@byline/admin 6.7.2 → 6.9.0

package/dist/modules/auth/components/sign-in-form.js

@@ -1,20 +1,52 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { getAdminConfig } from "@byline/core";
 import { useTranslation } from "@byline/i18n/react";
-import { Alert, Button, Card, Input, InputPassword, LoaderEllipsis } from "@byline/ui/react";
+import { Alert, Button, Card, Input, InputPassword, LoaderEllipsis, PasskeyIcon } from "@byline/ui/react";
 import clsx from "clsx";
 import { useBylineAdminServices } from "../../../services/admin-services-context.js";
 import { normalizeRootRelativeRedirect, resolveSignInFormRedirect } from "../safe-redirect.js";
+import { passkeyErrorKey, signInWithPasskey } from "./passkey-browser.js";
 import sign_in_form_module from "./sign-in-form.module.js";
 function SignInForm({ redirectTo, homeUrl }) {
-    const { adminSignIn } = useBylineAdminServices();
+    const { adminSignIn, passkeys } = useBylineAdminServices();
     const { t } = useTranslation('byline-admin');
     const [email, setEmail] = useState('');
     const [password, setPassword] = useState('');
     const [pending, setPending] = useState(false);
     const [error, setError] = useState(null);
+    const mounted = useRef(false);
+    const [passkeysEnabled, setPasskeysEnabled] = useState(false);
+    useEffect(()=>{
+        let active = true;
+        mounted.current = true;
+        passkeys?.capability().then(({ enabled })=>{
+            if (active) setPasskeysEnabled(enabled);
+        }).catch(()=>{});
+        return ()=>{
+            active = false;
+            mounted.current = false;
+        };
+    }, [
+        passkeys
+    ]);
+    async function handlePasskey() {
+        if (!passkeys || pending) return;
+        setPending(true);
+        setError(null);
+        try {
+            await signInWithPasskey(passkeys, ()=>mounted.current);
+        } catch (error) {
+            if (mounted.current) {
+                setError(t(passkeyErrorKey(error)));
+                setPending(false);
+            }
+            return;
+        }
+        const destination = resolveSignInFormRedirect(redirectTo, getAdminConfig().routes.admin);
+        window.location.assign(normalizeRootRelativeRedirect(destination) ?? '/');
+    }
     async function handleSubmit(event) {
         event.preventDefault();
         if (pending) return;
@@ -115,6 +147,33 @@ function SignInForm({ redirectTo, homeUrl }) {
                         })
                     ]
                 })
+            }),
+            passkeysEnabled && /*#__PURE__*/ jsxs(Card.Footer, {
+                className: clsx('byline-sign-in-alternate', sign_in_form_module.alternate),
+                children: [
+                    /*#__PURE__*/ jsx("div", {
+                        className: clsx('byline-sign-in-divider', sign_in_form_module.divider),
+                        children: /*#__PURE__*/ jsx("span", {
+                            children: t('auth.signIn.alternate')
+                        })
+                    }),
+                    /*#__PURE__*/ jsxs(Button, {
+                        type: "button",
+                        variant: "outlined",
+                        disabled: pending,
+                        onClick: handlePasskey,
+                        className: clsx('byline-passkey-sign-in-button', sign_in_form_module["passkey-button"]),
+                        children: [
+                            /*#__PURE__*/ jsx(PasskeyIcon, {
+                                width: "20px",
+                                height: "20px"
+                            }),
+                            /*#__PURE__*/ jsx("span", {
+                                children: t('passkeys.signIn')
+                            })
+                        ]
+                    })
+                ]
             })
         ]
     });

package/dist/modules/auth/components/sign-in-form.module.js

@@ -7,6 +7,10 @@ const sign_in_form_module = {
     actions: "actions-bVKfoJ",
     "home-link": "home-link-YfGVyd",
     homeLink: "home-link-YfGVyd",
-    button: "button-paNjW_"
+    button: "button-paNjW_",
+    alternate: "alternate-bC6QfW",
+    divider: "divider-QyDRIH",
+    "passkey-button": "passkey-button-LpEiWc",
+    passkeyButton: "passkey-button-LpEiWc"
 };
 export default sign_in_form_module;

