@homurajs/auth 26.10.14 → 26.10.15

package/dist/index.d.ts

@@ -1,5 +1,9 @@
-import { a as RefreshTokenStore, c as RefreshTokenRecord, d as AuthUser, f as OAuth2Endpoints, i as SessionTokens, l as OAuth2Client, n as SessionManager, o as createDrizzleSessionStore, p as TokenResponse, r as SessionManagerConfig, s as ConsumedToken, t as SessionClaims, u as OAuth2ClientConfig } from "./manager-_5q5sluE.js";
+import { _ as TokenResponse, c as SessionManagerConfig, d as RefreshTokenStore, f as createDrizzleSessionStore, g as OAuth2Endpoints, h as AuthUser, i as UserStore, l as SessionTokens, m as RefreshTokenRecord, n as LocalUser, o as SessionClaims, p as ConsumedToken, r as OAuth2LinkStore, s as SessionManager, t as IdentityLink, u as DrizzleDb } from "./types-C-SlEMFJ.js";
+import { a as PasswordStore, c as IdentityResolverOptions, d as OAuth2Client, f as OAuth2ClientConfig, i as PasswordRecord, l as ResolveProfile, n as PasswordProviderOptions, o as IdentityNotLinkedError, r as UsernameTakenError, s as IdentityResolver, t as PasswordProvider, u as createDefaultIdentityResolver } from "./provider-BkUYQ703.js";
+import { a as WebAuthProvider, c as WEBAUTHN_CREDENTIALS_TABLE, d as WebauthnCredentialStore, i as RegistrationResponse, l as createRestWebauthnCredentialStore, n as AuthenticationResponse, o as WebAuthProviderConfig, r as RegistrationOptions, s as RestWebauthnCredentialStoreOptions, t as AuthenticationOptions, u as createDrizzleWebauthnCredentialStore } from "./provider-Bf7d5mkl.js";
 import { RestDb } from "@homurajs/db";
+import { NodeSQLiteDatabase } from "drizzle-orm/node-sqlite";
+import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 //#region src/session/rest-store.d.ts
 export declare const REFRESH_TOKENS_TABLE = "refresh_tokens";
 interface RestSessionStoreOptions {
@@ -8,4 +12,44 @@ interface RestSessionStoreOptions {
 }
 export declare function createRestSessionStore(rest: RestDb, opts?: RestSessionStoreOptions): RefreshTokenStore;
 //#endregion
-export { type AuthUser, type ConsumedToken, OAuth2Client, type OAuth2ClientConfig, type OAuth2Endpoints, type RefreshTokenRecord, type RefreshTokenStore, type RestSessionStoreOptions, type SessionClaims, SessionManager, type SessionManagerConfig, type SessionTokens, type TokenResponse, createDrizzleSessionStore };
+//#region src/identity/user-store.d.ts
+type DrizzleDb$3 = PostgresJsDatabase | NodeSQLiteDatabase;
+export declare function createDrizzleUserStore(db: DrizzleDb$3, opts?: {
+  now?: () => number;
+}): UserStore;
+//#endregion
+//#region src/identity/oauth2-link-store.d.ts
+type DrizzleDb$2 = PostgresJsDatabase | NodeSQLiteDatabase;
+export declare function createDrizzleOAuth2LinkStore(db: DrizzleDb$2, opts?: {
+  now?: () => number;
+}): OAuth2LinkStore;
+//#endregion
+//#region src/identity/user-rest-store.d.ts
+interface RestUserStoreOptions {
+  table?: string;
+  now?: () => number;
+}
+export declare function createRestUserStore(rest: RestDb, opts?: RestUserStoreOptions): UserStore;
+//#endregion
+//#region src/identity/oauth2-link-rest-store.d.ts
+interface RestOAuth2LinkStoreOptions {
+  table?: string;
+  now?: () => number;
+}
+export declare function createRestOAuth2LinkStore(rest: RestDb, opts?: RestOAuth2LinkStoreOptions): OAuth2LinkStore;
+//#endregion
+//#region src/password/drizzle-store.d.ts
+type DrizzleDb$1 = PostgresJsDatabase | NodeSQLiteDatabase;
