@plumix/core 0.1.0

package/dist/auth/passkey/errors.d.ts

@@ -0,0 +1,41 @@
+export declare const PASSKEY_ERROR_CODES: readonly ["challenge_not_found", "invalid_client_data", "invalid_origin", "invalid_rp_id", "user_presence_missing", "unsupported_attestation_format", "unsupported_algorithm", "credential_already_registered", "credential_limit_reached", "credential_not_found", "credential_storage_corrupt", "invalid_signature", "counter_replay", "user_not_found", "invalid_response"];
+export type PasskeyErrorCode = (typeof PASSKEY_ERROR_CODES)[number];
+interface PasskeyErrorDetail {
+    readonly expected?: string;
+    readonly actual?: string;
+}
+export declare class PasskeyError extends Error {
+    readonly code: PasskeyErrorCode;
+    readonly detail: PasskeyErrorDetail;
+    private constructor();
+    static challengeNotFound(): PasskeyError;
+    static invalidClientData(ctx: {
+        expectedType: "get" | "create";
+    }): PasskeyError;
+    static invalidOrigin(ctx: {
+        expected: string;
+        actual: string;
+    }): PasskeyError;
+    static invalidRpId(): PasskeyError;
+    static userPresenceMissing(): PasskeyError;
+    static unsupportedAttestationFormat(ctx: {
+        format: string;
+    }): PasskeyError;
+    static unsupportedAlgorithm(ctx: {
+        reason: string;
+    }): PasskeyError;
+    static credentialAlreadyRegistered(): PasskeyError;
+    static credentialLimitReached(): PasskeyError;
+    static credentialNotFound(): PasskeyError;
+    static credentialStorageCorrupt(ctx: {
+        reason: string;
+    }): PasskeyError;
+    static invalidSignature(): PasskeyError;
+    static counterReplay(): PasskeyError;
+    static userNotFound(): PasskeyError;
+    static invalidResponse(ctx: {
+        reason: string;
+    }): PasskeyError;
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/passkey/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/errors.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,mBAAmB,gXAgBtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAIpE,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,YAAa,SAAQ,KAAK;IAKrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,OAAO;IAUP,MAAM,CAAC,iBAAiB,IAAI,YAAY;IAIxC,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAC5B,YAAY,EAAE,KAAK,GAAG,QAAQ,CAAC;KAChC,GAAG,YAAY;IAOhB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,YAAY;IAOhB,MAAM,CAAC,WAAW,IAAI,YAAY;IAIlC,MAAM,CAAC,mBAAmB,IAAI,YAAY;IAI1C,MAAM,CAAC,4BAA4B,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY;IAO1E,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY;IAIlE,MAAM,CAAC,2BAA2B,IAAI,YAAY;IAOlD,MAAM,CAAC,sBAAsB,IAAI,YAAY;IAO7C,MAAM,CAAC,kBAAkB,IAAI,YAAY;IAIzC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY;IAItE,MAAM,CAAC,gBAAgB,IAAI,YAAY;IAIvC,MAAM,CAAC,aAAa,IAAI,YAAY;IAIpC,MAAM,CAAC,YAAY,IAAI,YAAY;IAInC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY;CAG9D"}

