@camstack/server 1.2.485 → 1.2.487

package/dist/agent/agent-mesh-join.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentMeshJoin = createAgentMeshJoin;
+/**
+ * The agent's mesh join (D802): authenticate to the hub on every connection,
+ * before anything else reaches it, and check that the hub is the hub.
+ *
+ * `MeshJoinClient` (in `@camstack/system`) holds the protocol and the call
+ * gate; this file binds it to the agent's broker lifecycle:
+ *  - the hub connects → a join runs;
+ *  - the hub disconnects → back to `pending` (calls wait for the next join);
+ *  - the hub says "not authenticated" (it restarted and lost us) → join again;
+ *  - the join settles `unavailable` (the hub cannot read its secret yet) →
+ *    retried every {@link REJOIN_INTERVAL_MS} while connected.
+ */
+const system_1 = require("@camstack/system");
+const REJOIN_INTERVAL_MS = 15_000;
+const HUB_NODE_ID = 'hub';
+function nodeIdOf(data) {
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const node = Reflect.get(data, 'node');
+    if (node === null || typeof node !== 'object')
+        return undefined;
+    const id = Reflect.get(node, 'id');
+    return typeof id === 'string' ? id : undefined;
+}
+function createAgentMeshJoin(opts) {
+    let connected = false;
+    let rejoinTimer = null;
+    const clearRejoin = () => {
+        if (rejoinTimer !== null)
+            clearTimeout(rejoinTimer);
+        rejoinTimer = null;
+    };
+    const client = new system_1.MeshJoinClient({
+        nodeId: opts.nodeId,
+        secret: opts.secret,
+        call: opts.call,
+        hubNodeId: HUB_NODE_ID,
+        ...(opts.log !== undefined ? { log: opts.log } : {}),
+        onSettled: (state) => {
+            opts.onState?.(state);
+            clearRejoin();
+            if (state === 'unavailable' && connected) {
+                rejoinTimer = setTimeout(() => void runJoin(), REJOIN_INTERVAL_MS);
+                rejoinTimer.unref?.();
+            }
+        },
+    });
+    const runJoin = async () => {
+        if (!connected)
+            return;
+        await client.join();
+    };
+    const rejoin = () => {
+        client.reset();
+        void runJoin();
+    };
+    return {
+        client,
+        middleware: client.middleware(rejoin),
+        attach(broker) {
+            broker.localBus.on('$node.connected', (data) => {
+                if (nodeIdOf(data) !== HUB_NODE_ID)
+                    return;
+                connected = true;
+                rejoin();
+            });
+            broker.localBus.on('$node.disconnected', (data) => {
+                if (nodeIdOf(data) !== HUB_NODE_ID)
+                    return;
+                connected = false;
+                clearRejoin();
+                client.reset();
+            });
+        },
+        stop: clearRejoin,
+    };
+}

package/dist/agent/main.js

@@ -44,6 +44,7 @@ const package_dir_utils_js_1 = require("../core/addon/package-dir-utils.js");
 const single_copy_cleanup_runner_js_1 = require("../single-copy-cleanup-runner.js");
 const addon_scan_js_1 = require("./addon-scan.js");
 const agent_addon_updates_js_1 = require("./agent-addon-updates.js");
+const agent_mesh_join_js_1 = require("./agent-mesh-join.js");
 const agent_config_js_1 = require("./agent-config.js");
 const agent_group_runner_js_1 = require("./agent-group-runner.js");
 const agent_http_js_1 = require("./agent-http.js");
@@ -144,12 +145,46 @@ async function startAgent(configPath) {
         }
     }
     console.log(`[Agent] Addon packages ready in ${config.addonsDir}`);
+    // D802: the mesh join. Every call to the hub waits for the challenge–response
+    // (and the hub's own proof) on each connection. The secret comes from
+    // `agent.json`; a secret saved on the status page / desktop Setup takes
+    // effect through `reconnect()` below, which re-reads the file.
