@yielded/auth 0.1.0-beta.1

package/src/passkey/module.ts

@@ -0,0 +1,367 @@
+import { Context, DateTime, Effect, Layer, Schema, type Types } from "effect";
+
+import { makeAuthStrategy } from "../auth/AuthStrategy";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults";
+import type { AuthInvocation } from "../operations/context";
+import type { AuthOperationResult } from "../operations/credentials";
+import { operationGroup } from "../operations/operation";
+import { makePasskeyContract } from "../PasskeyContract";
+import type { AuthenticationAuthority } from "../sessions/AuthenticationAuthority";
+import type { makeSessionModule } from "../sessions/module";
+import {
+  makePasskeyActions,
+  capturePasskeyPolicy,
+  passkeyUnexpected,
+  makePasskeyCeremony,
+  passkeyNoAmbient,
+  readPasskeyCommit,
+} from "./actions";
+import type { PasskeyFailure } from "./errors";
+import {
+  PasskeyMethodUnsupported,
+  PasskeyRejected,
+  PasskeyUnavailable,
+  PasskeyConfigurationError,
+} from "./errors";
+import { makePasskeyManagement } from "./management";
+import {
+  type PasskeyAuthenticationStarted,
+  type PasskeyCleanupResult,
+  PasskeyBegin,
+  PasskeyComplete,
+  type PasskeyCredential,
+} from "./models";
+import type { PasskeyCredentials } from "./PasskeyCredentials";
+import { PasskeyPersistence } from "./PasskeyPersistence";
+import { makePasskeyPending } from "./pending";
+import { type PasskeyManagementPolicy, PasskeyMethodPolicy, validatePasskeyPolicy } from "./policy";
+import { makePasskeyRegistration } from "./registration";
+import { snapshotPasskey } from "./snapshot";
+import { makePasskeyStepUp } from "./stepUp";
+
+type PasskeyConfiguration =
+  | { readonly policy: PasskeyMethodPolicy; readonly relyingParty?: never }
+  | {
+      readonly policy?: never;
+      readonly relyingParty: {
+        readonly id: string;
+        readonly name: string;
+        readonly origins: readonly string[];
+        readonly developmentLocalhost?: boolean;
+      };
+    };
+
+/** Descriptors capture policy data once; invalid policies remain typed Effect failures. */
+export const capturePasskeyConfiguration = (options: PasskeyConfiguration) => {
+  const defaultPolicy =
+    options.policy === undefined
+      ? {
+          generation: 1,
+          lifetimeMillis: 300_000,
+          claimLifetimeMillis: 30_000,
+          retentionMillis: 3_600_000,
+          maximumPending: 1000,
+          maximumPendingPerSubject: 5,
+          admission: {
+            global: { limit: 1000, windowMillis: 60_000 },
+            subject: { limit: 10, windowMillis: 60_000 },
+            target: { limit: 10, windowMillis: 60_000 },
+          },
+          profiles: [
+            {
+              profileId: "default",
+              generation: 1,
+              rpId: options.relyingParty?.id,
+              rpName: options.relyingParty?.name,
+              origins: Array.isArray(options.relyingParty?.origins)
+                ? [...options.relyingParty.origins]
+                : options.relyingParty?.origins,
+              developmentLocalhost: options.relyingParty?.developmentLocalhost ?? false,
+              residentKey: "required",
+              userVerification: "required",
+              primarySignIn: true,
+              attestation: "none",
+              algorithms: [-7, -257],
+            },
+          ],
+        }
+      : undefined;
+
+  return options.policy === undefined
+    ? // eslint-disable-next-line no-restricted-properties -- Relying-party configuration becomes a complete, validated policy here.
