@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/webauthn.cjs

@@ -0,0 +1,786 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/webauthn/index.ts
+var webauthn_exports = {};
+__export(webauthn_exports, {
+  webauthn: () => webauthn
+});
+module.exports = __toCommonJS(webauthn_exports);
+var import_server = require("@simplewebauthn/server");
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/schema-builder.ts
+var import_openapi = require("@bajustone/fetcher/openapi");
+var import_schema = require("@bajustone/fetcher/schema");
+function collectRefNames(schema, acc) {
+  if (!schema || typeof schema !== "object")
+    return acc;
+  if (typeof schema.$ref === "string") {
+    const i = schema.$ref.lastIndexOf("/");
+    acc.add(i >= 0 ? schema.$ref.slice(i + 1) : schema.$ref);
+  }
+  if (schema.properties) {
+    for (const key of Object.keys(schema.properties))
+      collectRefNames(schema.properties[key], acc);
+  }
+  collectRefNames(schema.items, acc);
+  for (const key of ["oneOf", "anyOf", "allOf"]) {
+    const variants = schema[key];
+    if (variants) {
+      for (const variant of variants)
+        collectRefNames(variant, acc);
+    }
+  }
+  if (schema.additionalProperties && typeof schema.additionalProperties === "object")
+    collectRefNames(schema.additionalProperties, acc);
+  return acc;
+}
+var refDefinitionContexts = /* @__PURE__ */ new WeakMap();
+function refName(refPath) {
+  const i = refPath.lastIndexOf("/");
+  return i >= 0 ? refPath.slice(i + 1) : refPath;
+}
+function resolveRefDefs(schema) {
+  if (collectRefNames(schema, /* @__PURE__ */ new Set()).size === 0)
+    return void 0;
+  const defs = /* @__PURE__ */ Object.create(null);
+  const unresolved = /* @__PURE__ */ new Set();
+  const hasOwn = (value, key) => Object.hasOwn(value, key);
+  const visit = (node, inherited) => {
+    if (!node || typeof node !== "object")
+      return;
+    const context = refDefinitionContexts.get(node) ?? inherited;
+    if (typeof node.$ref === "string") {
+      const name = refName(node.$ref);
+      const component = context && hasOwn(context, name) ? context[name] : void 0;
+      if (component) {
+        if (hasOwn(defs, name) && !unresolved.has(name) && defs[name] !== component) {
+          throw new Error(`Conflicting component definitions for $ref '${name}'`);
+        }
+        const firstResolution = !hasOwn(defs, name) || unresolved.delete(name);
+        defs[name] = component;
+        if (firstResolution)
+          visit(component, context);
+      } else if (!hasOwn(defs, name)) {
+        defs[name] = {};
+        unresolved.add(name);
+      }
+    }
+    if (node.properties) {
+      for (const child of Object.values(node.properties))
+        visit(child, context);
+    }
+    visit(node.items, context);
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+      for (const child of node[key] ?? [])
+        visit(child, context);
+    }
+    if (node.additionalProperties && typeof node.additionalProperties === "object")
+      visit(node.additionalProperties, context);
+  };
+  visit(schema);
+  return defs;
+}
+function createStandardProps(schema) {
+  let validateFn;
+  return {
+    version: 1,
+    vendor: "fortress",
+    validate(value) {
+      if (!validateFn) {
+        const defs = resolveRefDefs(schema);
+        validateFn = (0, import_openapi.fromJSONSchema)(schema, defs)["~standard"].validate;
+      }
+      return validateFn(value);
+    }
+  };
+}
+function toFortressSchema(schema, refDefinitions, standardProps) {
+  if (refDefinitions)
+    refDefinitionContexts.set(schema, refDefinitions);
+  return Object.assign(schema, {
+    "~standard": standardProps ?? createStandardProps(schema)
+  });
+}
+function str(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "string" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minLength = o.min;
+  if (o.max !== void 0)
+    s.maxLength = o.max;
+  if (o.pattern !== void 0)
+    s.pattern = o.pattern;
+  if (o.format !== void 0)
+    s.format = o.format;
+  return toFortressSchema(s);
+}
+function int(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "integer" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minimum = o.min;
