@yielded/auth 0.1.0-beta.1

package/dist/passkey/simplewebauthn/configuration.mjs

@@ -0,0 +1,45 @@
+import { reportAuthFailure } from "../../internal/diagnostics.mjs";
+import { PasskeyConfigurationError, PasskeyProtocolRejected } from "../errors.mjs";
+import { PasskeyProfile } from "../models.mjs";
+import { samePasskey, snapshotPasskey } from "../snapshot.mjs";
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./models.mjs";
+import { Cause, Effect } from "effect";
+import { parse } from "tldts";
+//#region src/passkey/simplewebauthn/configuration.ts
+const captureSimpleWebAuthnProfiles = Effect.fn("captureSimpleWebAuthnProfiles")(function* (options) {
+	const captured = yield* snapshotPasskey(SimpleWebAuthnPasskeyProtocolOptions, options).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
+	const keys = /* @__PURE__ */ new Set();
+	for (const profile of captured.profiles) {
+		const key = `${profile.rpId}/${profile.profileId}/${profile.generation}`;
+		if (keys.has(key) || new Set(profile.origins).size !== profile.origins.length || new Set(profile.algorithms).size !== profile.algorithms.length || profile.primarySignIn && (profile.residentKey !== "required" || profile.userVerification !== "required")) return yield* PasskeyConfigurationError.make({});
+		keys.add(key);
+		if (!(yield* Effect.try({
+			try: () => {
+				const host = new URL(`https://${profile.rpId}`).hostname;
+				if (host !== profile.rpId) return false;
+				const domain = parse(host, {
+					allowIcannDomains: true,
+					allowPrivateDomains: true,
+					extractHostname: false,
+					validateHostname: true,
+					detectIp: true
+				});
+				if (host === "localhost" ? !profile.developmentLocalhost : domain.isIp || domain.domain === null || domain.publicSuffix === host) return false;
+				return profile.origins.every((origin) => {
+					const url = new URL(origin);
+					return url.origin === origin && url.username === "" && url.password === "" && (url.protocol === "https:" || profile.developmentLocalhost && profile.rpId === "localhost" && url.hostname === "localhost" && url.protocol === "http:") && (url.hostname === profile.rpId || profile.rpId !== "localhost" && url.hostname.endsWith(`.${profile.rpId}`));
+				});
+			},
+			catch: () => PasskeyConfigurationError.make({})
+		}))) return yield* PasskeyConfigurationError.make({});
+	}
+	return Effect.fn("selectSimpleWebAuthnProfile")(function* (input) {
+		const profile = captured.profiles.find((value) => value.rpId === input.rpId && value.profileId === input.profileId && value.generation === input.generation);
+		if (profile === void 0 || !(yield* samePasskey(PasskeyProfile, profile, input))) return yield* PasskeyProtocolRejected.make({});
+		return profile;
+	});
+}, Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-protocol", cause).pipe(Effect.andThen(Effect.fail(PasskeyConfigurationError.make({})))) : Effect.failCause(cause)));
+//#endregion
+export { captureSimpleWebAuthnProfiles };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/passkey/simplewebauthn/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../src/passkey/simplewebauthn/configuration.ts"],"sourcesContent":["import { Cause, Effect } from \"effect\";\nimport { parse } from \"tldts\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { PasskeyConfigurationError, PasskeyProtocolRejected } from \"../errors\";\nimport { PasskeyProfile } from \"../models\";\nimport { samePasskey, snapshotPasskey } from \"../snapshot\";\nimport { SimpleWebAuthnPasskeyProtocolOptions } from \"./models\";\n\nexport const captureSimpleWebAuthnProfiles = Effect.fn(\"captureSimpleWebAuthnProfiles\")(\n  function* (options: SimpleWebAuthnPasskeyProtocolOptions) {\n    const captured = yield* snapshotPasskey(SimpleWebAuthnPasskeyProtocolOptions, options).pipe(\n      Effect.mapError(() => PasskeyConfigurationError.make({})),\n    );\n\n    const keys = new Set<string>();\n\n    for (const profile of captured.profiles) {\n      const key = `${profile.rpId}/${profile.profileId}/${profile.generation}`;\n\n      if (\n        keys.has(key) ||\n        new Set(profile.origins).size !== profile.origins.length ||\n        new Set(profile.algorithms).size !