@plumix/core 0.1.0

package/dist/auth/oauth/signup.d.ts

@@ -0,0 +1,40 @@
+import type { Db } from "../../context/app.js";
+import type { User } from "../../db/schema/users.js";
+import type { OAuthProfile } from "./types.js";
+interface ResolveOAuthUserInput {
+    readonly provider: string;
+    readonly profile: OAuthProfile;
+    /**
+     * When true, allow this OAuth callback to mint the very first admin
+     * (forwarded to `resolveExternalIdentity`). The route handler reads
+     * this from `ctx.bootstrapAllowed`, which is derived from
+     * `auth.bootstrapVia`. Default false keeps the bootstrap rail
+     * passkey-only.
+     */
+    readonly bootstrapAllowed?: boolean;
+}
+interface ResolvedOAuthUser {
+    readonly user: User;
+    /** True when this call provisioned a new user row. */
+    readonly created: boolean;
+    /** True when this call linked an existing user to the OAuth account. */
+    readonly linked: boolean;
+}
+/**
+ * Decide who an OAuth callback maps to:
+ *
+ *   1. If `oauth_accounts(provider, providerAccountId)` already points
+ *      at a user, that's the answer (modulo disabled / dangling-link).
+ *   2. Else delegate to `resolveExternalIdentity` for the lookup-or-
+ *      provision dance shared with magic-link signup. On success, write
+ *      the `oauth_accounts` link row.
+ *
+ * OAuth-specific concerns (link table, dangling-link detection) stay
+ * here. The generic identity-resolution logic (verified-email gate,
+ * disabled-account gate, allowed-domains gate, bootstrap rail, race-on-
+ * insert retry) lives in `auth/identity.ts` and is shared with every
+ * external flow.
+ */
+export declare function resolveOAuthUser(db: Db, input: ResolveOAuthUserInput): Promise<ResolvedOAuthUser>;
+export {};
+//# sourceMappingURL=signup.d.ts.map

package/dist/auth/oauth/signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/signup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO/C,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAwE5B"}

package/dist/auth/oauth/signup.js

@@ -0,0 +1,92 @@
+import { and, eq, isUniqueConstraintError } from "../../db/index.js";
+import { oauthAccounts } from "../../db/schema/oauth_accounts.js";
+import { users } from "../../db/schema/users.js";
+import { ExternalIdentityError, resolveExternalIdentity } from "../identity.js";
+import { OAuthError } from "./errors.js";
+/**
+ * Decide who an OAuth callback maps to:
+ *
+ *   1. If `oauth_accounts(provider, providerAccountId)` already points
+ *      at a user, that's the answer (modulo disabled / dangling-link).
+ *   2. Else delegate to `resolveExternalIdentity` for the lookup-or-
+ *      provision dance shared with magic-link signup. On success, write
+ *      the `oauth_accounts` link row.
+ *
+ * OAuth-specific concerns (link table, dangling-link detection) stay
+ * here. The generic identity-resolution logic (verified-email gate,
+ * disabled-account gate, allowed-domains gate, bootstrap rail, race-on-
+ * insert retry) lives in `auth/identity.ts` and is shared with every
+ * external flow.
+ */
+export async function resolveOAuthUser(db, input) {
+    const { provider, profile } = input;
+    const existingLink = await db.query.oauthAccounts.findFirst({
+        where: and(eq(oauthAccounts.provider, provider), eq(oauthAccounts.providerAccountId, profile.providerAccountId)),
+    });
+    if (existingLink) {
+        const linked = await db.query.users.findFirst({
+            where: eq(users.id, existingLink.userId),
+        });
+        // A dangling oauth_accounts row means the cascade-on-delete didn't
+        // fire (FK enforcement off, or hand-rolled SQL). Surface a distinct
+        // code so the friendly-message map can say "support" rather than
+        // "your account is disabled" — the row is gone, not paused.
+        if (!linked)
+            throw OAuthError.linkBroken();
+        if (linked.disabledAt)
+            throw OAuthError.accountDisabled();
+        return { user: linked, created: false, linked: false };
+    }
+    let resolved;
+    try {
+        resolved = await resolveExternalIdentity(db, {
+            email: profile.email,
+            emailVerified: profile.emailVerified,
+            name: profile.name,
+            avatarUrl: profile.avatarUrl,
+            bootstrapAllowed: input.bootstrapAllowed,
+            // allowed_domains still gates signup; the `oauth_accounts` link
+            // row is OAuth-specific and written below regardless of whether
+            // the user existed or was just provisioned.
+        });
+    }
+    catch (error) {
+        if (error instanceof ExternalIdentityError) {
+            switch (error.code) {
+                case "email_unverified":
+                    throw OAuthError.emailUnverified();
+                case "account_disabled":
+                    throw OAuthError.accountDisabled();
+                case "domain_not_allowed":
+                    throw OAuthError.domainNotAllowed();
+                case "registration_closed":
+                    throw OAuthError.registrationClosed();
+            }
+        }
+        throw error;
+    }
+    // Write the OAuth link row. Race retry is its own concern: a
+    // concurrent OAuth callback for the same `(provider, providerAccountId)`
+    // could fire between our `existingLink` check and this insert.
+    try {
+        await db.insert(oauthAccounts).values({
+            provider,
+            providerAccountId: profile.providerAccountId,
+            userId: resolved.user.id,
+        });
+    }
+    catch (error) {
+        if (!isUniqueConstraintError(error))
+            throw error;
+        // Another callback won the race; the link already exists pointing
+        // at the same userId (provider + providerAccountId is the PK and
+        // resolveExternalIdentity returned the same email-keyed user).
+        // Fall through — sign-in succeeds.
+    }
+    return {
+        user: resolved.user,
+        created: resolved.created,
+        linked: !resolved.created,
+    };
+}
+//# sourceMappingURL=signup.js.map