+export declare function createDrizzlePasswordStore(db: DrizzleDb$1, opts?: {
+  now?: () => number;
+}): PasswordStore;
+//#endregion
+//#region src/password/rest-store.d.ts
+export declare const PASSWORDS_TABLE = "passwords";
+interface RestPasswordStoreOptions {
+  table?: string;
+  now?: () => number;
+}
+export declare function createRestPasswordStore(rest: RestDb, opts?: RestPasswordStoreOptions): PasswordStore;
+//#endregion
+export { type AuthUser, type AuthenticationOptions, type AuthenticationResponse, type ConsumedToken, type DrizzleDb, type IdentityLink, IdentityNotLinkedError, type IdentityResolver, type IdentityResolverOptions, type LocalUser, OAuth2Client, type OAuth2ClientConfig, type OAuth2Endpoints, type OAuth2LinkStore, PasswordProvider, type PasswordProviderOptions, type PasswordRecord, type PasswordStore, type RefreshTokenRecord, type RefreshTokenStore, type RegistrationOptions, type RegistrationResponse, type ResolveProfile, type RestOAuth2LinkStoreOptions, type RestPasswordStoreOptions, type RestSessionStoreOptions, type RestUserStoreOptions, type RestWebauthnCredentialStoreOptions, type SessionClaims, SessionManager, type SessionManagerConfig, type SessionTokens, type TokenResponse, type UserStore, UsernameTakenError, WEBAUTHN_CREDENTIALS_TABLE, WebAuthProvider, type WebAuthProviderConfig, type WebauthnCredentialStore, createDefaultIdentityResolver, createDrizzleSessionStore, createDrizzleWebauthnCredentialStore, createRestWebauthnCredentialStore };

package/dist/index.js

@@ -1,5 +1,7 @@
+import { i as createDefaultIdentityResolver, n as UsernameTakenError, r as IdentityNotLinkedError, t as PasswordProvider } from "./provider-DMtwLgGf.js";
+import { i as createDrizzleWebauthnCredentialStore, n as WEBAUTHN_CREDENTIALS_TABLE, r as createRestWebauthnCredentialStore, t as WebAuthProvider } from "./provider-zTWN9myS.js";
 import { randomToken } from "@homurajs/core";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { SignJWT, jwtVerify } from "jose";
 import { sql } from "drizzle-orm";
 import { isSqlite } from "@homurajs/db";
@@ -191,11 +193,11 @@ var SessionManager = class {
 };
 //#endregion
 //#region src/session/store.ts
-async function exec(db, q) {
+async function exec$3(db, q) {
 	if (isSqlite(db)) await db.run(q);
 	else await db.execute(q);
 }
-async function query(db, q) {
+async function query$2(db, q) {
 	if (isSqlite(db)) return await db.all(q);
 	return await db.execute(q) ?? [];
 }
@@ -207,12 +209,12 @@ function createDrizzleSessionStore(db, opts) {
 	const now = opts?.now ?? (() => Date.now());
 	return {
 		async create(r) {
-			await exec(db, sql`INSERT INTO refresh_tokens (token_hash, family_id, sid, sub, expires_at, profile)
+			await exec$3(db, sql`INSERT INTO refresh_tokens (token_hash, family_id, sid, sub, expires_at, profile)
 VALUES (${r.tokenHash}, ${r.familyId}, ${r.sid}, ${r.sub}, ${r.expiresAt}, ${r.profile ?? null})`);
 		},
 		async consume(tokenHash) {
 			const ts = now();
-			const claimed = (await query(db, sql`UPDATE refresh_tokens
+			const claimed = (await query$2(db, sql`UPDATE refresh_tokens
 SET used_at = ${ts}
 WHERE token_hash = ${tokenHash} AND expires_at > ${ts} AND used_at IS NULL
 RETURNING family_id, sid, sub, profile`))[0];
@@ -223,7 +225,7 @@ RETURNING family_id, sid, sub, profile`))[0];
 				profile: claimed.profile,
 				revoked: false
 			};
