@homurajs/auth 26.10.14 → 26.10.15

package/dist/provider-BkUYQ703.d.ts

@@ -0,0 +1,157 @@
+import { _ as TokenResponse, g as OAuth2Endpoints, h as AuthUser, i as UserStore, n as LocalUser, r as OAuth2LinkStore } from "./types-C-SlEMFJ.js";
+import { TtlKv } from "@homurajs/core";
+//#region src/oauth2/client.d.ts
+interface OAuth2ClientConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+  scopes?: string[];
+  endpoints: OAuth2Endpoints;
+  /** 上游原始 userinfo → 规范身份（预设来自 @homurajs/3p/*） */
+  mapUser: (raw: unknown) => AuthUser;
+  /** state 存储（core 的内存或 db 实现），TTL 5min 一次性消费 */
+  stateKv: TtlKv;
+  /** 测试注入口；全程不 mock 全局 fetch */
+  fetchImpl?: typeof fetch;
+  authorizeExtraParams?: Record<string, string>;
+  /** dev 显式 opt-in 才允许无 state（修复 Suzuran 的 Redis 缺失放行后门） */
+  allowNoState?: boolean;
+  /** state TTL（默认 5min） */
+  stateTtlMs?: number;
+}
+/**
+ * 通用标准 OAuth2 (Authorization Code Flow) 客户端。
+ * 服务端（如 ../oauth2-dingtalk）由 3p 预设注入，本类不感知具体 IdP。
+ */
+declare class OAuth2Client {
+  private config;
+  private fetchImpl;
+  private stateTtl;
+  constructor(config: OAuth2ClientConfig);
+  /** 生成 authorize URL（state 入 kv），returnTo 编码进 state 关联存储 */
+  authorizeUrl(returnTo?: string): Promise<string>;
+  /**
+   * 回调：state 一次性消费校验 → code 换 token → 拉 userinfo → mapUser
+   * 返回 { user, returnTo }，供 hono 路由建 session 后跳转
+   */
+  callback(params: {
+    code: string;
+    state?: string;
+  }): Promise<{
+    user: AuthUser;
+    returnTo: string;
+  }>;
+  /** 内部：code 换 token（POST tokenUrl，form 编码） */
+  protected exchangeToken(code: string): Promise<TokenResponse>;
+  /** 内部：Bearer 拉 userinfo */
+  protected fetchUserinfo(accessToken: string): Promise<unknown>;
+}
+//#endregion
+//#region src/identity/resolver.d.ts
+interface IdentityResolverOptions {
+  /** 首次 OAuth2 登录时自动建户（默认 true） */
+  jit?: boolean;
+}
+interface ResolveProfile {
+  nickname?: string;
+  avatarUrl?: string;
+}
+/**
+ * Identity Resolver 接口。
+ * App 可自行实现（如拒绝新注册、合并账户、审批制等）。
+ */
+interface IdentityResolver {
+  resolve(provider: string, providerSub: string, profile: ResolveProfile): Promise<LocalUser>;
+}
+/**
+ * 默认实现：查 link → 有则返回已有 user，无则 JIT 建户+建 link。
+ * 关闭 JIT 时，无 link 抛错。
+ */
+declare function createDefaultIdentityResolver(userStore: UserStore, linkStore: OAuth2LinkStore, opts?: IdentityResolverOptions): IdentityResolver;
+/** 身份未关联（JIT 关闭时抛出） */
+declare class IdentityNotLinkedError extends Error {
+  readonly provider: string;
+  readonly providerSub: string;
+  constructor(provider: string, providerSub: string);
+}
+//#endregion
+//#region src/password/store.d.ts
+/**
+ * 密码凭证仓储接口。
+ * Drizzle 双方言与 PostgREST 两版实现共享此接口。
+ * PasswordProvider 通过此接口操作 passwords 表，不直接依赖 DrizzleDb。
+ */
+interface PasswordRecord {
+  userId: string;
+  passwordHash: string;
+  createdAt: number;
+  updatedAt: number;
+}
+interface PasswordStore {
+  /** 按 userId 查密码记录；不存在返回 null */
+  findByUserId(userId: string): Promise<PasswordRecord | null>;
+  /** 创建密码记录（user_id 即 PK，1:1 约束） */
+  create(input: {
+    userId: string;
+    passwordHash: string;
+  }): Promise<PasswordRecord>;
+  /** 更新密码哈希 */