== profile.algorithms.length ||\n        (profile.primarySignIn &&\n          (profile.residentKey !== \"required\" || profile.userVerification !== \"required\"))\n      ) {\n        return yield* PasskeyConfigurationError.make({});\n      }\n      keys.add(key);\n\n      const valid = yield* Effect.try({\n        try: () => {\n          const host = new URL(`https://${profile.rpId}`).hostname;\n\n          if (host !== profile.rpId) return false;\n\n          const domain = parse(host, {\n            allowIcannDomains: true,\n            allowPrivateDomains: true,\n            extractHostname: false,\n            validateHostname: true,\n            detectIp: true,\n          });\n\n          if (\n            host === \"localhost\"\n              ? !profile.developmentLocalhost\n              : domain.isIp || domain.domain === null || domain.publicSuffix === host\n          )\n            return false;\n\n          return profile.origins.every((origin) => {\n            const url = new URL(origin);\n\n            return (\n              url.origin === origin &&\n              url.username === \"\" &&\n              url.password === \"\" &&\n              (url.protocol === \"https:\" ||\n                (profile.developmentLocalhost &&\n                  profile.rpId === \"localhost\" &&\n                  url.hostname === \"localhost\" &&\n                  url.protocol === \"http:\")) &&\n              (url.hostname === profile.rpId ||\n                (profile.rpId !== \"localhost\" && url.hostname.endsWith(`.${profile.rpId}`)))\n            );\n          });\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      });\n\n      if (!valid) return yield* PasskeyConfigurationError.make({});\n    }\n\n    return Effect.fn(\"selectSimpleWebAuthnProfile\")(function* (input: PasskeyProfile) {\n      const profile = captured.profiles.find(\n        (value) =>\n          value.rpId === input.rpId &&\n          value.profileId === input.profileId &&\n          value.generation === input.generation,\n      );\n\n      if (profile === undefined || !(yield* samePasskey(PasskeyProfile, profile, input)))\n        return yield* PasskeyProtocolRejected.make({});\n\n      return profile;\n    });\n  },\n  Effect.catchCause((cause) =>\n    Cause.hasDies(cause)\n      ? reportAuthFailure(\"passkey-protocol\", cause).pipe(\n          Effect.andThen(Effect.fail(PasskeyConfigurationError.make({}))),\n        )\n      : Effect.failCause(cause),\n  ),\n);\n"],"mappings":";;;;;;;;AASA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CACrF,WAAW,SAA+C;CACxD,MAAM,WAAW,OAAO,gBAAgB,sCAAsC,OAAO,CAAC,CAAC,KACrF,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;CAEA,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,WAAW,SAAS,UAAU;EACvC,MAAM,MAAM,GAAG,QAAQ,KAAK,GAAG,QAAQ,UAAU,GAAG,QAAQ;EAE5D,IACE,KAAK,IAAI,GAAG,KACZ,IAAI,IAAI,QAAQ,OAAO,CAAC,CAAC,SAAS,QAAQ,QAAQ,UAClD,IAAI,IAAI,QAAQ,UAAU,CAAC,CAAC,SAAS,QAAQ,WAAW,UACvD,QAAQ,kBACN,QAAQ,gBAAgB,cAAc,QAAQ,qBAAqB,aAEtE,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;EAEjD,KAAK,IAAI,GAAG;EA2CZ,IAAI,EAAC,OAzCgB,OAAO,IAAI;GAC9B,WAAW;IACT,MAAM,OAAO,IAAI,IAAI,WAAW,QAAQ,MAAM,CAAC,CAAC;IAEhD,IAAI,SAAS,QAAQ,MAAM,OAAO;IAElC,MAAM,SAAS,MAAM,MAAM;KACzB,mBAAmB;KACnB,qBAAqB;KACrB,iBAAiB;KACjB,kBAAkB;KAClB,UAAU;IACZ,CAAC;IAED,IACE,SAAS,cACL,CAAC,QAAQ,uBACT,OAAO,QAAQ,OAAO,WAAW,QAAQ,OAAO,iBAAiB,MAErE,OAAO;IAET,OAAO,QAAQ,QAAQ,OAAO,WAAW;KACvC,MAAM,MAAM,IAAI,IAAI,MAAM;KAE1B,OACE,IAAI,WAAW,UACf,IAAI,aAAa,MACjB,IAAI,aAAa,OAChB,IAAI,aAAa,YACf,QAAQ,wBACP,QAAQ,SAAS,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,aACpB,IAAI,aAAa,QAAQ,QACvB,QAAQ,SAAS,eAAe,IAAI,SAAS,SAAS,IAAI,QAAQ,MAAM;IAE/E,CAAC;GACH;GACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;EAChD,CAAC,IAEW,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAC7D;CAEA,OAAO,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,OAAuB;EAChF,MAAM,UAAU,SAAS,SAAS,MAC/B,UACC,MAAM,SAAS,MAAM,QACrB,MAAM,cAAc,MAAM,aAC1B,MAAM,eAAe,MAAM,UAC/B;EAEA,IAAI,YAAY,KAAA,KAAa,EAAE,OAAO,YAAY,gBAAgB,SAAS,KAAK,IAC9E,OAAO,OAAO,wBAAwB,KAAK,CAAC,CAAC;EAE/C,OAAO;CACT,CAAC;AACH,GACA,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,oBAAoB,KAAK,CAAC,CAAC,KAC3C,OAAO,QAAQ,OAAO,KAAK,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC,CAChE,IACA,OAAO,UAAU,KAAK,CAC5B,CACF"}

