@ambushsoftworks/nestjs-auth-graphql 0.16.0-rc.2 → 0.16.0

package/CHANGELOG.md

@@ -27,6 +27,99 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.16.0] - 2026-10-01
+
+Passkeys (WebAuthn), and step-up re-authentication to protect adding one.
+Identical to `0.16.0-rc.3`, which LiftIQ piloted on a real Android Credential
+Manager and against Postgres. This entry is the summary for anyone coming from
+0.15.x; the three release-candidate entries below have the detail.
+
+**Nothing changes unless you enable passkeys**, with two exceptions noted
+under Changed.
+
+### ⚠ External configuration required
+
+Only if you enable passkeys (details: README, "Passkeys → Platform setup"):
+
+- Install the optional peer `@simplewebauthn/server@^14`; it needs Node.js 20+.
+- **Web:** the frontend on HTTPS at `passkey.rp.id` or a subdomain, its exact
+  origin listed in `passkey.rp.origins`.
+- **Android:** `https://<rp.id>/.well-known/assetlinks.json` granting
+  `delegate_permission/common.get_login_creds`, and
+  `android:apk-key-hash:<base64url SHA-256 of the signing certificate>` in
+  `passkey.rp.origins`.
+- **iOS:** `https://<rp.id>/.well-known/apple-app-site-association` with
+  `webcredentials.apps`, and `webcredentials:<rp.id>` in Associated Domains.
+- **Database:** passkey credential and challenge tables
+  (`examples/passkeys/schema.prisma`), and the value `step-up` if your
+  verification repository stores its type in a database enum.
+
+### Added
+
+- **Passkeys**: `PasskeyService`, `IPasskeyRepository`, 11 `perform*` methods
+  on `BaseAuthResolver`. Usernameless sign-in, browser autofill, user
+  verification required by default (configurable), realm-bound credentials.
+- **Step-up re-authentication** (`StepUpService`): password, passkey or email
+  code, giving a five-minute token bound to user and realm and reusable until
+  it expires. **Required to add a passkey.**
+- **Owner notification emails** when a passkey is added or removed, sent by
+  the package through optional `IEmailService` methods; turn off with
+  `passkey.emailNotifications`.
+- **`@ambushsoftworks/nestjs-auth-graphql/testing`**:
+  `assertPasskeyRepositoryContract` (with `userIds`, `realms` and `cleanup`
+  for real databases) and `SoftwareAuthenticator`.
+- **`examples/passkeys/`**: reference Prisma schema and adapter, verified with
+  the contract on PostgreSQL 16.
+- Error codes `STEP_UP_FAILED`, `STEP_UP_REQUIRED`, `STEP_UP_UNAVAILABLE`,
+  `PASSKEY_AUTHENTICATION_FAILED`, `PASSKEY_ALREADY_REGISTERED`,
+  `CANNOT_REMOVE_LAST_AUTH_METHOD`. **Do not map `STEP_UP_FAILED` to a token
+  refresh**; it is not an expired session.
+
+### Changed
+
+- `RepositoryVerificationType` includes `STEP_UP`. An adapter with an
+  exhaustive `switch` over it needs the new case.
+- `BaseAuthResolver` gains protected members `authPasskeys` and `authStepUp`
+  (its constructor is unchanged). A subclass declaring members with those
+  names must rename them.
+
+### Upgrading from an RC
+
+From rc.1, read the rc.2 entry: the error codes changed, and the package now
+sends the passkey emails, so remove any you send from the hooks. From rc.2,
+nothing breaks; the contract gained options. From rc.3, nothing changes.
+
+## [0.16.0-rc.3] - 2026-10-01
+
+The repository contract from rc.2 could not run against a real schema,
+including the reference schema in this README. Found by LiftIQ on Postgres.
+
+### Fixed
+
+- **`assertPasskeyRepositoryContract` takes options** (defaults unchanged):
+  - `userIds: [a, b, ...]`: existing users to attach credentials to. Without
+    them the contract invented user ids, so any schema with a foreign key to
+    users, the README's included, failed with `P2003` on the first insert.
+  - `realms: false`: for deployments without realms. Every fixture carried a
+    realm and every check demanded it back, though the interface says realm
+    is only set when realms are enabled.
+  - `cleanup({ credentialIds, challengeIds })`: called once, pass or fail,
+    with every id created. Before, every run left rows in the database the
+    README told adopters to use.
+- **Listing is checked by containment, not an exact list**, so users who
+  already have passkeys do not fail it.
+- **`userIds` without `cleanup` is refused**: the contract creates active
+  passkeys on those users, which would show in their passkey lists. Pass
+  `cleanup: () => {}` to keep them on purpose.
+
+### Added
+
+- **`examples/passkeys/`**: the reference Prisma schema and a
+  `PrismaPasskeyRepository` built from the README's snippets, verified with the
+  contract on PostgreSQL 16, with and without realms, with a foreign key to
+  users, and with cleanup removing every row on both a passing and a failing
+  run.