+  updateHash(userId: string, passwordHash: string): Promise<void>;
+  /** 删除密码记录 */
+  delete(userId: string): Promise<void>;
+}
+//#endregion
+//#region src/password/provider.d.ts
+interface PasswordProviderOptions {
+  userStore: UserStore;
+  passwordStore: PasswordStore;
+}
+/**
+ * 用户名已被占用。register 预检 username 时抛出（跨方言确定的类型化错误），
+ * 路由层据此回 409；唯一索引是并发兜底（见 hono/password-routes.ts 的 isUniqueViolation）。
+ */
+declare class UsernameTakenError extends Error {
+  readonly username: string;
+  constructor(username: string);
+}
+/**
+ * 密码认证 Provider。
+ * 依赖 UserStore（用户 CRUD）+ PasswordStore（密码 CRUD），不直接依赖数据库实例。
+ */
+declare class PasswordProvider {
+  private readonly userStore;
+  private readonly passwordStore;
+  constructor(opts: PasswordProviderOptions);
+  /**
+   * 注册用户：创建 user + password 记录。
+   *
+   * username 占用走**两道防线**：
+   *  1. 预检 findByUsername → 抛类型化 UsernameTakenError（跨方言确定，路由回 409 的主路径）；
+   *  2. users.username 唯一索引兜底并发（两个请求同时过预检时，create 撞唯一约束，
+   *     路由层 isUniqueViolation 识别后同样回 409）。
+   *
+   * ⚠ 两步非原子（store 抽象不暴露事务）：先建 user 再建 password，若 password 创建失败，
+   *   会留下一个无密码、username 已被占用的孤儿 user（既登不进又报废了用户名）。
+   *   故 password 创建失败时 best-effort 删除刚建的 user 再抛原错误，把窗口收窄到
+   *   「user 删除也失败」这种双重故障（此时日志可见，运维可手动清理）。
+   */
+  register(input: {
+    username: string;
+    password: string;
+    nickname?: string;
+  }): Promise<LocalUser>;
+  /**
+   * 验证用户名密码，返回用户（供 session 创建）。
+   * 用户不存在或密码错误均返回 null（响应不区分，且耗时均衡，防枚举攻击）。
+   */
+  verify(username: string, password: string): Promise<LocalUser | null>;
+  /**
+   * 修改密码（需验证旧密码）。
+   * 旧密码错误抛错；无密码记录抛错。
+   */
+  changePassword(userId: string, oldPassword: string, newPassword: string): Promise<void>;
+  /** 删除密码记录（用户将无法用密码登录） */
+  deletePassword(userId: string): Promise<void>;
+}
+//#endregion
+export { PasswordStore as a, IdentityResolverOptions as c, OAuth2Client as d, OAuth2ClientConfig as f, PasswordRecord as i, ResolveProfile as l, PasswordProviderOptions as n, IdentityNotLinkedError as o, UsernameTakenError as r, IdentityResolver as s, PasswordProvider as t, createDefaultIdentityResolver as u };

package/dist/provider-DMtwLgGf.js

@@ -0,0 +1,215 @@
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/identity/resolver.ts
+/**
+* 默认实现：查 link → 有则返回已有 user，无则 JIT 建户+建 link。
+* 关闭 JIT 时，无 link 抛错。
+*/
+function createDefaultIdentityResolver(userStore, linkStore, opts = {}) {
+	const jit = opts.jit ?? true;
+	return { async resolve(provider, providerSub, profile) {
+		const existing = await linkStore.findByProvider(provider, providerSub);
+		if (existing) {
+			const user = await userStore.findById(existing.userId);
+			if (!user) await linkStore.delete(existing.id);
+			else {
+				const patch = {};
+				if (!user.nickname && profile.nickname) patch.nickname = profile.nickname;
+				if (!user.avatarUrl && profile.avatarUrl) patch.avatarUrl = profile.avatarUrl;
+				if (Object.keys(patch).length > 0) return userStore.update(user.id, patch);
+				return user;
+			}
+		}
+		if (!jit) throw new IdentityNotLinkedError(provider, providerSub);
+		const user = await userStore.create({
+			nickname: profile.nickname ?? null,
+			avatarUrl: profile.avatarUrl ?? null
