@yielded/auth 0.1.0-beta.1

package/dist/passkey/module.mjs

@@ -0,0 +1,174 @@
+import { operationGroup } from "../operations/operation.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { PasskeyPersistence } from "./PasskeyPersistence.mjs";
+import { PasskeyConfigurationError, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyBegin, PasskeyComplete } from "./models.mjs";
+import { snapshotPasskey } from "./snapshot.mjs";
+import { PasskeyMethodPolicy, validatePasskeyPolicy } from "./policy.mjs";
+import { makePasskeyContract } from "../PasskeyContract.mjs";
+import { capturePasskeyPolicy, makePasskeyActions, makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./actions.mjs";
+import { makePasskeyManagement } from "./management.mjs";
+import { makePasskeyPending } from "./pending.mjs";
+import { makePasskeyRegistration } from "./registration.mjs";
+import { makePasskeyStepUp } from "./stepUp.mjs";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+//#region src/passkey/module.ts
+/** Descriptors capture policy data once; invalid policies remain typed Effect failures. */
+const capturePasskeyConfiguration = (options) => {
+	const defaultPolicy = options.policy === void 0 ? {
+		generation: 1,
+		lifetimeMillis: 3e5,
+		claimLifetimeMillis: 3e4,
+		retentionMillis: 36e5,
+		maximumPending: 1e3,
+		maximumPendingPerSubject: 5,
+		admission: {
+			global: {
+				limit: 1e3,
+				windowMillis: 6e4
+			},
+			subject: {
+				limit: 10,
+				windowMillis: 6e4
+			},
+			target: {
+				limit: 10,
+				windowMillis: 6e4
+			}
+		},
+		profiles: [{
+			profileId: "default",
+			generation: 1,
+			rpId: options.relyingParty?.id,
+			rpName: options.relyingParty?.name,
+			origins: Array.isArray(options.relyingParty?.origins) ? [...options.relyingParty.origins] : options.relyingParty?.origins,
+			developmentLocalhost: options.relyingParty?.developmentLocalhost ?? false,
+			residentKey: "required",
+			userVerification: "required",
+			primarySignIn: true,
+			attestation: "none",
+			algorithms: [-7, -257]
+		}]
+	} : void 0;
+	return options.policy === void 0 ? Schema.decodeUnknownEffect(PasskeyMethodPolicy)(defaultPolicy).pipe(Effect.flatMap(validatePasskeyPolicy), Effect.mapError(() => PasskeyConfigurationError.make({}))) : capturePasskeyPolicy(options.policy);
+};
+const makePasskeyMethod = (moduleId, options, configuredSource) => {
+	const sessions = options.sessions;
+	const source = configuredSource ?? capturePasskeyConfiguration(options);
+	const ceremony = makePasskeyCeremony(moduleId, source, "sign-in");
+	const ClaimsForPasskey = Context.Service(`effect-auth/ClaimsForPasskey/${moduleId.length}:${moduleId}`);
+	const Passkeys = Context.Service(`effect-auth/Passkeys/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(Passkeys, Effect.gen(function* () {
+		const runtime = yield* ceremony.make, claims = yield* ClaimsForPasskey, completion = yield* sessions.AuthenticationCompletion, persistence = yield* PasskeyPersistence;
+		const services = yield* Effect.context();
+		const claimsCodec = Schema.toCodecJson(Schema.toType(sessions.claims));
+		return Passkeys.of({
+			begin: Effect.fn("Passkeys.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(PasskeyBegin), input);
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				return yield* runtime.beginAuthentication(input, { _tag: "SignIn" });
+			}, passkeyUnexpected),
+			complete: Effect.fn("Passkeys.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(PasskeyComplete), input);
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				const verified = yield* runtime.authentication(input, { _tag: "SignIn" }).pipe(Effect.provide(services));
+				const resolved = yield* claims.resolve(verified.credential);
+				const encoded = yield* Schema.encodeEffect(claimsCodec)(resolved).pipe(Effect.provide(services), Effect.mapError(() => PasskeyUnavailable.make({})));
+				const captured = yield* Schema.decodeEffect(claimsCodec)(encoded).pipe(Effect.provide(services), Effect.mapError(() => PasskeyUnavailable.make({})));
+				const result = yield* readPasskeyCommit(yield* completion.prepare({
+					evidence: verified.evidence,
+					claims: captured
+				}).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : error._tag === "SessionCapabilityUnsupported" ? PasskeyMethodUnsupported.make({}) : PasskeyRejected.make({}))));
+				return {
+					value: result.value,
+					credentialCommands: [...verified.credentialCommands, ...result.credentialCommands]
+				};
+			}, passkeyUnexpected),
+			cleanup: Effect.fn("Passkeys.cleanup")(function* (invocation, limit) {
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "System") return yield* PasskeyMethodUnsupported.make({});
+				yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({
+					minimum: 1,
+					maximum: 1e3
+				})))(limit).pipe(Effect.mapError(() => PasskeyRejected.make({})));
+				return yield* readPasskeyCommit(yield* persistence.cleanup({
+					moduleId,
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now),
+					limit
+				}, (value, journal) => journal.prepare(value)));
+			}, passkeyUnexpected)
+		});
+	}));
+	const { Begin, Complete, Cleanup } = makePasskeyContract(moduleId, sessions).operations;
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(Passkeys, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(Passkeys, (service) => service.complete(invocation, input))), Cleanup.handlerLayer((input, invocation) => Effect.flatMap(Passkeys, (service) => service.cleanup(invocation, input.limit))));
+	const actions = makePasskeyActions(moduleId, source);
+	const strategyLayer = handlersLayer.pipe(Layer.provide(defaultLayer(Passkeys, layer)), Layer.provide(defaultLayer(ceremony.binding.RequestBinding, ceremony.binding.layer)), Layer.provide(hooksLayer), Layer.provide(cryptoLayer));
+	const registration = (codec) => {
+		const module = makePasskeyRegistration(moduleId, source, codec);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				register: module.operations.Begin.invoke,
+				completeRegistration: module.operations.Complete.invoke
+			}, module.handlersLayer.pipe(Layer.provide(defaultLayer(module.Registrations, module.layer)), Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)), Layer.provide(hooksLayer), Layer.provide(cryptoLayer)))
+		});
+	};
+	const management = (policy) => {
+		const module = makePasskeyManagement(moduleId, source, policy, sessions);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				enrollPasskey: module.operations.Begin.invoke,
+				completePasskeyEnrollment: module.operations.Complete.invoke,
+				listPasskeys: module.operations.List.invoke,
+				renamePasskey: module.operations.Rename.invoke,
+				removePasskey: module.operations.Remove.invoke
+			}, module.handlersLayer.pipe(Layer.provide(defaultLayer(module.Management, module.layer)), Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)), Layer.provide(hooksLayer), Layer.provide(cryptoLayer)))
+		});
+	};
+	const pendingModule = makePasskeyPending(moduleId, source, sessions);
+	const pending = Object.freeze({
+		...pendingModule,
+		strategy: makeAuthStrategy({
+			beginPending: pendingModule.operations.Begin.invoke,
+			completePending: pendingModule.operations.Complete.invoke
+		}, pendingModule.handlersLayer.pipe(Layer.provide(defaultLayer(pendingModule.Pending, pendingModule.layer)), Layer.provide(defaultLayer(pendingModule.binding.RequestBinding, pendingModule.binding.layer)), Layer.provide(hooksLayer), Layer.provide(cryptoLayer)), { completion: true })
+	});
+	const stepUpModule = makePasskeyStepUp(moduleId, source, sessions);
+	const stepUp = Object.freeze({
+		...stepUpModule,
+		strategy: makeAuthStrategy({
+			beginStepUp: stepUpModule.operations.Begin.invoke,
+			completeStepUp: stepUpModule.operations.Complete.invoke
+		}, stepUpModule.handlersLayer.pipe(Layer.provide(defaultLayer(stepUpModule.StepUp, stepUpModule.layer)), Layer.provide(defaultLayer(stepUpModule.binding.RequestBinding, stepUpModule.binding.layer)), Layer.provide(hooksLayer), Layer.provide(cryptoLayer)))
+	});
+	return Object.freeze({
+		strategy: makeAuthStrategy({
+			signIn: Begin.invoke,
+			completeSignIn: Complete.invoke
+		}, strategyLayer, { completion: true }),
+		Passkeys,
+		ClaimsForPasskey,
+		binding: ceremony.binding,
+		layer,
+		handlersLayer,
+		operations: Object.freeze({
+			Begin,
+			Complete,
+			Cleanup
+		}),