package/dist/auth/oauth/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../../src/auth/oauth/signup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuBzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEpC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAC1D,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpC,EAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAC/D;KACF,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC5C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,CAAC,MAAM;YAAE,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,UAAU;YAAE,MAAM,UAAU,CAAC,eAAe,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;YAC3C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gEAAgE;YAChE,gEAAgE;YAChE,4CAA4C;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,kBAAkB;oBACrB,MAAM,UAAU,CAAC,eAAe,EAAE,CAAC;gBACrC,KAAK,kBAAkB;oBACrB,MAAM,UAAU,CAAC,eAAe,EAAE,CAAC;gBACrC,KAAK,oBAAoB;oBACvB,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACtC,KAAK,qBAAqB;oBACxB,MAAM,UAAU,CAAC,kBAAkB,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,6DAA6D;IAC7D,yEAAyE;IACzE,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;YACpC,QAAQ;YACR,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,mCAAmC;IACrC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC"}

package/dist/auth/oauth/state.d.ts

@@ -0,0 +1,19 @@
+import type { Db } from "../../context/app.js";
+interface OAuthStatePayload {
+    readonly provider: string;
+    readonly codeVerifier: string;
+}
+interface IssuedOAuthState {
+    /** Raw state token to send to the provider via the URL. Never persisted. */
+    readonly state: string;
+    readonly expiresAt: Date;
+}
+/**
+ * Store oauth_state in `auth_tokens` keyed by SHA-256(state). The raw token
+ * lives only in the URL round-trip; a DB snapshot leak yields hashes, not
+ * forgeable states. Single-use semantics enforced by `consumeOAuthState`.
+ */
+export declare function issueOAuthState(db: Db, payload: OAuthStatePayload, ttlSeconds?: number): Promise<IssuedOAuthState>;
+export declare function consumeOAuthState(db: Db, state: string): Promise<OAuthStatePayload | null>;
+export {};
+//# sourceMappingURL=state.d.ts.map

package/dist/auth/oauth/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAO/C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,gBAAgB;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,iBAAiB,EAC1B,UAAU,GAAE,MAAgC,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAW3B;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4BnC"}