-			const row = (await query(db, sql`SELECT family_id, used_at FROM refresh_tokens WHERE token_hash = ${tokenHash}`))[0];
+			const row = (await query$2(db, sql`SELECT family_id, used_at FROM refresh_tokens WHERE token_hash = ${tokenHash}`))[0];
 			if (!row) return null;
 			if (row.used_at !== null) return {
 				familyId: row.family_id,
@@ -235,10 +237,10 @@ RETURNING family_id, sid, sub, profile`))[0];
 			return null;
 		},
 		async revokeFamily(familyId) {
-			await exec(db, sql`UPDATE refresh_tokens SET used_at = ${now()} WHERE family_id = ${familyId} AND used_at IS NULL`);
+			await exec$3(db, sql`UPDATE refresh_tokens SET used_at = ${now()} WHERE family_id = ${familyId} AND used_at IS NULL`);
 		},
 		async revokeUser(sub) {
-			await exec(db, sql`UPDATE refresh_tokens SET used_at = ${now()} WHERE sub = ${sub} AND used_at IS NULL`);
+			await exec$3(db, sql`UPDATE refresh_tokens SET used_at = ${now()} WHERE sub = ${sub} AND used_at IS NULL`);
 		}
 	};
 }
@@ -306,4 +308,316 @@ function createRestSessionStore(rest, opts = {}) {
 	};
 }
 //#endregion
-export { OAuth2Client, REFRESH_TOKENS_TABLE, SessionManager, createDrizzleSessionStore, createRestSessionStore };
+//#region src/identity/user-store.ts
+/**
+* Drizzle 双方言 UserStore —— users 表的 CRUD。
+* 复用 session/store.ts 的 exec/query 模式（isSqlite 分支 + 原生 SQL）。
+*
+* ⚠ 列名必须与 tables.ts 的显式 snake_case 对齐（id/username/nickname/avatar_url/created_at/updated_at）。
+*/
+async function exec$2(db, q) {
+	if (isSqlite(db)) await db.run(q);
+	else await db.execute(q);
+}
+async function query$1(db, q) {
+	if (isSqlite(db)) return await db.all(q);
+	return await db.execute(q) ?? [];
+}
+function toUser$1(row) {
+	return {
+		id: row.id,
+		username: row.username,
+		nickname: row.nickname,
+		avatarUrl: row.avatar_url,
+		createdAt: Number(row.created_at),
+		updatedAt: Number(row.updated_at)
+	};
+}
+function createDrizzleUserStore(db, opts) {
+	const now = opts?.now ?? (() => Date.now());
+	return {
+		async findById(id) {
+			const rows = await query$1(db, sql`SELECT id, username, nickname, avatar_url, created_at, updated_at FROM users WHERE id = ${id}`);
+			return rows[0] ? toUser$1(rows[0]) : null;
+		},
+		async findByUsername(username) {
+			const rows = await query$1(db, sql`SELECT id, username, nickname, avatar_url, created_at, updated_at FROM users WHERE username = ${username}`);
+			return rows[0] ? toUser$1(rows[0]) : null;
+		},
+		async create(input) {
+			const id = randomUUID();
+			const ts = now();
+			await exec$2(db, sql`INSERT INTO users (id, username, nickname, avatar_url, created_at, updated_at)
+VALUES (${id}, ${input.username ?? null}, ${input.nickname ?? null}, ${input.avatarUrl ?? null}, ${ts}, ${ts})`);
+			return {
+				id,
+				username: input.username ?? null,
+				nickname: input.nickname ?? null,
+				avatarUrl: input.avatarUrl ?? null,
+				createdAt: ts,
+				updatedAt: ts
+			};
+		},
+		async update(id, patch) {
+			const ts = now();
+			if (patch.nickname !== void 0 && patch.avatarUrl !== void 0) await exec$2(db, sql`UPDATE users SET nickname = ${patch.nickname}, avatar_url = ${patch.avatarUrl}, updated_at = ${ts} WHERE id = ${id}`);
+			else if (patch.nickname !== void 0) await exec$2(db, sql`UPDATE users SET nickname = ${patch.nickname}, updated_at = ${ts} WHERE id = ${id}`);
+			else if (patch.avatarUrl !== void 0) await exec$2(db, sql`UPDATE users SET avatar_url = ${patch.avatarUrl}, updated_at = ${ts} WHERE id = ${id}`);