+  if (o.max !== void 0)
+    s.maximum = o.max;
+  return toFortressSchema(s);
+}
+function id(description) {
+  const s = { type: "string", minLength: 1 };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function bool(description) {
+  const s = { type: "boolean" };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function obj(properties, ...required) {
+  const s = { type: "object", properties };
+  if (required.length > 0)
+    s.required = required;
+  return toFortressSchema(s);
+}
+function record(description) {
+  const s = { type: "object", additionalProperties: true };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function makeFormatBuilder(factory) {
+  const f = factory();
+  return (description) => {
+    const s = { type: "string" };
+    if (f.format)
+      s.format = f.format;
+    if (f.pattern)
+      s.pattern = f.pattern;
+    if (description)
+      s.description = description;
+    return toFortressSchema(s);
+  };
+}
+var email = makeFormatBuilder(import_schema.email);
+var uuid = makeFormatBuilder(import_schema.uuid);
+var url = makeFormatBuilder(import_schema.url);
+var datetime = makeFormatBuilder(import_schema.datetime);
+var date = makeFormatBuilder(import_schema.date);
+var time = makeFormatBuilder(import_schema.time);
+function isStandardSchema(value) {
+  return typeof value === "object" && value !== null && "~standard" in value && typeof value["~standard"]?.validate === "function";
+}
+function isFortressSchema(value) {
+  return isStandardSchema(value) && value["~standard"].vendor === "fortress" && ("type" in value || "$ref" in value || "oneOf" in value || "anyOf" in value);
+}
+var JSON_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+function hasJsonSchemaShape(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  if ("$ref" in v || "oneOf" in v || "anyOf" in v || "allOf" in v)
+    return true;
+  if (typeof v.type === "string" && JSON_SCHEMA_TYPES.has(v.type))
+    return true;
+  if (Array.isArray(v.type) && v.type.every((t) => typeof t === "string" && JSON_SCHEMA_TYPES.has(t)))
+    return true;
+  return false;
+}
+function extractJsonSchema(schema) {
+  if (isFortressSchema(schema)) {
+    return schema;
+  }
+  if (isStandardSchema(schema)) {
+    const std = schema["~standard"];
+    if (std?.jsonSchema?.input) {
+      return std.jsonSchema.input({ target: "draft-2020-12" });
+    }
+    if (hasJsonSchemaShape(schema)) {
+      return schema;
+    }
+  }
+  return {};
+}
+var ErrorEnvelope = obj({
+  code: str("Machine-readable error code"),
+  message: str("Human-readable error message"),
+  statusCode: int("HTTP status code"),
+  details: toFortressSchema({ description: "Optional structured error details" })
+}, "code", "message", "statusCode");
+var EndpointBuilder = class {
+  _method;
+  _path;
+  _handler = "";
+  _summary = "";
+  _description;
+  _tags = [];
+  _security = [];
+  _deprecated = false;
+  _permission;
+  _body;
+  _query;
+  _params;
+  _responses = {};
+  constructor(method, path) {
+    this._method = method;
+    this._path = path;
+  }
+  summary(s) {
+    this._summary = s;
+    return this;
+  }
+  description(s) {
+    this._description = s;
+    return this;
+  }
+  tags(...t) {
+    this._tags.push(...t);
+    return this;
+  }
+  security(...s) {
+    this._security.push(...s);
+    return this;
+  }
+  deprecated() {
+    this._deprecated = true;
+    return this;
+  }
+  permission(resource, action) {
+    this._permission = { resource, action };
+    return this;
+  }
+  body(schema) {
+    this._body = schema;
+    return this;
+  }
+  query(schema) {
+    this._query = schema;
+    return this;
+  }
+  params(schema) {
+    this._params = schema;
+    return this;
+  }
+  response(status, description, schema) {
+    const stored = { description };
+    if (schema !== void 0) {
+      stored.schema = isStandardSchema(schema) ? extractJsonSchema(schema) : schema;
+    }
+    this._responses[status] = stored;
+    return this;
+  }
+  /**
+   * Declare an error response that returns the canonical {@link ErrorEnvelope}
+   * body. Shorthand for `.response(status, description, ErrorEnvelope)`.