package/dist/modules/auth/components/sign-in-form_module.css

@@ -39,3 +39,43 @@
   margin-left: auto;
 }
 
+:is(.alternate-bC6QfW, .byline-sign-in-alternate) {
+  align-items: stretch;
+  gap: var(--spacing-16);
+  padding-bottom: var(--spacing-24);
+  flex-direction: column;
+}
+
+:is(.divider-QyDRIH, .byline-sign-in-divider) {
+  align-items: center;
+  gap: var(--spacing-12);
+  color: var(--gray-500);
+  font-size: var(--font-size-xs);
+  text-transform: uppercase;
+  letter-spacing: .04em;
+  display: flex;
+}
+
+.divider-QyDRIH:before, .divider-QyDRIH:after {
+  content: "";
+  border-top: var(--border-width-thin) var(--border-style-solid) var(--border-color, #8885);
+  flex: 1;
+}
+
+.byline-sign-in-divider:before {
+  content: "";
+  border-top: var(--border-width-thin) var(--border-style-solid) var(--border-color, #8885);
+  flex: 1;
+}
+
+.byline-sign-in-divider:after {
+  content: "";
+  border-top: var(--border-width-thin) var(--border-style-solid) var(--border-color, #8885);
+  flex: 1;
+}
+
+:is(.passkey-button-LpEiWc, .byline-passkey-sign-in-button) {
+  gap: var(--spacing-8);
+  width: 100%;
+}
+

package/dist/modules/auth/index.d.ts

@@ -19,9 +19,14 @@
  * Clerk, institutional SSO) should be shipped as separate packages
  * against `@byline/auth` rather than added here.
  */
+export { createAuthMaintenanceTasks } from './auth-maintenance.js';
 export { JwtSessionProvider, type JwtSessionProviderConfig, type NativeSessionEvent, } from './jwt-session-provider.js';
+export { createPasskeyRequestLimiter } from './passkey-rate-limiter.js';
+export { assertPasskeyAttempt, assertPasskeyBytes, assertPasskeyClaim, assertPasskeyTokenHash, } from './passkey-storage-validation.js';
 export { hashPassword, verifyPassword } from './password.js';
 export { resolveActor } from './resolve-actor.js';
 export { createPasswordSignInLimiter, type SignInLimiterOptions, type SignInRateLimitPolicy, type SignInRateLimitStore, type SignInSecurityEvent, } from './sign-in-rate-limiter.js';
+export type { AuthMaintenanceRepository } from './auth-maintenance-repository.js';
 export type { LoginSessionRow, LoginSessionsRepository } from './login-sessions-repository.js';
+export type { PasskeyAttemptRow, PasskeyClaimInput, PasskeyCredentialRow, PasskeysRepository, } from './passkeys-repository.js';
 export type { IssueRefreshTokenInput, RefreshTokenRow, RefreshTokensRepository, } from './refresh-tokens-repository.js';

package/dist/modules/auth/index.js

@@ -1,4 +1,7 @@
+export { createAuthMaintenanceTasks } from "./auth-maintenance.js";
 export { JwtSessionProvider } from "./jwt-session-provider.js";
+export { createPasskeyRequestLimiter } from "./passkey-rate-limiter.js";
+export { assertPasskeyAttempt, assertPasskeyBytes, assertPasskeyClaim, assertPasskeyTokenHash } from "./passkey-storage-validation.js";
 export { hashPassword, verifyPassword } from "./password.js";
 export { resolveActor } from "./resolve-actor.js";
 export { createPasswordSignInLimiter } from "./sign-in-rate-limiter.js";