package/dist/passkey/simplewebauthn/models.d.mts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+//#region src/passkey/simplewebauthn/models.d.ts
+declare const SimpleWebAuthnPasskeyProtocolOptions: Schema.Struct<{
+  readonly profiles: Schema.NonEmptyArray<Schema.Struct<{
+    readonly profileId: Schema.String;
+    readonly generation: Schema.Int;
+    readonly rpId: Schema.String;
+    readonly rpName: Schema.NonEmptyString;
+    readonly origins: Schema.NonEmptyArray<Schema.NonEmptyString>;
+    readonly developmentLocalhost: Schema.Boolean;
+    readonly residentKey: Schema.Literals<readonly ["required", "preferred", "discouraged"]>;
+    readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+    readonly primarySignIn: Schema.Boolean;
+    readonly attestation: Schema.Literal<"none">;
+    readonly algorithms: Schema.NonEmptyArray<Schema.Literals<readonly [-7, -257]>>;
+  }>>;
+}>;
+type SimpleWebAuthnPasskeyProtocolOptions = typeof SimpleWebAuthnPasskeyProtocolOptions.Type;
+//#endregion
+export { SimpleWebAuthnPasskeyProtocolOptions };
+//# sourceMappingURL=models.d.mts.map

package/dist/passkey/simplewebauthn/models.mjs

@@ -0,0 +1,8 @@
+import { PasskeyProfile } from "../models.mjs";
+import { Schema } from "effect";
+//#region src/passkey/simplewebauthn/models.ts
+const SimpleWebAuthnPasskeyProtocolOptions = Schema.Struct({ profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(64)) });
+//#endregion
+export { SimpleWebAuthnPasskeyProtocolOptions };
+
+//# sourceMappingURL=models.mjs.map

package/dist/passkey/simplewebauthn/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/passkey/simplewebauthn/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { PasskeyProfile } from \"../models\";\n\nexport const SimpleWebAuthnPasskeyProtocolOptions = Schema.Struct({\n  profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(64)),\n});\n\nexport type SimpleWebAuthnPasskeyProtocolOptions = typeof SimpleWebAuthnPasskeyProtocolOptions.Type;\n"],"mappings":";;;AAIA,MAAa,uCAAuC,OAAO,OAAO,EAChE,UAAU,OAAO,cAAc,cAAc,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,EAC7E,CAAC"}

package/dist/passkey/simplewebauthn/protocol.d.mts

@@ -0,0 +1,62 @@
+import { PasskeyAssertionVerified, PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyCredential, PasskeyDescriptor, PasskeyProfile, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyUserHandle } from "../models.mjs";
+import { PasskeyConfigurationError, PasskeyProtocolRejected, PasskeyUnavailable } from "../errors.mjs";
+import { PasskeyProtocol } from "../PasskeyProtocol.mjs";
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./models.mjs";
+import { Effect, Layer, Redacted } from "effect";
+//#region src/passkey/simplewebauthn/protocol.d.ts
+declare const makeSimpleWebAuthnPasskeyProtocol: (options: {
+  readonly profiles: readonly [{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }, ...{
+    readonly profileId: string;
+    readonly generation: number;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly origins: readonly [string, ...string[]];
+    readonly developmentLocalhost: boolean;
+    readonly residentKey: "discouraged" | "preferred" | "required";
+    readonly userVerification: "preferred" | "required";
+    readonly primarySignIn: boolean;
+    readonly attestation: "none";
+    readonly algorithms: readonly [-257 | -7, ...(-257 | -7)[]];
+  }[]];
+}) => Effect.Effect<{
+  readonly prepareAuthentication: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly allowedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyAuthenticationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly prepareRegistration: (input: {
+    readonly profile: PasskeyProfile;
+    readonly challenge: string;
+    readonly timeoutMillis: number;
+    readonly userHandle: PasskeyUserHandle;
+    readonly name: string;
+    readonly displayName: string;
+    readonly excludedCredentials: ReadonlyArray<typeof PasskeyDescriptor.Type>;
