@mrgnw/anahtar 0.0.29-diagnostic.0 → 0.0.30

package/dist/components/AuthFlow.svelte

@@ -210,6 +210,9 @@ function handlePasskeySkip() {
 					bind:value={email}
 					required
 					autocomplete="username webauthn"
+					autocapitalize="none"
+					autocorrect="off"
+					spellcheck="false"
 					placeholder={m.emailPlaceholder}
 					class="anahtar-input"
 				/>

package/dist/components/AuthPill.svelte

@@ -60,10 +60,25 @@ let isTouch = $state(false);
 let hoveredKey = $state<string | null>(null);
 let passkeyRefresh = $state(0);
 let passkeyOnboarding = $state(false);
-let conditionalAbort: AbortController | null = null;
+
+const PASSKEY_TIMEOUT_MS = 8000;
+// Captured from the lazy @simplewebauthn/browser import so onMount cleanup (sync)
+// and handleEmailSubmit can cancel an in-flight ceremony without re-importing.
+let webauthnAbort: { cancelCeremony: () => void } | null = null;
 
 const isAuthenticated = $derived(!!user);
 
+// Best-effort bound on a promise so a WebAuthn ceremony that never settles
+// (e.g. rpID mismatch on preview domains) can't wedge the sign-in flow.
+function raceTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<never>((_, reject) => {
+		timer = setTimeout(() => reject(new Error('timeout')), ms);
+	});
+	// Promise.race consumes the loser's later settlement, so no unhandled rejection.
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
 function shortDate(ts?: number): string {
 	if (!ts) return '';
 	const d = new Date(ts);
@@ -77,7 +92,7 @@ const passkeyPromise = $derived(
 onMount(() => {
 	isTouch = matchMedia('(pointer: coarse)').matches;
 	if (!isAuthenticated) tryConditionalWebAuthn();
-	return () => conditionalAbort?.abort();
+	return () => webauthnAbort?.cancelCeremony();
 });
 
 async function handleSignOut() {
@@ -94,40 +109,45 @@ async function handleSignOut() {
 
 async function tryConditionalWebAuthn() {
 	try {
-		const { startAuthentication } = await import('@simplewebauthn/browser');
+		const mod = await import('@simplewebauthn/browser');
+		webauthnAbort = mod.WebAuthnAbortService;
 		const res = await fetch(`${apiBase}/passkey/login-start`);
 		if (!res.ok) return;
 		const options = (await res.json()) as any;
-		conditionalAbort = new AbortController();
-		const authResponse = await startAuthentication({
+		const authResponse = await mod.startAuthentication({
 			optionsJSON: options,
 			useBrowserAutofill: true,
 		});
+		// Only reached when the user actually picks a passkey via autofill.
+		// Scope `loading` to the verify step so the abort path never touches it
+		// (an aborted ceremony throws straight to the catch below).
 		loading = true;
-		const verifyRes = await fetch(`${apiBase}/passkey/login-finish`, {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify(authResponse),
-		});
-		if (verifyRes.ok) await onSuccess?.();
+		try {
+			const verifyRes = await fetch(`${apiBase}/passkey/login-finish`, {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify(authResponse),
+			});
+			if (verifyRes.ok) await onSuccess?.();
+		} finally {
+			loading = false;
+		}
 	} catch {
 		/* not available or cancelled */
-	} finally {
-		loading = false;
 	}
 }
 