+		group: operationGroup(Begin, Complete, Cleanup),
+		registration,
+		management,
+		pending,
+		stepUp,
+		actions
+	});
+};
+//#endregion
+export { capturePasskeyConfiguration, makePasskeyMethod };
+
+//# sourceMappingURL=module.mjs.map

package/dist/passkey/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":[],"sources":["../../src/passkey/module.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Schema, type Types } from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { operationGroup } from \"../operations/operation\";\nimport { makePasskeyContract } from \"../PasskeyContract\";\nimport type { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  makePasskeyActions,\n  capturePasskeyPolicy,\n  passkeyUnexpected,\n  makePasskeyCeremony,\n  passkeyNoAmbient,\n  readPasskeyCommit,\n} from \"./actions\";\nimport type { PasskeyFailure } from \"./errors\";\nimport {\n  PasskeyMethodUnsupported,\n  PasskeyRejected,\n  PasskeyUnavailable,\n  PasskeyConfigurationError,\n} from \"./errors\";\nimport { makePasskeyManagement } from \"./management\";\nimport {\n  type PasskeyAuthenticationStarted,\n  type PasskeyCleanupResult,\n  PasskeyBegin,\n  PasskeyComplete,\n  type PasskeyCredential,\n} from \"./models\";\nimport type { PasskeyCredentials } from \"./PasskeyCredentials\";\nimport { PasskeyPersistence } from \"./PasskeyPersistence\";\nimport { makePasskeyPending } from \"./pending\";\nimport { type PasskeyManagementPolicy, PasskeyMethodPolicy, validatePasskeyPolicy } from \"./policy\";\nimport { makePasskeyRegistration } from \"./registration\";\nimport { snapshotPasskey } from \"./snapshot\";\nimport { makePasskeyStepUp } from \"./stepUp\";\n\ntype PasskeyConfiguration =\n  | { readonly policy: PasskeyMethodPolicy; readonly relyingParty?: never }\n  | {\n      readonly policy?: never;\n      readonly relyingParty: {\n        readonly id: string;\n        readonly name: string;\n        readonly origins: readonly string[];\n        readonly developmentLocalhost?: boolean;\n      };\n    };\n\n/** Descriptors capture policy data once; invalid policies remain typed Effect failures. */\nexport const capturePasskeyConfiguration = (options: PasskeyConfiguration) => {\n  const defaultPolicy =\n    options.policy === undefined\n      ? {\n          generation: 1,\n          lifetimeMillis: 300_000,\n          claimLifetimeMillis: 30_000,\n          retentionMillis: 3_600_000,\n          maximumPending: 1000,\n          maximumPendingPerSubject: 5,\n          admission: {\n            global: { limit: 1000, windowMillis: 60_000 },\n            subject: { limit: 10, windowMillis: 60_000 },\n            target: { limit: 10, windowMillis: 60_000 },\n          },\n          profiles: [\n            {\n              profileId: \"default\",\n              generation: 1,\n              rpId: options.relyingParty?.id,\n              rpName: options.relyingParty?.name,\n              origins: Array.isArray(options.relyingParty?.origins)\n                ? [...options.relyingParty.origins]\n                : options.relyingParty?.origins,\n              developmentLocalhost: options.relyingParty?.developmentLocalhost ?? false,\n              residentKey: \"required\",\n              userVerification: \"required\",\n              primarySignIn: true,\n              attestation: \"none\",\n              algorithms: [-7, -257],\n            },\n          ],\n        }\n      : undefined;\n\n  return options.policy === undefined\n    ? // eslint-disable-next-line no-restricted-properties -- Relying-party configuration becomes a complete, validated policy here.\n      Schema.decodeUnknownEffect(PasskeyMethodPolicy)(defaultPolicy).pipe(\n        Effect.flatMap(validatePasskeyPolicy),\n        Effect.mapError(() => PasskeyConfigurationError.make({})),\n      )\n    : capturePasskeyPolicy(options.policy);\n};\n\nexport const makePasskeyMethod = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n  } & PasskeyConfiguration,\n  configuredSource?: ReturnType<typeof capturePasskeyConfiguration>,\n) => {\n  const sessions = options.sessions;\n  const source = configuredSource ?? capturePasskeyConfiguration(options);\n  const ceremony = makePasskeyCeremony(moduleId, source, \"sign-in\");\n\n  const ClaimsForPasskey = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkey-claims\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly resolve: (\n        credential: PasskeyCredential,\n      ) => Effect.Effect<Claims[\"Type\"], PasskeyUnavailable>;\n    }\n  >(`effect-auth/ClaimsForPasskey/${moduleId.length}:${moduleId}`);\n\n  const Passkeys = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkeys\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: PasskeyBegin,\n      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: PasskeyComplete,\n      ) => Effect.Effect<\n        AuthOperationResult<typeof sessions.CompletionResult.Type>,\n        PasskeyFailure\n      >;\n      readonly cleanup: (\n        invocation: AuthInvocation,\n        limit: number,\n      ) => Effect.Effect<PasskeyCleanupResult, PasskeyFailure>;\n    }\n  >(`effect-auth/Passkeys/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    Passkeys,\n    Effect.gen(function* () {\n      const runtime = yield* ceremony.make,\n        claims = yield* ClaimsForPasskey,\n        completion = yield* sessions.AuthenticationCompletion,\n        persistence = yield* PasskeyPersistence;\n\n      const services = yield* Effect.context<\n        | PasskeyCredentials\n        | AuthenticationAuthority\n        | Claims[\"EncodingServices\"]\n        | Claims[\"DecodingServices\"]\n      >();\n\n      const claimsCodec = Schema.toCodecJson(Schema.toType(sessions.claims));\n\n      return Passkeys.of({\n        begin: Effect.fn(\"Passkeys.begin\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(PasskeyBegin), input);\n          yield* passkeyNoAmbient();\n          if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n\n          return yield* runtime.beginAuthentication(input, { _tag: \"SignIn\" });\n        }, passkeyUnexpected),\n        complete: Effect.fn(\"Passkeys.complete\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(PasskeyComplete), input);\n          yield* passkeyNoAmbient();\n          if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n\n          const verified = yield* runtime\n            .authentication(input, { _tag: \"SignIn\" })\n            .pipe(Effect.provide(services));\n\n          const resolved = yield* claims.resolve(verified.credential);\n\n          const encoded = yield* Schema.encodeEffect(claimsCodec)(resolved).pipe(\n            Effect.provide(services),\n            Effect.mapError(() => PasskeyUnavailable.make({})),\n          );\n\n          const captured = yield* Schema.decodeEffect(claimsCodec)(encoded).pipe(\n            Effect.provide(services),\n            Effect.mapError(() => PasskeyUnavailable.make({})),\n          );\n\n          const result = yield* readPasskeyCommit(\n            yield* completion\n              .prepare({ evidence: verified.evidence, claims: captured })\n              .pipe(\n                Effect.mapError((error) =>\n                  error._tag === \"HookDenied\"\n                    ? error\n                    : error._tag === \"SessionUnavailable\"\n                      ? PasskeyUnavailable.make({})\n                      : error._tag === \"SessionCapabilityUnsupported\"\n                        ? PasskeyMethodUnsupported.make({})\n                        : PasskeyRejected.make({}),\n                ),\n              ),\n          );\n\n          return {\n            value: result.value,\n            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],\n          };\n        }, passkeyUnexpected),\n        cleanup: Effect.fn(\"Passkeys.cleanup\")(function* (invocation, limit) {\n          yield* passkeyNoAmbient();\n          if (invocation._tag !== \"System\") return yield* PasskeyMethodUnsupported.make({});\n          yield* Schema.decodeEffect(\n            Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n          )(limit).pipe(Effect.mapError(() => PasskeyRejected.make({})));\n\n          return yield* readPasskeyCommit(\n            yield* persistence.cleanup(\n              { moduleId, nowMillis: DateTime.toEpochMillis(yield* DateTime.now), limit },\n              (value, journal) => journal.prepare(value),\n            ),\n          );\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  const { Begin, Complete, Cleanup } = makePasskeyContract(moduleId, sessions).operations;\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Passkeys, (service) => service.begin(invocation, input)),\n    ),\n    Complete.