+
 ## [0.16.0-rc.2] - 2026-10-01
 
 Fixes from LiftIQ's pilot of rc.1 on a real Android Credential Manager. Still a

package/README.md

@@ -1276,7 +1276,14 @@ tests use, against a real database:
 import { assertPasskeyRepositoryContract } from '@ambushsoftworks/nestjs-auth-graphql/testing';
 
 it('meets the passkey repository contract', async () => {
-  await assertPasskeyRepositoryContract(() => new PrismaPasskeyRepository(prisma));
+  await assertPasskeyRepositoryContract(() => new PrismaPasskeyRepository(prisma), {
+    userIds: [alice.id, bob.id],   // existing users: the reference schema has a foreign key to User
+    realms: false,                 // only if you do not use realms
+    cleanup: async ({ credentialIds, challengeIds }) => {
+      await prisma.passkeyCredential.deleteMany({ where: { credentialId: { in: credentialIds } } });
+      await prisma.passkeyChallenge.deleteMany({ where: { id: { in: challengeIds } } });
+    },
+  });
 });
 ```
 
@@ -1284,6 +1291,15 @@ It resolves when the adapter is correct and otherwise rejects naming the rule
 broken: concurrent claims of one challenge, a counter column too small for a
 uint32, an unmapped duplicate, a dropped realm, hidden deactivated
 credentials, expiry left to a TTL. Framework-agnostic.
+
+| Option | Default | Use it when |
+|---|---|---|
+| `userIds` | invented ids | Your credentials table has a foreign key to users, as the reference schema does. At least two existing users; they may already have passkeys. **Requires `cleanup`** |
+| `realms` | `true` | `false` when you do not set `realmExtractorInstance` and store no realm |
+| `cleanup` | none | Always, against a shared database. Called once, pass or fail, with every id created; the list may include ids never stored, so delete with `deleteMany` |
+
+`examples/passkeys/` has the reference schema and a Prisma adapter that pass
+this contract on PostgreSQL 16, with and without realms.
 `InMemoryPasskeyRepository` is exported for tests and single-instance
 development.
 

package/dist/testing/index.d.ts

@@ -1,3 +1,3 @@
-export { assertPasskeyRepositoryContract, PasskeyRepositoryContractError, } from './passkey-repository.contract';
+export { assertPasskeyRepositoryContract, PasskeyRepositoryContractError, type PasskeyRepositoryContractOptions, type PasskeyContractCreatedIds, } from './passkey-repository.contract';
 export { SoftwareAuthenticator, type CreateOptions as SoftwareAuthenticatorCreateOptions, type GetOptions as SoftwareAuthenticatorGetOptions, type SoftwareAlgorithm, } from '../test-utils/software-authenticator';
 //# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,IAAI,kCAAkC,EACxD,KAAK,UAAU,IAAI,+BAA+B,EAClD,KAAK,iBAAiB,GACvB,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,IAAI,kCAAkC,EACxD,KAAK,UAAU,IAAI,+BAA+B,EAClD,KAAK,iBAAiB,GACvB,MAAM,sCAAsC,CAAC"}

package/dist/testing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAMA,6EAGuC;AAFrC,8IAAA,+BAA+B,OAAA;AAC/B,6IAAA,8BAA8B,OAAA;AAEhC,+EAK8C;AAJ5C,+HAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAMA,6EAKuC;AAJrC,8IAAA,+BAA+B,OAAA;AAC/B,6IAAA,8BAA8B,OAAA;AAIhC,+EAK8C;AAJ5C,+HAAA,qBAAqB,OAAA"}

package/dist/testing/passkey-repository.contract.d.ts

@@ -1,8 +1,19 @@
 import { IPasskeyRepository } from '../interfaces/passkey-repository.interface';
 export declare class PasskeyRepositoryContractError extends Error {
-    constructor(check: string, detail: string);
+    constructor(check: string, detail: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface PasskeyContractCreatedIds {
+    credentialIds: string[];
+    challengeIds: string[];
+}
+export interface PasskeyRepositoryContractOptions {
+    realms?: boolean;
+    userIds?: readonly string[];
+    cleanup?: (created: PasskeyContractCreatedIds) => void | Promise<void>;
 }
 type Factory = () => IPasskeyRepository | Promise<IPasskeyRepository>;
-export declare function assertPasskeyRepositoryContract(factory: Factory): Promise<void>;
+export declare function assertPasskeyRepositoryContract(factory: Factory, options?: PasskeyRepositoryContractOptions): Promise<void>;
 export {};
 //# sourceMappingURL=passkey-repository.contract.d.ts.map

package/dist/testing/passkey-repository.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-repository.contract.d.ts","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAGnB,MAAM,4CAA4C,CAAC;AAGpD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI1C;AAED,KAAK,OAAO,GAAG,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAuCtE,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAarF"}
+{"version":3,"file":"passkey-repository.contract.d.ts","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAInB,MAAM,4CAA4C,CAAC;AAGpD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOzE;AAGD,MAAM,WAAW,yBAAyB;IAKxC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,gCAAgC;IAQ/C,MAAM,CAAC,EAAE,OAAO,CAAC;IAYjB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAW5B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,KAAK,OAAO,GAAG,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AA8CtE,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/testing/passkey-repository.contract.js

@@ -5,60 +5,145 @@ exports.assertPasskeyRepositoryContract = assertPasskeyRepositoryContract;
 const crypto_1 = require("crypto");
 const passkey_repository_interface_1 = require("../interfaces/passkey-repository.interface");
 class PasskeyRepositoryContractError extends Error {
-    constructor(check, detail) {
+    constructor(check, detail, options) {
         super(`IPasskeyRepository contract — ${check}: ${detail}`);
         this.name = 'PasskeyRepositoryContractError';
+        if (options?.cause !== undefined) {
+            this.cause = options.cause;
+        }
     }
 }
 exports.PasskeyRepositoryContractError = PasskeyRepositoryContractError;
 const CONCURRENCY = 8;
 const MAX_COUNTER = 2 ** 32 - 1;
-async function assertPasskeyRepositoryContract(factory) {
-    for (const [name, check] of CHECKS) {
-        const repository = await factory();