+  }) => Effect.Effect<PasskeyRegistrationOptions, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyAuthentication: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly credential: PasskeyCredential;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyAssertionVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+  readonly verifyRegistration: (input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly response: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasskeyRegistrationVerified, PasskeyProtocolRejected | PasskeyUnavailable>;
+}, PasskeyConfigurationError, never>;
+declare const layerSimpleWebAuthnPasskeyProtocol: (options: SimpleWebAuthnPasskeyProtocolOptions) => Layer.Layer<PasskeyProtocol, PasskeyConfigurationError>;
+//#endregion
+export { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol };
+//# sourceMappingURL=protocol.d.mts.map

package/dist/passkey/simplewebauthn/protocol.mjs

@@ -0,0 +1,402 @@
+import { reportAuthFailure } from "../../internal/diagnostics.mjs";
+import { PasskeyProtocolRejected, PasskeyUnavailable } from "../errors.mjs";
+import { PasskeyAssertion, PasskeyAssertionVerified, PasskeyAttestation, PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyChallenge, PasskeyCounter, PasskeyCredential, PasskeyDescriptor, PasskeyLabel, PasskeyProfile, PasskeyProtocolCredentialId, PasskeyRegistrationOptions, PasskeyRegistrationVerified, PasskeyUserHandle } from "../models.mjs";
+import { samePasskey, snapshotPasskey } from "../snapshot.mjs";
+import { PasskeyProtocol } from "../PasskeyProtocol.mjs";
+import { captureSimpleWebAuthnProfiles } from "./configuration.mjs";
+import { Cause, DateTime, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { decodeAttestationObject, decodeClientDataJSON, decodeCredentialPublicKey, isoCBOR, parseAuthenticatorData } from "@simplewebauthn/server/helpers";
+//#region src/passkey/simplewebauthn/protocol.ts
+const rejected = () => PasskeyProtocolRejected.make({});
+const unavailable = () => PasskeyUnavailable.make({});
+const unexpected = (effect) => effect.pipe(Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("passkey-protocol", cause).pipe(Effect.andThen(Effect.fail(unavailable()))) : Effect.failCause(cause)));
+const maintained = (call) => Effect.tryPromise(call).pipe(Effect.onError((cause) => reportAuthFailure("passkey-protocol", cause)), Effect.mapError(unavailable));
+const parsed = (call) => Effect.try({
+	try: call,
+	catch: rejected
+});
+const decode = (schema, input) => Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError(rejected));
+const capture = (schema, input) => snapshotPasskey(schema, input).pipe(Effect.mapError(rejected));
+const sameBytes = (left, right) => left.length === right.length && left.every((byte, index) => byte === right[index]);
+const binary = (minimum, maximum) => Schema.String.check(Schema.isMaxLength(Math.ceil(maximum * 4 / 3)), Schema.makeFilter((value) => {
+	const result = Encoding.decodeBase64Url(value);
+	return result._tag === "Success" && result.success.length >= minimum && result.success.length <= maximum && Encoding.encodeBase64Url(result.success) === value;
+}));
+const bytes = Effect.fn("simpleWebAuthnBytes")(function* (value) {
+	const result = Encoding.decodeBase64Url(value);
+	if (result._tag === "Failure") return yield* rejected();
+	return new Uint8Array(result.success);
+});
+const duration = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 3e5
+}));
+const prepareAuthenticationInput = Schema.Struct({
+	profile: PasskeyProfile,
+	challenge: PasskeyChallenge,
+	timeoutMillis: duration,
+	allowedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64))
+});
+const prepareRegistrationInput = Schema.Struct({
+	profile: PasskeyProfile,
+	challenge: PasskeyChallenge,
+	timeoutMillis: duration,
+	userHandle: PasskeyUserHandle,
+	name: PasskeyLabel,
+	displayName: PasskeyLabel,
+	excludedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64))
+});
+const authenticationInput = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	credential: PasskeyCredential,
+	response: PasskeyAssertion
+});
+const registrationInput = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	response: PasskeyAttestation
+});
+const envelope = {
+	id: PasskeyProtocolCredentialId,