+			else await exec$2(db, sql`UPDATE users SET updated_at = ${ts} WHERE id = ${id}`);
+			const rows = await query$1(db, sql`SELECT id, username, nickname, avatar_url, created_at, updated_at FROM users WHERE id = ${id}`);
+			if (!rows[0]) throw new Error("user 不存在: " + id);
+			return toUser$1(rows[0]);
+		},
+		async delete(id) {
+			await exec$2(db, sql`DELETE FROM users WHERE id = ${id}`);
+		}
+	};
+}
+//#endregion
+//#region src/identity/oauth2-link-store.ts
+/**
+* Drizzle 双方言 OAuth2LinkStore —— oauth2_identity_links 表的 CRUD。
+* identity resolver 在 OAuth2 callback 时用 findByProvider 查已有 link，
+* JIT 模式时 create 新 link 并关联新建的 user。
+*
+* ⚠ 列名必须与 tables.ts 的显式 snake_case 对齐
+*   （id/user_id/provider/provider_sub/raw_profile/created_at）。
+*/
+async function exec$1(db, q) {
+	if (isSqlite(db)) await db.run(q);
+	else await db.execute(q);
+}
+async function query(db, q) {
+	if (isSqlite(db)) return await db.all(q);
+	return await db.execute(q) ?? [];
+}
+function toLink$1(row) {
+	return {
+		id: row.id,
+		userId: row.user_id,
+		provider: row.provider,
+		providerSub: row.provider_sub,
+		rawProfile: row.raw_profile,
+		createdAt: Number(row.created_at)
+	};
+}
+const SELECT_COLS = sql.raw("id, user_id, provider, provider_sub, raw_profile, created_at");
+function createDrizzleOAuth2LinkStore(db, opts) {
+	const now = opts?.now ?? (() => Date.now());
+	return {
+		async findByProvider(provider, providerSub) {
+			const rows = await query(db, sql`SELECT ${SELECT_COLS} FROM oauth2_identity_links
+WHERE provider = ${provider} AND provider_sub = ${providerSub}`);
+			return rows[0] ? toLink$1(rows[0]) : null;
+		},
+		async findByUserId(userId) {
+			return (await query(db, sql`SELECT ${SELECT_COLS} FROM oauth2_identity_links WHERE user_id = ${userId}`)).map(toLink$1);
+		},
+		async create(input) {
+			const id = randomUUID();
+			const ts = now();
+			await exec$1(db, sql`INSERT INTO oauth2_identity_links (id, user_id, provider, provider_sub, raw_profile, created_at)
+VALUES (${id}, ${input.userId}, ${input.provider}, ${input.providerSub}, ${input.rawProfile ?? null}, ${ts})`);
+			return {
+				id,
+				userId: input.userId,
+				provider: input.provider,
+				providerSub: input.providerSub,
+				rawProfile: input.rawProfile ?? null,
+				createdAt: ts
+			};
+		},
+		async delete(id) {
+			await exec$1(db, sql`DELETE FROM oauth2_identity_links WHERE id = ${id}`);
+		}
+	};
+}
+function toUser(row) {
+	return {
+		id: row.id,
+		username: row.username,
+		nickname: row.nickname,
+		avatarUrl: row.avatar_url,
+		createdAt: Number(row.created_at),
+		updatedAt: Number(row.updated_at)
+	};
+}
+function createRestUserStore(rest, opts = {}) {
+	const t = rest.table(opts.table ?? "users");
+	const now = opts.now ?? (() => Date.now());
+	return {
+		async findById(id) {
+			const row = (await t.select({ id }, { limit: 1 }))[0];
+			return row ? toUser(row) : null;
+		},
+		async findByUsername(username) {
+			const row = (await t.select({ username }, { limit: 1 }))[0];
+			return row ? toUser(row) : null;
+		},
+		async create(input) {
+			const id = randomUUID();
+			const ts = now();
+			const row = (await t.insert({
+				id,
+				username: input.username ?? null,
+				nickname: input.nickname ?? null,
+				avatar_url: input.avatarUrl ?? null,
+				created_at: ts,
+				updated_at: ts
+			}))[0];
+			if (!row) throw new Error("insert failed");
+			return toUser(row);
+		},