+async function assertPasskeyRepositoryContract(factory, options = {}) {
+    validateOptions(options);
+    const run = new ContractRun(options);
+    let failure;
+    try {
+        for (const [name, check] of CHECKS) {
+            try {
+                const repository = run.track(await factory());
+                await check(repository, run);
+            }
+            catch (error) {
+                if (error instanceof PasskeyRepositoryContractError)
+                    throw error;
+                throw new PasskeyRepositoryContractError(name, `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`);
+            }
+        }
+    }
+    catch (error) {
+        failure = error;
+    }
+    if (options.cleanup) {
         try {
-            await check(repository);
+            await options.cleanup(run.created());
         }
-        catch (error) {
-            if (error instanceof PasskeyRepositoryContractError)
-                throw error;
-            throw new PasskeyRepositoryContractError(name, `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`);
+        catch (cleanupError) {
+            if (failure instanceof PasskeyRepositoryContractError) {
+                throw new PasskeyRepositoryContractError('cleanup', `${failure.message} — and cleanup then threw: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+            }
+            if (failure === undefined)
+                throw cleanupError;
         }
     }
+    if (failure !== undefined)
+        throw failure;
+}
+function validateOptions(options) {
+    const { realms, userIds, cleanup } = options;
+    if (realms !== undefined && typeof realms !== 'boolean') {
+        throw new TypeError(`assertPasskeyRepositoryContract: realms must be a boolean; received ${String(realms)}`);
+    }
+    if (cleanup !== undefined && typeof cleanup !== 'function') {
+        throw new TypeError('assertPasskeyRepositoryContract: cleanup must be a function');
+    }
+    if (userIds !== undefined) {
+        const ids = Array.isArray(userIds) ? userIds : [];
+        if (ids.length < 2 || ids.some((id) => typeof id !== 'string' || id === '') || new Set(ids).size !== ids.length) {
+            throw new TypeError('assertPasskeyRepositoryContract: userIds must hold at least two distinct, non-empty ids of ' +
+                `existing users; received ${JSON.stringify(userIds)}`);
+        }
+        if (!cleanup) {
+            throw new TypeError('assertPasskeyRepositoryContract: userIds needs cleanup. The contract creates active passkeys ' +
+                'on those users, which would appear in their passkey lists. Delete them in cleanup, or pass ' +
+                '`cleanup: () => {}` to keep them on purpose.');
+        }
+    }
+}
+class ContractRun {
+    constructor(options) {
+        this.credentialIds = new Set();
+        this.challengeIds = new Set();
+        this.realms = options.realms ?? true;
+        this.users = options.userIds;
+    }
+    user(which) {
+        return this.users?.[which] ?? `contract-user-${(0, crypto_1.randomUUID)()}`;
+    }
+    realm(realm) {
+        return this.realms ? { realm } : {};
+    }
+    created() {
+        return { credentialIds: [...this.credentialIds], challengeIds: [...this.challengeIds] };
+    }
+    track(repo) {
+        return new Proxy(repo, {
+            get: (target, property, receiver) => {
+                const value = Reflect.get(target, property, receiver);
+                if (property === 'storeChallenge') {
+                    return async (input) => {
+                        const id = await value.call(target, input);
+                        if (typeof id === 'string')
+                            this.challengeIds.add(id);
+                        return id;
+                    };
+                }
+                if (property === 'createCredential') {
+                    return async (record) => {
+                        this.credentialIds.add(record.credentialId);
+                        return value.call(target, record);
+                    };
+                }
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+    }
+    credential(overrides = {}) {
+        return {
+            credentialId: `contract-${(0, crypto_1.randomUUID)()}`,
+            userId: this.user(0),
+            ...this.realm('contract-realm'),
+            publicKey: 'pQECAyYgASFYIA',
+            counter: 0,
+            userHandle: `handle-${(0, crypto_1.randomUUID)()}`,
+            transports: ['internal', 'hybrid'],
+            deviceType: 'multiDevice',
+            backedUp: true,
+            aaguid: '00000000-0000-0000-0000-000000000000',
+            name: 'Contract passkey',
+            createdAt: new Date(Math.floor(Date.now() / 1000) * 1000),
+            lastUsedAt: null,
+            isActive: true,
+            ...overrides,
+        };
+    }
 }
 function fail(check, detail) {
     throw new PasskeyRepositoryContractError(check, detail);
 }
-function credential(overrides = {}) {
-    return {
-        credentialId: `contract-${(0, crypto_1.randomUUID)()}`,
-        userId: `contract-user-${(0, crypto_1.randomUUID)()}`,
-        realm: 'contract-realm',
-        publicKey: 'pQECAyYgASFYIA',
-        counter: 0,
-        userHandle: `handle-${(0, crypto_1.randomUUID)()}`,
-        transports: ['internal', 'hybrid'],
-        deviceType: 'multiDevice',
-        backedUp: true,
-        aaguid: '00000000-0000-0000-0000-000000000000',
-        name: 'Contract passkey',
-        createdAt: new Date(Math.floor(Date.now() / 1000) * 1000),
-        lastUsedAt: null,
-        isActive: true,
-        ...overrides,
-    };
-}
 const sameTime = (a, b) => a === b || (a instanceof Date && b instanceof Date && Math.abs(a.getTime() - b.getTime()) < 1000);
 const CHECKS = [
     [
         'challenges round-trip every field',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'challenges round-trip every field';
             const input = {