+	rawId: PasskeyProtocolCredentialId,
+	type: Schema.Literal("public-key")
+};
+const authenticationResponse = Schema.Struct({
+	...envelope,
+	response: Schema.Struct({
+		clientDataJSON: binary(1, 8192),
+		authenticatorData: binary(37, 16384),
+		signature: binary(1, 1024),
+		userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle))
+	})
+});
+const registrationResponse = Schema.Struct({
+	...envelope,
+	response: Schema.Struct({
+		clientDataJSON: binary(1, 8192),
+		attestationObject: binary(1, 65536)
+	})
+});
+const clientData = Schema.Struct({
+	type: Schema.String,
+	challenge: PasskeyChallenge,
+	origin: Schema.String.check(Schema.isMaxLength(2048)),
+	crossOrigin: Schema.optionalKey(Schema.Boolean),
+	topOrigin: Schema.optionalKey(Schema.Unknown)
+});
+const cborLeaf = Schema.Union([
+	Schema.String.check(Schema.isMaxLength(8192)),
+	Schema.Number.check(Schema.isFinite()),
+	Schema.Boolean,
+	Schema.Null,
+	Schema.Uint8Array.check(Schema.makeFilter((value) => value.length <= 16384))
+]);
+const cborValue = (depth) => {
+	if (depth === 0) return cborLeaf;
+	const child = cborValue(depth - 1);
+	return Schema.Union([
+		cborLeaf,
+		Schema.Array(child).check(Schema.isMaxLength(64)),
+		Schema.ReadonlyMap(Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]), child).check(Schema.makeFilter((value) => value.size <= 32))
+	]);
+};
+const cborMap = Schema.ReadonlyMap(Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]), cborValue(4)).check(Schema.makeFilter((value) => value.size <= 32));
+const encodeCbor = (value) => {
+	return isoCBOR.encode(value);
+};
+const exactMap = Effect.fn("simpleWebAuthnExactMap")(function* (input, value) {
+	const result = yield* decode(cborMap, value);
+	const encoded = yield* parsed(() => encodeCbor(result));
+	if (!sameBytes(input, encoded)) return yield* rejected();
+	return result;
+});
+const byteValue = (minimum, maximum) => Schema.Uint8Array.check(Schema.makeFilter((value) => value.length >= minimum && value.length <= maximum));
+const fresh = Effect.fn("simpleWebAuthnFresh")(function* (ceremony) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (ceremony.issuedAtMillis > now || now >= ceremony.expiresAtMillis || now >= ceremony.requestBindingExpiresAtMillis || ceremony.expiresAtMillis <= ceremony.issuedAtMillis) return yield* rejected();
+});
+const checkClient = Effect.fn("simpleWebAuthnClientData")(function* (value, ceremony, type) {
+	const client = yield* decode(clientData, yield* parsed(() => decodeClientDataJSON(value)));
+	if (client.type !== type || client.challenge !== ceremony.challenge || !ceremony.profile.origins.includes(client.origin) || client.crossOrigin === true || "topOrigin" in client) return yield* rejected();
+	return client;
+});
+const checkAuthenticator = Effect.fn("simpleWebAuthnAuthenticatorData")(function* (original, registration, profile) {
+	if (original.length < 37 || original.length > 16384 || Boolean(original[32] & 64) !== registration) return yield* rejected();
+	let prefix = 37;
+	if (registration) {
+		if (original.length < 55) return yield* rejected();
+		const length = new DataView(original.buffer, original.byteOffset, original.byteLength).getUint16(53, false);
+		if (length < 1 || length > 1023 || original.length < 55 + length) return yield* rejected();
+		prefix = 55 + length;
+	}
+	const result = yield* parsed(() => parseAuthenticatorData(new Uint8Array(original)));
+	if (!result.flags.up || profile.userVerification === "required" && !result.flags.uv || result.flags.bs && !result.flags.be || result.flags.at !== registration || result.flags.flagsInt !== original[32]) return yield* rejected();
+	yield* decode(PasskeyCounter, result.counter);
+	const chunks = [original.slice(0, prefix)];
+	if (registration) {
+		const id = yield* decode(byteValue(1, 1023), result.credentialID);
+		const key = yield* decode(byteValue(1, 8192), result.credentialPublicKey);
+		if (!sameBytes(id, original.slice(55, prefix))) return yield* rejected();
+		chunks.push(key);
+	}
+	if (result.flags.ed) {
+		const extension = yield* decode(byteValue(1, 16384), result.extensionsDataBuffer);
+		yield* exactMap(extension, yield* parsed(() => isoCBOR.decodeFirst(new Uint8Array(extension))));