+		});
+		try {
+			await linkStore.create({
+				userId: user.id,
+				provider,
+				providerSub,
+				rawProfile: JSON.stringify(profile)
+			});
+			return user;
+		} catch (e) {
+			const winner = await linkStore.findByProvider(provider, providerSub);
+			if (winner && winner.userId === user.id) return user;
+			await userStore.delete(user.id).catch(() => {});
+			if (winner) {
+				const winnerUser = await userStore.findById(winner.userId);
+				if (winnerUser) return winnerUser;
+			}
+			throw e;
+		}
+	} };
+}
+/** 身份未关联（JIT 关闭时抛出） */
+var IdentityNotLinkedError = class extends Error {
+	provider;
+	providerSub;
+	constructor(provider, providerSub) {
+		super(`OAuth2 身份未关联: provider=${provider}, sub=${providerSub}（JIT 已关闭）`);
+		this.provider = provider;
+		this.providerSub = providerSub;
+		this.name = "IdentityNotLinkedError";
+	}
+};
+//#endregion
+//#region src/password/provider.ts
+/**
+* 密码认证 Provider —— 基于 scrypt 的密码哈希 + 验证。
+*
+* 职责：
+* - register: 创建用户 + 密码记录
+* - verify: 验证用户名密码，返回用户（供 session 创建）
+* - changePassword: 修改密码（需验证旧密码）
+* - deletePassword: 删除密码记录
+*
+* ⚠ scrypt 参数（N=16384, r=8, p=1）适合 2024 年硬件，未来可升级。
+* ⚠ 密码哈希格式：$scrypt$N,r,p$salt$hash（便于未来升级算法）。
+* ⚠ 通过 PasswordStore 接口操作数据库，不直接依赖 DrizzleDb。
+*/
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SALT_BYTES = 16;
+const HASH_BYTES = 64;
+const SCRYPT_OPTIONS = {
+	N: SCRYPT_N,
+	r: SCRYPT_R,
+	p: SCRYPT_P
+};
+/** 生成密码哈希（scrypt）。格式：$scrypt$N,r,p$salt$hash */
+function hashPassword(password) {
+	const salt = randomBytes(SALT_BYTES);
+	const hash = scryptSync(password, salt, HASH_BYTES, SCRYPT_OPTIONS);
+	return `$scrypt$${SCRYPT_N},${SCRYPT_R},${SCRYPT_P}$${salt.toString("base64")}$${hash.toString("base64")}`;
+}
+/** 验证密码（timing-safe 比较） */
+function verifyPassword(password, stored) {
+	const parts = stored.split("$");
+	if (parts.length !== 5 || parts[1] !== "scrypt") return false;
+	const params = parts[2];
+	if (!params) return false;
+	const saltB64 = parts[3];
+	const hashB64 = parts[4];
+	if (!saltB64 || !hashB64) return false;
+	const [nStr, rStr, pStr] = params.split(",");
+	const N = Number(nStr);
+	const r = Number(rStr);
+	const p = Number(pStr);
+	if (!N || !r || !p) return false;
+	const salt = Buffer.from(saltB64, "base64");
+	const expected = Buffer.from(hashB64, "base64");
+	const actual = scryptSync(password, salt, HASH_BYTES, {
+		N,
+		r,
+		p
+	});
+	return timingSafeEqual(actual, expected);
+}
+/**
+* 时序均衡用的假哈希（懒生成 + 缓存）。
+*
+* 为什么需要：verify 在「用户不存在 / 无密码记录」时若直接返回 null，就跳过了
+* ~50-100ms 的 scrypt 运算，而用户存在时会跑——响应时间差可被用来枚举有效用户名
+* （即便响应体已统一）。故对不存在的用户也拿这个假哈希跑一遍 verifyPassword 再丢弃，
+* 把两条路径的耗时拉平。首次调用付一次生成成本，之后复用缓存。
+*/
+let dummyHashCache;
+function dummyHash() {
+	if (dummyHashCache === void 0) dummyHashCache = hashPassword("timing-equalization-dummy-password");
+	return dummyHashCache;
+}
+/**
+* 用户名已被占用。register 预检 username 时抛出（跨方言确定的类型化错误），
+* 路由层据此回 409；唯一索引是并发兜底（见 hono/password-routes.ts 的 isUniqueViolation）。
+*/
+var UsernameTakenError = class extends Error {
+	username;
+	constructor(username) {
+		super(`用户名已被注册: ${username}`);
+		this.username = username;
+		this.name = "UsernameTakenError";