                 challenge: `challenge-${(0, crypto_1.randomUUID)()}`,
                 purpose: 'registration',
-                userId: `user-${(0, crypto_1.randomUUID)()}`,
-                realm: 'contract-realm',
+                userId: run.user(0),
+                ...run.realm('contract-realm'),
                 userHandle: `handle-${(0, crypto_1.randomUUID)()}`,
                 expiresAt: new Date(Date.now() + 60_000),
             };
@@ -68,7 +153,8 @@ const CHECKS = [
             const got = await repo.consumeChallenge(id);
             if (!got)
                 fail(check, 'consumeChallenge returned null for a fresh challenge');
-            for (const key of ['challenge', 'purpose', 'userId', 'realm', 'userHandle']) {
+            const keys = ['challenge', 'purpose', 'userId', 'userHandle', ...(run.realms ? ['realm'] : [])];
+            for (const key of keys) {
                 if (got[key] !== input[key]) {
                     fail(check, `${key} came back as ${JSON.stringify(got[key])}, stored ${JSON.stringify(input[key])}`);
                 }
@@ -81,11 +167,12 @@ const CHECKS = [
     ],
     [
         'a challenge is claimed exactly once, under concurrency',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'a challenge is claimed exactly once, under concurrency';
             const id = await repo.storeChallenge({
                 challenge: 'c',
                 purpose: 'authentication',
+                ...run.realm('contract-realm'),
                 expiresAt: new Date(Date.now() + 60_000),
             });
             const claims = await Promise.all(Array.from({ length: CONCURRENCY }, () => repo.consumeChallenge(id)));
@@ -100,11 +187,12 @@ const CHECKS = [
     ],
     [
         'expired and unknown challenges answer null',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'expired and unknown challenges answer null';
             const id = await repo.storeChallenge({
                 challenge: 'c',
                 purpose: 'authentication',
+                ...run.realm('contract-realm'),
                 expiresAt: new Date(Date.now() - 1_000),
             });
             if (await repo.consumeChallenge(id)) {
@@ -116,17 +204,19 @@ const CHECKS = [
     ],
     [
         'credentials round-trip every field, counter up to 2^32-1',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'credentials round-trip every field';
-            const record = credential({ counter: MAX_COUNTER, metadata: { device: 'contract' } });
+            const record = run.credential({ counter: MAX_COUNTER, metadata: { device: 'contract' } });
             await repo.createCredential(record);
-            const got = await repo.getCredential(record.credentialId);
+            const got = await repo.getCredential(record.credentialId, record.realm);
             if (!got)
                 fail(check, 'getCredential returned null for a credential just created');
-            for (const key of [
-                'credentialId', 'userId', 'realm', 'publicKey', 'counter', 'userHandle',
+            const keys = [
+                'credentialId', 'userId', 'publicKey', 'counter', 'userHandle',
                 'deviceType', 'backedUp', 'aaguid', 'name', 'isActive',
-            ]) {
+                ...(run.realms ? ['realm'] : []),
+            ];
+            for (const key of keys) {
                 if (got[key] !== record[key]) {
                     fail(check, `${key} came back as ${JSON.stringify(got[key])}, stored ${JSON.stringify(record[key])}` +
                         (key === 'counter' ? ' (a uint32: store it in a bigint column)' : ''));
@@ -143,19 +233,19 @@ const CHECKS = [
     ],
     [
         'a duplicate credential id throws PasskeyCredentialExistsError and leaves the original',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'a duplicate credential id is refused';
-            const original = credential();
+            const original = run.credential();
             await repo.createCredential(original);
             try {
-                await repo.createCredential(credential({ credentialId: original.credentialId }));
+                await repo.createCredential(run.credential({ credentialId: original.credentialId, userId: run.user(1) }));
             }
             catch (error) {
                 if (!(error instanceof passkey_repository_interface_1.PasskeyCredentialExistsError)) {
                     fail(check, `threw ${error instanceof Error ? error.name : String(error)}; map your unique-constraint ` +
                         'violation (Prisma P2002) to PasskeyCredentialExistsError');
                 }
-                const kept = await repo.getCredential(original.credentialId);
+                const kept = await repo.getCredential(original.credentialId, original.realm);
                 if (kept?.userId !== original.userId)
                     fail(check, "the original credential's owner changed");
                 return;
@@ -165,12 +255,12 @@ const CHECKS = [
     ],
     [
         'deactivated credentials are still returned',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'deactivated credentials are still returned';
-            const record = credential();
+            const record = run.credential();
             await repo.createCredential(record);
             await repo.deactivateCredential(record.credentialId);
-            const got = await repo.getCredential(record.credentialId);
+            const got = await repo.getCredential(record.credentialId, record.realm);
             if (!got)
                 fail(check, 'getCredential hid a deactivated credential; the package decides, not the store');
             if (got.isActive !== false)
@@ -182,31 +272,49 @@ const CHECKS = [
         },
     ],
     [
-        'listing is by user, narrowed by realm',
-        async (repo) => {
-            const check = 'listing is by user, narrowed by realm';
-            const userId = `contract-user-${(0, crypto_1.randomUUID)()}`;
-            const mine = credential({ userId, realm: 'realm-a' });