+		chunks.push(extension);
+	} else if (result.extensionsDataBuffer !== void 0) return yield* rejected();
+	if (chunks.reduce((sum, chunk) => sum + chunk.length, 0) !== original.length) return yield* rejected();
+	let offset = 0;
+	for (const chunk of chunks) {
+		if (!sameBytes(chunk, original.slice(offset, offset + chunk.length))) return yield* rejected();
+		offset += chunk.length;
+	}
+	const rpHash = new Uint8Array(yield* maintained(() => globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(profile.rpId))));
+	if (!sameBytes(rpHash, original.slice(0, 32))) return yield* rejected();
+	return result;
+});
+const checkKey = Effect.fn("simpleWebAuthnPublicKey")(function* (input, allowed, expected) {
+	const map = yield* exactMap(input, yield* parsed(() => decodeCredentialPublicKey(new Uint8Array(input))));
+	const algorithmId = yield* decode(Schema.Literals([-7, -257]), map.get(3));
+	if (!allowed.includes(algorithmId) || expected !== void 0 && algorithmId !== expected) return yield* rejected();
+	let jwk;
+	let algorithm;
+	if (algorithmId === -7) {
+		if (map.size !== 5 || ![
+			1,
+			3,
+			-1,
+			-2,
+			-3
+		].every((key) => map.has(key)) || map.get(1) !== 2 || map.get(-1) !== 1) return yield* rejected();
+		const x = yield* decode(byteValue(32, 32), map.get(-2));
+		const y = yield* decode(byteValue(32, 32), map.get(-3));
+		jwk = {
+			kty: "EC",
+			crv: "P-256",
+			x: Encoding.encodeBase64Url(x),
+			y: Encoding.encodeBase64Url(y),
+			ext: false
+		};
+		algorithm = {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		};
+	} else {
+		if (map.size !== 4 || ![
+			1,
+			3,
+			-1,
+			-2
+		].every((key) => map.has(key)) || map.get(1) !== 3) return yield* rejected();
+		const n = yield* decode(byteValue(256, 512), map.get(-1));
+		const e = yield* decode(byteValue(1, 4), map.get(-2));
+		const exponent = e.reduce((value, byte) => value * 256 + byte, 0);
+		if (n[0] < 128 || (n[n.length - 1] & 1) === 0 || e[0] === 0 || exponent < 3 || exponent % 2 !== 1) return yield* rejected();
+		jwk = {
+			kty: "RSA",
+			alg: "RS256",
+			n: Encoding.encodeBase64Url(n),
+			e: Encoding.encodeBase64Url(e),
+			ext: false
+		};
+		algorithm = {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		};
+	}
+	yield* maintained(() => globalThis.crypto.subtle.importKey("jwk", jwk, algorithm, false, ["verify"]));
+	return algorithmId;
+});
+const makeSimpleWebAuthnPasskeyProtocol = Effect.fn("makeSimpleWebAuthnPasskeyProtocol")(function* (options) {
+	const select = yield* captureSimpleWebAuthnProfiles(options);
+	const prepareAuthentication = Effect.fn("SimpleWebAuthnPasskeyProtocol.prepareAuthentication")(function* (input) {
+		const fixed = yield* capture(prepareAuthenticationInput, input);
+		const profile = yield* select(fixed.profile);
+		const challenge = yield* bytes(fixed.challenge);
+		const result = yield* maintained(() => generateAuthenticationOptions({
+			rpID: profile.rpId,
+			challenge,
+			timeout: fixed.timeoutMillis,
+			userVerification: profile.userVerification,
+			allowCredentials: fixed.allowedCredentials.map((value) => ({ ...value }))
+		}));
+		const value = yield* decode(PasskeyAuthenticationOptions, {
+			challenge: result.challenge,
+			rpId: result.rpId,
+			timeout: result.timeout,
+			userVerification: result.userVerification,
+			allowCredentials: result.allowCredentials ?? []
+		});
+		if (!(yield* samePasskey(PasskeyAuthenticationOptions, value, {
+			challenge: fixed.challenge,
+			rpId: profile.rpId,
+			timeout: fixed.timeoutMillis,
+			userVerification: profile.userVerification,
+			allowCredentials: fixed.allowedCredentials
+		}))) return yield* unavailable();
+		return yield* capture(PasskeyAuthenticationOptions, value);
+	}, unexpected);
+	const prepareRegistration = Effect.fn("SimpleWebAuthnPasskeyProtocol.prepareRegistration")(function* (input) {
+		const fixed = yield* capture(prepareRegistrationInput, input);
+		const profile = yield* select(fixed.profile);
+		const challenge = yield* bytes(fixed.challenge), userID = yield* bytes(fixed.userHandle);
+		const result = yield* maintained(() => generateRegistrationOptions({