+    let currentSecret = config.secret ?? null;
+    let joinState = 'pending';
+    /** A registration waited for a join that had not settled; the join re-fires it. */
+    let registrationDeferred = false;
+    const meshJoin = (0, agent_mesh_join_js_1.createAgentMeshJoin)({
+        nodeId: config.nodeId,
+        secret: () => currentSecret,
+        call: (action, params, opts) => broker.call(action, params, opts),
+        log: (msg) => console.log(`[Agent] ${msg}`),
+        onState: (state) => {
+            joinState = state;
+            if (state === 'secret-mismatch' || state === 'hub-unverified') {
+                hubConnectionStateOverride = 'secret-mismatch';
+                consoleLogger.error(state === 'secret-mismatch'
+                    ? "mesh join refused: cluster secret mismatch — copy the cluster secret from the hub's System → Cluster page into this agent's setup"
+                    : 'mesh join refused: the node answering as the hub could not prove the cluster secret — check the hub address and the secret');
+            }
+            else if (hubConnectionStateOverride === 'secret-mismatch') {
+                hubConnectionStateOverride = null;
+            }
+            const blocking = state === 'secret-mismatch' || state === 'hub-unverified';
+            if (!blocking && registrationDeferred)
+                triggerUpwardRegistration();
+            if (state === 'no-secret') {
+                consoleLogger.warn("no cluster secret configured — the hub tolerates this agent only while its System → Cluster is in Transition. Copy the hub's cluster secret into this agent's setup");
+            }
+        },
+    });
     let broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
         mode: 'agent',
         hubAddress: config.hubAddress,
         logLevel: config.logLevel,
+        middlewares: [meshJoin.middleware],
     });
+    meshJoin.attach(broker);
     /**
      * Reconnect: stop the current broker, reload config from file,
      * create a new broker with the updated hub/secret, and restart.
@@ -178,12 +213,18 @@ async function startAgent(configPath) {
             process.env['CAMSTACK_HUB_URL'] = freshHubUrl;
             console.log(`[Agent] Derived CAMSTACK_HUB_URL=${freshHubUrl} from hub address "${fresh.hubAddress}"`);
         }
+        currentSecret = fresh.secret ?? null;
         broker = (0, system_1.createBroker)({
             nodeID: config.nodeId,
             mode: 'agent',
             hubAddress: fresh.hubAddress,
             logLevel: fresh.logLevel,
+            middlewares: [meshJoin.middleware],
         });
+        meshJoin.attach(broker);
+        // The boot-time `$node.connected` listeners belong to the old broker: let
+        // the next settled join on this one re-send the manifest (D802).
+        registrationDeferred = true;
         await broker.start();
         console.log('[Agent] Reconnected successfully');
     };
@@ -301,7 +342,12 @@ async function startAgent(configPath) {
         // carries the agent's root-package identity so the hub's HubNodeRegistry
         // (and the Server management UI) sees every node's exact version.
         const rootPackage = agentUpdateService.getRunningRootPackage();
-        return (0, system_1.buildNodeManifest)(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, config.secret ? (0, system_1.hashClusterSecret)(config.secret) : undefined, rootPackage.version === null
+        return (0, system_1.buildNodeManifest)(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, 
+        // D802: the replayable D797 hash goes out ONLY to a hub that predates the
+        // challenge–response join. After a successful join nothing is sent.
+        joinState === 'unsupported' && currentSecret !== null && currentSecret.length > 0
+            ? (0, system_1.hashClusterSecret)(currentSecret)
+            : undefined, rootPackage.version === null
             ? undefined
             : { name: rootPackage.name, version: rootPackage.version });
     }
@@ -313,6 +359,19 @@ async function startAgent(configPath) {
      *   - on hub reconnect (via `$node.connected`)
      */
     function triggerUpwardRegistration() {
+        // D802: the manifest goes to the hub only once the mesh join has settled —
+        // never to a node that could not prove it is the hub — and it is built
+        // AFTER the join, so it carries the legacy hash only for a hub that needs it.
+        meshJoin.client.whenCallable().then(() => {
+            registrationDeferred = false;
+            sendUpwardRegistration();
+        }, () => {
+            // Blocked (mismatch / unverified hub) or the join is still pending:
+            // the next settled join re-fires it (`onState`).