 async function handleEmailSubmit(e: SubmitEvent) {
 	e.preventDefault();
 	if (!email.includes('@')) return;
-	conditionalAbort?.abort();
-	conditionalAbort = null;
+	webauthnAbort?.cancelCeremony();
 	loading = true;
 	error = '';
 	try {
 		// Passkey-first: check if user has passkeys before falling back to OTP
 		try {
-			const { startAuthentication } = await import('@simplewebauthn/browser');
+			const mod = await import('@simplewebauthn/browser');
+			webauthnAbort = mod.WebAuthnAbortService;
 			const checkRes = await fetch(`${apiBase}/passkey/check-email`, {
 				method: 'POST',
 				headers: { 'Content-Type': 'application/json' },
@@ -137,7 +157,10 @@ async function handleEmailSubmit(e: SubmitEvent) {
 				const opts = (await checkRes.json()) as any;
 				if ((opts?.allowCredentials?.length ?? 0) > 0) {
 					try {
-						const authResp = await startAuthentication({ optionsJSON: opts });
+						const authResp = await raceTimeout(
+							mod.startAuthentication({ optionsJSON: opts }),
+							PASSKEY_TIMEOUT_MS,
+						);
 						const vRes = await fetch(`${apiBase}/passkey/login-finish`, {
 							method: 'POST',
 							headers: { 'Content-Type': 'application/json' },
@@ -148,7 +171,8 @@ async function handleEmailSubmit(e: SubmitEvent) {
 							return;
 						}
 					} catch {
-						/* cancelled */
+						mod.WebAuthnAbortService.cancelCeremony();
+						/* stalled, cancelled, or failed — fall through to OTP */
 					}
 				}
 			}
@@ -412,13 +436,18 @@ async function removePasskey(id: string) {
 					placeholder={m.emailPlaceholder}
 					class="anahtar-pill-email-input"
 					autocomplete="username webauthn"
+					autocapitalize="none"
+					autocorrect="off"
+					spellcheck="false"
 					disabled={loading}
 				/>
-			<button type="submit" class="anahtar-pill-go" disabled={loading || !email.includes('@')}>
+			<button type="submit" class="anahtar-pill-go" disabled={loading || !email.includes('@')} aria-label={m.continue}>
 				{#if loading}
-					...
+					<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" class="anahtar-spinner" aria-hidden="true">
+						<path d="M21 12a9 9 0 1 1-6.219-8.56"/>
+					</svg>
 				{:else}
-					<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+					<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
 						<path d="M5 12h14"/><path d="m12 5 7 7-7 7"/>
 					</svg>
 				{/if}
@@ -585,6 +614,11 @@ async function removePasskey(id: string) {
 	.anahtar-pill-go:disabled { opacity: 0.4; cursor: not-allowed; }
 	.anahtar-pill-go:hover:not(:disabled) { opacity: 0.85; }
 
+	@keyframes anahtar-spin {
+		to { transform: rotate(360deg); }
+	}
+	.anahtar-spinner { animation: anahtar-spin 0.8s linear infinite; }
+
 	/* OTP */
 	.anahtar-pill-otp-label {
 		font-size: 0.8125rem;

package/dist/db/d1.js

@@ -1,3 +1,4 @@
+import { normalizeEmail } from '../email.js';
 export function d1Adapter(db, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -45,8 +46,8 @@ export function d1Adapter(db, options = {}) {
         },
         async getUserByEmail(email) {
             const row = await db
-                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ?`)
-                .bind(email)
+                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ? COLLATE NOCASE`)
+                .bind(normalizeEmail(email))
                 .first();
             if (!row)
                 return null;
@@ -59,10 +60,11 @@ export function d1Adapter(db, options = {}) {
         },
         async createUser(email) {
             const id = crypto.randomUUID();
-            await db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).bind(id, email).run();
+            const normalized = normalizeEmail(email);
+            await db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).bind(id, normalized).run();
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Math.floor(Date.now() / 1000)
             };
@@ -102,13 +104,13 @@ export function d1Adapter(db, options = {}) {
         async storeOTP(email, id, code, expiresAt) {
             await db
                 .prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`)
-                .bind(id, email, code, expiresAt)
+                .bind(id, normalizeEmail(email), code, expiresAt)
                 .run();
         },
         async getLatestOTP(email) {
             const row = await db
-                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? ORDER BY created_at DESC LIMIT 1`)
-                .bind(email)
+                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE ORDER BY created_at DESC LIMIT 1`)
+                .bind(normalizeEmail(email))
                 .first();
             if (!row)
                 return null;
@@ -127,7 +129,7 @@ export function d1Adapter(db, options = {}) {
             await db.prepare(`DELETE FROM ${t.otpCodes} WHERE id = ?`).bind(id).run();
         },
         async deleteOTPsForEmail(email) {
-            await db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ?`).bind(email).run();
+            await db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE`).bind(normalizeEmail(email)).run();
         },
         async storeChallenge(challenge, userId, expiresAt) {
             await db.prepare(`DELETE FROM ${t.challenges} WHERE expires_at < ?`).bind(Date.now()).run();