package/dist/modules/auth/jwt-session-provider.d.ts

@@ -5,13 +5,20 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import { type AdminAuth, type RefreshSessionArgs, type RevokeSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
+import { type AdminAuth, type PasskeyProvider, type RefreshSessionArgs, type RevokeSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
+import type { PasskeyConfig } from '@byline/core';
 import type { AdminStore } from '../../store.js';
-export interface NativeSessionEvent {
+export type NativeSessionEvent = {
     type: 'refresh_attempted' | 'refresh_completed' | 'refresh_contested';
-}
+} | {
+    type: 'passkey_attempted' | 'passkey_completed' | 'passkey_failed' | 'passkey_admission_denied';
+    purpose: 'sign-in-options' | 'sign-in' | 'password-proof' | 'proof-options' | 'proof' | 'enrollment-options' | 'enrollment' | 'list' | 'rename' | 'remove';
+    reason?: 'invalid-proof' | 'stale-authority' | 'forbidden' | 'limit' | 'unavailable' | 'capacity' | 'network';
+};
 export interface JwtSessionProviderConfig {
-    /** Best-effort, token-free renewal telemetry. Errors never change authentication outcomes. */
+    /** Optional explicit WebAuthn trust configuration; disabled when absent. */
+    passkeys?: PasskeyConfig;
+    /** Best-effort, token-free authentication telemetry. Errors never change authentication outcomes. */
     onEvent?: (event: NativeSessionEvent) => void;
     /**
      * Adapter-backed admin repositories. Construct via the DB adapter's
@@ -40,6 +47,7 @@ export interface JwtSessionProviderConfig {
 export declare class JwtSessionProvider implements SessionProvider {
     #private;
     readonly capabilities: SessionProviderCapabilities;
+    readonly passkeys?: PasskeyProvider;
     constructor(config: JwtSessionProviderConfig);
     signInWithPassword(args: SignInWithPasswordArgs): Promise<SignInResult>;
     verifyAccessToken(token: string): Promise<{