package/dist/auth/passkey/errors.js

@@ -0,0 +1,85 @@
+// challenge_expired is folded into challenge_not_found — `consumeChallenge`
+// returns null whether the row was missing or just expired, since the
+// distinction is meaningless to the caller (and leaking it would help
+// timing-distinguish stale from never-issued).
+//
+// Admin's `passkey-errors.ts` mirrors this tuple via a compile-time
+// assertion; changing it will trip an admin typecheck failure.
+export const PASSKEY_ERROR_CODES = [
+    "challenge_not_found",
+    "invalid_client_data",
+    "invalid_origin",
+    "invalid_rp_id",
+    "user_presence_missing",
+    "unsupported_attestation_format",
+    "unsupported_algorithm",
+    "credential_already_registered",
+    "credential_limit_reached",
+    "credential_not_found",
+    "credential_storage_corrupt",
+    "invalid_signature",
+    "counter_replay",
+    "user_not_found",
+    "invalid_response",
+];
+export class PasskeyError extends Error {
+    static {
+        PasskeyError.prototype.name = "PasskeyError";
+    }
+    code;
+    detail;
+    constructor(code, message, detail = {}) {
+        super(message);
+        this.code = code;
+        this.detail = detail;
+    }
+    static challengeNotFound() {
+        return new PasskeyError("challenge_not_found", "challenge_not_found");
+    }
+    static invalidClientData(ctx) {
+        return new PasskeyError("invalid_client_data", `Expected webauthn.${ctx.expectedType}`);
+    }
+    static invalidOrigin(ctx) {
+        return new PasskeyError("invalid_origin", "invalid_origin", {
+            expected: ctx.expected,
+            actual: ctx.actual,
+        });
+    }
+    static invalidRpId() {
+        return new PasskeyError("invalid_rp_id", "invalid_rp_id");
+    }
+    static userPresenceMissing() {
+        return new PasskeyError("user_presence_missing", "user_presence_missing");
+    }
+    static unsupportedAttestationFormat(ctx) {
+        return new PasskeyError("unsupported_attestation_format", `Unsupported attestation format: ${ctx.format}`);
+    }
+    static unsupportedAlgorithm(ctx) {
+        return new PasskeyError("unsupported_algorithm", ctx.reason);
+    }
+    static credentialAlreadyRegistered() {
+        return new PasskeyError("credential_already_registered", "credential_already_registered");
+    }
+    static credentialLimitReached() {
+        return new PasskeyError("credential_limit_reached", "credential_limit_reached");
+    }
+    static credentialNotFound() {
+        return new PasskeyError("credential_not_found", "credential_not_found");
+    }
+    static credentialStorageCorrupt(ctx) {
+        return new PasskeyError("credential_storage_corrupt", ctx.reason);
+    }
+    static invalidSignature() {
+        return new PasskeyError("invalid_signature", "invalid_signature");
+    }
+    static counterReplay() {
+        return new PasskeyError("counter_replay", "counter_replay");
+    }
+    static userNotFound() {
+        return new PasskeyError("user_not_found", "user_not_found");
+    }
+    static invalidResponse(ctx) {
+        return new PasskeyError("invalid_response", ctx.reason);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/passkey/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/auth/passkey/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,sEAAsE;AACtE,sEAAsE;AACtE,+CAA+C;AAC/C,EAAE;AACF,oEAAoE;AACpE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,qBAAqB;IACrB,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,gCAAgC;IAChC,uBAAuB;IACvB,+BAA+B;IAC/B,0BAA0B;IAC1B,sBAAsB;IACtB,4BAA4B;IAC5B,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;CACV,CAAC;AAWX,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC;QACE,YAAY,CAAC,SAAS,CAAC,IAAI,GAAG,cAAc,CAAC;IAC/C,CAAC;IAEQ,IAAI,CAAmB;IACvB,MAAM,CAAqB;IAEpC,YACE,IAAsB,EACtB,OAAe,EACf,SAA6B,EAAE;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,iBAAiB,CAAC,GAExB;QACC,OAAO,IAAI,YAAY,CACrB,qBAAqB,EACrB,qBAAqB,GAAG,CAAC,YAAY,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAGpB;QACC,OAAO,IAAI,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;YAC1D,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,mBAAmB;QACxB,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,4BAA4B,CAAC,GAAuB;QACzD,OAAO,IAAI,YAAY,CACrB,gCAAgC,EAChC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,oBAAoB,CAAC,GAAuB;QACjD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,2BAA2B;QAChC,OAAO,IAAI,YAAY,CACrB,+BAA+B,EAC/B,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,sBAAsB;QAC3B,OAAO,IAAI,YAAY,CACrB,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,wBAAwB,CAAC,GAAuB;QACrD,OAAO,IAAI,YAAY,CAAC,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,gBAAgB;QACrB,OAAO,IAAI,YAAY,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,GAAuB;QAC5C,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/auth/passkey/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./authenticate.js";
+export * from "./challenges.js";
+export * from "./config.js";
+export * from "./errors.js";
+export * from "./register.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/passkey/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/auth/passkey/index.js

@@ -0,0 +1,7 @@
+export * from "./authenticate.js";
+export * from "./challenges.js";
+export * from "./config.js";
+export * from "./errors.js";
+export * from "./register.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/passkey/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/passkey/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/auth/passkey/register.d.ts