-            const otherRealm = credential({ userId, realm: 'realm-b' });
-            const otherUser = credential({ realm: 'realm-a' });
+        'listing is by user, narrowed by realm when realms are on',
+        async (repo, run) => {
+            const check = 'listing is by user';
+            const ids = (list) => new Set(list.map((c) => c.credentialId));
+            const user = run.user(0);
+            if (!run.realms) {
+                const mine = run.credential({ userId: user });
+                const otherUser = run.credential({ userId: run.user(1) });
+                for (const c of [mine, otherUser])
+                    await repo.createCredential(c);
+                const listed = ids(await repo.listCredentials(user));
+                if (!listed.has(mine.credentialId))
+                    fail(check, "listCredentials(user) left out the user's passkey");
+                if (listed.has(otherUser.credentialId))
+                    fail(check, "listCredentials(user) returned another user's passkey");
+                return;
+            }
+            const mine = run.credential({ userId: user, realm: 'realm-a' });
+            const otherRealm = run.credential({ userId: user, realm: 'realm-b' });
+            const otherUser = run.credential({ userId: run.user(1), realm: 'realm-a' });
             for (const c of [mine, otherRealm, otherUser])
                 await repo.createCredential(c);
-            const inRealm = (await repo.listCredentials(userId, 'realm-a')).map((c) => c.credentialId);
-            if (inRealm.length !== 1 || inRealm[0] !== mine.credentialId) {
-                fail(check, `listCredentials(user, 'realm-a') returned ${JSON.stringify(inRealm)}`);
+            const inRealm = ids(await repo.listCredentials(user, 'realm-a'));
+            if (!inRealm.has(mine.credentialId))
+                fail(check, "listCredentials(user, 'realm-a') left out the user's passkey");
+            if (inRealm.has(otherRealm.credentialId)) {
+                fail(check, "listCredentials(user, 'realm-a') returned the user's passkey from realm-b");
             }
-            const all = (await repo.listCredentials(userId)).map((c) => c.credentialId).sort();
-            const expected = [mine.credentialId, otherRealm.credentialId].sort();
-            if (JSON.stringify(all) !== JSON.stringify(expected)) {
-                fail(check, `listCredentials(user) returned ${JSON.stringify(all)}`);
+            if (inRealm.has(otherUser.credentialId))
+                fail(check, "listCredentials(user, 'realm-a') returned another user's passkey");
+            const all = ids(await repo.listCredentials(user));
+            if (!all.has(mine.credentialId) || !all.has(otherRealm.credentialId)) {
+                fail(check, 'listCredentials(user) without a realm left out one of the user’s passkeys');
             }
+            if (all.has(otherUser.credentialId))
+                fail(check, "listCredentials(user) returned another user's passkey");
         },
     ],
     [
         'updateCounter is a compare-and-set, under concurrency',
-        async (repo) => {
+        async (repo, run) => {
             const check = 'updateCounter is a compare-and-set';
-            const record = credential({ counter: 3 });
+            const record = run.credential({ counter: 3 });
             await repo.createCredential(record);
             const update = (expectedCounter, newCounter) => repo.updateCounter({
                 credentialId: record.credentialId,
@@ -223,7 +331,7 @@ const CHECKS = [
                 fail(check, `${applied} of ${CONCURRENCY} concurrent updates from the same counter applied. It must be one ` +
                     'conditional update (UPDATE … WHERE counter = expected), not a read then a write.');
             }
-            const got = await repo.getCredential(record.credentialId);
+            const got = await repo.getCredential(record.credentialId, record.realm);
             if (!got || got.counter < 4)
                 fail(check, `the counter is ${String(got?.counter)} after an applied update`);
             if (got.backedUp !== false)
@@ -234,11 +342,11 @@ const CHECKS = [
     ],
     [
         'renameCredential changes the name',
-        async (repo) => {
-            const record = credential();
+        async (repo, run) => {
+            const record = run.credential();
             await repo.createCredential(record);
             await repo.renameCredential(record.credentialId, 'Renamed');
-            const got = await repo.getCredential(record.credentialId);
+            const got = await repo.getCredential(record.credentialId, record.realm);
             if (got?.name !== 'Renamed') {
                 fail('renameCredential changes the name', `name is ${JSON.stringify(got?.name)}`);
             }

package/dist/testing/passkey-repository.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-repository.contract.js","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":";;;AAsDA,0EAaC;AAnED,mCAAoC;AACpC,6FAIoD;AAGpD,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CAAC,iCAAiC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AALD,wEAKC;AAKD,MAAM,WAAW,GAAG,CAAC,CAAC;AAGtB,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAiCzB,KAAK,UAAU,+BAA+B,CAAC,OAAgB;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,8BAA8B;gBAAE,MAAM,KAAK,CAAC;YACjE,MAAM,IAAI,8BAA8B,CACtC,IAAI,EACJ,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,MAAM,IAAI,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,YAA8C,EAAE;IAClE,OAAO;QACL,YAAY,EAAE,YAAY,IAAA,mBAAU,GAAE,EAAE;QACxC,MAAM,EAAE,iBAAiB,IAAA,mBAAU,GAAE,EAAE;QACvC,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;QACpC,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QAClC,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,sCAAsC;QAC9C,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACzD,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,CAA0B,EAAE,EAAE,CAC1E,