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Passkeys, (service) => service.complete(invocation, input)),\n    ),\n    Cleanup.handlerLayer((input, invocation) =>\n      Effect.flatMap(Passkeys, (service) => service.cleanup(invocation, input.limit)),\n    ),\n  );\n\n  const actions = makePasskeyActions(moduleId, source);\n\n  // Protocol verification is an explicit server capability. Keeping it out of\n  // this shared contract avoids bundling the maintained verifier into clients.\n  const strategyLayer = handlersLayer.pipe(\n    Layer.provide(defaultLayer(Passkeys, layer)),\n    Layer.provide(defaultLayer(ceremony.binding.RequestBinding, ceremony.binding.layer)),\n    Layer.provide(hooksLayer),\n    Layer.provide(cryptoLayer),\n  );\n\n  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n    codec: Registration,\n  ) => {\n    const module = makePasskeyRegistration(moduleId, source, codec);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          register: module.operations.Begin.invoke,\n          completeRegistration: module.operations.Complete.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Registrations, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide(hooksLayer),\n          Layer.provide(cryptoLayer),\n        ),\n      ),\n    });\n  };\n\n  const management = (policy: PasskeyManagementPolicy) => {\n    const module = makePasskeyManagement(moduleId, source, policy, sessions);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          enrollPasskey: module.operations.Begin.invoke,\n          completePasskeyEnrollment: module.operations.Complete.invoke,\n          listPasskeys: module.operations.List.invoke,\n          renamePasskey: module.operations.Rename.invoke,\n          removePasskey: module.operations.Remove.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Management, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide(hooksLayer),\n          Layer.provide(cryptoLayer),\n        ),\n      ),\n    });\n  };\n\n  const pendingModule = makePasskeyPending(moduleId, source, sessions);\n\n  const pending = Object.freeze({\n    ...pendingModule,\n    strategy: makeAuthStrategy(\n      {\n        beginPending: pendingModule.operations.Begin.invoke,\n        completePending: pendingModule.operations.Complete.invoke,\n      },\n      pendingModule.handlersLayer.pipe(\n        Layer.provide(defaultLayer(pendingModule.Pending, pendingModule.layer)),\n        Layer.provide(\n          defaultLayer(pendingModule.binding.RequestBinding, pendingModule.binding.layer),\n        ),\n        Layer.provide(hooksLayer),\n        Layer.provide(cryptoLayer),\n      ),\n      { completion: true },\n    ),\n  });\n\n  const stepUpModule = makePasskeyStepUp(moduleId, source, sessions);\n\n  const stepUp = Object.freeze({\n    ...stepUpModule,\n    strategy: makeAuthStrategy(\n      {\n        beginStepUp: stepUpModule.operations.Begin.invoke,\n        completeStepUp: stepUpModule.operations.Complete.invoke,\n      },\n      stepUpModule.handlersLayer.pipe(\n        Layer.provide(defaultLayer(stepUpModule.StepUp, stepUpModule.layer)),\n        Layer.provide(\n          defaultLayer(stepUpModule.binding.RequestBinding, stepUpModule.binding.layer),\n        ),\n        Layer.provide(hooksLayer),\n        Layer.provide(cryptoLayer),\n      ),\n    ),\n  });\n\n  return Object.freeze({\n    strategy: makeAuthStrategy(\n      { signIn: Begin.invoke, completeSignIn: Complete.invoke },\n      strategyLayer,\n      { completion: true },\n    ),\n    Passkeys,\n    ClaimsForPasskey,\n    binding: ceremony.binding,\n    layer,\n    handlersLayer,\n    operations: Object.freeze({ Begin, Complete, Cleanup }),\n    group: operationGroup(Begin, Complete, Cleanup),\n    registration,\n    management,\n    pending,\n    stepUp,\n    actions,\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAsDA,MAAa,+BAA+B,YAAkC;CAC5E,MAAM,gBACJ,QAAQ,WAAW,KAAA,IACf;EACE,YAAY;EACZ,gBAAgB;EAChB,qBAAqB;EACrB,iBAAiB;EACjB,gBAAgB;EAChB,0BAA0B;EAC1B,WAAW;GACT,QAAQ;IAAE,OAAO;IAAM,cAAc;GAAO;GAC5C,SAAS;IAAE,OAAO;IAAI,cAAc;GAAO;GAC3C,QAAQ;IAAE,OAAO;IAAI,cAAc;GAAO;EAC5C;EACA,UAAU,CACR;GACE,WAAW;GACX,YAAY;GACZ,MAAM,QAAQ,cAAc;GAC5B,QAAQ,QAAQ,cAAc;GAC9B,SAAS,MAAM,QAAQ,QAAQ,cAAc,OAAO,IAChD,CAAC,GAAG,QAAQ,aAAa,OAAO,IAChC,QAAQ,cAAc;GAC1B,sBAAsB,QAAQ,cAAc,wBAAwB;GACpE,aAAa;GACb,kBAAkB;GAClB,eAAe;GACf,aAAa;GACb,YAAY,CAAC,IAAI,IAAI;EACvB,CACF;CACF,IACA,KAAA;CAEN,OAAO,QAAQ,WAAW,KAAA,IAEtB,OAAO,oBAAoB,mBAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,KAC7D,OAAO,QAAQ,qBAAqB,GACpC,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D,IACA,qBAAqB,QAAQ,MAAM;AACzC;AAEA,MAAa,qBAKX,UACA,SAGA,qBACG;CACH,MAAM,WAAW,QAAQ;CACzB,MAAM,SAAS,oBAAoB,4BAA4B,OAAO;CACtE,MAAM,WAAW,oBAAoB,UAAU,QAAQ,SAAS;CAEhE,MAAM,mBAAmB,QAAQ,QAW/B,gCAAgC,SAAS,OAAO,GAAG,UAAU;CAE/D,MAAM,WAAW,QAAQ,QAuBvB,wBAAwB,SAAS,OAAO,GAAG,UAAU;CAEvD,MAAM,QAAQ,MAAM,OAClB,UACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,MAC9B,SAAS,OAAO,kBAChB,aAAa,OAAO,SAAS,0BAC7B,cAAc,OAAO;EAEvB,MAAM,WAAW,OAAO,OAAO,QAK7B;EAEF,MAAM,cAAc,OAAO,YAAY,OAAO,OAAO,SAAS,MAAM,CAAC;EAErE,OAAO,SAAS,GAAG;GACjB,OAAO,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,YAAY,OAAO;IAC/D,QAAQ,OAAO,gBAAgB,OAAO,OAAO,YAAY,GAAG,KAAK;IACjE,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEtE,OAAO,OAAO,QAAQ,oBAAoB,OAAO,EAAE,MAAM,SAAS,CAAC;GACrE,GAAG,iBAAiB;GACpB,UAAU,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,YAAY,OAAO;IACrE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAAe,GAAG,KAAK;IACpE,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEtE,MAAM,WAAW,OAAO,QACrB,eAAe,OAAO,EAAE,MAAM,SAAS,CAAC,CAAC,CACzC,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,SAAS,UAAU;IAE1D,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,KAChE,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;IAEA,MAAM,WAAW,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,KAChE,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;IAEA,MAAM,SAAS,OAAO,kBACpB,OAAO,WACJ,QAAQ;KAAE,UAAU,SAAS;KAAU,QAAQ;IAAS,CAAC,CAAC,CAC1D,KACC,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,mBAAmB,KAAK,CAAC,CAAC,IAC1B,MAAM,SAAS,iCACb,yBAAyB,KAAK,CAAC,CAAC,IAChC,gBAAgB,KAAK,CAAC,CAAC,CACjC,CACF,CACJ;IAEA,OAAO;KACL,OAAO,OAAO;KACd,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,GAAG,OAAO,kBAAkB;IACnF;GACF,GAAG,iBAAiB;GACpB,SAAS,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,YAAY,OAAO;IACnE,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,UAAU,OAAO,OAAO,yBAAyB,KAAK,CAAC,CAAC;IAChF,OAAO,OAAO,aACZ,OAAO,IAAI,MAAM,OAAO,UAAU;KAAE,SAAS;KAAG,SAAS;IAAK,CAAC,CAAC,CAClE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,OAAO,OAAO,kBACZ,OAAO,YAAY,QACjB;KAAE;KAAU,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;KAAG;IAAM,IACzE,OAAO,YAAY,QAAQ,QAAQ,KAAK,CAC3C,CACF;GACF,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,MAAM,EAAE,OAAO,UAAU,YAAY,oBAAoB,UAAU,QAAQ,CAAC,CAAC;CAE7E,MAAM,gBAAgB,MAAM,SAC1B,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,WAAW,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CACxE,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CAC3E,GACA,QAAQ,cAAc,OAAO,eAC3B,OAAO,QAAQ,WAAW,YAAY,QAAQ,QAAQ,YAAY,MAAM,KAAK,CAAC,CAChF,CACF;CAEA,MAAM,UAAU,mBAAmB,UAAU,MAAM;CAInD,MAAM,gBAAgB,cAAc,KAClC,MAAM,QAAQ,aAAa,UAAU,KAAK,CAAC,GAC3C,MAAM,QAAQ,aAAa,SAAS,QAAQ,gBAAgB,SAAS,QAAQ,KAAK,CAAC,GACnF,MAAM,QAAQ,UAAU,GACxB,MAAM,QAAQ,WAAW,CAC3B;CAEA,MAAM,gBACJ,UACG;EACH,MAAM,SAAS,wBAAwB,UAAU,QAAQ,KAAK;EAE9D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,UAAU,OAAO,WAAW,MAAM;IAClC,sBAAsB,OAAO,WAAW,SAAS;GACnD,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,eAAe,OAAO,KAAK,CAAC,GAC9D,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,UAAU,GACxB,MAAM,QAAQ,WAAW,CAC3B,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,WAAoC;EACtD,MAAM,SAAS,sBAAsB,UAAU,QAAQ,QAAQ,QAAQ;EAEvE,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,eAAe,OAAO,WAAW,MAAM;IACvC,2BAA2B,OAAO,WAAW,SAAS;IACtD,cAAc,OAAO,WAAW,KAAK;IACrC,eAAe,OAAO,WAAW,OAAO;IACxC,eAAe,OAAO,WAAW,OAAO;GAC1C,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,YAAY,OAAO,KAAK,CAAC,GAC3D,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,UAAU,GACxB,MAAM,QAAQ,WAAW,CAC3B,CACF;EACF,CAAC;CACH;CAEA,MAAM,gBAAgB,mBAAmB,UAAU,QAAQ,QAAQ;CAEnE,MAAM,UAAU,OAAO,OAAO;EAC5B,GAAG;EACH,UAAU,iBACR;GACE,cAAc,cAAc,WAAW,MAAM;GAC7C,iBAAiB,cAAc,WAAW,SAAS;EACrD,GACA,cAAc,cAAc,KAC1B,MAAM,QAAQ,aAAa,cAAc,SAAS,cAAc,KAAK,CAAC,GACtE,MAAM,QACJ,aAAa,cAAc,QAAQ,gBAAgB,cAAc,QAAQ,KAAK,CAChF,GACA,MAAM,QAAQ,UAAU,GACxB,MAAM,QAAQ,WAAW,CAC3B,GACA,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;CAED,MAAM,eAAe,kBAAkB,UAAU,QAAQ,QAAQ;CAEjE,MAAM,SAAS,OAAO,OAAO;EAC3B,GAAG;EACH,UAAU,iBACR;GACE,aAAa,aAAa,WAAW,MAAM;GAC3C,gBAAgB,aAAa,WAAW,SAAS;EACnD,GACA,aAAa,cAAc,KACzB,MAAM,QAAQ,aAAa,aAAa,QAAQ,aAAa,KAAK,CAAC,GACnE,MAAM,QACJ,aAAa,aAAa,QAAQ,gBAAgB,aAAa,QAAQ,KAAK,CAC9E,GACA,MAAM,QAAQ,UAAU,GACxB,MAAM,QAAQ,WAAW,CAC3B,CACF;CACF,CAAC;CAED,OAAO,OAAO,OAAO;EACnB,UAAU,iBACR;GAAE,QAAQ,MAAM;GAAQ,gBAAgB,SAAS;EAAO,GACxD,eACA,EAAE,YAAY,KAAK,CACrB;EACA;EACA;EACA,SAAS,SAAS;EAClB;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;GAAU;EAAQ,CAAC;EACtD,OAAO,eAAe,OAAO,UAAU,OAAO;EAC9C;EACA;EACA;EACA;EACA;CACF,CAAC;AACH"}