+		async update(id, patch) {
+			const ts = now();
+			const row = (await t.update({
+				...patch.nickname !== void 0 ? { nickname: patch.nickname } : {},
+				...patch.avatarUrl !== void 0 ? { avatar_url: patch.avatarUrl } : {},
+				updated_at: ts
+			}, { id }))[0];
+			if (!row) throw new Error("user 不存在: " + id);
+			return toUser(row);
+		},
+		async delete(id) {
+			await t.remove({ id });
+		}
+	};
+}
+function toLink(row) {
+	return {
+		id: row.id,
+		userId: row.user_id,
+		provider: row.provider,
+		providerSub: row.provider_sub,
+		rawProfile: row.raw_profile,
+		createdAt: Number(row.created_at)
+	};
+}
+function createRestOAuth2LinkStore(rest, opts = {}) {
+	const t = rest.table(opts.table ?? "oauth2_identity_links");
+	const now = opts.now ?? (() => Date.now());
+	return {
+		async findByProvider(provider, providerSub) {
+			const row = (await t.select({
+				provider,
+				provider_sub: providerSub
+			}, { limit: 1 }))[0];
+			return row ? toLink(row) : null;
+		},
+		async findByUserId(userId) {
+			return (await t.select({ user_id: userId })).map(toLink);
+		},
+		async create(input) {
+			const id = randomUUID();
+			const ts = now();
+			const row = (await t.insert({
+				id,
+				user_id: input.userId,
+				provider: input.provider,
+				provider_sub: input.providerSub,
+				raw_profile: input.rawProfile ?? null,
+				created_at: ts
+			}))[0];
+			if (!row) throw new Error("insert failed");
+			return toLink(row);
+		},
+		async delete(id) {
+			await t.remove({ id });
+		}
+	};
+}
+//#endregion
+//#region src/password/drizzle-store.ts
+/**
+* Drizzle 双方言 PasswordStore 实现。
+*
+* ⚠ 列名必须与 tables.ts 的显式 snake_case 对齐
+*   （user_id/password_hash/created_at/updated_at）。
+*/
+async function exec(db, q) {
+	if (isSqlite(db)) await db.run(q);
+	else await db.execute(q);
+}
+async function queryOne(db, q) {
+	if (isSqlite(db)) return (await db.all(q))[0] ?? null;
+	return (await db.execute(q))?.[0] ?? null;
+}
+function toRecord$1(row) {
+	return {
+		userId: row.user_id,
+		passwordHash: row.password_hash,
+		createdAt: Number(row.created_at),
+		updatedAt: Number(row.updated_at)
+	};
+}
+function createDrizzlePasswordStore(db, opts) {
+	const now = opts?.now ?? (() => Date.now());
+	return {
+		async findByUserId(userId) {
+			const row = await queryOne(db, sql`SELECT user_id, password_hash, created_at, updated_at FROM passwords WHERE user_id = ${userId}`);
+			return row ? toRecord$1(row) : null;
+		},
+		async create(input) {
+			const ts = now();
+			await exec(db, sql`INSERT INTO passwords (user_id, password_hash, created_at, updated_at)
+VALUES (${input.userId}, ${input.passwordHash}, ${ts}, ${ts})`);
+			return {
+				userId: input.userId,
+				passwordHash: input.passwordHash,
+				createdAt: ts,
+				updatedAt: ts
+			};
+		},
+		async updateHash(userId, passwordHash) {
+			const ts = now();
+			await exec(db, sql`UPDATE passwords SET password_hash = ${passwordHash}, updated_at = ${ts} WHERE user_id = ${userId}`);
+		},
+		async delete(userId) {
+			await exec(db, sql`DELETE FROM passwords WHERE user_id = ${userId}`);
+		}
+	};
+}
+//#endregion
+//#region src/password/rest-store.ts
+const PASSWORDS_TABLE = "passwords";
+function toRecord(row) {
+	return {
+		userId: row.user_id,
+		passwordHash: row.password_hash,
+		createdAt: Number(row.created_at),
+		updatedAt: Number(row.updated_at)
+	};
+}
+function createRestPasswordStore(rest, opts = {}) {