+	}
+};
+/**
+* 密码认证 Provider。
+* 依赖 UserStore（用户 CRUD）+ PasswordStore（密码 CRUD），不直接依赖数据库实例。
+*/
+var PasswordProvider = class {
+	userStore;
+	passwordStore;
+	constructor(opts) {
+		this.userStore = opts.userStore;
+		this.passwordStore = opts.passwordStore;
+	}
+	/**
+	* 注册用户：创建 user + password 记录。
+	*
+	* username 占用走**两道防线**：
+	*  1. 预检 findByUsername → 抛类型化 UsernameTakenError（跨方言确定，路由回 409 的主路径）；
+	*  2. users.username 唯一索引兜底并发（两个请求同时过预检时，create 撞唯一约束，
+	*     路由层 isUniqueViolation 识别后同样回 409）。
+	*
+	* ⚠ 两步非原子（store 抽象不暴露事务）：先建 user 再建 password，若 password 创建失败，
+	*   会留下一个无密码、username 已被占用的孤儿 user（既登不进又报废了用户名）。
+	*   故 password 创建失败时 best-effort 删除刚建的 user 再抛原错误，把窗口收窄到
+	*   「user 删除也失败」这种双重故障（此时日志可见，运维可手动清理）。
+	*/
+	async register(input) {
+		if (await this.userStore.findByUsername(input.username)) throw new UsernameTakenError(input.username);
+		const user = await this.userStore.create({
+			username: input.username,
+			nickname: input.nickname
+		});
+		const passwordHash = hashPassword(input.password);
+		try {
+			await this.passwordStore.create({
+				userId: user.id,
+				passwordHash
+			});
+		} catch (e) {
+			try {
+				await this.userStore.delete(user.id);
+			} catch {}
+			throw e;
+		}
+		return user;
+	}
+	/**
+	* 验证用户名密码，返回用户（供 session 创建）。
+	* 用户不存在或密码错误均返回 null（响应不区分，且耗时均衡，防枚举攻击）。
+	*/
+	async verify(username, password) {
+		const user = await this.userStore.findByUsername(username);
+		if (!user) {
+			verifyPassword(password, dummyHash());
+			return null;
+		}
+		const record = await this.passwordStore.findByUserId(user.id);
+		if (!record) {
+			verifyPassword(password, dummyHash());
+			return null;
+		}
+		return verifyPassword(password, record.passwordHash) ? user : null;
+	}
+	/**
+	* 修改密码（需验证旧密码）。
+	* 旧密码错误抛错；无密码记录抛错。
+	*/
+	async changePassword(userId, oldPassword, newPassword) {
+		const record = await this.passwordStore.findByUserId(userId);
+		if (!record) throw new Error("密码记录不存在");
+		if (!verifyPassword(oldPassword, record.passwordHash)) throw new Error("旧密码错误");
+		const newHash = hashPassword(newPassword);
+		await this.passwordStore.updateHash(userId, newHash);
+	}
+	/** 删除密码记录（用户将无法用密码登录） */
+	async deletePassword(userId) {
+		await this.passwordStore.delete(userId);
+	}
+};
+//#endregion
+export { createDefaultIdentityResolver as i, UsernameTakenError as n, IdentityNotLinkedError as r, PasswordProvider as t };

package/dist/provider-zTWN9myS.js

@@ -0,0 +1,276 @@
+import { randomToken } from "@homurajs/core";
+import { sql } from "drizzle-orm";
+import { isSqlite } from "@homurajs/db";
+//#region src/webauthn/credential-drizzle-store.ts
+/**
+* Drizzle 双方言 WebauthnCredentialStore 实现。
+*
+* ⚠ 列名必须与 tables.ts 的显式 snake_case 对齐
+*   （id/user_id/public_key/counter/device_type/backed_up/transports/display_name/created_at）。
+*/
+async function exec(db, q) {
+	if (isSqlite(db)) await db.run(q);
+	else await db.execute(q);
+}
+async function query(db, q) {
+	if (isSqlite(db)) return await db.all(q);
+	return await db.execute(q) ?? [];
+}
+function toRecord$1(row) {
+	return {
+		id: row.id,
+		userId: row.user_id,
+		publicKey: row.public_key,