+            registrationDeferred = true;
+        });
+    }
+    function sendUpwardRegistration() {
         (0, system_1.callRegisterNodeWithRetry)(broker, aggregateManifest(), {
             target: 'hub',
             signal: registerAbortController.signal,
@@ -325,7 +384,7 @@ async function startAgent(configPath) {
         })
             .catch((err) => {
             if ((0, system_1.isClusterSecretMismatchError)(err)) {
-                consoleLogger.error('hub registration rejected: cluster secret mismatch — enter the hub\'s cluster secret (System → Cluster) in this agent\'s setup (agent.json) and restart the agent');
+                consoleLogger.error("hub registration rejected: cluster secret mismatch — enter the hub's cluster secret (System → Cluster) in this agent's setup (agent.json) and restart the agent");
                 // Surface the mismatch in the UI status.
                 hubConnectionStateOverride = 'secret-mismatch';
                 return;

package/dist/api/auth-whoami.js

@@ -14,7 +14,7 @@ async function registerAuthWhoamiRoute(fastify, authService, addonRegistry) {
             const ok = {
                 ok: true,
                 kind: 'jwt',
-                userId: payload.userId ?? payload.keyId ?? 'unknown',
+                userId: payload.userId ?? 'unknown',
                 username: payload.username ?? 'unknown',
                 isAdmin: payload.isAdmin,
             };

package/dist/api/core/auth-admin-tokens.procedures.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthAuditRecordSchema = exports.AdminTokenSchema = exports.ADMIN_TOKEN_MAX_DAYS = exports.ADMIN_TOKEN_DEFAULT_DAYS = void 0;
+exports.createAdminTokenProcedures = createAdminTokenProcedures;
+/**
+ * Admin tokens (`csa_`) and the auth audit trail, as the `auth` router serves
+ * them. The token store and its rules are local-auth's
+ * (`admin-token-manager.ts`); this layer adds who may mint one: an ADMIN, in a
+ * real signed-in session (never a token minting a token), right after
+ * re-authenticating. Every create / use / revoke is audited.
+ */
+const system_1 = require("@camstack/system");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const DAY_MS = 86_400_000;
+exports.ADMIN_TOKEN_DEFAULT_DAYS = 7;
+exports.ADMIN_TOKEN_MAX_DAYS = system_1.ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
+exports.AdminTokenSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    createdBy: zod_1.z.string(),
+    name: zod_1.z.string(),
+    tokenPrefix: zod_1.z.string(),
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number(),
+    lastUsedAt: zod_1.z.number().nullable(),
+    revokedAt: zod_1.z.number().nullable(),
+});
+exports.AuthAuditRecordSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    at: zod_1.z.number(),
+    action: zod_1.z.string(),
+    userId: zod_1.z.string().optional(),
+    ip: zod_1.z.string().optional(),
+    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+});
+function requireInternal(registry) {
+    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+    if (internal === null) {
+        throw new server_1.TRPCError({
+            code: 'PRECONDITION_FAILED',
+            message: 'User management is not available',
+        });
+    }
+    return internal;
+}
+function createAdminTokenProcedures(deps) {
+    return {
+        /**
+         * ADMIN — mint an admin token for an ops script. Requires a real
+         * signed-in session (an admin token cannot mint another) and a fresh
+         * re-authentication. Expiry mandatory: 1–90 days, default 7. The token
+         * is in this answer only.
+         */
+        createAdminToken: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({
+            name: zod_1.z.string().trim().min(1).max(80),
+            expiresInDays: zod_1.z
+                .number()
+                .int()
+                .min(1)
+                .max(exports.ADMIN_TOKEN_MAX_DAYS)
+                .default(exports.ADMIN_TOKEN_DEFAULT_DAYS),
+            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+        }))
+            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.AdminTokenSchema }))
+            .mutation(async ({ ctx, input }) => {
+            if (ctx.user.isScoped === true ||
+                ctx.user.shareView !== undefined ||
+                ctx.user.credential !== undefined) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'An admin token can only be created from a signed-in admin session',
+                });
+            }
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
+            const internal = requireInternal(deps.registry);
+            const created = await internal.adminTokens.create({
+                createdBy: ctx.user.id,
+                name: input.name,
+                expiresAt: Date.now() + input.expiresInDays * DAY_MS,
+            });
+            const ip = deps.network.clientAddress(ctx.req).ip;
+            await internal.audit.record({
+                action: 'admin-token-created',
+                userId: ctx.user.id,
+                ...(ip !== null ? { ip } : {}),
+                detail: {
+                    tokenId: created.record.id,
+                    name: created.record.name,
+                    prefix: created.record.tokenPrefix,
+                    expiresAt: created.record.expiresAt,
+                },
+            });
+            return created;
+        }),
+        /** ADMIN — every admin token not yet reaped (no secrets). */
+        listAdminTokens: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(exports.AdminTokenSchema))
+            .query(async () => [...(await requireInternal(deps.registry).adminTokens.list())]),
+        /** ADMIN — revoke one admin token; it stops working at once. */