+   *
+   * Aligns host endpoint error responses with what Fortress's own routes
+   * emit, so a single client-side error parser works everywhere.
+   *
+   * ```ts
+   * endpoint('GET', '/schools/:id')
+   *   .summary('Get a school')
+   *   .params(obj({ id: str() }, 'id'))
+   *   .response(200, 'OK', SchoolEnvelope)
+   *   .errorResponse(404, 'School not found')
+   *   .errorResponse(403, 'Forbidden')
+   *   .build();
+   * ```
+   */
+  errorResponse(status, description) {
+    return this.response(status, description, ErrorEnvelope);
+  }
+  handler(name) {
+    this._handler = name;
+    return this;
+  }
+  build() {
+    const def = {
+      method: this._method,
+      path: this._path,
+      handler: this._handler
+    };
+    if (this._summary || this._tags.length > 0 || this._security.length > 0 || this._description || this._deprecated || this._permission) {
+      def.meta = {
+        summary: this._summary,
+        ...this._description && { description: this._description },
+        ...this._tags.length > 0 && { tags: this._tags },
+        ...this._security.length > 0 && { security: this._security },
+        ...this._deprecated && { deprecated: true },
+        ...this._permission && { permission: this._permission }
+      };
+    }
+    if (this._body || this._query || this._params) {
+      def.input = {};
+      if (this._body) {
+        def.input.body = extractJsonSchema(this._body);
+        if (isStandardSchema(this._body))
+          def.input.bodySchema = this._body;
+      }
+      if (this._query) {
+        def.input.query = extractJsonSchema(this._query);
+        if (isStandardSchema(this._query))
+          def.input.querySchema = this._query;
+      }
+      if (this._params) {
+        def.input.params = extractJsonSchema(this._params);
+        if (isStandardSchema(this._params))
+          def.input.paramsSchema = this._params;
+      }
+    }
+    if (Object.keys(this._responses).length > 0) {
+      def.responses = this._responses;
+    }
+    return def;
+  }
+};
+function endpoint(method, path) {
+  return new EndpointBuilder(method, path);
+}
+
+// src/plugins/webauthn/index.ts
+var RE_PLUS = /\+/g;
+var RE_SLASH = /\//g;
+var RE_TRAILING_EQ = /=+$/;
+function base64urlToUint8Array(base64url) {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = base64.length % 4;
+  const padded = pad ? base64 + "=".repeat(4 - pad) : base64;
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function uint8ArrayToBase64url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(RE_PLUS, "-").replace(RE_SLASH, "_").replace(RE_TRAILING_EQ, "");
+}
+var webauthnRoutes = {
+  generateRegistrationOptions: endpoint("POST", "/webauthn/register/options").summary("Generate WebAuthn registration options").description("Generate public key credential creation options for registering a new passkey against the authenticated caller.").tags("WebAuthn").security("bearer").body(obj({})).response(200, "Registration options", obj({
+    options: record("PublicKeyCredentialCreationOptions JSON")
+  }, "options")).response(400, "Bad request").response(401, "Not authenticated").response(404, "User not found").handler("generateRegistrationOptions").build(),
+  verifyRegistration: endpoint("POST", "/webauthn/register/verify").summary("Verify WebAuthn registration").description("Verify the registration response from the authenticator and store the new credential for the authenticated caller.").tags("WebAuthn").security("bearer").body(obj({
+    response: record("RegistrationResponseJSON from navigator.credentials.create()")
+  }, "response")).response(200, "Registration verified", obj({
+    verified: bool("Whether registration was successful"),
+    credentialId: str("Base64url-encoded credential ID"),
+    credentialDeviceType: str("singleDevice or multiDevice"),
+    credentialBackedUp: bool("Whether credential is backed up (synced passkey)")
+  }, "verified")).response(400, "Verification failed").handler("verifyRegistration").build(),
