@mrgnw/anahtar 0.0.27 → 0.0.29-diagnostic.0

package/README.md

@@ -1,4 +1,4 @@
-# @mrgnw/anahtar
+# anahtar: incredibly simple & secure auth with passkeys and email+otp fallback
 
 > **Pre-alpha.** API may change between releases.
 
@@ -13,6 +13,12 @@ Auth for SvelteKit. Email+OTP + optional passkeys.
 3. First login -> passkey registration prompt
 4. Future logins -> passkey autofill, OTP fallback
 
+## Roadmap: Proof-of-concept: everything can change
+The goal is simplicity, we will likely stay with passkeys and email+OTP only.
+
+- we may change the implemenation.
+- we will likely split the UI elements from the API, making it easier to run headless, just use the UI, or use both.
+
 ## Quick start
 
 ```sh

package/dist/components/AuthPill.svelte

@@ -25,6 +25,8 @@ interface Props {
 	onStepChange?: (step: 'email' | 'otp' | 'authenticated') => void;
 	/** Extra inline icons rendered before the sign-out button when authenticated. */
 	actions?: Snippet;
+	/** Show `·` dot separators between pill segments. Defaults to false (flex gap only). */
+	separators?: boolean;
 }
 
 let {
@@ -39,6 +41,7 @@ let {
 	getPasskeys,
 	onStepChange,
 	actions,
+	separators = false,
 }: Props = $props();
 
 let expanded = $state(false);
@@ -348,7 +351,7 @@ async function removePasskey(id: string) {
 			</button>
 		{:else if isAuthenticated}
 			<span class="anahtar-pill-email">{user?.email}</span>
-			<span class="anahtar-pill-sep">&middot;</span>
+			{#if separators}<span class="anahtar-pill-sep">&middot;</span>{/if}
 			{#if getPasskeys}
 				<button
 					class="anahtar-pill-icon"
@@ -361,11 +364,11 @@ async function removePasskey(id: string) {
 						<circle cx="7.5" cy="15.5" r="5.5"/><path d="m11.5 12 4-4"/><path d="m15 7 2 2"/><path d="m17.5 4.5 2 2"/>
 					</svg>
 				</button>
-				<span class="anahtar-pill-sep">&middot;</span>
+				{#if separators}<span class="anahtar-pill-sep">&middot;</span>{/if}
 			{/if}
 			{#if actions}
 				{@render actions()}
-				<span class="anahtar-pill-sep">&middot;</span>
+				{#if separators}<span class="anahtar-pill-sep">&middot;</span>{/if}
 			{/if}
 			<button class="anahtar-pill-icon anahtar-pill-signout" onclick={handleSignOut} title="Sign out" disabled={loading}>
 				<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -373,7 +376,7 @@ async function removePasskey(id: string) {
 				</svg>
 			</button>
 			{#if compact}
-				<span class="anahtar-pill-sep">&middot;</span>
+				{#if separators}<span class="anahtar-pill-sep">&middot;</span>{/if}
 				<button class="anahtar-pill-icon" onclick={() => { expanded = false; showPasskeys = false; }} title="Collapse">
 					<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
 						<line x1="18" x2="6" y1="6" y2="18"/><line x1="6" x2="18" y1="6" y2="18"/>
@@ -383,7 +386,7 @@ async function removePasskey(id: string) {
 
 		{:else if otpStep}
 			<span class="anahtar-pill-otp-label">{email}</span>
-			<span class="anahtar-pill-sep">&middot;</span>
+			{#if separators}<span class="anahtar-pill-sep">&middot;</span>{/if}
 			<div class="anahtar-pill-otp-boxes">
 				{#each otpDigits as _, i}
 					<input

package/dist/components/AuthPill.svelte.d.ts

@@ -21,6 +21,8 @@ interface Props {
     onStepChange?: (step: 'email' | 'otp' | 'authenticated') => void;
     /** Extra inline icons rendered before the sign-out button when authenticated. */
     actions?: Snippet;
+    /** Show `·` dot separators between pill segments. Defaults to false (flex gap only). */
+    separators?: boolean;
 }
 declare const AuthPill: import("svelte").Component<Props, {}, "">;
 type AuthPill = ReturnType<typeof AuthPill>;

package/dist/passkey.js

@@ -121,13 +121,25 @@ export async function generateAuthenticationChallenge(db, requestUrl, config) {
 }
 export async function verifyAuthenticationResponse(db, response, requestUrl, config) {
     const { rpID, origin } = getWebAuthnConfig(requestUrl, config);
+    const idHint = `${response.id.slice(0, 8)}…`;
     const passkey = await db.getPasskeyByCredentialId(response.id);
-    if (!passkey)
+    if (!passkey) {
+        console.warn(`[anahtar login-finish] no stored passkey for credentialId=${idHint} (rpID=${rpID})`);
         return null;
-    const challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString()).challenge;
+    }
+    let challenge;
+    try {
+        challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString()).challenge;
+    }
+    catch (e) {
+        console.warn(`[anahtar login-finish] clientDataJSON parse failed: ${e}`);
+        return null;
+    }
     const stored = await db.consumeChallenge(challenge);
-    if (!stored)
+    if (!stored) {
+        console.warn(`[anahtar login-finish] challenge not found or expired (credentialId=${idHint})`);
         return null;
+    }
     try {
         const verification = await verifyAuthResponse({
             response,
@@ -144,14 +156,17 @@ export async function verifyAuthenticationResponse(db, response, requestUrl, con
                     : undefined,
             },
         });
-        if (!verification.verified)
+        if (!verification.verified) {
+            console.warn(`[anahtar login-finish] not verified (credentialId=${idHint}, expectedRPID=${rpID}, expectedOrigin=${origin})`);
             return null;
+        }
         await db.updatePasskeyCounter(passkey.id, verification.authenticationInfo.newCounter);
         return {
             user: { id: passkey.userId, email: passkey.email },
         };
     }
-    catch {
+    catch (e) {
+        console.warn(`[anahtar login-finish] verification threw (credentialId=${idHint}, expectedRPID=${rpID}, expectedOrigin=${origin}): ${e}`);
         return null;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgnw/anahtar",
-  "version": "0.0.27",
+  "version": "0.0.29-diagnostic.0",
   "description": "Opinionated, reusable auth for SvelteKit. Email+OTP + passkeys.",
   "license": "MIT",
   "type": "module",
@@ -12,6 +12,14 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
+  "scripts": {
+    "build": "svelte-package",
+    "check": "svelte-check --tsconfig ./tsconfig.json",
+    "test": "vitest run --config vitest.unit.ts && vitest run --config vitest.browser.ts",
+    "test:unit": "vitest run --config vitest.unit.ts",
+    "test:browser": "vitest run --config vitest.browser.ts",
+    "prepublishOnly": "pnpm build"
+  },
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -60,6 +68,11 @@
     "@oslojs/encoding": "^1.1.0",
     "@simplewebauthn/server": "^13.2.2"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ]
+  },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.2.2",
     "@sveltejs/kit": "^2.31.1",
@@ -75,12 +88,5 @@
     "svelte-check": "^4.3.1",
     "typescript": "^5.9.2",
     "vitest": "^3.2.1"
-  },
-  "scripts": {
-    "build": "svelte-package",
-    "check": "svelte-check --tsconfig ./tsconfig.json",
-    "test": "vitest run --config vitest.unit.ts && vitest run --config vitest.browser.ts",
-    "test:unit": "vitest run --config vitest.unit.ts",
-    "test:browser": "vitest run --config vitest.browser.ts"
   }
-}
+}