package/dist/auth/oauth/state.js

@@ -0,0 +1,48 @@
+import { and, eq } from "../../db/index.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { generateToken, hashToken } from "../tokens.js";
+const OAUTH_STATE_TTL_SECONDS = 10 * 60;
+/**
+ * Store oauth_state in `auth_tokens` keyed by SHA-256(state). The raw token
+ * lives only in the URL round-trip; a DB snapshot leak yields hashes, not
+ * forgeable states. Single-use semantics enforced by `consumeOAuthState`.
+ */
+export async function issueOAuthState(db, payload, ttlSeconds = OAUTH_STATE_TTL_SECONDS) {
+    const state = generateToken();
+    const hash = await hashToken(state);
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
+    await db.insert(authTokens).values({
+        hash,
+        type: "oauth_state",
+        payload: { ...payload },
+        expiresAt,
+    });
+    return { state, expiresAt };
+}
+export async function consumeOAuthState(db, state) {
+    const hash = await hashToken(state);
+    // Atomic compare-and-delete: `DELETE … RETURNING` returns at most one
+    // row to whichever caller wins the SQLite write. A concurrent second
+    // consume sees an empty result, never the same payload twice. Scope the
+    // DELETE by `type = 'oauth_state'` so a hash collision with another
+    // token type (invite, magic_link, …) doesn't accidentally consume that
+    // row when the oauth row was never present.
+    const [row] = await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.hash, hash), eq(authTokens.type, "oauth_state")))
+        .returning();
+    if (!row)
+        return null;
+    if (row.expiresAt.getTime() < Date.now())
+        return null;
+    const payload = row.payload;
+    if (typeof payload?.provider !== "string" ||
+        typeof payload.codeVerifier !== "string") {
+        return null;
+    }
+    return {
+        provider: payload.provider,
+        codeVerifier: payload.codeVerifier,
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/auth/oauth/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/auth/oauth/state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAaxC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,OAA0B,EAC1B,aAAqB,uBAAuB;IAE5C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACjC,IAAI;QACJ,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE;QACvB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACzE,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAA4C,CAAC;IACjE,IACE,OAAO,OAAO,EAAE,QAAQ,KAAK,QAAQ;QACrC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;AACJ,CAAC"}

package/dist/auth/oauth/types.d.ts

@@ -0,0 +1,81 @@
+import type { EnvInput } from "../../runtime/env-input.js";
+export interface OAuthClientConfig {
+    readonly clientId: string;
+    readonly clientSecret: string;
+}
+/**
+ * Either literal credentials, or an `(env) => OAuthClientConfig` resolver — the
+ * client secret is used at token exchange (request time), so on Workers it must
+ * come from the per-request `env`, not config-time. See {@link EnvInput}.
+ * Module-local: callers reach it through the `github`/`google` factory signature
+ * (`OAuthProviderFactory`), never by name.
+ */
+type OAuthClientInput = EnvInput<OAuthClientConfig>;
+export interface OAuthProfile {
+    /** Provider-side stable user id. */
+    readonly providerAccountId: string;
+    readonly email: string;
+    /**
+     * Whether the provider asserts the email is verified. We refuse to
+     * auto-link an OAuth identity to an existing local user unless the
+     * provider has confirmed the address — without this any attacker who
+     * controls the provider account could claim someone else's email.
+     */
+    readonly emailVerified: boolean;
+    readonly name: string | null;
+    readonly avatarUrl: string | null;
+}
+/**
+ * Concrete, configured provider — what `auth({ oauth: { providers } })`
+ * accepts. Built-ins (`github`, `google`) ship as factories that return
+ * this shape; user-defined providers implement the same interface in
+ * their own code and hand an instance to the same config slot. There's
+ * no privileged registry — provider keys come from the user's config
+ * map, and routes / admin UI / signup all read keys at runtime.
+ */
+export interface OAuthProviderClient {
+    /**
+     * Human-readable name shown on the login screen ("GitHub", "Google",
+     * "Acme SSO"). Travels with the provider definition so adding a new
+     * provider is one file, not "edit core + edit admin".
+     */
+    readonly label: string;
+    readonly authorizeUrl: string;
+    readonly tokenUrl: string;
+    readonly userInfoUrl: string;
+    readonly scopes: readonly string[];
+    readonly client: OAuthClientInput;
+    /**
+     * Translate the provider's userinfo JSON into a partial OAuthProfile.
+     * Returning `email: null` is fine — the consumer will call
+     * `fetchVerifiedEmail` (if defined) to resolve the missing address.
+     */
+    parseProfile(raw: unknown): Omit<OAuthProfile, "email" | "emailVerified"> & {
+        email: string | null;
+        emailVerified: boolean;
+    };
+    /**
+     * Provider-specific authorize-URL params (Google's `access_type=offline`,
+     * etc.). Called after the standard OAuth params are set; the provider
+     * may add or override searchParams freely.
+     */
+    decorateAuthorizeUrl?(url: URL): void;
+    /**
+     * Resolve a verified primary email when `parseProfile` returned
+     * `email: null`. GitHub needs this — its `/user` endpoint omits
+     * email unless made public, but `/user/emails` always carries it.
+     * Returning null here surfaces as `email_missing` to the user.
+     */
+    fetchVerifiedEmail?(accessToken: string): Promise<{
+        email: string;
+        verified: boolean;
+    } | null>;
+}
+/**
+ * Convenience alias for provider factories. Built-ins follow this shape;
+ * users can write their own factories the same way.
+ */
+export type OAuthProviderFactory = (client: OAuthClientInput) => OAuthProviderClient;
+export declare const OAUTH_PROVIDER_KEY_PATTERN: RegExp;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAElC;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,eAAe,CAAC,GAAG;QAC1E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF;;;;OAIG;IACH,oBAAoB,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IAEtC;;;;;OAKG;IACH,kBAAkB,CAAC,CACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,MAAM,EAAE,gBAAgB,KACrB,mBAAmB,CAAC;AAMzB,eAAO,MAAM,0BAA0B,QAA4B,CAAC"}