@@ -0,0 +1,39 @@
+import type { Db } from "../../context/app.js";
+import type { Credential, CredentialTransport } from "../../db/schema/credentials.js";
+import type { ResolvedPasskeyConfig } from "./config.js";
+import type { RegistrationOptions, RegistrationResponse } from "./types.js";
+interface BeginRegistrationInput {
+    readonly userId: number;
+    readonly userEmail: string;
+    readonly userDisplayName?: string;
+    readonly excludeCredentials?: readonly Credential[];
+}
+export declare function beginRegistration(db: Db, config: ResolvedPasskeyConfig, input: BeginRegistrationInput): Promise<RegistrationOptions>;
+interface VerifiedRegistration {
+    readonly credentialId: string;
+    /** SEC1-uncompressed P-256 public key, ready for storage. */
+    readonly publicKey: Uint8Array;
+    readonly signatureCounter: number;
+    readonly transports: readonly CredentialTransport[];
+    /** User the original challenge was issued for. Null for discoverable-cred flows. */
+    readonly userId: number | null;
+}
+/**
+ * Verify a registration response and extract the credential. Steps follow
+ * the Copenhagen Book ceremony: client data type → challenge → origin →
+ * RP-ID hash → user-present → attestation format → algorithm → public key.
+ */
+export declare function finishRegistration(db: Db, config: ResolvedPasskeyConfig, response: RegistrationResponse): Promise<VerifiedRegistration>;
+interface PersistCredentialInput {
+    readonly userId: number;
+    readonly verified: VerifiedRegistration;
+    readonly name?: string;
+    readonly maxPerUser: number;
+}
+/**
+ * Persist a verified credential. Enforces the per-user limit and refuses to
+ * register the same credential id twice (which would silently re-bind it).
+ */
+export declare function persistCredential(db: Db, input: PersistCredentialInput): Promise<Credential>;
+export {};
+//# sourceMappingURL=register.d.ts.map

package/dist/auth/passkey/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/register.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAK5E,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CACrD;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAkF/B;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAwCrB"}