package/dist/modules/auth/jwt-session-provider.js

@@ -3,6 +3,7 @@ import { ERR_ACCESS_EXPIRED, ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_
 import { passwordSignInSchema } from "@byline/core/validation";
 import { SignJWT, compactVerify, jwtVerify } from "jose";
 import { v7 } from "uuid";
+import { NativePasskeyProvider } from "./native-passkey-provider.js";
 import { verifyPassword } from "./password.js";
 import { resolveActor, resolveActorFromUser } from "./resolve-actor.js";
 function _check_private_redeclaration(obj, privateCollection) {
@@ -52,11 +53,11 @@ const CAPABILITIES = {
     magicLink: false,
     sso: false
 };
-var _onEvent = /*#__PURE__*/ new WeakMap(), _store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _emit = /*#__PURE__*/ new WeakSet(), _observedLogins = /*#__PURE__*/ new WeakSet(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
+var _onEvent = /*#__PURE__*/ new WeakMap(), jwt_session_provider_store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _verifyAccessTokenAtStore = /*#__PURE__*/ new WeakSet(), _emit = /*#__PURE__*/ new WeakSet(), _emitEvent = /*#__PURE__*/ new WeakSet(), _authenticatePasskeySession = /*#__PURE__*/ new WeakSet(), _completeSignIn = /*#__PURE__*/ new WeakSet(), _observedLogins = /*#__PURE__*/ new WeakSet(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
 class JwtSessionProvider {
     async signInWithPassword(args) {
         const credentials = passwordSignInSchema.parse(args);
-        const users = _class_private_field_get(this, _store).adminUsers;
+        const users = _class_private_field_get(this, jwt_session_provider_store).adminUsers;
         const row = await users.getByEmailForSignIn(credentials.email);
         if (!row) {
             await verifyPassword(credentials.password, DUMMY_HASH_FOR_TIMING);
@@ -74,99 +75,27 @@ class JwtSessionProvider {
         if (!row.is_enabled) throw ERR_ACCOUNT_DISABLED({
             message: 'account disabled'
         });
-        const previous = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, args);
-        const withLocks = (work)=>previous.length ? _class_private_field_get(this, _store).withSessionLocks([
-                row.id,
-                ...previous.map((login)=>login.admin_user_id)
-            ], work) : _class_private_field_get(this, _store).withSessionLock(row.id, (store)=>work(store));
-        return withLocks(async (store)=>{
-            const current = await store.adminUsers.getByIdForSignIn(row.id);
-            if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
-                message: 'account disabled'
-            });
-            if (current.password_hash !== row.password_hash || current.session_version !== row.session_version) throw ERR_INVALID_CREDENTIALS({
+        return _class_private_method_get(this, _completeSignIn, completeSignIn).call(this, row, args, async (_store, current)=>{
+            if (current.password_hash !== row.password_hash) throw ERR_INVALID_CREDENTIALS({
                 message: 'credentials changed during sign-in'
             });
-            for (const observed of previous){
-                const login = await store.loginSessions.findById(observed.id);
-                if (login && login.admin_user_id === observed.admin_user_id) await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
-            }
-            await store.adminUsers.recordLoginSuccess(row.id, args.ip ?? null);
-            const actor = await resolveActorFromUser(store, current);
-            if (!actor) throw ERR_ACCOUNT_DISABLED({
-                message: 'account disabled'
-            });
-            const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, store, {
-                adminUserId: row.id,
-                sessionVersion: current.session_version,
-                ip: args.ip ?? null,
-                userAgent: args.userAgent ?? null
-            });
-            return {
-                ...tokens,
-                actor
-            };
         });
     }
     async verifyAccessToken(token) {
-        let payload;
-        try {
-            const result = await jwtVerify(token, _class_private_field_get(this, _signingKey), {
-                issuer: _class_private_field_get(this, _issuer),
-                algorithms: [
-                    'HS256'
-                ],
-                currentDate: _class_private_field_get(this, _now).call(this),
-                requiredClaims: [
-                    'sub',
-                    'iat',
-                    'exp',
-                    'jti',
-                    'sv',
-                    'sid'
-                ]
-            });
-            payload = result.payload;
-        } catch (err) {
-            if (err instanceof Error && 'code' in err && 'ERR_JWT_EXPIRED' === err.code) throw ERR_ACCESS_EXPIRED({
-                message: 'access token expired'
-            });
-            throw ERR_INVALID_TOKEN({
-                message: 'access token verification failed',
-                cause: err
-            });
-        }
-        if ('access' !== payload.typ || 'string' != typeof payload.sub || !validSid(payload.sid) || !Number.isSafeInteger(payload.sv) || payload.sv < 0) throw ERR_INVALID_TOKEN({
-            message: 'unexpected token type'
-        });
-        const current = await _class_private_field_get(this, _store).adminUsers.getByIdForSignIn(payload.sub);
-        if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
-            message: 'account disabled or deleted'
-        });
-        if (current.session_version !== payload.sv) throw ERR_REVOKED_TOKEN({
-            message: 'account session generation changed'
-        });
-        const login = await _class_private_field_get(this, _store).loginSessions.findById(payload.sid);
-        if (!login || login.admin_user_id !== payload.sub || login.session_version !== payload.sv || null != login.revoked_at || login.expires_at.getTime() <= _class_private_field_get(this, _now).call(this).getTime()) throw ERR_REVOKED_TOKEN({
-            message: 'login revoked or expired'
-        });