+      Schema.decodeUnknownEffect(PasskeyMethodPolicy)(defaultPolicy).pipe(
+        Effect.flatMap(validatePasskeyPolicy),
+        Effect.mapError(() => PasskeyConfigurationError.make({})),
+      )
+    : capturePasskeyPolicy(options.policy);
+};
+
+export const makePasskeyMethod = <
+  const Id extends string,
+  const SessionId extends string,
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+>(
+  moduleId: Id,
+  options: {
+    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+  } & PasskeyConfiguration,
+  configuredSource?: ReturnType<typeof capturePasskeyConfiguration>,
+) => {
+  const sessions = options.sessions;
+  const source = configuredSource ?? capturePasskeyConfiguration(options);
+  const ceremony = makePasskeyCeremony(moduleId, source, "sign-in");
+
+  const ClaimsForPasskey = Context.Service<
+    {
+      readonly moduleId: Id;
+      readonly kind: "passkey-claims";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    },
+    {
+      readonly resolve: (
+        credential: PasskeyCredential,
+      ) => Effect.Effect<Claims["Type"], PasskeyUnavailable>;
+    }
+  >(`effect-auth/ClaimsForPasskey/${moduleId.length}:${moduleId}`);
+
+  const Passkeys = Context.Service<
+    {
+      readonly moduleId: Id;
+      readonly kind: "passkeys";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    },
+    {
+      readonly begin: (
+        invocation: AuthInvocation,
+        input: PasskeyBegin,
+      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (
+        invocation: AuthInvocation,
+        input: PasskeyComplete,
+      ) => Effect.Effect<
+        AuthOperationResult<typeof sessions.CompletionResult.Type>,
+        PasskeyFailure
+      >;
+      readonly cleanup: (
+        invocation: AuthInvocation,
+        limit: number,
+      ) => Effect.Effect<PasskeyCleanupResult, PasskeyFailure>;
+    }
+  >(`effect-auth/Passkeys/${moduleId.length}:${moduleId}`);
+
+  const layer = Layer.effect(
+    Passkeys,
+    Effect.gen(function* () {
+      const runtime = yield* ceremony.make,
+        claims = yield* ClaimsForPasskey,
+        completion = yield* sessions.AuthenticationCompletion,
+        persistence = yield* PasskeyPersistence;
+
+      const services = yield* Effect.context<
+        | PasskeyCredentials
+        | AuthenticationAuthority
+        | Claims["EncodingServices"]
+        | Claims["DecodingServices"]
+      >();
+
+      const claimsCodec = Schema.toCodecJson(Schema.toType(sessions.claims));
+
+      return Passkeys.of({
+        begin: Effect.fn("Passkeys.begin")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(PasskeyBegin), input);
+          yield* passkeyNoAmbient();
+          if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+
+          return yield* runtime.beginAuthentication(input, { _tag: "SignIn" });
+        }, passkeyUnexpected),
+        complete: Effect.fn("Passkeys.complete")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(PasskeyComplete), input);
+          yield* passkeyNoAmbient();
+          if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+
+          const verified = yield* runtime
+            .authentication(input, { _tag: "SignIn" })
+            .pipe(Effect.provide(services));
+
+          const resolved = yield* claims.resolve(verified.credential);
+
+          const encoded = yield* Schema.encodeEffect(claimsCodec)(resolved).pipe(
+            Effect.provide(services),
+            Effect.mapError(() => PasskeyUnavailable.make({})),
+          );
+
+          const captured = yield* Schema.decodeEffect(claimsCodec)(encoded).pipe(
+            Effect.provide(services),
+            Effect.mapError(() => PasskeyUnavailable.make({})),
+          );
+
+          const result = yield* readPasskeyCommit(
+            yield* completion
+              .prepare({ evidence: verified.evidence, claims: captured })
+              .pipe(
+                Effect.mapError((error) =>
+                  error._tag === "HookDenied"
+                    ? error
+                    : error._tag === "SessionUnavailable"
+                      ? PasskeyUnavailable.make({})
+                      : error._tag === "SessionCapabilityUnsupported"
+                        ? PasskeyMethodUnsupported.make({})
+                        : PasskeyRejected.make({}),
+                ),
+              ),
+          );
+
+          return {
+            value: result.value,
+            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],
+          };
+        }, passkeyUnexpected),
+        cleanup: Effect.fn("Passkeys.cleanup")(function* (invocation, limit) {
+          yield* passkeyNoAmbient();
+          if (invocation._tag !== "System") return yield* PasskeyMethodUnsupported.make({});
+          yield* Schema.decodeEffect(
+            Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),
+          )(limit).pipe(Effect.mapError(() => PasskeyRejected.make({})));
+
+          return yield* readPasskeyCommit(
+            yield* persistence.cleanup(
+              { moduleId, nowMillis: DateTime.toEpochMillis(yield* DateTime.now), limit },
+              (value, journal) => journal.prepare(value),
+            ),
+          );
+        }, passkeyUnexpected),
+      });
+    }),
+  );
+
+  const { Begin, Complete, Cleanup } = makePasskeyContract(moduleId, sessions).operations;
+
+  const handlersLayer = Layer.mergeAll(
+    Begin.credentialHandlerLayer((input, invocation) =>
+      Effect.flatMap(Passkeys, (service) => service.begin(invocation, input)),
+    ),
+    Complete.credentialHandlerLayer((input, invocation) =>
+      Effect.flatMap(Passkeys, (service) => service.complete(invocation, input)),
+    ),
+    Cleanup.handlerLayer((input, invocation) =>
+      Effect.flatMap(Passkeys, (service) => service.cleanup(invocation, input.limit)),
+    ),
+  );
+
+  const actions = makePasskeyActions(moduleId, source);
+
+  // Protocol verification is an explicit server capability. Keeping it out of
+  // this shared contract avoids bundling the maintained verifier into clients.