+			rpName: profile.rpName,
+			rpID: profile.rpId,
+			userName: fixed.name,
+			userDisplayName: fixed.displayName,
+			userID,
+			challenge,
+			timeout: fixed.timeoutMillis,
+			attestationType: "none",
+			supportedAlgorithmIDs: [...profile.algorithms],
+			authenticatorSelection: {
+				residentKey: profile.residentKey,
+				userVerification: profile.userVerification
+			},
+			excludeCredentials: fixed.excludedCredentials.map((value) => ({ ...value }))
+		}));
+		const value = yield* decode(PasskeyRegistrationOptions, {
+			challenge: result.challenge,
+			rp: result.rp,
+			user: result.user,
+			pubKeyCredParams: result.pubKeyCredParams,
+			timeout: result.timeout,
+			attestation: result.attestation,
+			authenticatorSelection: result.authenticatorSelection,
+			excludeCredentials: result.excludeCredentials ?? []
+		});
+		const expected = {
+			challenge: fixed.challenge,
+			rp: {
+				id: profile.rpId,
+				name: profile.rpName
+			},
+			user: {
+				id: fixed.userHandle,
+				name: fixed.name,
+				displayName: fixed.displayName
+			},
+			pubKeyCredParams: profile.algorithms.map((alg) => ({
+				type: "public-key",
+				alg
+			})),
+			timeout: fixed.timeoutMillis,
+			attestation: "none",
+			authenticatorSelection: {
+				residentKey: profile.residentKey,
+				userVerification: profile.userVerification
+			},
+			excludeCredentials: fixed.excludedCredentials
+		};
+		if (!(yield* samePasskey(PasskeyRegistrationOptions, value, yield* decode(PasskeyRegistrationOptions, expected)))) return yield* unavailable();
+		return yield* capture(PasskeyRegistrationOptions, value);
+	}, unexpected);
+	const verifyRegistration = Effect.fn("SimpleWebAuthnPasskeyProtocol.verifyRegistration")(function* (input) {
+		const fixed = yield* capture(registrationInput, input), ceremony = fixed.ceremony;
+		const profile = yield* select(ceremony.profile);
+		if ((ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration") && (ceremony.purpose !== "enrollment" || ceremony.context._tag !== "Enrollment")) return yield* rejected();
+		yield* fresh(ceremony);
+		const wire = yield* decode(Schema.fromJsonString(registrationResponse), Redacted.value(fixed.response));
+		if (wire.id !== wire.rawId) return yield* rejected();
+		const client = yield* checkClient(wire.response.clientDataJSON, ceremony, "webauthn.create");
+		const attestationBytes = yield* bytes(wire.response.attestationObject);
+		const attestation = yield* exactMap(attestationBytes, yield* parsed(() => decodeAttestationObject(new Uint8Array(attestationBytes))));
+		if (attestation.size !== 3 || attestation.get("fmt") !== "none" || !attestation.has("attStmt") || !attestation.has("authData")) return yield* rejected();
+		if ((yield* decode(cborMap, attestation.get("attStmt"))).size !== 0) return yield* rejected();
+		const authenticatorBytes = yield* decode(byteValue(37, 16384), attestation.get("authData"));
+		const auth = yield* checkAuthenticator(authenticatorBytes, true, profile);
+		const id = yield* decode(byteValue(1, 1023), auth.credentialID);
+		const key = yield* decode(byteValue(1, 8192), auth.credentialPublicKey);
+		if (Encoding.encodeBase64Url(id) !== wire.id) return yield* rejected();
+		const algorithm = yield* checkKey(key, profile.algorithms);
+		const result = yield* maintained(() => verifyRegistrationResponse({
+			response: {
+				...wire,
+				clientExtensionResults: {}
+			},
+			expectedChallenge: ceremony.challenge,
+			expectedOrigin: [...profile.origins],
+			expectedRPID: profile.rpId,
+			expectedType: "webauthn.create",
+			requireUserPresence: true,
+			requireUserVerification: profile.userVerification === "required",
+			supportedAlgorithmIDs: [...profile.algorithms]
+		}));
+		if (!result.verified || result.registrationInfo === void 0) return yield* rejected();
+		const info = result.registrationInfo;
+		if (info.fmt !== "none" || info.origin !== client.origin || info.rpID !== profile.rpId || info.credential.id !== wire.id || !sameBytes(info.credential.publicKey, key) || info.credential.counter !== auth.counter || info.userVerified !== auth.flags.uv || info.credentialDeviceType === "multiDevice" !== auth.flags.be || info.credentialBackedUp !== auth.flags.bs) return yield* rejected();