+	const t = rest.table(opts.table ?? "passwords");
+	const now = opts.now ?? (() => Date.now());
+	return {
+		async findByUserId(userId) {
+			const row = (await t.select({ user_id: userId }, { limit: 1 }))[0];
+			return row ? toRecord(row) : null;
+		},
+		async create(input) {
+			const ts = now();
+			const row = (await t.insert({
+				user_id: input.userId,
+				password_hash: input.passwordHash,
+				created_at: ts,
+				updated_at: ts
+			}))[0];
+			if (!row) throw new Error("insert failed");
+			return toRecord(row);
+		},
+		async updateHash(userId, passwordHash) {
+			const ts = now();
+			await t.update({
+				password_hash: passwordHash,
+				updated_at: ts
+			}, { user_id: userId });
+		},
+		async delete(userId) {
+			await t.remove({ user_id: userId });
+		}
+	};
+}
+//#endregion
+export { IdentityNotLinkedError, OAuth2Client, PASSWORDS_TABLE, PasswordProvider, REFRESH_TOKENS_TABLE, SessionManager, UsernameTakenError, WEBAUTHN_CREDENTIALS_TABLE, WebAuthProvider, createDefaultIdentityResolver, createDrizzleOAuth2LinkStore, createDrizzlePasswordStore, createDrizzleSessionStore, createDrizzleUserStore, createDrizzleWebauthnCredentialStore, createRestOAuth2LinkStore, createRestPasswordStore, createRestSessionStore, createRestUserStore, createRestWebauthnCredentialStore };

package/dist/provider-Bf7d5mkl.d.ts

@@ -0,0 +1,164 @@
+import { a as WebauthnCredentialRecord, i as UserStore, n as LocalUser } from "./types-C-SlEMFJ.js";
+import { TtlKv } from "@homurajs/core";
+import { RestDb } from "@homurajs/db";
+import { NodeSQLiteDatabase } from "drizzle-orm/node-sqlite";
+import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+//#region src/webauthn/credential-store.d.ts
+interface WebauthnCredentialStore {
+  /** 按 credentialId 查；不存在返回 null */
+  findById(id: string): Promise<WebauthnCredentialRecord | null>;
+  /** 按 userId 查所有凭证 */
+  findByUserId(userId: string): Promise<WebauthnCredentialRecord[]>;
+  /** 创建凭证 */
+  create(input: {
+    id: string;
+    userId: string;
+    publicKey: string;
+    counter: number;
+    deviceType: string;
+    backedUp: number;
+    transports?: string | null;
+    displayName?: string | null;
+  }): Promise<WebauthnCredentialRecord>;
+  /** 更新 counter（验证成功后调用） */
+  updateCounter(id: string, counter: number): Promise<void>;
+  /** 删除凭证 */
+  delete(id: string): Promise<void>;
+}
+//#endregion
+//#region src/webauthn/credential-drizzle-store.d.ts
+type DrizzleDb = PostgresJsDatabase | NodeSQLiteDatabase;
+declare function createDrizzleWebauthnCredentialStore(db: DrizzleDb, opts?: {
+  now?: () => number;
+}): WebauthnCredentialStore;
+//#endregion
+//#region src/webauthn/credential-rest-store.d.ts
+declare const WEBAUTHN_CREDENTIALS_TABLE = "webauthn_credentials";
+interface RestWebauthnCredentialStoreOptions {
+  table?: string;
+  now?: () => number;
+}
+declare function createRestWebauthnCredentialStore(rest: RestDb, opts?: RestWebauthnCredentialStoreOptions): WebauthnCredentialStore;
+//#endregion
+//#region src/webauthn/provider.d.ts
+/**
+ * WebAuthn RP 配置。
+ * rpId 通常是域名（如 'app.example.com'），origin 是完整 origin（如 'https://app.example.com'）。
+ */
+interface WebAuthProviderConfig {
+  rpId: string;
+  rpName: string;
+  /** 允许的 origin（如 ['https://app.example.com']） */
+  origin: string | string[];
+  credentialStore: WebauthnCredentialStore;
+  userStore: UserStore;
+  /** challenge 存储（TtlKv），TTL 5min */