package/dist/auth/oauth/types.js

@@ -0,0 +1,6 @@
+// Provider keys (the map keys in `auth.oauth.providers`) flow through the
+// URL path and into the `oauth_accounts.provider` column. Constrain the
+// shape to URL-path-safe identifiers so a typo can't smuggle special
+// characters into routing or storage.
+export const OAUTH_PROVIDER_KEY_PATTERN = /^[a-z][a-z0-9_-]{0,31}$/;
+//# sourceMappingURL=types.js.map

package/dist/auth/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/oauth/types.ts"],"names":[],"mappings":"AAwFA,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,sCAAsC;AACtC,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,CAAC"}

package/dist/auth/passkey/authenticate.d.ts

@@ -0,0 +1,26 @@
+import type { Db } from "../../context/app.js";
+import type { Credential } from "../../db/schema/credentials.js";
+import type { ResolvedPasskeyConfig } from "./config.js";
+import type { AuthenticationOptions, AuthenticationResponse } from "./types.js";
+interface BeginAuthenticationInput {
+    readonly allowCredentials?: readonly Credential[];
+}
+export declare function beginAuthentication(db: Db, config: ResolvedPasskeyConfig, input?: BeginAuthenticationInput): Promise<AuthenticationOptions>;
+interface VerifiedAuthentication {
+    readonly credential: Credential;
+    readonly newSignatureCounter: number;
+}
+/**
+ * Verify an assertion. Order of checks (Copenhagen Book):
+ * 1. challenge consumed atomically (no double-spend)
+ * 2. clientData type === webauthn.get
+ * 3. origin === expected
+ * 4. RP-ID hash matches
+ * 5. user-present flag set
+ * 6. counter strictly greater than stored (replay defence; counter == 0 means
+ *    the authenticator does not implement counters — accept once)
+ * 7. ECDSA signature verifies over `authenticatorData || sha256(clientDataJSON)`
+ */
+export declare function finishAuthentication(db: Db, config: ResolvedPasskeyConfig, response: AuthenticationResponse): Promise<VerifiedAuthentication>;
+export {};
+//# sourceMappingURL=authenticate.d.ts.map

package/dist/auth/passkey/authenticate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/authenticate.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAKhF,UAAU,wBAAwB;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CACnD;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,KAAK,GAAE,wBAA6B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAahC;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAoFjC"}