+  const strategyLayer = handlersLayer.pipe(
+    Layer.provide(defaultLayer(Passkeys, layer)),
+    Layer.provide(defaultLayer(ceremony.binding.RequestBinding, ceremony.binding.layer)),
+    Layer.provide(hooksLayer),
+    Layer.provide(cryptoLayer),
+  );
+
+  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(
+    codec: Registration,
+  ) => {
+    const module = makePasskeyRegistration(moduleId, source, codec);
+
+    return Object.freeze({
+      ...module,
+      strategy: makeAuthStrategy(
+        {
+          register: module.operations.Begin.invoke,
+          completeRegistration: module.operations.Complete.invoke,
+        },
+        module.handlersLayer.pipe(
+          Layer.provide(defaultLayer(module.Registrations, module.layer)),
+          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),
+          Layer.provide(hooksLayer),
+          Layer.provide(cryptoLayer),
+        ),
+      ),
+    });
+  };
+
+  const management = (policy: PasskeyManagementPolicy) => {
+    const module = makePasskeyManagement(moduleId, source, policy, sessions);
+
+    return Object.freeze({
+      ...module,
+      strategy: makeAuthStrategy(
+        {
+          enrollPasskey: module.operations.Begin.invoke,
+          completePasskeyEnrollment: module.operations.Complete.invoke,
+          listPasskeys: module.operations.List.invoke,
+          renamePasskey: module.operations.Rename.invoke,
+          removePasskey: module.operations.Remove.invoke,
+        },
+        module.handlersLayer.pipe(
+          Layer.provide(defaultLayer(module.Management, module.layer)),
+          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),
+          Layer.provide(hooksLayer),
+          Layer.provide(cryptoLayer),
+        ),
+      ),
+    });
+  };
+
+  const pendingModule = makePasskeyPending(moduleId, source, sessions);
+
+  const pending = Object.freeze({
+    ...pendingModule,
+    strategy: makeAuthStrategy(
+      {
+        beginPending: pendingModule.operations.Begin.invoke,
+        completePending: pendingModule.operations.Complete.invoke,
+      },
+      pendingModule.handlersLayer.pipe(
+        Layer.provide(defaultLayer(pendingModule.Pending, pendingModule.layer)),
+        Layer.provide(
+          defaultLayer(pendingModule.binding.RequestBinding, pendingModule.binding.layer),
+        ),
+        Layer.provide(hooksLayer),
+        Layer.provide(cryptoLayer),
+      ),
+      { completion: true },
+    ),
+  });
+
+  const stepUpModule = makePasskeyStepUp(moduleId, source, sessions);
+
+  const stepUp = Object.freeze({
+    ...stepUpModule,
+    strategy: makeAuthStrategy(
+      {
+        beginStepUp: stepUpModule.operations.Begin.invoke,
+        completeStepUp: stepUpModule.operations.Complete.invoke,
+      },
+      stepUpModule.handlersLayer.pipe(
+        Layer.provide(defaultLayer(stepUpModule.StepUp, stepUpModule.layer)),
+        Layer.provide(
+          defaultLayer(stepUpModule.binding.RequestBinding, stepUpModule.binding.layer),
+        ),
+        Layer.provide(hooksLayer),
+        Layer.provide(cryptoLayer),
+      ),
+    ),
+  });
+
+  return Object.freeze({
+    strategy: makeAuthStrategy(
+      { signIn: Begin.invoke, completeSignIn: Complete.invoke },
+      strategyLayer,
+      { completion: true },
+    ),
+    Passkeys,
+    ClaimsForPasskey,
+    binding: ceremony.binding,
+    layer,
+    handlersLayer,
+    operations: Object.freeze({ Begin, Complete, Cleanup }),
+    group: operationGroup(Begin, Complete, Cleanup),
+    registration,
+    management,
+    pending,
+    stepUp,
+    actions,
+  });
+};

package/src/passkey/pending.ts

@@ -0,0 +1,203 @@
+import { Context, Effect, Layer, Schema, type Types } from "effect";
+
+import type { AuthInvocation } from "../operations/context";
+import type { AuthOperationResult } from "../operations/credentials";
+import { makeOperation, operationGroup } from "../operations/operation";
+import type { AuthenticationAuthority } from "../sessions/AuthenticationAuthority";
+import type { makeSessionModule } from "../sessions/module";
+import {
+  passkeyUnexpected,
+  makePasskeyCeremony,
+  passkeyNoAmbient,
+  readPasskeyCommit,
+} from "./actions";
+import type { PasskeyConfigurationError } from "./errors";
+import {
+  PasskeyFailure,
+  PasskeyMethodUnsupported,
+  PasskeyRejected,
+  PasskeyUnavailable,
+} from "./errors";
+import {
+  PasskeyAuthenticationStarted,
+  PasskeyBegin,
+  PasskeyComplete,
+  PasskeyTarget,
+} from "./models";
+import type { PasskeyCredentials } from "./PasskeyCredentials";
+import type { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext";
+import type { PasskeyMethodPolicy } from "./policy";