package/dist/passkey/pending.mjs

@@ -0,0 +1,99 @@
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { PasskeyFailure, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyComplete, PasskeyTarget } from "./models.mjs";
+import { snapshotPasskey } from "./snapshot.mjs";
+import { makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./actions.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/passkey/pending.ts
+const credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));
+const makePasskeyPending = (moduleId, source, sessions) => {
+	const ceremony = makePasskeyCeremony(moduleId, source, "pending");
+	const BeginInput = Schema.Struct({
+		...PasskeyBegin.fields,
+		pendingCredential: credential
+	});
+	const CompleteInput = Schema.Struct({
+		...PasskeyComplete.fields,
+		pendingCredential: credential
+	});
+	const Pending = Context.Service(`effect-auth/PasskeyPending/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(Pending, Effect.gen(function* () {
+		const runtime = yield* ceremony.make, completion = yield* sessions.AuthenticationCompletion;
+		const services = yield* Effect.context();
+		const target = Effect.fn("PasskeyPending.target")(function* (token) {
+			const context = yield* completion.pendingContext(token).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : error._tag === "SessionCapabilityUnsupported" ? PasskeyMethodUnsupported.make({}) : PasskeyRejected.make({})));
+			return yield* snapshotPasskey(PasskeyTarget, {
+				...context,
+				moduleId: sessions.moduleId,
+				kind: "login-pending",
+				commandId: context.flowId
+			});
+		}, passkeyUnexpected);
+		return Pending.of({
+			begin: Effect.fn("PasskeyPending.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				const fixed = yield* target(input.pendingCredential), captured = yield* runtime.exclusions(input.profileId, fixed.revision.subjectId).pipe(Effect.provide(services));
+				return yield* runtime.beginAuthentication(input, {
+					_tag: "Pending",
+					target: fixed
+				}, captured.credentials);
+			}, passkeyUnexpected),
+			complete: Effect.fn("PasskeyPending.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				const fixed = yield* target(input.pendingCredential);
+				const verified = yield* runtime.authentication(input, {
+					_tag: "Pending",
+					target: fixed
+				}).pipe(Effect.provide(services), Effect.catchTag("PasskeyRejected", () => Effect.gen(function* () {
+					yield* readPasskeyCommit(yield* completion.rejectPendingCredential(input.pendingCredential).pipe(Effect.mapError(() => PasskeyUnavailable.make({}))));
+					return yield* PasskeyRejected.make({});
+				})));
+				const result = yield* readPasskeyCommit(yield* completion.preparePending({
+					credential: input.pendingCredential,
+					additional: verified.evidence
+				}).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : error._tag === "SessionCapabilityUnsupported" ? PasskeyMethodUnsupported.make({}) : PasskeyRejected.make({}))));
+				return {
+					value: result.value,
+					credentialCommands: [...verified.credentialCommands, ...result.credentialCommands]
+				};
+			}, passkeyUnexpected)
+		});
+	}));
+	const Begin = makeOperation(`${moduleId}/passkey/pending/begin`, {
+		payload: BeginInput,
+		success: PasskeyAuthenticationStarted,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/passkey/pending/complete`, {
+		payload: CompleteInput,
+		success: sessions.CompletionResult,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	return Object.freeze({
+		Pending,
+		binding: ceremony.binding,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete
+		}),
+		group: operationGroup(Begin, Complete),
+		handlersLayer: Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(Pending, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(Pending, (service) => service.complete(invocation, input))))
+	});
+};
+//#endregion
+export { makePasskeyPending };
+
+//# sourceMappingURL=pending.mjs.map

package/dist/passkey/pending.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.mjs","names":[],"sources":["../../src/passkey/pending.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema, type Types } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  passkeyUnexpected,\n  makePasskeyCeremony,\n  passkeyNoAmbient,\n  readPasskeyCommit,\n} from \"./actions\";\nimport type { PasskeyConfigurationError } from \"./errors\";\nimport {\n  PasskeyFailure,\n  PasskeyMethodUnsupported,\n  PasskeyRejected,\n  PasskeyUnavailable,\n} from \"./errors\";\nimport {\n  PasskeyAuthenticationStarted,\n  PasskeyBegin,\n  PasskeyComplete,\n  PasskeyTarget,\n} from \"./models\";\nimport type { PasskeyCredentials } from \"./PasskeyCredentials\";\nimport type { PasskeyEnrollmentContext } from \"./PasskeyEnrollmentContext\";\nimport type { PasskeyMethodPolicy } from \"./policy\";\nimport { snapshotPasskey } from \"./snapshot\";\nconst credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));\n\nexport const makePasskeyPending = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n) => {\n  const ceremony = makePasskeyCeremony(moduleId, source, \"pending\");\n  const BeginInput = Schema.Struct({ ...PasskeyBegin.fields, pendingCredential: credential });\n  const CompleteInput = Schema.Struct({ ...PasskeyComplete.fields, pendingCredential: credential });\n\n  const Pending = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkey-pending\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof BeginInput.Type,\n      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof CompleteInput.Type,\n      ) => Effect.Effect<\n        AuthOperationResult<typeof sessions.CompletionResult.Type>,\n        PasskeyFailure\n      >;\n    }\n  >(`effect-auth/PasskeyPending/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    Pending,\n    Effect.gen(function* () {\n      const runtime = yield* ceremony.make,\n        completion = yield* sessions.AuthenticationCompletion;\n\n      const services = yield* Effect.context<\n        PasskeyCredentials | PasskeyEnrollmentContext | AuthenticationAuthority\n      >();\n\n      const target = Effect.fn(\"PasskeyPending.target\")(function* (token: typeof credential.Type) {\n        const context = yield* completion\n          .pendingContext(token)\n          .pipe(\n            Effect.mapError((error) =>\n              error._tag === \"HookDenied\"\n                ? error\n                : error._tag === \"SessionUnavailable\"\n                  ? PasskeyUnavailable.make({})\n                  : error._tag === \"SessionCapabilityUnsupported\"\n                    ? PasskeyMethodUnsupported.make({})\n                    : PasskeyRejected.make({}),\n            ),\n          );\n\n        return yield* snapshotPasskey(PasskeyTarget, {\n          ...context,\n          moduleId: sessions.moduleId,\n          kind: \"login-pending\",\n          commandId: context.flowId,\n        });\n      }, passkeyUnexpected);\n\n      return Pending.of({\n        begin: Effect.fn(\"PasskeyPending.begin\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(BeginInput), input);\n          yield* passkeyNoAmbient();\n          if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n\n          const fixed = yield* target(input.pendingCredential),\n            captured = yield* runtime\n              .exclusions(input.profileId, fixed.revision.subjectId)\n              .pipe(Effect.provide(services));\n\n          return yield* runtime.beginAuthentication(\n            input,\n            { _tag: \"Pending\", target: fixed },\n            captured.credentials,\n          );\n        }, passkeyUnexpected),\n        complete: Effect.fn(\"PasskeyPending.complete\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);\n          yield* passkeyNoAmbient();\n          if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n          const fixed = yield* target(input.pendingCredential);\n\n          const verified = yield* runtime\n            .authentication(input, { _tag: \"Pending\", target: fixed })\n            .pipe(\n              Effect.provide(services),\n              Effect.catchTag(\"PasskeyRejected\", () =>\n                Effect.gen(function* () {\n                  yield* readPasskeyCommit(\n                    yield* completion\n                      .rejectPendingCredential(input.pendingCredential)\n                      .