+  generateAuthenticationOptions: endpoint("POST", "/webauthn/authenticate/options").summary("Generate WebAuthn authentication options").description("Generate public key credential request options. Optionally pass userId for non-discoverable credential flow.").tags("WebAuthn").security("none").body(obj({ userId: id("Optional user ID") })).response(200, "Authentication options", obj({
+    options: record("PublicKeyCredentialRequestOptions JSON")
+  }, "options")).handler("generateAuthenticationOptions").build(),
+  verifyAuthentication: endpoint("POST", "/webauthn/authenticate/verify").summary("Verify WebAuthn authentication").description("Verify the authentication assertion. Returns tokens if passwordless mode is enabled.").tags("WebAuthn").security("none").body(obj({
+    response: record("AuthenticationResponseJSON from navigator.credentials.get()")
+  }, "response")).response(200, "Authentication verified", obj({
+    verified: bool("Whether authentication was successful"),
+    userId: id("Authenticated user ID"),
+    accessToken: str("JWT access token (if passwordless)"),
+    refreshToken: str("Refresh token (if passwordless)")
+  }, "verified", "userId")).response(401, "Authentication failed").handler("verifyAuthentication").build()
+};
+function webauthn(config) {
+  const rpName = config.rpName;
+  const rpID = config.rpID;
+  const origin = config.origin;
+  const attestation = config.attestation ?? "none";
+  const timeout = config.timeout ?? 6e4;
+  const challengeTTLSeconds = config.challengeTTLSeconds ?? 300;
+  const supportPasswordless = config.supportPasswordless ?? true;
+  const authenticatorSelection = {
+    residentKey: config.authenticatorSelection?.residentKey ?? "preferred",
+    userVerification: config.authenticatorSelection?.userVerification ?? "preferred",
+    ...config.authenticatorSelection?.authenticatorAttachment ? { authenticatorAttachment: config.authenticatorSelection.authenticatorAttachment } : {}
+  };
+  async function verifyAuthenticationProof(db, response) {
+    const credentialRecord = await db.findOne({
+      model: "webauthn_credential",
+      where: [{ field: "credentialId", operator: "=", value: response.id }]
+    });
+    if (!credentialRecord)
+      throw Errors.unauthorized("Unknown credential");
+    let responseChallenge;
+    try {
+      const clientData = JSON.parse(
+        new TextDecoder().decode(base64urlToUint8Array(response.response.clientDataJSON))
+      );
+      if (typeof clientData.challenge !== "string" || clientData.challenge.length === 0)
+        throw new Error("missing challenge");
+      responseChallenge = clientData.challenge;
+    } catch {
+      throw Errors.unauthorized("Invalid WebAuthn client data");
+    }
+    const challenge = await db.findOne({
+      model: "webauthn_challenge",
+      where: [{ field: "challenge", operator: "=", value: responseChallenge }]
+    });
+    if (!challenge || challenge.userId !== null && challenge.userId !== credentialRecord.userId)
+      throw Errors.badRequest("No pending authentication challenge");
+    if (new Date(challenge.expiresAt) < /* @__PURE__ */ new Date()) {
+      await db.delete({
+        model: "webauthn_challenge",
+        where: [{ field: "id", operator: "=", value: challenge.id }]
+      });
+      throw Errors.badRequest("Challenge expired");
+    }
+    const verification = await (0, import_server.verifyAuthenticationResponse)({
+      response,
+      expectedChallenge: challenge.challenge,
+      expectedOrigin: origin,
+      expectedRPID: rpID,
+      credential: {
+        id: credentialRecord.credentialId,
+        publicKey: base64urlToUint8Array(credentialRecord.publicKey),
+        counter: credentialRecord.counter,
+        transports: credentialRecord.transports ? JSON.parse(credentialRecord.transports) : void 0
+      }
+    });
+    if (!verification.verified)
+      throw Errors.unauthorized("Authentication verification failed");
+    const { newCounter } = verification.authenticationInfo;
+    if (newCounter > 0 && credentialRecord.counter > 0 && newCounter <= credentialRecord.counter)