+  challengeKv: TtlKv;
+  /** challenge TTL（默认 5min） */
+  challengeTtlMs?: number;
+  now?: () => number;
+}
+/** 注册 options（传给客户端 @simplewebauthn/browser 的 startRegistration） */
+interface RegistrationOptions {
+  challenge: string;
+  rp: {
+    name: string;
+    id: string;
+  };
+  user: {
+    id: string;
+    name: string;
+    displayName: string;
+  };
+  pubKeyCredParams: Array<{
+    type: 'public-key';
+    alg: number;
+  }>;
+  timeout: number;
+  attestationType: string;
+  authenticatorSelection: {
+    userVerification: string;
+    residentKey: string;
+  };
+}
+/** 认证 options（传给客户端 @simplewebauthn/browser 的 startAuthentication） */
+interface AuthenticationOptions {
+  challenge: string;
+  timeout: number;
+  rpId: string;
+  allowCredentials: Array<{
+    type: 'public-key';
+    id: string;
+    transports?: string[];
+  }>;
+  userVerification: string;
+}
+/** 注册验证输入（客户端 attestation 响应） */
+interface RegistrationResponse {
+  id: string;
+  rawId: string;
+  response: {
+    clientDataJSON: string;
+    attestationObject: string;
+    transports?: string[];
+  };
+  type: string;
+  clientExtensionResults?: Record<string, unknown>;
+}
+/** 认证验证输入（客户端 assertion 响应） */
+interface AuthenticationResponse {
+  id: string;
+  rawId: string;
+  response: {
+    clientDataJSON: string;
+    authenticatorData: string;
+    signature: string;
+    userHandle?: string | null;
+  };
+  type: string;
+  clientExtensionResults?: Record<string, unknown>;
+}
+declare class WebAuthProvider {
+  private readonly config;
+  private readonly challengeTtl;
+  private readonly nowFn;
+  constructor(config: WebAuthProviderConfig);
+  /**
+   * 生成注册 options（已登录用户发起）。
+   * challenge 存入 TtlKv（key = userId:challengeType），TTL 5min。
+   */
+  generateRegistrationOptions(userId: string): Promise<RegistrationOptions>;
+  /**
+   * 验证注册响应并存储凭证。
+   * challenge 一次性消费（take 语义）。
+   */
+  verifyRegistration(userId: string, response: RegistrationResponse, displayName?: string): Promise<{
+    id: string;
+  }>;
+  /**
+   * 生成认证 options（未登录用户发起）。
+   * challenge 存入 TtlKv，返回 { options, challengeKey }——challengeKey 必须由调用方
+   * 在 verifyAuthentication 时回传，否则匿名（discoverable credential）流程无法定位 challenge：
+   * 匿名场景下 options 阶段还不知道是哪个用户/凭证，key 只能是 `anon:${random}`，
+   * 而 verify 阶段是按 response.id 反查凭证的，两条腿对不上同一个 key。
+   * 已知 userId 时 key 固定为 `${userId}:auth`，回传与否都能命中（向后兼容）。
+   */
+  generateAuthenticationOptions(userId?: string): Promise<{
+    options: AuthenticationOptions;
+    challengeKey: string;
+  }>;
+  /**
+   * 验证认证响应，返回已验证的用户（供 session 创建）。
+   * challenge 一次性消费。
+   *
+   * @param challengeKey generateAuthenticationOptions 返回的 key。匿名流程**必须**回传；
+   *   已知 userId 的流程可省略（缺省按 `${cred.userId}:auth` 取）。
+   */
+  verifyAuthentication(response: AuthenticationResponse, challengeKey?: string): Promise<LocalUser>;
+  /** 列出用户的所有凭证（管理用） */
+  listCredentials(userId: string): Promise<WebauthnCredentialRecord[]>;
+  /** 删除凭证 */
+  deleteCredential(userId: string, credentialId: string): Promise<void>;
+}
+//#endregion
+export { WebAuthProvider as a, WEBAUTHN_CREDENTIALS_TABLE as c, WebauthnCredentialStore as d, RegistrationResponse as i, createRestWebauthnCredentialStore as l, AuthenticationResponse as n, WebAuthProviderConfig as o, RegistrationOptions as r, RestWebauthnCredentialStoreOptions as s, AuthenticationOptions as t, createDrizzleWebauthnCredentialStore as u };