package/dist/auth/passkey/register.js

@@ -0,0 +1,175 @@
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding, } from "@oslojs/encoding";
+import { AttestationStatementFormat, ClientDataType, coseAlgorithmES256, coseAlgorithmRS256, coseEllipticCurveP256, COSEKeyType, parseAttestationObject, parseClientDataJSON, } from "@oslojs/webauthn";
+import { eq } from "drizzle-orm";
+import { credentials } from "../../db/schema/credentials.js";
+import { consumeChallenge, issueChallenge } from "./challenges.js";
+import { PasskeyError } from "./errors.js";
+export async function beginRegistration(db, config, input) {
+    const { challenge } = await issueChallenge(db, config.challengeTtlMs, input.userId);
+    const userIdBytes = new TextEncoder().encode(String(input.userId));
+    return {
+        challenge,
+        rp: { name: config.rpName, id: config.rpId },
+        user: {
+            id: encodeBase64urlNoPadding(userIdBytes),
+            name: input.userEmail,
+            displayName: input.userDisplayName ?? input.userEmail,
+        },
+        pubKeyCredParams: [
+            // ES256 first — covers Apple, Android, Windows Hello, YubiKey.
+            { type: "public-key", alg: coseAlgorithmES256 },
+            // Advertise RS256 for older Windows Hello, but reject in verify (v1 = ES256 only).
+            { type: "public-key", alg: coseAlgorithmRS256 },
+        ],
+        timeout: 60_000,
+        attestation: "none",
+        authenticatorSelection: {
+            residentKey: "preferred",
+            userVerification: "preferred",
+        },
+        excludeCredentials: input.excludeCredentials?.map((c) => ({
+            type: "public-key",
+            id: c.id,
+            transports: c.transports ?? undefined,
+        })),
+    };
+}
+/**
+ * Verify a registration response and extract the credential. Steps follow
+ * the Copenhagen Book ceremony: client data type → challenge → origin →
+ * RP-ID hash → user-present → attestation format → algorithm → public key.
+ */
+export async function finishRegistration(db, config, response) {
+    let clientDataBytes;
+    let attestationBytes;
+    try {
+        clientDataBytes = decodeBase64urlIgnorePadding(response.response.clientDataJSON);
+        attestationBytes = decodeBase64urlIgnorePadding(response.response.attestationObject);
+    }
+    catch {
+        throw PasskeyError.invalidResponse({
+            reason: "Malformed base64url in registration response",
+        });
+    }
+    const clientData = parseClientDataJSON(clientDataBytes);
+    if (clientData.type !== ClientDataType.Create) {
+        throw PasskeyError.invalidClientData({ expectedType: "create" });
+    }
+    if (clientData.origin !== config.origin) {
+        throw PasskeyError.invalidOrigin({
+            expected: config.origin,
+            actual: clientData.origin,
+        });
+    }
+    const attestation = parseAttestationObject(attestationBytes);
+    if (attestation.attestationStatement.format !== AttestationStatementFormat.None) {
+        throw PasskeyError.unsupportedAttestationFormat({
+            format: String(attestation.attestationStatement.format),
+        });
+    }
+    const { authenticatorData } = attestation;
+    if (!authenticatorData.verifyRelyingPartyIdHash(config.rpId)) {
+        throw PasskeyError.invalidRpId();
+    }
+    const challengeString = encodeBase64urlNoPadding(clientData.challenge);
+    const challenge = await consumeChallenge(db, challengeString);
+    if (!challenge)
+        throw PasskeyError.challengeNotFound();
+    if (!authenticatorData.userPresent)
+        throw PasskeyError.userPresenceMissing();
+    if (!authenticatorData.credential) {
+        throw PasskeyError.invalidResponse({
+            reason: "No credential data in attestation",
+        });
+    }
+    const { credential } = authenticatorData;
+    const algorithm = credential.publicKey.algorithm();
+    if (algorithm !== coseAlgorithmES256) {
+        // RS256 was advertised for compatibility but we deliberately don't
+        // implement RSA verify in v1 — ES256 covers ~all real-world authenticators.
+        throw PasskeyError.unsupportedAlgorithm({
+            reason: `algorithm ${algorithm}`,
+        });
+    }
+    if (credential.publicKey.type() !== COSEKeyType.EC2) {
+        throw PasskeyError.unsupportedAlgorithm({
+            reason: "Expected EC2 key for ES256",
+        });
+    }
+    const cose = credential.publicKey.ec2();
+    if (cose.curve !== coseEllipticCurveP256) {
+        throw PasskeyError.unsupportedAlgorithm({
+            reason: "Expected P-256 curve",
+        });
+    }
+    const publicKey = encodeSec1Uncompressed(cose.x, cose.y);
+    return {
+        credentialId: encodeBase64urlNoPadding(credential.id),
+        publicKey,
+        signatureCounter: authenticatorData.signatureCounter,
+        transports: response.response.transports ?? [],
+        userId: challenge.userId,
+    };
+}
+/**
+ * Persist a verified credential. Enforces the per-user limit and refuses to
+ * register the same credential id twice (which would silently re-bind it).
+ */
+export async function persistCredential(db, input) {
+    const userCount = await db.$count(credentials, eq(credentials.userId, input.userId));
+    if (userCount >= input.maxPerUser) {
+        throw PasskeyError.credentialLimitReached();
+    }
+    const collision = await db
+        .select({ id: credentials.id })
+        .from(credentials)
+        .where(eq(credentials.id, input.verified.credentialId))
+        .get();
+    if (collision)
+        throw PasskeyError.credentialAlreadyRegistered();
+    const [row] = await db
+        .insert(credentials)
+        .values({
+        id: input.verified.credentialId,
+        userId: input.userId,
+        // Drizzle's `blob({ mode: "buffer" })` types this column as `Buffer`.
+        // The cast is only for the type checker — at runtime the libsql / D1
+        // driver accepts a Uint8Array (Buffer is a Uint8Array subclass). When
+        // the cloudflare adapter lands in Phase 4 we may switch the schema
+        // mode so this dance is unnecessary.
+        publicKey: input.verified.publicKey,
+        counter: input.verified.signatureCounter,
+        // Backup-eligible flag parsing isn't exposed by @oslojs/webauthn yet;
+        // conservative default until it is.
+        deviceType: "single_device",
+        isBackedUp: false,
+        transports: [...input.verified.transports],
+        name: input.name ?? null,
+    })
+        .returning();
+    // eslint-disable-next-line no-restricted-syntax -- defensive driver-regression guard; migrate alongside auth errors in PR 2 (#234)
+    if (!row)
+        throw new Error("persistCredential: insert returned no row");
+    return row;
+}
+// COSE delivers x/y as fixed 32-byte wire values, but oslojs's parser
+// hands them back as bigints, and its `encodeSEC1Uncompressed` places
+// a minimal-length Y at a fixed offset — a Y with a leading zero byte
+// (~1/256 of P-256 keys) comes out left-shifted, silently storing a
+// corrupted key that fails every future assertion. Encode with fixed
+// 32-byte big-endian slots instead (RFC 5480 §2.2).
+function encodeSec1Uncompressed(x, y) {
+    const out = new Uint8Array(65);
+    out[0] = 0x04;
+    writeFixedWidthBE(out, x, 1);
+    writeFixedWidthBE(out, y, 33);
+    return out;
+}
+function writeFixedWidthBE(out, value, offset) {
+    let v = value;
+    for (let i = 31; i >= 0; i--) {
+        out[offset + i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+}
+//# sourceMappingURL=register.js.map

