAAW,OAAO,uBACtB,OAAO,OAAO,OAAO;IAAE,MAAM;IAAO;IAAW;GAAU,CAAC,CAC5D;GAEA,OAAO,UAAU,QAAQ;GAEzB,OAAO,OAAO,gBAAgB,8BAA8B;IAC1D,QAAQ,QAAQ;IAChB,UAAU,SAAS,KAAK,QAAQ;GAClC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACtC,CAAC,CACH;CACF,GAAG,UAAU;CAEb,OAAO,eAAe,GAAG;EAAE;EAAc;EAAU;CAAa,CAAC;AACnE,CAAC,CACL;AAEA,MAAa,oCAAiE,MAAM,OAClF,gBACA,iCAAiC,CACnC"}