-        const actor = await resolveActorFromUser(_class_private_field_get(this, _store), current);
-        if (!actor) throw ERR_ACCOUNT_DISABLED({
-            message: 'account disabled or deleted'
-        });
+        const { actor, sessionId } = await _class_private_method_get(this, _verifyAccessTokenAtStore, verifyAccessTokenAtStore).call(this, token, _class_private_field_get(this, jwt_session_provider_store));
         return {
             actor,
-            sessionId: payload.sid
+            sessionId
         };
     }
     async refreshSession(args) {
         _class_private_method_get(this, _emit, emit).call(this, 'refresh_attempted');
         const hash = hashToken(args.refreshToken);
-        const observed = await _class_private_field_get(this, _store).refreshTokens.findByHash(hash);
+        const observed = await _class_private_field_get(this, jwt_session_provider_store).refreshTokens.findByHash(hash);
         if (!observed) throw ERR_INVALID_TOKEN({
             message: 'refresh token not recognised'
         });
-        const outcome = await _class_private_field_get(this, _store).withSessionLock(observed.admin_user_id, async (store, user)=>{
+        const outcome = await _class_private_field_get(this, jwt_session_provider_store).withSessionLock(observed.admin_user_id, async (store, user)=>{
             if (!user?.is_enabled) throw ERR_ACCOUNT_DISABLED({
                 message: 'account disabled or deleted'
             });
@@ -242,21 +171,25 @@ class JwtSessionProvider {
         if (args.expectedSessionId && logins.some((login)=>login.id !== args.expectedSessionId)) throw ERR_SESSION_CHANGED({
             message: 'session changed before logout'
         });
-        for (const login of logins)await _class_private_field_get(this, _store).withSessionLock(login.admin_user_id, async (store)=>{
+        for (const login of logins)await _class_private_field_get(this, jwt_session_provider_store).withSessionLock(login.admin_user_id, async (store)=>{
             await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
         });
         if (args.refreshToken) {
-            const row = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.refreshToken));
-            if (row) await _class_private_field_get(this, _store).withSessionLock(row.admin_user_id, async (store)=>{
+            const row = await _class_private_field_get(this, jwt_session_provider_store).refreshTokens.findByHash(hashToken(args.refreshToken));
+            if (row) await _class_private_field_get(this, jwt_session_provider_store).withSessionLock(row.admin_user_id, async (store)=>{
                 await store.refreshTokens.revokeChain(row.id, _class_private_field_get(this, _now).call(this));
             });
         }
     }
     async resolveActor(adminUserId) {
-        return resolveActor(_class_private_field_get(this, _store), adminUserId);
+        return resolveActor(_class_private_field_get(this, jwt_session_provider_store), adminUserId);
     }
     constructor(config){
+        _class_private_method_init(this, _verifyAccessTokenAtStore);
         _class_private_method_init(this, _emit);
+        _class_private_method_init(this, _emitEvent);
+        _class_private_method_init(this, _authenticatePasskeySession);
+        _class_private_method_init(this, _completeSignIn);
         _class_private_method_init(this, _observedLogins);
         _class_private_method_init(this, _issueTokens);
         _class_private_method_init(this, _signAccessToken);
@@ -264,7 +197,7 @@ class JwtSessionProvider {
             writable: true,
             value: void 0
         });
-        _class_private_field_init(this, _store, {
+        _class_private_field_init(this, jwt_session_provider_store, {
             writable: true,
             value: void 0
         });
@@ -288,25 +221,133 @@ class JwtSessionProvider {
             writable: true,
             value: void 0
         });
-        this.capabilities = CAPABILITIES;
         _class_private_field_set(this, _onEvent, config.onEvent);
-        _class_private_field_set(this, _store, config.store);
+        _class_private_field_set(this, jwt_session_provider_store, config.store);
         _class_private_field_set(this, _signingKey, 'string' == typeof config.signingSecret ? new TextEncoder().encode(config.signingSecret) : config.signingSecret);
         if (_class_private_field_get(this, _signingKey).byteLength < 32) throw new Error('JwtSessionProvider: signingSecret must carry at least 32 bytes of entropy (256 bits)');
         _class_private_field_set(this, _issuer, config.issuer ?? DEFAULT_ISSUER);
         _class_private_field_set(this, _accessTtl, config.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS);
         _class_private_field_set(this, _refreshTtl, config.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS);
         _class_private_field_set(this, _now, config.now ?? (()=>new Date()));
+        this.capabilities = config.passkeys ? {
+            ...CAPABILITIES,
+            passkeys: true
+        } : CAPABILITIES;
+        if (config.passkeys) this.passkeys = new NativePasskeyProvider(config.passkeys, {
+            store: _class_private_field_get(this, jwt_session_provider_store),
+            now: _class_private_field_get(this, _now),
+            authenticate: (session, store)=>_class_private_method_get(this, _authenticatePasskeySession, authenticatePasskeySession).call(this, session, store),
+            signIn: (snapshot, args, recheck)=>_class_private_method_get(this, _completeSignIn, completeSignIn).call(this, snapshot, args, recheck),
+            emit: (event)=>_class_private_method_get(this, _emitEvent, emitEvent).call(this, event)
+        });
+    }
+}
+async function verifyAccessTokenAtStore(token, store) {
+    let payload;
+    try {
+        const result = await jwtVerify(token, _class_private_field_get(this, _signingKey), {
+            issuer: _class_private_field_get(this, _issuer),
+            algorithms: [
+                'HS256'
+            ],
+            currentDate: _class_private_field_get(this, _now).call(this),
+            requiredClaims: [
+                'sub',