+import { snapshotPasskey } from "./snapshot";
+const credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));
+
+export const makePasskeyPending = <
+  const Id extends string,
+  const SessionId extends string,
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+>(
+  moduleId: Id,
+  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,
+  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,
+) => {
+  const ceremony = makePasskeyCeremony(moduleId, source, "pending");
+  const BeginInput = Schema.Struct({ ...PasskeyBegin.fields, pendingCredential: credential });
+  const CompleteInput = Schema.Struct({ ...PasskeyComplete.fields, pendingCredential: credential });
+
+  const Pending = Context.Service<
+    {
+      readonly moduleId: Id;
+      readonly kind: "passkey-pending";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    },
+    {
+      readonly begin: (
+        invocation: AuthInvocation,
+        input: typeof BeginInput.Type,
+      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (
+        invocation: AuthInvocation,
+        input: typeof CompleteInput.Type,
+      ) => Effect.Effect<
+        AuthOperationResult<typeof sessions.CompletionResult.Type>,
+        PasskeyFailure
+      >;
+    }
+  >(`effect-auth/PasskeyPending/${moduleId.length}:${moduleId}`);
+
+  const layer = Layer.effect(
+    Pending,
+    Effect.gen(function* () {
+      const runtime = yield* ceremony.make,
+        completion = yield* sessions.AuthenticationCompletion;
+
+      const services = yield* Effect.context<
+        PasskeyCredentials | PasskeyEnrollmentContext | AuthenticationAuthority
+      >();
+
+      const target = Effect.fn("PasskeyPending.target")(function* (token: typeof credential.Type) {
+        const context = yield* completion
+          .pendingContext(token)
+          .pipe(
+            Effect.mapError((error) =>
+              error._tag === "HookDenied"
+                ? error
+                : error._tag === "SessionUnavailable"
+                  ? PasskeyUnavailable.make({})
+                  : error._tag === "SessionCapabilityUnsupported"
+                    ? PasskeyMethodUnsupported.make({})
+                    : PasskeyRejected.make({}),
+            ),
+          );
+
+        return yield* snapshotPasskey(PasskeyTarget, {
+          ...context,
+          moduleId: sessions.moduleId,
+          kind: "login-pending",
+          commandId: context.flowId,
+        });
+      }, passkeyUnexpected);
+
+      return Pending.of({
+        begin: Effect.fn("PasskeyPending.begin")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+          yield* passkeyNoAmbient();
+          if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+
+          const fixed = yield* target(input.pendingCredential),
+            captured = yield* runtime
+              .exclusions(input.profileId, fixed.revision.subjectId)
+              .pipe(Effect.provide(services));
+
+          return yield* runtime.beginAuthentication(
+            input,
+            { _tag: "Pending", target: fixed },
+            captured.credentials,
+          );
+        }, passkeyUnexpected),
+        complete: Effect.fn("PasskeyPending.complete")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+          yield* passkeyNoAmbient();
+          if (invocation._tag !== "Guest") return yield* PasskeyRejected.make({});
+          const fixed = yield* target(input.pendingCredential);
+
+          const verified = yield* runtime
+            .authentication(input, { _tag: "Pending", target: fixed })
+            .pipe(
+              Effect.provide(services),
+              Effect.catchTag("PasskeyRejected", () =>
+                Effect.gen(function* () {
+                  yield* readPasskeyCommit(
+                    yield* completion
+                      .rejectPendingCredential(input.pendingCredential)
+                      .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),
+                  );
+
+                  return yield* PasskeyRejected.make({});
+                }),
+              ),
+            );
+
+          const result = yield* readPasskeyCommit(
+            yield* completion
+              .preparePending({
+                credential: input.pendingCredential,
+                additional: verified.evidence,
+              })
+              .pipe(
+                Effect.mapError((error) =>
+                  error._tag === "HookDenied"
+                    ? error
+                    : error._tag === "SessionUnavailable"
+                      ? PasskeyUnavailable.make({})
+                      : error._tag === "SessionCapabilityUnsupported"
+                        ? PasskeyMethodUnsupported.make({})