+      throw Errors.unauthorized("Authenticator counter validation failed");
+    await db.update({
+      model: "webauthn_credential",
+      where: [{ field: "id", operator: "=", value: credentialRecord.id }],
+      data: { counter: newCounter }
+    });
+    await db.delete({
+      model: "webauthn_challenge",
+      where: [{ field: "id", operator: "=", value: challenge.id }]
+    });
+    return credentialRecord.userId;
+  }
+  return {
+    name: "webauthn",
+    models: [
+      {
+        name: "webauthn_credential",
+        fields: {
+          id: { type: "number", required: true },
+          userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+          credentialId: { type: "string", required: true, unique: true },
+          publicKey: { type: "string", required: true },
+          counter: { type: "number", required: true },
+          deviceType: { type: "string", required: true },
+          backedUp: { type: "boolean", required: true },
+          transports: { type: "string" },
+          createdAt: { type: "date", required: true }
+        }
+      },
+      {
+        name: "webauthn_challenge",
+        fields: {
+          id: { type: "number", required: true },
+          challenge: { type: "string", required: true, unique: true },
+          userId: { type: "number" },
+          expiresAt: { type: "date", required: true },
+          createdAt: { type: "date", required: true }
+        }
+      }
+    ],
+    routes: webauthnRoutes,
+    hooks: supportPasswordless ? void 0 : {
+      postAuthGate: {
+        reason: "webauthn",
+        async evaluate(ctx) {
+          const credential = await ctx.db.findOne({
+            model: "webauthn_credential",
+            where: [{ field: "userId", operator: "=", value: ctx.user.id }]
+          });
+          return credential ? { pluginData: { requiresWebAuthn: true } } : void 0;
+        },
+        async verify(ctx, completion) {
+          if (!completion || typeof completion !== "object" || !("response" in completion))
+            throw Errors.unauthorized("Invalid WebAuthn completion");
+          const userId = await verifyAuthenticationProof(
+            ctx.db,
+            completion.response
+          );
+          if (userId !== ctx.user.id)
+            throw Errors.unauthorized("WebAuthn credential belongs to another user");
+        }
+      }
+    },
+    methods: (ctx) => ({
+      async generateRegistrationOptions(_input, routeCtx) {
+        const userId = routeCtx?.userId;
+        if (userId == null)
+          throw Errors.unauthorized("User not authenticated");
+        const user = await ctx.db.findOne({
+          model: "user",
+          where: [{ field: "id", operator: "=", value: userId }]
+        });
+        if (!user)
+          throw Errors.notFound("User not found");
+        const existing = await ctx.db.findMany({
+          model: "webauthn_credential",
+          where: [{ field: "userId", operator: "=", value: userId }]
+        });
+        await ctx.db.delete({
+          model: "webauthn_challenge",
+          where: [{ field: "userId", operator: "=", value: userId }]
+        });
+        const options = await (0, import_server.generateRegistrationOptions)({
+          rpName,
+          rpID,
+          userName: user.email,
+          userDisplayName: user.name,
+          userID: new TextEncoder().encode(String(userId)),
+          attestationType: attestation === "indirect" ? "none" : attestation,
+          excludeCredentials: existing.map((cred) => ({
+            id: cred.credentialId,
+            transports: cred.transports ? JSON.parse(cred.transports) : void 0
+          })),
+          authenticatorSelection,
+          timeout
+        });
+        await ctx.db.create({
+          model: "webauthn_challenge",
+          data: {
+            challenge: options.challenge,
+            userId,
+            expiresAt: new Date(Date.now() + challengeTTLSeconds * 1e3),
+            createdAt: /* @__PURE__ */ new Date()
+          }
+        });