+        revokeAdminToken: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            const internal = requireInternal(deps.registry);
+            const success = await internal.adminTokens.revoke(input.id);
+            if (success) {
+                const ip = deps.network.clientAddress(ctx.req).ip;
+                await internal.audit.record({
+                    action: 'admin-token-revoked',
+                    userId: ctx.user.id,
+                    ...(ip !== null ? { ip } : {}),
+                    detail: { tokenId: input.id },
+                });
+            }
+            return { success };
+        }),
+        /** ADMIN — the authentication audit trail, newest first. */
+        listAuthAudit: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z
+            .object({
+            limit: zod_1.z.number().int().min(1).max(500).optional(),
+            userId: zod_1.z.string().min(1).optional(),
+        })
+            .optional())
+            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
+            .query(async ({ input }) => [
+            ...(await requireInternal(deps.registry).audit.list({
+                ...(input?.limit !== undefined ? { limit: input.limit } : {}),
+                ...(input?.userId !== undefined ? { userId: input.userId } : {}),
+            })),
+        ]),
+    };
+}

package/dist/api/core/auth-limits.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROCESS_AUTH_LIMITERS = void 0;
+exports.createAuthLimiters = createAuthLimiters;
+exports.tooMany = tooMany;
+exports.limitByClient = limitByClient;
+exports.assertAccountNotLocked = assertAccountNotLocked;
+exports.recordAccountFailure = recordAccountFailure;
+exports.limitByUser = limitByUser;
+/**
+ * Rate limits of the public auth surface, in one place.
+ *
+ * Two kinds of bucket, both fixed-window (`auth-rate-limit.ts`):
+ *
+ *  - **per client address** — the REAL client behind a trusted proxy
+ *    (`auth-network-policy.ts`), so one remote attacker no longer shares a
+ *    bucket with every other user of the tunnel:
+ *      • credential tier — anything that VERIFIES a secret (password, TOTP,
+ *        passkey assertion, handoff code, session exchange, refresh): 10/min;
+ *      • ceremony tier — begin-legs that only mint a challenge: 30/min.
+ *  - **per account** — FAILURES only, 20 per 15 min. Peeked before the secret
+ *    is checked and counted only when it is wrong, so guessing one account
+ *    from many addresses is slowed while the owner's own logins never spend
+ *    it. The price: someone hammering a known username can hold that account
+ *    at the limit for the window. That is the documented trade.
+ *  - **per user** — authenticated legs a hijacked session could flood:
+ *    `beginExternalLink` (5/min; its intents are a bounded shared map) and
+ *    `reauthenticate` (10/min).
+ *
+ * Mesh-internal calls (no originating request) are never limited.
+ */
+const server_1 = require("@trpc/server");
+const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+function createAuthLimiters(now) {
+    const clock = now !== undefined ? { now } : {};
+    return {
+        credential: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
+        ceremony: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 30, ...clock }),
+        accountFailures: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 15 * 60_000, max: 20, ...clock }),
+        link: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 5, ...clock }),
+        reauth: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
+    };
+}
+/** The process-wide limiters: router rebuilds must not reset an attacker's budget. */
+exports.PROCESS_AUTH_LIMITERS = createAuthLimiters();
+function tooMany(retryAfterSeconds) {
+    return new server_1.TRPCError({
+        code: 'TOO_MANY_REQUESTS',
+        message: `Too many attempts — retry in ${retryAfterSeconds}s`,
+    });
+}
+/** Count one attempt from the request's client address; throws when over. */
+function limitByClient(limiter, bucket, req, network = auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY) {
+    const ip = network.clientAddress(req).ip;
+    if (ip === null)
+        return;
+    const verdict = limiter.check(`${bucket}:${ip}`);
+    if (!verdict.allowed)
+        throw tooMany(verdict.retryAfterSeconds);
+}
+/** Refuse before checking a secret when `account` already failed too often. */
+function assertAccountNotLocked(limiters, account) {
+    const verdict = limiters.accountFailures.peek(`account:${account.toLowerCase()}`);
+    if (!verdict.allowed)
+        throw tooMany(verdict.retryAfterSeconds);
+}
+/** Count one failed secret against `account`. */
+function recordAccountFailure(limiters, account) {
+    limiters.accountFailures.check(`account:${account.toLowerCase()}`);
+}
+/** Count one call of an authenticated leg against the user; throws when over. */
+function limitByUser(limiter, bucket, userId) {
+    const verdict = limiter.check(`${bucket}:${userId}`);
+    if (!verdict.allowed)
+        throw tooMany(verdict.retryAfterSeconds);
+}

package/dist/api/core/auth-reauth.procedures.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REAUTH_REQUIRED_MESSAGE = exports.ReauthTokenInput = void 0;
+exports.assertReauthenticated = assertReauthenticated;
+exports.createReauthProcedures = createReauthProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_limits_js_1 = require("./auth-limits.js");
+/** The input field a re-auth-gated procedure takes. */
+exports.ReauthTokenInput = zod_1.z.string().min(1).max(4096);
+exports.REAUTH_REQUIRED_MESSAGE = 'Confirm it is you first: re-enter your password or use a passkey (update the app if it cannot ask).';
+/**
+ * Throw unless `reauthToken` is a live proof by THIS user, made in THIS
+ * session. A missing token is the same refusal: the action needs one.