+		yield* fresh(ceremony);
+		return yield* capture(PasskeyRegistrationVerified, yield* decode(PasskeyRegistrationVerified, {
+			protocolCredentialId: info.credential.id,
+			publicKey: Encoding.encodeBase64Url(info.credential.publicKey),
+			algorithm,
+			counter: info.credential.counter,
+			userVerified: info.userVerified,
+			backupEligible: info.credentialDeviceType === "multiDevice",
+			backupState: info.credentialBackedUp
+		}));
+	}, unexpected);
+	const verifyAuthentication = Effect.fn("SimpleWebAuthnPasskeyProtocol.verifyAuthentication")(function* (input) {
+		const fixed = yield* capture(authenticationInput, input), ceremony = fixed.ceremony, credential = fixed.credential;
+		const profile = yield* select(ceremony.profile), original = yield* select(credential.profile);
+		if (ceremony.purpose === "registration" || ceremony.purpose === "enrollment" || {
+			"sign-in": "SignIn",
+			pending: "Pending",
+			"step-up": "StepUp",
+			action: "Action"
+		}[ceremony.purpose] !== ceremony.context._tag || !credential.active || credential.rpId !== profile.rpId || original.rpId !== profile.rpId || !original.algorithms.includes(credential.algorithm) || !profile.algorithms.includes(credential.algorithm)) return yield* rejected();
+		yield* fresh(ceremony);
+		const wire = yield* decode(Schema.fromJsonString(authenticationResponse), Redacted.value(fixed.response));
+		const userHandle = wire.response.userHandle ?? void 0;
+		if (wire.id !== wire.rawId || wire.id !== credential.protocolCredentialId || userHandle !== void 0 && userHandle !== credential.userHandle || ceremony.context._tag === "SignIn" && userHandle === void 0 || ceremony.allowedCredentials.length > 0 && !ceremony.allowedCredentials.some((value) => value.id === wire.id)) return yield* rejected();
+		const client = yield* checkClient(wire.response.clientDataJSON, ceremony, "webauthn.get");
+		const auth = yield* checkAuthenticator(yield* bytes(wire.response.authenticatorData), false, profile);
+		if (auth.flags.be !== credential.backupEligible || !credential.backupEligible && (credential.counter > 0 || auth.counter > 0) && auth.counter <= credential.counter) return yield* rejected();
+		const publicKey = yield* bytes(credential.publicKey);
+		yield* checkKey(publicKey, profile.algorithms, credential.algorithm);
+		const result = yield* maintained(() => verifyAuthenticationResponse({
+			response: {
+				...wire,
+				response: {
+					...wire.response,
+					userHandle
+				},
+				clientExtensionResults: {}
+			},
+			expectedChallenge: ceremony.challenge,
+			expectedOrigin: [...profile.origins],
+			expectedRPID: profile.rpId,
+			expectedType: "webauthn.get",
+			requireUserVerification: profile.userVerification === "required",
+			credential: {
+				id: credential.protocolCredentialId,
+				publicKey,
+				counter: credential.backupEligible ? 0 : credential.counter
+			}
+		}));
+		if (!result.verified) return yield* rejected();
+		const info = result.authenticationInfo;
+		if (info.credentialID !== wire.id || info.origin !== client.origin || info.rpID !== profile.rpId || info.newCounter !== auth.counter || info.userVerified !== auth.flags.uv || info.credentialDeviceType === "multiDevice" !== credential.backupEligible || info.credentialBackedUp !== auth.flags.bs) return yield* rejected();
+		yield* fresh(ceremony);
+		return yield* capture(PasskeyAssertionVerified, yield* decode(PasskeyAssertionVerified, {
+			protocolCredentialId: info.credentialID,
+			...userHandle === void 0 ? {} : { userHandle },
+			counter: info.newCounter,
+			userVerified: info.userVerified,
+			backupEligible: info.credentialDeviceType === "multiDevice",
+			backupState: info.credentialBackedUp
+		}));
+	}, unexpected);
+	return PasskeyProtocol.of({
+		prepareAuthentication,
+		prepareRegistration,
+		verifyRegistration,
+		verifyAuthentication
+	});
+});
+const layerSimpleWebAuthnPasskeyProtocol = (options) => Layer.effect(PasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol(options));
+//#endregion
+export { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol };
+
+//# sourceMappingURL=protocol.mjs.map