+		counter: Number(row.counter),
+		deviceType: row.device_type,
+		backedUp: Number(row.backed_up),
+		transports: row.transports,
+		displayName: row.display_name,
+		createdAt: Number(row.created_at)
+	};
+}
+function createDrizzleWebauthnCredentialStore(db, opts) {
+	const now = opts?.now ?? (() => Date.now());
+	return {
+		async findById(id) {
+			const rows = await query(db, sql`SELECT id, user_id, public_key, counter, device_type, backed_up, transports, display_name, created_at
+FROM webauthn_credentials WHERE id = ${id}`);
+			return rows[0] ? toRecord$1(rows[0]) : null;
+		},
+		async findByUserId(userId) {
+			return (await query(db, sql`SELECT id, user_id, public_key, counter, device_type, backed_up, transports, display_name, created_at
+FROM webauthn_credentials WHERE user_id = ${userId}`)).map(toRecord$1);
+		},
+		async create(input) {
+			const ts = now();
+			await exec(db, sql`INSERT INTO webauthn_credentials (id, user_id, public_key, counter, device_type, backed_up, transports, display_name, created_at)
+VALUES (${input.id}, ${input.userId}, ${input.publicKey}, ${input.counter}, ${input.deviceType}, ${input.backedUp}, ${input.transports ?? null}, ${input.displayName ?? null}, ${ts})`);
+			return {
+				id: input.id,
+				userId: input.userId,
+				publicKey: input.publicKey,
+				counter: input.counter,
+				deviceType: input.deviceType,
+				backedUp: input.backedUp,
+				transports: input.transports ?? null,
+				displayName: input.displayName ?? null,
+				createdAt: ts
+			};
+		},
+		async updateCounter(id, counter) {
+			await exec(db, sql`UPDATE webauthn_credentials SET counter = ${counter} WHERE id = ${id}`);
+		},
+		async delete(id) {
+			await exec(db, sql`DELETE FROM webauthn_credentials WHERE id = ${id}`);
+		}
+	};
+}
+//#endregion
+//#region src/webauthn/credential-rest-store.ts
+const WEBAUTHN_CREDENTIALS_TABLE = "webauthn_credentials";
+function toRecord(row) {
+	return {
+		id: row.id,
+		userId: row.user_id,
+		publicKey: row.public_key,
+		counter: Number(row.counter),
+		deviceType: row.device_type,
+		backedUp: Number(row.backed_up),
+		transports: row.transports,
+		displayName: row.display_name,
+		createdAt: Number(row.created_at)
+	};
+}
+function createRestWebauthnCredentialStore(rest, opts = {}) {
+	const t = rest.table(opts.table ?? "webauthn_credentials");
+	const now = opts.now ?? (() => Date.now());
+	return {
+		async findById(id) {
+			const row = (await t.select({ id }, { limit: 1 }))[0];
+			return row ? toRecord(row) : null;
+		},
+		async findByUserId(userId) {
+			return (await t.select({ user_id: userId })).map(toRecord);
+		},
+		async create(input) {
+			const ts = now();
+			const row = (await t.insert({
+				id: input.id,
+				user_id: input.userId,
+				public_key: input.publicKey,
+				counter: input.counter,
+				device_type: input.deviceType,
+				backed_up: input.backedUp,
+				transports: input.transports ?? null,
+				display_name: input.displayName ?? null,
+				created_at: ts
+			}))[0];
+			if (!row) throw new Error("insert failed");
+			return toRecord(row);
+		},
+		async updateCounter(id, counter) {
+			await t.update({ counter }, { id });