+ */
+function assertReauthenticated(auth, user, reauthToken) {
+    const claims = reauthToken === undefined ? null : auth.verifyReauthToken(reauthToken);
+    const valid = claims !== null &&
+        claims.userId === user.id &&
+        (user.sessionId === undefined || claims.sessionId === user.sessionId);
+    if (!valid)
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: exports.REAUTH_REQUIRED_MESSAGE });
+}
+function isPasswordChecker(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        typeof Reflect.get(value, 'validateCredentials') === 'function');
+}
+/** Real user sessions only: a scoped or share token cannot prove a password. */
+function assertPerson(user) {
+    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+    }
+}
+function createReauthProcedures(deps) {
+    return {
+        /** Passkey re-authentication, step 1: assertion options for the caller's own credentials. */
+        reauthBeginPasskey: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(passkey_provider_js_1.OptionsJsonSchema)
+            .mutation(async ({ ctx }) => {
+            assertPerson(ctx.user);
+            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthBeginPasskey', ctx.user.id);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
+            if (!provider)
+                throw new Error('Passkey authentication is not available');
+            return provider.beginAuthentication({ userId: ctx.user.id });
+        }),
+        /**
+         * Prove it is you — the current password, or the passkey assertion from
+         * `reauthBeginPasskey`. Answers a 5-minute proof for the re-auth-gated
+         * actions, valid only for this user in this session.
+         */
+        reauthenticate: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.union([
+            zod_1.z.object({ password: zod_1.z.string().min(1).max(1024) }),
+            zod_1.z.object({ passkeyResponse: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }),
+        ]))
+            .output(zod_1.z.object({
+            reauthToken: zod_1.z.string(),
+            expiresAt: zod_1.z.number(),
+            method: zod_1.z.enum(['password', 'passkey']),
+        }))
+            .mutation(async ({ ctx, input }) => {
+            assertPerson(ctx.user);
+            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthenticate', ctx.user.id);
+            (0, auth_limits_js_1.assertAccountNotLocked)(deps.limiters, ctx.user.username);
+            let method;
+            if ('password' in input) {
+                const userMgmt = deps.registry?.getSingleton('user-management');
+                if (!isPasswordChecker(userMgmt)) {
+                    throw new Error('user-management capability not available');
+                }
+                const record = await userMgmt.validateCredentials({
+                    username: ctx.user.username,
+                    password: input.password,
+                });
+                if (record === null || record.id !== ctx.user.id) {
+                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
+                    throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Password is incorrect' });
+                }
+                method = 'password';
+            }
+            else {
+                const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
+                if (!provider)
+                    throw new Error('Passkey authentication is not available');
+                const result = await provider.finishAuthentication({
+                    userId: ctx.user.id,
+                    response: input.passkeyResponse,
+                });
+                if (!result.verified) {
+                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
+                    throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Passkey verification failed' });
+                }
+                method = 'passkey';
+            }
+            const reauthToken = deps.auth.signReauthToken({
+                userId: ctx.user.id,
+                method,
+                ...(ctx.user.sessionId !== undefined ? { sessionId: ctx.user.sessionId } : {}),
+            });
+            return { reauthToken, expiresAt: Date.now() + 300_000, method };
+        }),
+    };
+}