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),\n                  );\n\n                  return yield* PasskeyRejected.make({});\n                }),\n              ),\n            );\n\n          const result = yield* readPasskeyCommit(\n            yield* completion\n              .preparePending({\n                credential: input.pendingCredential,\n                additional: verified.evidence,\n              })\n              .pipe(\n                Effect.mapError((error) =>\n                  error._tag === \"HookDenied\"\n                    ? error\n                    : error._tag === \"SessionUnavailable\"\n                      ? PasskeyUnavailable.make({})\n                      : error._tag === \"SessionCapabilityUnsupported\"\n                        ? PasskeyMethodUnsupported.make({})\n                        : PasskeyRejected.make({}),\n                ),\n              ),\n          );\n\n          return {\n            value: result.value,\n            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],\n          };\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  const Begin = makeOperation(`${moduleId}/passkey/pending/begin`, {\n    payload: BeginInput,\n    success: PasskeyAuthenticationStarted,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/pending/complete`, {\n    payload: CompleteInput,\n    success: sessions.CompletionResult,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  return Object.freeze({\n    Pending,\n    binding: ceremony.binding,\n    layer,\n    operations: Object.freeze({ Begin, Complete }),\n    group: operationGroup(Begin, Complete),\n    handlersLayer: Layer.mergeAll(\n      Begin.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Pending, (service) => service.begin(invocation, input)),\n      ),\n      Complete.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Pending, (service) => service.complete(invocation, input)),\n      ),\n    ),\n  });\n};\n"],"mappings":";;;;;;;AA8BA,MAAM,aAAa,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAElG,MAAa,sBAKX,UACA,QACA,aACG;CACH,MAAM,WAAW,oBAAoB,UAAU,QAAQ,SAAS;CAChE,MAAM,aAAa,OAAO,OAAO;EAAE,GAAG,aAAa;EAAQ,mBAAmB;CAAW,CAAC;CAC1F,MAAM,gBAAgB,OAAO,OAAO;EAAE,GAAG,gBAAgB;EAAQ,mBAAmB;CAAW,CAAC;CAEhG,MAAM,UAAU,QAAQ,QAmBtB,8BAA8B,SAAS,OAAO,GAAG,UAAU;CAE7D,MAAM,QAAQ,MAAM,OAClB,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,MAC9B,aAAa,OAAO,SAAS;EAE/B,MAAM,WAAW,OAAO,OAAO,QAE7B;EAEF,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAA+B;GAC1F,MAAM,UAAU,OAAO,WACpB,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,mBAAmB,KAAK,CAAC,CAAC,IAC1B,MAAM,SAAS,iCACb,yBAAyB,KAAK,CAAC,CAAC,IAChC,gBAAgB,KAAK,CAAC,CAAC,CACjC,CACF;GAEF,OAAO,OAAO,gBAAgB,eAAe;IAC3C,GAAG;IACH,UAAU,SAAS;IACnB,MAAM;IACN,WAAW,QAAQ;GACrB,CAAC;EACH,GAAG,iBAAiB;EAEpB,OAAO,QAAQ,GAAG;GAChB,OAAO,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,YAAY,OAAO;IACrE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,UAAU,GAAG,KAAK;IAC/D,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEtE,MAAM,QAAQ,OAAO,OAAO,MAAM,iBAAiB,GACjD,WAAW,OAAO,QACf,WAAW,MAAM,WAAW,MAAM,SAAS,SAAS,CAAC,CACrD,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAElC,OAAO,OAAO,QAAQ,oBACpB,OACA;KAAE,MAAM;KAAW,QAAQ;IAAM,GACjC,SAAS,WACX;GACF,GAAG,iBAAiB;GACpB,UAAU,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,YAAY,OAAO;IAC3E,QAAQ,OAAO,gBAAgB,OAAO,OAAO,aAAa,GAAG,KAAK;IAClE,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACtE,MAAM,QAAQ,OAAO,OAAO,MAAM,iBAAiB;IAEnD,MAAM,WAAW,OAAO,QACrB,eAAe,OAAO;KAAE,MAAM;KAAW,QAAQ;IAAM,CAAC,CAAC,CACzD,KACC,OAAO,QAAQ,QAAQ,GACvB,OAAO,SAAS,yBACd,OAAO,IAAI,aAAa;KACtB,OAAO,kBACL,OAAO,WACJ,wBAAwB,MAAM,iBAAiB,CAAC,CAChD,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5D;KAEA,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,CAAC,CACH,CACF;IAEF,MAAM,SAAS,OAAO,kBACpB,OAAO,WACJ,eAAe;KACd,YAAY,MAAM;KAClB,YAAY,SAAS;IACvB,CAAC,CAAC,CACD,KACC,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,mBAAmB,KAAK,CAAC,CAAC,IAC1B,MAAM,SAAS,iCACb,yBAAyB,KAAK,CAAC,CAAC,IAChC,gBAAgB,KAAK,CAAC,CAAC,CACjC,CACF,CACJ;IAEA,OAAO;KACL,OAAO,OAAO;KACd,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,GAAG,OAAO,kBAAkB;IACnF;GACF,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,yBAAyB;EAC/D,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,4BAA4B;EACrE,SAAS;EACT,SAAS,SAAS;EAClB,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,SAAS;EAClB;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C,OAAO,eAAe,OAAO,QAAQ;EACrC,eAAe,MAAM,SACnB,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CACvE,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,UAAU,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CAC1E,CACF;CACF,CAAC;AACH"}

package/dist/passkey/policy.d.mts

@@ -0,0 +1,48 @@
+import "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/passkey/policy.d.ts
+declare const PasskeyMethodPolicy: Schema.Struct<{
+  readonly generation: Schema.Int;
+  readonly profiles: Schema.NonEmptyArray<Schema.Struct<{
+    readonly profileId: Schema.String;
+    readonly generation: Schema.Int;
+    readonly rpId: Schema.String;
+    readonly rpName: Schema.NonEmptyString;
+    readonly origins: Schema.NonEmptyArray<Schema.NonEmptyString>;
+    readonly developmentLocalhost: Schema.Boolean;
+    readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+    readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+    readonly primarySignIn: Schema.Boolean;
+    readonly attestation: Schema.Literal<"none">;
+    readonly algorithms: Schema.NonEmptyArray<Schema.Literals<readonly [-7, -257]>>;
+  }>>;
+  readonly lifetimeMillis: Schema.Int;
+  readonly claimLifetimeMillis: Schema.Int;
+  readonly retentionMillis: Schema.Int;
+  readonly maximumPending: Schema.Int;
+  readonly maximumPendingPerSubject: Schema.Int;
+  readonly admission: Schema.Struct<{
+    readonly global: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly subject: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly target: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+  }>;
+}>;
+type PasskeyMethodPolicy = typeof PasskeyMethodPolicy.Type;
+declare const PasskeyManagementPolicy: Schema.Struct<{
+  readonly maximumCredentials: Schema.Int;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type PasskeyManagementPolicy = typeof PasskeyManagementPolicy.Type;
+//#endregion
+export { PasskeyManagementPolicy, PasskeyMethodPolicy };
+//# sourceMappingURL=policy.d.mts.map

package/dist/passkey/policy.mjs

@@ -0,0 +1,77 @@
+import { PasskeyConfigurationError } from "./errors.mjs";
+import { PasskeyGeneration, PasskeyProfile } from "./models.mjs";
+import { snapshotPasskey } from "./snapshot.mjs";
+import { Effect, Schema } from "effect";
+//#region src/passkey/policy.ts
+const budget = Schema.Struct({
+	limit: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e4
+	})),
+	windowMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 864e5
+	}))
+});
+const PasskeyMethodPolicy = Schema.Struct({
+	generation: PasskeyGeneration,
+	profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(32)),
+	lifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	claimLifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 12e4
+	})),
+	retentionMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 6048e5
+	})),
+	maximumPending: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e5
+	})),