+                'iat',
+                'exp',
+                'jti',
+                'sv',
+                'sid'
+            ]
+        });
+        payload = result.payload;
+    } catch (err) {
+        if (err instanceof Error && 'code' in err && 'ERR_JWT_EXPIRED' === err.code) throw ERR_ACCESS_EXPIRED({
+            message: 'access token expired'
+        });
+        throw ERR_INVALID_TOKEN({
+            message: 'access token verification failed',
+            cause: err
+        });
     }
+    if ('access' !== payload.typ || 'string' != typeof payload.sub || !validSid(payload.sid) || !Number.isSafeInteger(payload.sv) || payload.sv < 0) throw ERR_INVALID_TOKEN({
+        message: 'unexpected token type'
+    });
+    const current = await store.adminUsers.getByIdForSignIn(payload.sub);
+    if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+        message: 'account disabled or deleted'
+    });
+    if (current.session_version !== payload.sv) throw ERR_REVOKED_TOKEN({
+        message: 'account session generation changed'
+    });
+    const login = await store.loginSessions.findById(payload.sid);
+    if (!login || login.admin_user_id !== payload.sub || login.session_version !== payload.sv || null != login.revoked_at || login.expires_at.getTime() <= _class_private_field_get(this, _now).call(this).getTime()) throw ERR_REVOKED_TOKEN({
+        message: 'login revoked or expired'
+    });
+    const actor = await resolveActorFromUser(store, current);
+    if (!actor) throw ERR_ACCOUNT_DISABLED({
+        message: 'account disabled or deleted'
+    });
+    return {
+        actor,
+        sessionId: payload.sid,
+        user: current
+    };
 }
 function emit(type) {
+    _class_private_method_get(this, _emitEvent, emitEvent).call(this, {
+        type
+    });
+}
+function emitEvent(event) {
     var _this, _this1;
     try {
-        null == (_this = _class_private_field_get(_this1 = this, _onEvent)) || _this.call(_this1, {
-            type
-        });
+        Promise.resolve(null == (_this = _class_private_field_get(_this1 = this, _onEvent)) ? void 0 : _this.call(_this1, event)).catch(()=>{});
     } catch  {}
 }
+async function authenticatePasskeySession(session, store = _class_private_field_get(this, jwt_session_provider_store)) {
+    const result = await _class_private_method_get(this, _verifyAccessTokenAtStore, verifyAccessTokenAtStore).call(this, session.accessToken, store);
+    if (result.sessionId !== session.expectedSessionId) throw ERR_SESSION_CHANGED({
+        message: 'session changed'
+    });
+    return result;
+}
+async function completeSignIn(snapshot, args, recheck) {
+    const previous = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, args);
+    const withLocks = (work)=>previous.length ? _class_private_field_get(this, jwt_session_provider_store).withSessionLocks([
+            snapshot.id,
+            ...previous.map((login)=>login.admin_user_id)
+        ], work) : _class_private_field_get(this, jwt_session_provider_store).withSessionLock(snapshot.id, (store)=>work(store));
+    return withLocks(async (store)=>{
+        const current = await store.adminUsers.getByIdForSignIn(snapshot.id);
+        if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+            message: 'account disabled'
+        });
+        if (current.session_version !== snapshot.session_version) throw ERR_INVALID_CREDENTIALS({
+            message: 'credentials changed during sign-in'
+        });
+        await recheck(store, current);
+        for (const observed of previous){
+            const login = await store.loginSessions.findById(observed.id);
+            if (login && login.admin_user_id === observed.admin_user_id) await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
+        }
+        await store.adminUsers.recordLoginSuccess(snapshot.id, args.ip ?? null);
+        const actor = await resolveActorFromUser(store, current);
+        if (!actor) throw ERR_ACCOUNT_DISABLED({
+            message: 'account disabled'
+        });
+        const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, store, {
+            adminUserId: snapshot.id,
+            sessionVersion: current.session_version,
+            ip: args.ip ?? null,
+            userAgent: args.userAgent ?? null
+        });
+        return {
+            ...tokens,
+            actor
+        };
+    });
+}
 async function observedLogins(args) {
     const ids = new Set();
     if (args.previousAccessToken) {
@@ -320,20 +361,20 @@ async function observedLogins(args) {
             claims = JSON.parse(new TextDecoder().decode(verified.payload));
         } catch  {}
         if (claims?.iss === _class_private_field_get(this, _issuer) && 'access' === claims.typ && validSid(claims.sid) && 'string' == typeof claims.sub) {
-            const login = await _class_private_field_get(this, _store).loginSessions.findById(claims.sid);
+            const login = await _class_private_field_get(this, jwt_session_provider_store).loginSessions.findById(claims.sid);
             if (login?.admin_user_id === claims.sub) ids.add(login.id);
         }
     }
     if (args.previousRefreshToken) {
-        const token = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.previousRefreshToken));
+        const token = await _class_private_field_get(this, jwt_session_provider_store).refreshTokens.findByHash(hashToken(args.previousRefreshToken));
         if (token?.sid) {
-            const login = await _class_private_field_get(this, _store).loginSessions.findById(token.sid);
+            const login = await _class_private_field_get(this, jwt_session_provider_store).loginSessions.findById(token.sid);
             if (login?.admin_user_id === token.admin_user_id) ids.add(login.id);
         }
     }
     const result = [];
     for (const id of ids){
-        const login = await _class_private_field_get(this, _store).loginSessions.findById(id);
+        const login = await _class_private_field_get(this, jwt_session_provider_store).loginSessions.findById(id);
         if (login) result.push(login);
     }
     return result;