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAiE;IAC3E;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,mCAAmC,CAAC;YAClD,MAAM,KAAK,GAAG;gBACZ,SAAS,EAAE,aAAa,IAAA,mBAAU,GAAE,EAAE;gBACtC,OAAO,EAAE,cAAuB;gBAChC,MAAM,EAAE,QAAQ,IAAA,mBAAU,GAAE,EAAE;gBAC9B,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;gBACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAU,EAAE,CAAC;gBACrF,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClF,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,wDAAwD,CAAC;YACvE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACd,IAAI,CACF,KAAK,EACL,GAAG,GAAG,OAAO,WAAW,+DAA+D;oBACrF,sGAAsG,CACzG,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;QAC9F,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aACxC,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,uFAAuF,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAA,mBAAU,GAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QAC1G,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;YACnF,KAAK,MAAM,GAAG,IAAI;gBAChB,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY;gBACvE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;aAC9C,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,IAAI,CACF,KAAK,EACL,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;wBACtF,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,CAAC,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACjF,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7G,CAAC;KACF;IACD;QACE,uFAAuF;QACvF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,sCAAsC,CAAC;YACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,YAAY,2DAA4B,CAAC,EAAE,CAAC;oBACrD,IAAI,CACF,KAAK,EACL,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B;wBACzF,0DAA0D,CAC7D,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC7D,IAAI,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,sEAAsE,CAAC,CAAC;QACtF,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,gFAAgF,CAAC,CAAC;YACxG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF;IACD;QACE,uCAAuC;QACvC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,uCAAuC,CAAC;YACtD,MAAM,MAAM,GAAG,iBAAiB,IAAA,mBAAU,GAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAE9E,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,EAAE,6CAA6C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,eAAuB,EAAE,UAAkB,EAAE,EAAE,CAC7D,IAAI,CAAC,aAAa,CAAC;gBACjB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,eAAe;gBACf,UAAU;gBACV,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YAEL,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC/C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,CACF,KAAK,EACL,GAAG,OAAO,OAAO,WAAW,oEAAoE;oBAC9F,kFAAkF,CACrF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,kBAAkB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC3G,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,YAAY,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;KACF;IACD;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,mCAAmC,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KACF;CACF,CAAC"}
+{"version":3,"file":"passkey-repository.contract.js","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":";;;AA6GA,0EA2CC;AAxJD,mCAAoC;AACpC,6FAKoD;AAGpD,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,KAAa,EAAE,MAAc,EAAE,OAA6B;QACtE,KAAK,CAAC,iCAAiC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AARD,wEAQC;AAiDD,MAAM,WAAW,GAAG,CAAC,CAAC;AAGtB,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAwCzB,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,UAA4C,EAAE;IAE9C,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;gBAC9C,MAAM,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,8BAA8B;oBAAE,MAAM,KAAK,CAAC;gBACjE,MAAM,IAAI,8BAA8B,CACtC,IAAI,EACJ,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,YAAqB,EAAE,CAAC;YAC/B,IAAI,OAAO,YAAY,8BAA8B,EAAE,CAAC;gBACtD,MAAM,IAAI,8BAA8B,CACtC,SAAS,EACT,GAAG,OAAO,CAAC,OAAO,8BAChB,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAC5E,EAAE,EACF,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,YAAY,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,OAAyC;IAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,uEAAuE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAChH,MAAM,IAAI,SAAS,CACjB,6FAA6F;gBAC3F,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,+FAA+F;gBAC7F,6FAA6F;gBAC7F,8CAA8C,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAGD,MAAM,WAAW;IAMf,YAAY,OAAyC;QAHpC,kBAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,iBAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QAGhD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;IAC/B,CAAC;IAGD,IAAI,CAAC,KAAY;QACf,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,iBAAiB,IAAA,mBAAU,GAAE,EAAE,CAAC;IAChE,CAAC;IAGD,KAAK,CAAC,KAAa;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IAC1F,CAAC;IAOD,KAAK,CAAC,IAAwB;QAC5B,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;YACrB,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACtD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBAClC,OAAO,KAAK,EAAE,KAAkD,EAAE,EAAE;wBAClE,MAAM,EAAE,GAAG,MAAO,KAA8C,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBACrF,IAAI,OAAO,EAAE,KAAK,QAAQ;4BAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACtD,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;oBACpC,OAAO,KAAK,EAAE,MAA+B,EAAE,EAAE;wBAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;wBAC5C,OAAQ,KAAgD,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAChF,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,YAA8C,EAAE;QACzD,OAAO;YACL,YAAY,EAAE,YAAY,IAAA,mBAAU,GAAE,EAAE;YACxC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpB,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC/B,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;YACpC,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;YAClC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACzD,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,MAAM,IAAI,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,CAA0B,EAAE,EAAE,CAC1E,