+	maximumPendingPerSubject: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 100
+	})),
+	admission: Schema.Struct({
+		global: budget,
+		subject: budget,
+		target: budget
+	})
+});
+const PasskeyManagementPolicy = Schema.Struct({
+	maximumCredentials: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 64
+	})),
+	maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 3e5
+	})),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const validatePasskeyPolicy = Effect.fn("validatePasskeyPolicy")(function* (input) {
+	const policy = yield* snapshotPasskey(PasskeyMethodPolicy, input).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
+	if (policy.retentionMillis < Math.max(policy.lifetimeMillis + policy.claimLifetimeMillis, ...Object.values(policy.admission).map((b) => b.windowMillis))) return yield* PasskeyConfigurationError.make({});
+	const ids = /* @__PURE__ */ new Set();
+	for (const profile of policy.profiles) {
+		if (ids.has(profile.profileId) || new Set(profile.origins).size !== profile.origins.length || new Set(profile.algorithms).size !== profile.algorithms.length) return yield* PasskeyConfigurationError.make({});
+		ids.add(profile.profileId);
+		if (profile.primarySignIn && (profile.userVerification !== "required" || profile.residentKey !== "required")) return yield* PasskeyConfigurationError.make({});
+		for (const origin of profile.origins) if (!(yield* Effect.try({
+			try: () => {
+				const url = new URL(origin);
+				return url.origin === origin && url.username === "" && url.password === "" && (url.protocol === "https:" || profile.developmentLocalhost && profile.rpId === "localhost" && url.hostname === "localhost" && url.protocol === "http:") && (url.hostname === profile.rpId || url.hostname.endsWith("." + profile.rpId));
+			},
+			catch: () => PasskeyConfigurationError.make({})
+		}))) return yield* PasskeyConfigurationError.make({});
+	}
+	return policy;
+});
+//#endregion
+export { PasskeyManagementPolicy, PasskeyMethodPolicy, validatePasskeyPolicy };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/passkey/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../src/passkey/policy.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { PasskeyConfigurationError } from \"./errors\";\nimport { PasskeyGeneration, PasskeyProfile } from \"./models\";\nimport { snapshotPasskey } from \"./snapshot\";\n\nconst budget = Schema.Struct({\n  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 10000 })),\n  windowMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 86400000 })),\n});\n\nexport const PasskeyMethodPolicy = Schema.Struct({\n  generation: PasskeyGeneration,\n  profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(32)),\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 120000 })),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 604800000 })),\n  maximumPending: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100000 })),\n  maximumPendingPerSubject: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),\n  admission: Schema.Struct({ global: budget, subject: budget, target: budget }),\n});\n\nexport type PasskeyMethodPolicy = typeof PasskeyMethodPolicy.Type;\n\nexport const PasskeyManagementPolicy = Schema.Struct({\n  maximumCredentials: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 })),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type PasskeyManagementPolicy = typeof PasskeyManagementPolicy.Type;\n\nexport const validatePasskeyPolicy = Effect.fn(\"validatePasskeyPolicy\")(function* (\n  input: PasskeyMethodPolicy,\n) {\n  const policy = yield* snapshotPasskey(PasskeyMethodPolicy, input).pipe(\n    Effect.mapError(() => PasskeyConfigurationError.make({})),\n  );\n\n  if (\n    policy.retentionMillis <\n    Math.max(\n      policy.lifetimeMillis + policy.claimLifetimeMillis,\n      ...Object.values(policy.admission).map((b) => b.windowMillis),\n    )\n  )\n    return yield* PasskeyConfigurationError.make({});\n  const ids = new Set<string>();\n\n  for (const profile of policy.profiles) {\n    if (\n      ids.has(profile.profileId) ||\n      new Set(profile.origins).size !== profile.origins.length ||\n      new Set(profile.algorithms).size !== profile.algorithms.length\n    )\n      return yield* PasskeyConfigurationError.make({});\n    ids.add(profile.profileId);\n    if (\n      profile.primarySignIn &&\n      (profile.userVerification !== \"required\" || profile.residentKey !== \"required\")\n    )\n      return yield* PasskeyConfigurationError.make({});\n    for (const origin of profile.origins) {\n      const valid = yield* Effect.try({\n        try: () => {\n          const url = new URL(origin);\n\n          return (\n            url.origin === origin &&\n            url.username === \"\" &&\n            url.password === \"\" &&\n            (url.protocol === \"https:\" ||\n              (profile.developmentLocalhost &&\n                profile.rpId === \"localhost\" &&\n                url.hostname === \"localhost\" &&\n                url.protocol === \"http:\")) &&\n            (url.hostname === profile.rpId || url.hostname.endsWith(\".\" + profile.rpId))\n          );\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      });\n\n      if (!valid) return yield* PasskeyConfigurationError.make({});\n    }\n  }\n\n  return policy;\n});\n"],"mappings":";;;;;AAMA,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAM,CAAC,CAAC;CACxE,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAS,CAAC,CAAC;AACvF,CAAC;AAED,MAAa,sBAAsB,OAAO,OAAO;CAC/C,YAAY;CACZ,UAAU,OAAO,cAAc,cAAc,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC3E,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CACrF,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CACvF,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAU,CAAC,CAAC;CACzF,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CAClF,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAI,CAAC,CAAC;CACzF,WAAW,OAAO,OAAO;EAAE,QAAQ;EAAQ,SAAS;EAAQ,QAAQ;CAAO,CAAC;AAC9E,CAAC;AAID,MAAa,0BAA0B,OAAO,OAAO;CACnD,oBAAoB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CAClF,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CAC5F,8BAA8B,OAAO;AACvC,CAAC;AAID,MAAa,wBAAwB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACtE,OACA;CACA,MAAM,SAAS,OAAO,gBAAgB,qBAAqB,KAAK,CAAC,CAAC,KAChE,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;CAEA,IACE,OAAO,kBACP,KAAK,IACH,OAAO,iBAAiB,OAAO,qBAC/B,GAAG,OAAO,OAAO,OAAO,SAAS,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAC9D,GAEA,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CACjD,MAAM,sBAAM,IAAI,IAAY;CAE5B,KAAK,MAAM,WAAW,OAAO,UAAU;EACrC,IACE,IAAI,IAAI,QAAQ,SAAS,KACzB,IAAI,IAAI,QAAQ,OAAO,CAAC,CAAC,SAAS,QAAQ,QAAQ,UAClD,IAAI,IAAI,QAAQ,UAAU,CAAC,CAAC,SAAS,QAAQ,WAAW,QAExD,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;EACjD,IAAI,IAAI,QAAQ,SAAS;EACzB,IACE,QAAQ,kBACP,QAAQ,qBAAqB,cAAc,QAAQ,gBAAgB,aAEpE,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;EACjD,KAAK,MAAM,UAAU,QAAQ,SAoB3B,IAAI,EAAC,OAnBgB,OAAO,IAAI;GAC9B,WAAW;IACT,MAAM,MAAM,IAAI,IAAI,MAAM;IAE1B,OACE,IAAI,WAAW,UACf,IAAI,aAAa,MACjB,IAAI,aAAa,OAChB,IAAI,aAAa,YACf,QAAQ,wBACP,QAAQ,SAAS,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,aACpB,IAAI,aAAa,QAAQ,QAAQ,IAAI,SAAS,SAAS,MAAM,QAAQ,IAAI;GAE9E;GACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;EAChD,CAAC,IAEW,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAE/D;CAEA,OAAO;AACT,CAAC"}

package/dist/passkey/registration.mjs

@@ -0,0 +1,107 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { operationGroup } from "../operations/operation.mjs";
+import { PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyIssueDecision, PasskeyLabel, PasskeyRegistrationResult, PasskeyUserHandle } from "./models.mjs";
+import { freezePasskey, snapshotPasskey, snapshotPasskeySync } from "./snapshot.mjs";
+import { makePasskeyRegistrationContract } from "../PasskeyContract.mjs";
+import { makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./actions.mjs";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+//#region src/passkey/registration.ts
+const decision = Schema.Union([PasskeyRegistrationResult, Schema.TaggedStruct("Rejected", {})]);
+const inspection = Schema.Struct({
+	fingerprint: TokenDigest.check(Schema.isMaxLength(256)),
+	eligible: Schema.Boolean,
+	name: PasskeyLabel,
+	displayName: PasskeyLabel
+});
+/** Exact application registration intent is owned by the optional authority.