package/dist/auth/passkey/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/auth/passkey/register.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AASjC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,MAA6B,EAC7B,KAA6B;IAE7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CACxC,EAAE,EACF,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO;QACL,SAAS;QACT,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,wBAAwB,CAAC,WAAW,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,SAAS;YACrB,WAAW,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,SAAS;SACtD;QACD,gBAAgB,EAAE;YAChB,+DAA+D;YAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,kBAAkB,EAAE;YAC/C,mFAAmF;YACnF,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAChD;QACD,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,MAAM;QACnB,sBAAsB,EAAE;YACtB,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;QACD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,YAAqB;YAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS;SACtC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,MAA6B,EAC7B,QAA8B;IAE9B,IAAI,eAA2B,CAAC;IAChC,IAAI,gBAA4B,CAAC;IACjC,IAAI,CAAC;QACH,eAAe,GAAG,4BAA4B,CAC5C,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACjC,CAAC;QACF,gBAAgB,GAAG,4BAA4B,CAC7C,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,eAAe,CAAC;YACjC,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,YAAY,CAAC,iBAAiB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,aAAa,CAAC;YAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IACE,WAAW,CAAC,oBAAoB,CAAC,MAAM,KAAK,0BAA0B,CAAC,IAAI,EAC3E,CAAC;QACD,MAAM,YAAY,CAAC,4BAA4B,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAC;IAC1C,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;IACvD,IAAI,CAAC,iBAAiB,CAAC,WAAW;QAAE,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC;IAE7E,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,YAAY,CAAC,eAAe,CAAC;YACjC,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;IAEzC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;IACnD,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrC,mEAAmE;QACnE,4EAA4E;QAC5E,MAAM,YAAY,CAAC,oBAAoB,CAAC;YACtC,MAAM,EAAE,aAAa,SAAS,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,YAAY,CAAC,oBAAoB,CAAC;YACtC,MAAM,EAAE,4BAA4B;SACrC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACzC,MAAM,YAAY,CAAC,oBAAoB,CAAC;YACtC,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO;QACL,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,SAAS;QACT,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;QACpD,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;QAC9C,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,KAA6B;IAE7B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAC/B,WAAW,EACX,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,IAAI,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,YAAY,CAAC,sBAAsB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;SAC9B,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACtD,GAAG,EAAE,CAAC;IACT,IAAI,SAAS;QAAE,MAAM,YAAY,CAAC,2BAA2B,EAAE,CAAC;IAEhE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,qCAAqC;QACrC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAmB;QAC7C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACxC,sEAAsE;QACtE,oCAAoC;QACpC,UAAU,EAAE,eAAe;QAC3B,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;KACzB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,mIAAmI;IACnI,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,oDAAoD;AACpD,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACd,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAe,EACf,KAAa,EACb,MAAc;IAEd,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QACpC,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/auth/passkey/routes.d.ts

@@ -0,0 +1,10 @@
+import type { AppContext } from "../../context/app.js";
+import type { PlumixApp } from "../../runtime/app.js";
+export declare function handlePasskeyRegisterOptions(ctx: AppContext, app: PlumixApp): Promise<Response>;
+export declare function handlePasskeyRegisterVerify(ctx: AppContext, app: PlumixApp): Promise<Response>;
+export declare function handlePasskeyLoginOptions(ctx: AppContext, app: PlumixApp): Promise<Response>;
+export declare function handlePasskeyLoginVerify(ctx: AppContext, app: PlumixApp): Promise<Response>;
+export declare function handleSignout(ctx: AppContext): Promise<Response>;
+export declare function handleInviteRegisterOptions(ctx: AppContext, app: PlumixApp): Promise<Response>;
+export declare function handleInviteRegisterVerify(ctx: AppContext, app: PlumixApp): Promise<Response>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/passkey/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAuJtD,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CA+BnB;AA8BD,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CA4EnB;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CA0CnB;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BtE;AA6CD,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAgEnB"}