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAmF;IAC7F;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,mCAAmC,CAAC;YAClD,MAAM,KAAK,GAAG;gBACZ,SAAS,EAAE,aAAa,IAAA,mBAAU,GAAE,EAAE;gBACtC,OAAO,EAAE,cAAuB;gBAChC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnB,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAC9B,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;gBACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;YACzG,KAAK,MAAM,GAAG,IAAI,IAAsE,EAAE,CAAC;gBACzF,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClF,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,wDAAwD,CAAC;YACvE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACd,IAAI,CACF,KAAK,EACL,GAAG,GAAG,OAAO,WAAW,+DAA+D;oBACrF,sGAAsG,CACzG,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;QAC9F,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aACxC,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,uFAAuF,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAA,mBAAU,GAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QAC1G,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG;gBACX,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY;gBAC9D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;gBACtD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACxB,CAAC;YACX,KAAK,MAAM,GAAG,IAAI,IAAkD,EAAE,CAAC;gBACrE,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,IAAI,CACF,KAAK,EACL,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;wBACtF,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,CAAC,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACjF,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7G,CAAC;KACF;IACD;QACE,uFAAuF;QACvF,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,sCAAsC,CAAC;YACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5G,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,YAAY,2DAA4B,CAAC,EAAE,CAAC;oBACrD,IAAI,CACF,KAAK,EACL,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B;wBACzF,0DAA0D,CAC7D,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC7E,IAAI,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,sEAAsE,CAAC,CAAC;QACtF,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,gFAAgF,CAAC,CAAC;YACxG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,oBAAoB,CAAC;YAEnC,MAAM,GAAG,GAAG,CAAC,IAA+B,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1D,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;oBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;oBAAE,IAAI,CAAC,KAAK,EAAE,mDAAmD,CAAC,CAAC;gBACrG,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC;oBAAE,IAAI,CAAC,KAAK,EAAE,uDAAuD,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAE9E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,8DAA8D,CAAC,CAAC;YACjH,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,EAAE,2EAA2E,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;YAEzH,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,KAAK,EAAE,2EAA2E,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,uDAAuD,CAAC,CAAC;QAC5G,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,eAAuB,EAAE,UAAkB,EAAE,EAAE,CAC7D,IAAI,CAAC,aAAa,CAAC;gBACjB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,eAAe;gBACf,UAAU;gBACV,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YAEL,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC/C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,CACF,KAAK,EACL,GAAG,OAAO,OAAO,WAAW,oEAAoE;oBAC9F,kFAAkF,CACrF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,kBAAkB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC3G,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,YAAY,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;KACF;IACD;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,mCAAmC,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KACF;CACF,CAAC"}

package/examples/passkeys/prisma-passkey.repository.ts

@@ -0,0 +1,166 @@
+import { Injectable } from '@nestjs/common';
+import { Prisma, PrismaClient } from '@prisma/client';
+import {
+  IPasskeyRepository,
+  PasskeyChallengeRecord,
+  PasskeyCredentialExistsError,
+  PasskeyCredentialRecord,
+} from '@ambushsoftworks/nestjs-auth-graphql';
+
+/**
+ * IPasskeyRepository on Prisma, for the models in ./schema.prisma.
+ *
+ * Verified against PostgreSQL 16 with `assertPasskeyRepositoryContract` from
+ * `@ambushsoftworks/nestjs-auth-graphql/testing`, with and without realms and
+ * with a foreign key to users. Run that contract against your copy, too:
+ *
+ *   await assertPasskeyRepositoryContract(() => new PrismaPasskeyRepository(prisma), {
+ *     userIds: [userA.id, userB.id],
+ *     cleanup: async ({ credentialIds, challengeIds }) => {
+ *       await prisma.passkeyCredential.deleteMany({ where: { credentialId: { in: credentialIds } } });
+ *       await prisma.passkeyChallenge.deleteMany({ where: { id: { in: challengeIds } } });
+ *     },
+ *   });
+ *
+ * Inject your own PrismaService in place of PrismaClient if you have one.
+ */
+@Injectable()
+export class PrismaPasskeyRepository implements IPasskeyRepository {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async storeChallenge(input: Omit<PasskeyChallengeRecord, 'challengeId'>): Promise<string> {
+    const row = await this.prisma.passkeyChallenge.create({
+      data: {
+        challenge: input.challenge,
+        purpose: input.purpose,
+        userId: input.userId ?? null,
+        realm: input.realm ?? null,
+        userHandle: input.userHandle ?? null,
+        expiresAt: input.expiresAt,
+      },
+      select: { id: true },
+    });
+    return row.id;
+  }
+
+  /** One conditional update, then a read: never a read followed by a write. */
+  async consumeChallenge(challengeId: string): Promise<PasskeyChallengeRecord | null> {
+    const { count } = await this.prisma.passkeyChallenge.updateMany({
+      where: { id: challengeId, used: false, expiresAt: { gt: new Date() } },
+      data: { used: true, usedAt: new Date() },
+    });
+    if (count !== 1) return null;
+
+    const row = await this.prisma.passkeyChallenge.findUnique({ where: { id: challengeId } });