+* No Claims/session dependency and no registration-time authentication proof. */
+const makePasskeyRegistration = (moduleId, source, codec) => {
+	const { BeginInput, RegistrationCodec, operations: { Begin, Complete } } = makePasskeyRegistrationContract(moduleId, codec);
+	const ceremony = makePasskeyCeremony(moduleId, source, "registration");
+	const RegistrationAuthority = Context.Service(`effect-auth/PasskeyRegistrationAuthority/${moduleId.length}:${moduleId}`);
+	const Registrations = Context.Service(`effect-auth/PasskeyRegistrations/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(Registrations, Effect.gen(function* () {
+		const runtime = yield* ceremony.make, authority = yield* RegistrationAuthority;
+		const services = yield* Effect.context();
+		const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));
+		const data = Effect.fn("PasskeyRegistration.data")(function* (value) {
+			const encoded = yield* Schema.encodeEffect(dataCodec)(value);
+			const decoded = yield* Schema.decodeEffect(dataCodec)(encoded);
+			freezePasskey(decoded);
+			return decoded;
+		}, Effect.mapError(() => PasskeyUnavailable.make({})), Effect.provide(services), passkeyUnexpected);
+		return Registrations.of({
+			begin: Effect.fn("PasskeyRegistration.begin")(function* (invocation, input) {
+				const authority = yield* RegistrationAuthority;
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				const selected = yield* runtime.profile(input.profileId);
+				if (!selected.primarySignIn || selected.residentKey !== "required" || selected.userVerification !== "required") return yield* PasskeyRejected.make({});
+				const registration = yield* data(input.registration), inspected = yield* snapshotPasskey(inspection, yield* authority.inspect(yield* data(registration)));
+				if (!inspected.eligible) return yield* PasskeyRejected.make({});
+				const context = {
+					_tag: "Registration",
+					fingerprint: inspected.fingerprint,
+					userHandle: PasskeyUserHandle.make(yield* runtime.random()),
+					name: inspected.name,
+					displayName: inspected.displayName
+				};
+				const draft = yield* runtime.prepareRegistration(input, context, []);
+				const issued = yield* readPasskeyCommit(yield* authority.issueRegistration({
+					ceremony: draft.ceremony,
+					policy: runtime.policy,
+					registration
+				}, (value, journal) => journal.prepare(snapshotPasskeySync(PasskeyIssueDecision, value))));
+				return yield* runtime.acceptRegistrationIssue(draft, issued);
+			}, passkeyUnexpected, Effect.provideService(RegistrationAuthority, authority)),
+			complete: Effect.fn("PasskeyRegistration.complete")(function* (invocation, input) {
+				yield* passkeyNoAmbient();
+				if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+				const { claim, verified } = yield* runtime.verifyRegistration(input, void 0);
+				const authority = yield* RegistrationAuthority;
+				const timestamp = DateTime.toEpochMillis(yield* DateTime.now);
+				const result = yield* readPasskeyCommit(yield* authority.completeRegistration({
+					claim,
+					verified,
+					nowMillis: timestamp
+				}, (value, journal) => {
+					const projected = snapshotPasskeySync(decision, value);
+					if (projected._tag === "RegistrationAccepted") journal.stage(lifecycleEvent({
+						id: LifecycleEventId.make(`passkey-registration/${moduleId}/${claim.ceremony.flowId}`),
+						occurredAtMillis: timestamp,
+						snapshot: lifecycleSnapshot({
+							action: "registration",
+							operation: `${moduleId}/passkey/registration/complete`,
+							method: "passkey",
+							identifiers: []
+						})
+					}));
+					return journal.prepare(projected);
+				}));
+				if (result._tag === "Rejected") return yield* PasskeyRejected.make({});
+				return {
+					value: result,
+					credentialCommands: [runtime.clear]
+				};
+			}, passkeyUnexpected, Effect.provideService(RegistrationAuthority, authority))
+		});
+	}));
+	return Object.freeze({
+		RegistrationAuthority,
+		Registrations,
+		binding: ceremony.binding,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete
+		}),
+		group: operationGroup(Begin, Complete),
+		handlersLayer: Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(Registrations, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(Registrations, (service) => service.complete(invocation, input))))
+	});
+};
+//#endregion
+export { makePasskeyRegistration };
+
+//# sourceMappingURL=registration.mjs.map

package/dist/passkey/registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.mjs","names":[],"sources":["../../src/passkey/registration.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Schema, type Types } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { operationGroup } from \"../operations/operation\";\nimport { makePasskeyRegistrationContract } from \"../PasskeyContract\";\nimport { TokenDigest } from \"../Schema\";\nimport {\n  passkeyUnexpected,\n  makePasskeyCeremony,\n  passkeyNoAmbient,\n  readPasskeyCommit,\n} from \"./actions\";\nimport type { PasskeyConfigurationError, PasskeyFailure } from \"./errors\";\nimport { PasskeyRejected, PasskeyUnavailable } from \"./errors\";\nimport type {\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyRegistrationComplete,\n  PasskeyRegistrationStarted,\n  PasskeyRegistrationVerified,\n} from \"./models\";\nimport {\n  PasskeyIssueDecision,\n  PasskeyLabel,\n  PasskeyRegistrationResult,\n  PasskeyUserHandle,\n} from \"./models\";\nimport type { PreparePasskeyCommit } from \"./PasskeyPersistence\";\nimport type { PasskeyMethodPolicy } from \"./policy\";\nimport { freezePasskey, snapshotPasskey, snapshotPasskeySync } from \"./snapshot\";\nconst decision = Schema.Union([PasskeyRegistrationResult, Schema.TaggedStruct(\"Rejected\", {})]);\n\nconst inspection = Schema.Struct({\n  fingerprint: TokenDigest.check(Schema.isMaxLength(256)),\n  eligible: Schema.Boolean,\n  name: PasskeyLabel,\n  displayName: PasskeyLabel,\n});\n\n/** Exact application registration intent is owned by the optional authority.\n * No Claims/session dependency and no registration-time authentication proof. */\nexport const makePasskeyRegistration = <\n  const Id extends string,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n  codec: Registration,\n) => {\n  const {\n    BeginInput,\n    RegistrationCodec,\n    operations: { Begin, Complete },\n  } = makePasskeyRegistrationContract(moduleId, codec);\n\n  const ceremony = makePasskeyCeremony(moduleId, source, \"registration\");\n\n  const RegistrationAuthority = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkey-registration-authority\";\n      readonly registration: Types.Invariant<Registration>;\n    },\n    {\n      readonly inspect: (\n        registration: Registration[\"Type\"],\n      ) => Effect.Effect<typeof inspection.Type, PasskeyUnavailable>;\n      /** Reserve exact application intent/fingerprint, random handle, challenge and\n       * admission in SAME owner; no subject yet. No adoption by command/flow. */\n      readonly issueRegistration: <A>(\n        input: {\n          readonly ceremony: PasskeyCeremony;\n          readonly policy: PasskeyMethodPolicy;\n          readonly registration: Registration[\"Type\"];\n        },\n        prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n      ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n      /** Exact claim/fingerprint/original reserved data; active eligible profile and\n       * RP-global id/handle ownership including unresolved jobs. Atomically consume,\n       * provision subject + credential/shared factor or reserve ProvisioningPending.\n       * No sequential public provision call; pending retains all exact original data\n       * and credential ownership before external work. Unknown never releases it.