+        return { options };
+      },
+      async verifyRegistration(input, routeCtx) {
+        const userId = routeCtx?.userId;
+        if (userId == null)
+          throw Errors.unauthorized("User not authenticated");
+        const { response } = input;
+        const challengeRecord = await ctx.db.findOne({
+          model: "webauthn_challenge",
+          where: [{ field: "userId", operator: "=", value: userId }]
+        });
+        if (!challengeRecord)
+          throw Errors.badRequest("No pending registration challenge");
+        if (new Date(challengeRecord.expiresAt) < /* @__PURE__ */ new Date()) {
+          await ctx.db.delete({
+            model: "webauthn_challenge",
+            where: [{ field: "id", operator: "=", value: challengeRecord.id }]
+          });
+          throw Errors.badRequest("Challenge expired");
+        }
+        const verification = await (0, import_server.verifyRegistrationResponse)({
+          response,
+          expectedChallenge: challengeRecord.challenge,
+          expectedOrigin: origin,
+          expectedRPID: rpID
+        });
+        if (!verification.verified || !verification.registrationInfo) {
+          throw Errors.badRequest("Registration verification failed");
+        }
+        const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+        await ctx.db.create({
+          model: "webauthn_credential",
+          data: {
+            userId,
+            credentialId: credential.id,
+            publicKey: uint8ArrayToBase64url(credential.publicKey),
+            counter: credential.counter,
+            deviceType: credentialDeviceType,
+            backedUp: credentialBackedUp,
+            transports: credential.transports ? JSON.stringify(credential.transports) : null,
+            createdAt: /* @__PURE__ */ new Date()
+          }
+        });
+        await ctx.db.delete({
+          model: "webauthn_challenge",
+          where: [{ field: "id", operator: "=", value: challengeRecord.id }]
+        });
+        return {
+          verified: true,
+          credentialId: credential.id,
+          credentialDeviceType,
+          credentialBackedUp
+        };
+      },
+      async generateAuthenticationOptions(input) {
+        const { userId } = input;
+        let allowCredentials;
+        if (userId) {
+          await ctx.db.delete({
+            model: "webauthn_challenge",
+            where: [{ field: "userId", operator: "=", value: userId }]
+          });
+          const credentials = await ctx.db.findMany({
+            model: "webauthn_credential",
+            where: [{ field: "userId", operator: "=", value: userId }]
+          });
+          allowCredentials = credentials.map((cred) => ({
+            id: cred.credentialId,
+            transports: cred.transports ? JSON.parse(cred.transports) : void 0
+          }));
+        }
+        const options = await (0, import_server.generateAuthenticationOptions)({
+          rpID,
+          allowCredentials,
+          userVerification: authenticatorSelection.userVerification,
+          timeout
+        });
+        await ctx.db.create({
+          model: "webauthn_challenge",
+          data: {
+            challenge: options.challenge,
+            userId: userId ?? null,
+            expiresAt: new Date(Date.now() + challengeTTLSeconds * 1e3),
+            createdAt: /* @__PURE__ */ new Date()
+          }
+        });
+        return { options };
+      },
+      async completeAuthentication(continuationToken, response, meta) {
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePendingAuth(continuationToken, { response }, meta);
+      },
+      async verifyAuthentication(input, meta) {
+        const userId = await verifyAuthenticationProof(ctx.db, input.response);
+        if (!supportPasswordless)
+          throw Errors.badRequest("Use completeAuthentication for second-factor WebAuthn");
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePluginAuth(userId, "webauthn", meta);
+      }
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  webauthn
+});