package/dist/db/postgres.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { normalizeEmail } from '../email.js';
 export function postgresAdapter(pool, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -58,7 +59,7 @@ export function postgresAdapter(pool, options = {}) {
 			`);
         },
         async getUserByEmail(email) {
-            const row = await queryOne(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = $1`, [email]);
+            const row = await queryOne(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE LOWER(email) = $1`, [normalizeEmail(email)]);
             if (!row)
                 return null;
             return {
@@ -70,10 +71,11 @@ export function postgresAdapter(pool, options = {}) {
         },
         async createUser(email) {
             const id = randomUUID();
-            await pool.query(`INSERT INTO ${t.users} (id, email) VALUES ($1, $2)`, [id, email]);
+            const normalized = normalizeEmail(email);
+            await pool.query(`INSERT INTO ${t.users} (id, email) VALUES ($1, $2)`, [id, normalized]);
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Date.now()
             };
@@ -108,13 +110,13 @@ export function postgresAdapter(pool, options = {}) {
         async storeOTP(email, id, code, expiresAt) {
             await pool.query(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES ($1, $2, $3, $4)`, [
                 id,
-                email,
+                normalizeEmail(email),
                 code,
                 expiresAt
             ]);
         },
         async getLatestOTP(email) {
-            const row = await queryOne(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = $1 ORDER BY created_at DESC LIMIT 1`, [email]);
+            const row = await queryOne(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE LOWER(email) = $1 ORDER BY created_at DESC LIMIT 1`, [normalizeEmail(email)]);
             if (!row)
                 return null;
             return {
@@ -132,7 +134,7 @@ export function postgresAdapter(pool, options = {}) {
             await pool.query(`DELETE FROM ${t.otpCodes} WHERE id = $1`, [id]);
         },
         async deleteOTPsForEmail(email) {
-            await pool.query(`DELETE FROM ${t.otpCodes} WHERE email = $1`, [email]);
+            await pool.query(`DELETE FROM ${t.otpCodes} WHERE LOWER(email) = $1`, [normalizeEmail(email)]);
         },
         async storeChallenge(challenge, userId, expiresAt) {
             await pool.query(`DELETE FROM ${t.challenges} WHERE expires_at < $1`, [Date.now()]);

package/dist/db/sqlite.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { normalizeEmail } from '../email.js';
 export function sqliteAdapter(db, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -53,8 +54,8 @@ export function sqliteAdapter(db, options = {}) {
         },
         getUserByEmail(email) {
             const row = db
-                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ?`)
-                .get(email);
+                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ? COLLATE NOCASE`)
+                .get(normalizeEmail(email));
             if (!row)
                 return null;
             return {
@@ -66,10 +67,11 @@ export function sqliteAdapter(db, options = {}) {
         },
         createUser(email) {
             const id = randomUUID();
-            db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).run(id, email);
+            const normalized = normalizeEmail(email);
+            db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).run(id, normalized);
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Math.floor(Date.now() / 1000)
             };
@@ -100,12 +102,12 @@ export function sqliteAdapter(db, options = {}) {
             db.prepare(`DELETE FROM ${t.sessions} WHERE id = ?`).run(tokenHash);
         },
         storeOTP(email, id, code, expiresAt) {
-            db.prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`).run(id, email, code, expiresAt);
+            db.prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`).run(id, normalizeEmail(email), code, expiresAt);
         },
         getLatestOTP(email) {
             const row = db
-                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? ORDER BY created_at DESC LIMIT 1`)
-                .get(email);
+                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE ORDER BY created_at DESC LIMIT 1`)
+                .get(normalizeEmail(email));
             if (!row)
                 return null;
             return {
@@ -123,7 +125,7 @@ export function sqliteAdapter(db, options = {}) {
             db.prepare(`DELETE FROM ${t.otpCodes} WHERE id = ?`).run(id);
         },
         deleteOTPsForEmail(email) {
-            db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ?`).run(email);
+            db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE`).run(normalizeEmail(email));
         },
         storeChallenge(challenge, userId, expiresAt) {
             db.prepare(`DELETE FROM ${t.challenges} WHERE expires_at < ?`).run(Date.now());

package/dist/email.d.ts

@@ -0,0 +1 @@
+export declare function normalizeEmail(email: string): string;

package/dist/email.js

@@ -0,0 +1,6 @@
+// Email is the user's identity key. Normalize it to one canonical form so the
+// same address always maps to a single account regardless of how it was typed
+// (mobile keyboards auto-capitalize, users add stray whitespace, etc.).
+export function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgnw/anahtar",
-  "version": "0.0.29-diagnostic.0",
+  "version": "0.0.30",
   "description": "Opinionated, reusable auth for SvelteKit. Email+OTP + passkeys.",
   "license": "MIT",
   "type": "module",
@@ -40,6 +40,10 @@
       "types": "./dist/db/d1.d.ts",
       "default": "./dist/db/d1.js"
     },
+    "./device": {
+      "types": "./dist/device.d.ts",
+      "default": "./dist/device.js"
+    },
     "./components": {
       "types": "./dist/components/index.d.ts",
       "svelte": "./dist/components/index.js",