+		},
+		async delete(id) {
+			await t.remove({ id });
+		}
+	};
+}
+//#endregion
+//#region src/webauthn/provider.ts
+/**
+* WebAuthn Provider —— 封装 @simplewebauthn/server 的注册/认证 ceremony。
+*
+* @simplewebauthn/server 是 optional peer dep，通过动态 import 加载——
+* 不用 WebAuthn 的 App 不需要安装它。
+*
+* 流程：
+* 注册：generateRegistrationOptions → 客户端 attestation → verifyRegistrationResponse → store credential
+* 认证：generateAuthenticationOptions → 客户端 assertion → verifyAuthenticationResponse → 更新 counter
+*
+* challenge 存储复用 core 的 TtlKv（与 OAuth2 state 同一机制）。
+*/
+const DEFAULT_CHALLENGE_TTL = 3e5;
+var WebAuthProvider = class {
+	config;
+	challengeTtl;
+	nowFn;
+	constructor(config) {
+		this.config = config;
+		this.challengeTtl = config.challengeTtlMs ?? DEFAULT_CHALLENGE_TTL;
+		this.nowFn = config.now ?? (() => Date.now());
+	}
+	/**
+	* 生成注册 options（已登录用户发起）。
+	* challenge 存入 TtlKv（key = userId:challengeType），TTL 5min。
+	*/
+	async generateRegistrationOptions(userId) {
+		const { generateRegistrationOptions } = await import("@simplewebauthn/server");
+		const user = await this.config.userStore.findById(userId);
+		if (!user) throw new Error("user 不存在: " + userId);
+		const existingCreds = await this.config.credentialStore.findByUserId(userId);
+		const options = await generateRegistrationOptions({
+			rpName: this.config.rpName,
+			rpID: this.config.rpId,
+			userID: new TextEncoder().encode(userId),
+			userName: user.username ?? user.nickname ?? user.id,
+			userDisplayName: user.nickname ?? user.username ?? user.id,
+			attestationType: "none",
+			excludeCredentials: existingCreds.map((c) => ({
+				id: c.id,
+				transports: c.transports ? JSON.parse(c.transports) : void 0
+			})),
+			authenticatorSelection: {
+				userVerification: "preferred",
+				residentKey: "preferred"
+			}
+		});
+		await this.config.challengeKv.set(`${userId}:register`, options.challenge, this.challengeTtl);
+		return options;
+	}
+	/**
+	* 验证注册响应并存储凭证。
+	* challenge 一次性消费（take 语义）。
+	*/
+	async verifyRegistration(userId, response, displayName) {
+		const { verifyRegistrationResponse } = await import("@simplewebauthn/server");
+		const challenge = await this.config.challengeKv.take(`${userId}:register`);
+		if (!challenge) throw new Error("challenge 无效或已过期");
+		const verification = await verifyRegistrationResponse({
+			response,
+			expectedChallenge: challenge,
+			expectedOrigin: this.config.origin,
+			expectedRPID: this.config.rpId
+		});
+		if (!verification.verified || !verification.registrationInfo) throw new Error("注册验证失败");
+		const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+		const credId = typeof credential.id === "string" ? credential.id : Buffer.from(credential.id).toString("base64url");
+		const publicKey = typeof credential.publicKey === "string" ? credential.publicKey : Buffer.from(credential.publicKey).toString("base64url");
+		await this.config.credentialStore.create({
+			id: credId,
+			userId,
+			publicKey,
+			counter: credential.counter,
+			deviceType: credentialDeviceType,
+			backedUp: credentialBackedUp ? 1 : 0,
+			transports: response.response.transports ? JSON.stringify(response.response.transports) : null,