package/dist/modules/auth/native-passkey-provider.d.ts

@@ -0,0 +1,72 @@
+/**
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type AdminAuth, type PasskeyAdmissionReason, type PasskeyAuthenticationOptions, type PasskeyCeremony, type PasskeyCredentialSummary, type PasskeyManagementAction, type PasskeyManagementGrant, type PasskeyOperation, type PasskeyProvider, type PasskeyRegistrationOptions, type PasskeyRequestMetadata, type PasskeySession, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
+import { type PasskeyConfig } from '@byline/core';
+import type { AdminStore } from '../../store.js';
+import type { AdminUserWithPasswordRow } from '../admin-users/repository.js';
+import type { NativeSessionEvent } from './jwt-session-provider.js';
+type Authenticated = {
+    actor: AdminAuth;
+    user: AdminUserWithPasswordRow;
+    sessionId: string;
+};
+type SignInArgs = Pick<SignInWithPasswordArgs, 'previousAccessToken' | 'previousRefreshToken' | 'ip' | 'userAgent'>;
+type PasskeyEvent = Extract<NativeSessionEvent, {
+    purpose: string;
+}>;
+interface NativeDependencies {
+    store: AdminStore;
+    now(): Date;
+    authenticate(session: PasskeySession, store?: AdminStore): Promise<Authenticated>;
+    /** Private constructor closure supplied only by JwtSessionProvider; never publicly exported. */
+    signIn(snapshot: AdminUserWithPasswordRow, args: SignInArgs, recheck: (store: AdminStore, user: AdminUserWithPasswordRow) => Promise<void>): Promise<SignInResult>;
+    emit(event: PasskeyEvent): void;
+}
+/** Internal native implementation. Public callers enter through SessionProvider.passkeys. */
+export declare class NativePasskeyProvider implements PasskeyProvider {
+    #private;
+    private readonly deps;
+    constructor(trust: PasskeyConfig, deps: NativeDependencies);
+    recordAdmissionDenied(purpose: PasskeyOperation, reason: PasskeyAdmissionReason): void;
+    signInOptions(_metadata: PasskeyRequestMetadata): Promise<PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    verifySignIn(args: SignInArgs & {
+        ceremonyId: string;
+        response: unknown;
+    }): Promise<SignInResult>;
+    passwordProof(args: PasskeySession & {
+        password: string;
+        action: PasskeyManagementAction;
+    }): Promise<PasskeyManagementGrant>;
+    proofOptions(args: PasskeySession & {
+        action: PasskeyManagementAction;
+    }): Promise<PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    verifyProof(args: PasskeySession & {
+        ceremonyId: string;
+        response: unknown;
+    }): Promise<PasskeyManagementGrant>;
+    enrollmentOptions(args: PasskeySession & {
+        grantId: string;
+    }): Promise<PasskeyCeremony<PasskeyRegistrationOptions>>;
+    verifyEnrollment(args: PasskeySession & {
+        ceremonyId: string;
+        response: unknown;
+        name: string;
+    }): Promise<PasskeyCredentialSummary>;
+    listCredentials(args: PasskeySession & {
+        targetUserId?: string;
+    }): Promise<PasskeyCredentialSummary[]>;
+    renameCredential(args: PasskeySession & {
+        credentialRecordId: string;
+        name: string;
+    }): Promise<PasskeyCredentialSummary>;
+    removeCredential(args: PasskeySession & {
+        grantId: string;
+    }): Promise<{
+        signedOut: boolean;
+    }>;
+}
+export {};