anchor.diff:  
     config = mkIf (cfg.ssh.enable || cfg.pam.enable) {
       assertions =
  -      [ { assertion = cfg.failmode == "safe" || cfg.failmode == "secure";
  -          message   = "Invalid value for failmode (must be safe or secure).";
  -        }
  -        { assertion = cfg.prompts == 1 || cfg.prompts == 2 || cfg.prompts == 3;
  -          message   = "Invalid value for prompts (must be 1, 2, or 3).";
  -        }
  -        { assertion = !cfg.pam.enable;
  +      [ { assertion = !cfg.pam.enable;
             message   = "PAM support is currently not implemented.";
           }
         ];
  
positive.code:       };
  
        prompts = mkOption {
          type = types.int;
          default = 3;
          description = ''
            If a user fails to authenticate with a second factor, Duo
  
negative.code:       };
  
        failmode = mkOption {
          type = types.enum [ "safe" "enum" ];
          default = "safe";
          description = ''
            On service or configuration errors that prevent Duo
  