+			displayName: displayName ?? null
+		});
+		return { id: credId };
+	}
+	/**
+	* 生成认证 options（未登录用户发起）。
+	* challenge 存入 TtlKv，返回 { options, challengeKey }——challengeKey 必须由调用方
+	* 在 verifyAuthentication 时回传，否则匿名（discoverable credential）流程无法定位 challenge：
+	* 匿名场景下 options 阶段还不知道是哪个用户/凭证，key 只能是 `anon:${random}`，
+	* 而 verify 阶段是按 response.id 反查凭证的，两条腿对不上同一个 key。
+	* 已知 userId 时 key 固定为 `${userId}:auth`，回传与否都能命中（向后兼容）。
+	*/
+	async generateAuthenticationOptions(userId) {
+		const { generateAuthenticationOptions } = await import("@simplewebauthn/server");
+		let allowCredentials = [];
+		let challengeKey;
+		if (userId) {
+			allowCredentials = (await this.config.credentialStore.findByUserId(userId)).map((c) => ({
+				id: c.id,
+				transports: c.transports ? JSON.parse(c.transports) : void 0
+			}));
+			challengeKey = `${userId}:auth`;
+		} else challengeKey = `anon:${randomToken(16)}`;
+		const options = await generateAuthenticationOptions({
+			rpID: this.config.rpId,
+			allowCredentials,
+			userVerification: "preferred"
+		});
+		await this.config.challengeKv.set(challengeKey, options.challenge, this.challengeTtl);
+		return {
+			options,
+			challengeKey
+		};
+	}
+	/**
+	* 验证认证响应，返回已验证的用户（供 session 创建）。
+	* challenge 一次性消费。
+	*
+	* @param challengeKey generateAuthenticationOptions 返回的 key。匿名流程**必须**回传；
+	*   已知 userId 的流程可省略（缺省按 `${cred.userId}:auth` 取）。
+	*/
+	async verifyAuthentication(response, challengeKey) {
+		const { verifyAuthenticationResponse } = await import("@simplewebauthn/server");
+		const cred = await this.config.credentialStore.findById(response.id);
+		if (!cred) throw new Error("凭证不存在: " + response.id);
+		const key = challengeKey ?? `${cred.userId}:auth`;
+		const challenge = await this.config.challengeKv.take(key);
+		if (!challenge) throw new Error("challenge 无效或已过期");
+		const verification = await verifyAuthenticationResponse({
+			response,
+			expectedChallenge: challenge,
+			expectedOrigin: this.config.origin,
+			expectedRPID: this.config.rpId,
+			credential: {
+				id: cred.id,
+				publicKey: Buffer.from(cred.publicKey, "base64url"),
+				counter: cred.counter,
+				transports: cred.transports ? JSON.parse(cred.transports) : void 0
+			}
+		});
+		if (!verification.verified) throw new Error("认证验证失败");
+		await this.config.credentialStore.updateCounter(cred.id, verification.authenticationInfo.newCounter);
+		const user = await this.config.userStore.findById(cred.userId);
+		if (!user) throw new Error("user 不存在: " + cred.userId);
+		return user;
+	}
+	/** 列出用户的所有凭证（管理用） */
+	async listCredentials(userId) {
+		return this.config.credentialStore.findByUserId(userId);
+	}
+	/** 删除凭证 */
+	async deleteCredential(userId, credentialId) {
+		const cred = await this.config.credentialStore.findById(credentialId);
+		if (!cred) throw new Error("凭证不存在");
+		if (cred.userId !== userId) throw new Error("凭证不属于该用户");
+		await this.config.credentialStore.delete(credentialId);
+	}
+};
+//#endregion
+export { createDrizzleWebauthnCredentialStore as i, WEBAUTHN_CREDENTIALS_TABLE as n, createRestWebauthnCredentialStore as r, WebAuthProvider as t };