+                        : PasskeyRejected.make({}),
+                ),
+              ),
+          );
+
+          return {
+            value: result.value,
+            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],
+          };
+        }, passkeyUnexpected),
+      });
+    }),
+  );
+
+  const Begin = makeOperation(`${moduleId}/passkey/pending/begin`, {
+    payload: BeginInput,
+    success: PasskeyAuthenticationStarted,
+    error: PasskeyFailure,
+    exposure: "public",
+    access: "any",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  const Complete = makeOperation(`${moduleId}/passkey/pending/complete`, {
+    payload: CompleteInput,
+    success: sessions.CompletionResult,
+    error: PasskeyFailure,
+    exposure: "public",
+    access: "any",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  return Object.freeze({
+    Pending,
+    binding: ceremony.binding,
+    layer,
+    operations: Object.freeze({ Begin, Complete }),
+    group: operationGroup(Begin, Complete),
+    handlersLayer: Layer.mergeAll(
+      Begin.credentialHandlerLayer((input, invocation) =>
+        Effect.flatMap(Pending, (service) => service.begin(invocation, input)),
+      ),
+      Complete.credentialHandlerLayer((input, invocation) =>
+        Effect.flatMap(Pending, (service) => service.complete(invocation, input)),
+      ),
+    ),
+  });
+};

package/src/passkey/policy.ts

@@ -0,0 +1,88 @@
+import { Effect, Schema } from "effect";
+
+import { PasskeyConfigurationError } from "./errors";
+import { PasskeyGeneration, PasskeyProfile } from "./models";
+import { snapshotPasskey } from "./snapshot";
+
+const budget = Schema.Struct({
+  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 10000 })),
+  windowMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 86400000 })),
+});
+
+export const PasskeyMethodPolicy = Schema.Struct({
+  generation: PasskeyGeneration,
+  profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(32)),
+  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),
+  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 120000 })),
+  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 604800000 })),
+  maximumPending: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100000 })),
+  maximumPendingPerSubject: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),
+  admission: Schema.Struct({ global: budget, subject: budget, target: budget }),
+});
+
+export type PasskeyMethodPolicy = typeof PasskeyMethodPolicy.Type;
+
+export const PasskeyManagementPolicy = Schema.Struct({
+  maximumCredentials: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),
+  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 })),
+  requireImmediateInvalidation: Schema.Boolean,
+});
+
+export type PasskeyManagementPolicy = typeof PasskeyManagementPolicy.Type;
+
+export const validatePasskeyPolicy = Effect.fn("validatePasskeyPolicy")(function* (
+  input: PasskeyMethodPolicy,
+) {
+  const policy = yield* snapshotPasskey(PasskeyMethodPolicy, input).pipe(
+    Effect.mapError(() => PasskeyConfigurationError.make({})),
+  );
+
+  if (
+    policy.retentionMillis <
+    Math.max(
+      policy.lifetimeMillis + policy.claimLifetimeMillis,
+      ...Object.values(policy.admission).map((b) => b.windowMillis),
+    )
+  )
+    return yield* PasskeyConfigurationError.make({});
+  const ids = new Set<string>();
+
+  for (const profile of policy.profiles) {
+    if (
+      ids.has(profile.profileId) ||
+      new Set(profile.origins).size !== profile.origins.length ||
+      new Set(profile.algorithms).size !== profile.algorithms.length
+    )
+      return yield* PasskeyConfigurationError.make({});
+    ids.add(profile.profileId);
+    if (
+      profile.primarySignIn &&
+      (profile.userVerification !== "required" || profile.residentKey !== "required")
+    )
+      return yield* PasskeyConfigurationError.make({});
+    for (const origin of profile.origins) {
+      const valid = yield* Effect.try({
+        try: () => {
+          const url = new URL(origin);
+
+          return (
+            url.origin === origin &&
+            url.username === "" &&
+            url.password === "" &&
+            (url.protocol === "https:" ||
+              (profile.developmentLocalhost &&
+                profile.rpId === "localhost" &&
+                url.hostname === "localhost" &&
+                url.protocol === "http:")) &&
+            (url.hostname === profile.rpId || url.hostname.endsWith("." + profile.rpId))
+          );
+        },
+        catch: () => PasskeyConfigurationError.make({}),
+      });
+
+      if (!valid) return yield* PasskeyConfigurationError.make({});
+    }
+  }
+
+  return policy;
+});