+    if (!row) return null;
+    return {
+      challengeId: row.id,
+      challenge: row.challenge,
+      purpose: row.purpose as PasskeyChallengeRecord['purpose'],
+      ...(row.userId !== null ? { userId: row.userId } : {}),
+      ...(row.realm !== null ? { realm: row.realm } : {}),
+      ...(row.userHandle !== null ? { userHandle: row.userHandle } : {}),
+      expiresAt: row.expiresAt,
+    };
+  }
+
+  async deleteExpiredChallenges(): Promise<number> {
+    const { count } = await this.prisma.passkeyChallenge.deleteMany({
+      where: { expiresAt: { lt: new Date() } },
+    });
+    return count;
+  }
+
+  /** The primary key is the uniqueness check; its violation becomes the package's error. */
+  async createCredential(record: PasskeyCredentialRecord): Promise<void> {
+    try {
+      await this.prisma.passkeyCredential.create({
+        data: {
+          credentialId: record.credentialId,
+          userId: record.userId,
+          realm: record.realm ?? null,
+          publicKey: record.publicKey,
+          counter: BigInt(record.counter),
+          userHandle: record.userHandle,
+          transports: record.transports ?? [],
+          deviceType: record.deviceType,
+          backedUp: record.backedUp,
+          aaguid: record.aaguid ?? null,
+          name: record.name,
+          createdAt: record.createdAt,
+          lastUsedAt: record.lastUsedAt,
+          isActive: record.isActive,
+          ...(record.metadata !== undefined ? { metadata: record.metadata as Prisma.InputJsonValue } : {}),
+        },
+      });
+    } catch (error: unknown) {
+      if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2002') {
+        throw new PasskeyCredentialExistsError(record.credentialId);
+      }
+      throw error;
+    }
+  }
+
+  /** Returns deactivated credentials too, and any realm: the package decides. */
+  async getCredential(credentialId: string): Promise<PasskeyCredentialRecord | null> {
+    const row = await this.prisma.passkeyCredential.findUnique({ where: { credentialId } });
+    return row ? toRecord(row) : null;
+  }
+
+  async listCredentials(userId: string, realm?: string): Promise<PasskeyCredentialRecord[]> {
+    const rows = await this.prisma.passkeyCredential.findMany({
+      where: { userId, ...(realm !== undefined ? { realm } : {}) },
+      orderBy: { createdAt: 'asc' },
+    });
+    return rows.map(toRecord);
+  }
+
+  /** Compare-and-set: applies only while the stored counter is still `expectedCounter`. */
+  async updateCounter(input: {
+    credentialId: string;
+    expectedCounter: number;
+    newCounter: number;
+    backedUp: boolean;
+    lastUsedAt: Date;
+  }): Promise<boolean> {
+    const { count } = await this.prisma.passkeyCredential.updateMany({
+      where: { credentialId: input.credentialId, counter: BigInt(input.expectedCounter) },
+      data: {
+        counter: BigInt(input.newCounter),
+        backedUp: input.backedUp,
+        lastUsedAt: input.lastUsedAt,
+      },
+    });
+    return count === 1;
+  }
+
+  async renameCredential(credentialId: string, name: string): Promise<void> {
+    await this.prisma.passkeyCredential.update({ where: { credentialId }, data: { name } });
+  }
+
+  async deactivateCredential(credentialId: string): Promise<void> {
+    await this.prisma.passkeyCredential.update({ where: { credentialId }, data: { isActive: false } });
+  }
+}
+
+type CredentialRow = Prisma.PasskeyCredentialGetPayload<Record<string, never>>;
+
+function toRecord(row: CredentialRow): PasskeyCredentialRecord {
+  return {
+    credentialId: row.credentialId,
+    userId: row.userId,
+    ...(row.realm !== null ? { realm: row.realm } : {}),
+    publicKey: row.publicKey,
+    counter: Number(row.counter),
+    userHandle: row.userHandle,
+    transports: row.transports,
+    deviceType: row.deviceType as PasskeyCredentialRecord['deviceType'],
+    backedUp: row.backedUp,
+    ...(row.aaguid !== null ? { aaguid: row.aaguid } : {}),
+    name: row.name,
+    createdAt: row.createdAt,
+    lastUsedAt: row.lastUsedAt,
+    isActive: row.isActive,
+    ...(row.metadata !== null ? { metadata: row.metadata as Record<string, unknown> } : {}),
+  };
+}

package/examples/passkeys/schema.prisma

@@ -0,0 +1,46 @@
+// Reference schema for IPasskeyRepository, as in the README ("Implementing
+// IPasskeyRepository"). Verified against PostgreSQL 16 with
+// `assertPasskeyRepositoryContract`, with and without realms.
+//
+// Merge these two models into your schema, and add the back-relation to your
+// User model:
+//
+//   model User {
+//     ...
+//     passkeyCredentials PasskeyCredential[]
+//   }
+
+model PasskeyCredential {
+  credentialId String    @id              // base64url, unique across all users
+  userId       String
+  realm        String?                    // set when realms are enabled
+  publicKey    String                     // base64url COSE key
+  counter      BigInt    @default(0)      // uint32 on the wire; Int is too small
+  userHandle   String
+  transports   String[]
+  deviceType   String
+  backedUp     Boolean
+  aaguid       String?
+  name         String
+  createdAt    DateTime  @default(now())
+  lastUsedAt   DateTime?
+  isActive     Boolean   @default(true)
+  metadata     Json?
+  user         User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, realm])
+}
+
+model PasskeyChallenge {
+  id         String    @id @default(uuid())
+  challenge  String
+  purpose    String                       // registration | authentication | step-up
+  userId     String?                      // not a foreign key: sign-in challenges have no user
+  realm      String?
+  userHandle String?                      // registration only
+  expiresAt  DateTime
+  used       Boolean   @default(false)
+  usedAt     DateTime?
+
+  @@index([expiresAt])
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.16.0-rc.2",
+  "version": "0.16.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",