\n       * Final owner clock checks expiry and all postconditions after last writes. */\n      readonly completeRegistration: <A>(\n        input: {\n          readonly claim: PasskeyClaim;\n          readonly verified: PasskeyRegistrationVerified;\n          readonly nowMillis: number;\n        },\n        prepare: PreparePasskeyCommit<typeof decision.Type, A>,\n      ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n    }\n  >(`effect-auth/PasskeyRegistrationAuthority/${moduleId.length}:${moduleId}`);\n\n  const Registrations = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkey-registration\";\n      readonly registration: Types.Invariant<Registration>;\n    },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof BeginInput.Type,\n      ) => Effect.Effect<AuthOperationResult<PasskeyRegistrationStarted>, PasskeyFailure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: PasskeyRegistrationComplete,\n      ) => Effect.Effect<AuthOperationResult<PasskeyRegistrationResult>, PasskeyFailure>;\n    }\n  >(`effect-auth/PasskeyRegistrations/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    Registrations,\n    Effect.gen(function* () {\n      const runtime = yield* ceremony.make,\n        authority = yield* RegistrationAuthority;\n\n      const services = yield* Effect.context<\n        Registration[\"DecodingServices\"] | Registration[\"EncodingServices\"]\n      >();\n\n      const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));\n\n      const data = Effect.fn(\"PasskeyRegistration.data\")(\n        function* (value: Registration[\"Type\"]) {\n          const encoded = yield* Schema.encodeEffect(dataCodec)(value);\n          const decoded = yield* Schema.decodeEffect(dataCodec)(encoded);\n\n          freezePasskey(decoded);\n\n          return decoded;\n        },\n        Effect.mapError(() => PasskeyUnavailable.make({})),\n        Effect.provide(services),\n        passkeyUnexpected,\n      );\n\n      return Registrations.of({\n        begin: Effect.fn(\"PasskeyRegistration.begin\")(\n          function* (invocation, input) {\n            const authority = yield* RegistrationAuthority;\n\n            yield* passkeyNoAmbient();\n            if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n            const selected = yield* runtime.profile(input.profileId);\n\n            if (\n              !selected.primarySignIn ||\n              selected.residentKey !== \"required\" ||\n              selected.userVerification !== \"required\"\n            )\n              return yield* PasskeyRejected.make({});\n\n            const registration = yield* data(input.registration),\n              inspected = yield* snapshotPasskey(\n                inspection,\n                yield* authority.inspect(yield* data(registration)),\n              );\n\n            if (!inspected.eligible) return yield* PasskeyRejected.make({});\n\n            const context = {\n              _tag: \"Registration\" as const,\n              fingerprint: inspected.fingerprint,\n              userHandle: PasskeyUserHandle.make(yield* runtime.random()),\n              name: inspected.name,\n              displayName: inspected.displayName,\n            };\n\n            const draft = yield* runtime.prepareRegistration(input, context, []);\n\n            const issued = yield* readPasskeyCommit(\n              yield* authority.issueRegistration(\n                { ceremony: draft.ceremony, policy: runtime.policy, registration },\n                (value, journal) =>\n                  journal.prepare(snapshotPasskeySync(PasskeyIssueDecision, value)),\n              ),\n            );\n\n            return yield* runtime.acceptRegistrationIssue(draft, issued);\n          },\n          passkeyUnexpected,\n          Effect.provideService(RegistrationAuthority, authority),\n        ),\n        complete: Effect.fn(\"PasskeyRegistration.complete\")(\n          function* (invocation, input) {\n            yield* passkeyNoAmbient();\n            if (invocation._tag !== \"Guest\") return yield* PasskeyRejected.make({});\n            const { claim, verified } = yield* runtime.verifyRegistration(input, undefined);\n            const authority = yield* RegistrationAuthority;\n            const timestamp = DateTime.toEpochMillis(yield* DateTime.now);\n\n            const result = yield* readPasskeyCommit(\n              yield* authority.completeRegistration(\n                { claim, verified, nowMillis: timestamp },\n                (value, journal) => {\n                  const projected = snapshotPasskeySync(decision, value);\n\n                  if (projected._tag === \"RegistrationAccepted\")\n                    journal.stage(\n                      lifecycleEvent({\n                        id: LifecycleEventId.make(\n                          `passkey-registration/${moduleId}/${claim.ceremony.flowId}`,\n                        ),\n                        occurredAtMillis: timestamp,\n                        snapshot: lifecycleSnapshot({\n                          action: \"registration\",\n                          operation: `${moduleId}/passkey/registration/complete`,\n                          method: \"passkey\",\n                          identifiers: [],\n                        }),\n                      }),\n                    );\n\n                  return journal.prepare(projected);\n                },\n              ),\n            );\n\n            if (result._tag === \"Rejected\") return yield* PasskeyRejected.make({});\n\n            return { value: result, credentialCommands: [runtime.clear] };\n          },\n          passkeyUnexpected,\n          Effect.provideService(RegistrationAuthority, authority),\n        ),\n      });\n    }),\n  );\n\n  return Object.freeze({\n    RegistrationAuthority,\n    Registrations,\n    binding: ceremony.binding,\n    layer,\n    operations: Object.freeze({ Begin, Complete }),\n    group: operationGroup(Begin, Complete),\n    handlersLayer: Layer.mergeAll(\n      Begin.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Registrations, (service) => service.begin(invocation, input)),\n      ),\n      Complete.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Registrations, (service) => service.complete(invocation, input)),\n      ),\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;AAiCA,MAAM,WAAW,OAAO,MAAM,CAAC,2BAA2B,OAAO,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,aAAa,OAAO,OAAO;CAC/B,aAAa,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;CACtD,UAAU,OAAO;CACjB,MAAM;CACN,aAAa;AACf,CAAC;;;AAID,MAAa,2BAIX,UACA,QACA,UACG;CACH,MAAM,EACJ,YACA,mBACA,YAAY,EAAE,OAAO,eACnB,gCAAgC,UAAU,KAAK;CAEnD,MAAM,WAAW,oBAAoB,UAAU,QAAQ,cAAc;CAErE,MAAM,wBAAwB,QAAQ,QAmCpC,4CAA4C,SAAS,OAAO,GAAG,UAAU;CAE3E,MAAM,gBAAgB,QAAQ,QAgB5B,oCAAoC,SAAS,OAAO,GAAG,UAAU;CAEnE,MAAM,QAAQ,MAAM,OAClB,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,MAC9B,YAAY,OAAO;EAErB,MAAM,WAAW,OAAO,OAAO,QAE7B;EAEF,MAAM,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC;EAErE,MAAM,OAAO,OAAO,GAAG,0BAA0B,CAAC,CAChD,WAAW,OAA6B;GACtC,MAAM,UAAU,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,KAAK;GAC3D,MAAM,UAAU,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,OAAO;GAE7D,cAAc,OAAO;GAErB,OAAO;EACT,GACA,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,GACjD,OAAO,QAAQ,QAAQ,GACvB,iBACF;EAEA,OAAO,cAAc,GAAG;GACtB,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAC3C,WAAW,YAAY,OAAO;IAC5B,MAAM,YAAY,OAAO;IAEzB,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACtE,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,SAAS;IAEvD,IACE,CAAC,SAAS,iBACV,SAAS,gBAAgB,cACzB,SAAS,qBAAqB,YAE9B,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,eAAe,OAAO,KAAK,MAAM,YAAY,GACjD,YAAY,OAAO,gBACjB,YACA,OAAO,UAAU,QAAQ,OAAO,KAAK,YAAY,CAAC,CACpD;IAEF,IAAI,CAAC,UAAU,UAAU,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAE9D,MAAM,UAAU;KACd,MAAM;KACN,aAAa,UAAU;KACvB,YAAY,kBAAkB,KAAK,OAAO,QAAQ,OAAO,CAAC;KAC1D,MAAM,UAAU;KAChB,aAAa,UAAU;IACzB;IAEA,MAAM,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,SAAS,CAAC,CAAC;IAEnE,MAAM,SAAS,OAAO,kBACpB,OAAO,UAAU,kBACf;KAAE,UAAU,MAAM;KAAU,QAAQ,QAAQ;KAAQ;IAAa,IAChE,OAAO,YACN,QAAQ,QAAQ,oBAAoB,sBAAsB,KAAK,CAAC,CACpE,CACF;IAEA,OAAO,OAAO,QAAQ,wBAAwB,OAAO,MAAM;GAC7D,GACA,mBACA,OAAO,eAAe,uBAAuB,SAAS,CACxD;GACA,UAAU,OAAO,GAAG,8BAA8B,CAAC,CACjD,WAAW,YAAY,OAAO;IAC5B,OAAO,iBAAiB;IACxB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,aAAa,OAAO,QAAQ,mBAAmB,OAAO,KAAA,CAAS;IAC9E,MAAM,YAAY,OAAO;IACzB,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;IAE5D,MAAM,SAAS,OAAO,kBACpB,OAAO,UAAU,qBACf;KAAE;KAAO;KAAU,WAAW;IAAU,IACvC,OAAO,YAAY;KAClB,MAAM,YAAY,oBAAoB,UAAU,KAAK;KAErD,IAAI,UAAU,SAAS,wBACrB,QAAQ,MACN,eAAe;MACb,IAAI,iBAAiB,KACnB,wBAAwB,SAAS,GAAG,MAAM,SAAS,QACrD;MACA,kBAAkB;MAClB,UAAU,kBAAkB;OAC1B,QAAQ;OACR,WAAW,GAAG,SAAS;OACvB,QAAQ;OACR,aAAa,CAAC;MAChB,CAAC;KACH,CAAC,CACH;KAEF,OAAO,QAAQ,QAAQ,SAAS;IAClC,CACF,CACF;IAEA,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErE,OAAO;KAAE,OAAO;KAAQ,oBAAoB,CAAC,QAAQ,KAAK;IAAE;GAC9D,GACA,mBACA,OAAO,eAAe,uBAAuB,SAAS,CACxD;EACF,CAAC;CACH,CAAC,CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA,SAAS,SAAS;EAClB;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C,OAAO,eAAe,OAAO,QAAQ;EACrC,eAAe,MAAM,SACnB,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CAC7E,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CAChF,CACF;CACF,CAAC;AACH"}