package/dist/auth/passkey/authenticate.js

@@ -0,0 +1,124 @@
+import { decodePKIXECDSASignature, decodeSEC1PublicKey, p256, verifyECDSASignature, } from "@oslojs/crypto/ecdsa";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding, } from "@oslojs/encoding";
+import { ClientDataType, createAssertionSignatureMessage, parseAuthenticatorData, parseClientDataJSON, } from "@oslojs/webauthn";
+import { eq } from "drizzle-orm";
+import { credentials } from "../../db/schema/credentials.js";
+import { consumeChallenge, issueChallenge } from "./challenges.js";
+import { PasskeyError } from "./errors.js";
+export async function beginAuthentication(db, config, input = {}) {
+    const { challenge } = await issueChallenge(db, config.challengeTtlMs);
+    return {
+        challenge,
+        rpId: config.rpId,
+        timeout: 60_000,
+        userVerification: "preferred",
+        allowCredentials: input.allowCredentials?.map((c) => ({
+            type: "public-key",
+            id: c.id,
+            transports: c.transports ?? undefined,
+        })),
+    };
+}
+/**
+ * Verify an assertion. Order of checks (Copenhagen Book):
+ * 1. challenge consumed atomically (no double-spend)
+ * 2. clientData type === webauthn.get
+ * 3. origin === expected
+ * 4. RP-ID hash matches
+ * 5. user-present flag set
+ * 6. counter strictly greater than stored (replay defence; counter == 0 means
+ *    the authenticator does not implement counters — accept once)
+ * 7. ECDSA signature verifies over `authenticatorData || sha256(clientDataJSON)`
+ */
+export async function finishAuthentication(db, config, response) {
+    let clientDataBytes;
+    let authenticatorDataBytes;
+    let signatureBytes;
+    try {
+        clientDataBytes = decodeBase64urlIgnorePadding(response.response.clientDataJSON);
+        authenticatorDataBytes = decodeBase64urlIgnorePadding(response.response.authenticatorData);
+        signatureBytes = decodeBase64urlIgnorePadding(response.response.signature);
+    }
+    catch {
+        throw PasskeyError.invalidResponse({
+            reason: "Malformed base64url in authentication response",
+        });
+    }
+    const clientData = parseClientDataJSON(clientDataBytes);
+    if (clientData.type !== ClientDataType.Get) {
+        throw PasskeyError.invalidClientData({ expectedType: "get" });
+    }
+    if (clientData.origin !== config.origin) {
+        throw PasskeyError.invalidOrigin({
+            expected: config.origin,
+            actual: clientData.origin,
+        });
+    }
+    const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
+    if (!authenticatorData.verifyRelyingPartyIdHash(config.rpId)) {
+        throw PasskeyError.invalidRpId();
+    }
+    const challengeString = encodeBase64urlNoPadding(clientData.challenge);
+    const challenge = await consumeChallenge(db, challengeString);
+    if (!challenge)
+        throw PasskeyError.challengeNotFound();
+    void challenge;
+    const credential = await db
+        .select()
+        .from(credentials)
+        .where(eq(credentials.id, response.id))
+        .get();
+    if (!credential)
+        throw PasskeyError.credentialNotFound();
+    if (!authenticatorData.userPresent)
+        throw PasskeyError.userPresenceMissing();
+    // Counter == 0 is "authenticator doesn't track" — accept; otherwise it must
+    // strictly increase. A non-increasing counter signals a cloned authenticator.
+    if (authenticatorData.signatureCounter !== 0 &&
+        authenticatorData.signatureCounter <= credential.counter) {
+        throw PasskeyError.counterReplay();
+    }
+    const signedMessage = createAssertionSignatureMessage(authenticatorDataBytes, clientDataBytes);
+    const messageHash = sha256(signedMessage);
+    const publicKey = decodeSEC1PublicKey(p256, ensureUint8Array(credential.publicKey));
+    const signature = decodePKIXECDSASignature(signatureBytes);
+    if (!verifyECDSASignature(publicKey, messageHash, signature)) {
+        throw PasskeyError.invalidSignature();
+    }
+    await db
+        .update(credentials)
+        .set({
+        counter: authenticatorData.signatureCounter,
+        lastUsedAt: new Date(),
+    })
+        .where(eq(credentials.id, credential.id));
+    return {
+        credential,
+        newSignatureCounter: authenticatorData.signatureCounter,
+    };
+}
+/**
+ * @internal
+ *
+ * Normalise a driver-returned BLOB value into a plain `Uint8Array`.
+ *
+ * Drivers disagree on the shape: better-sqlite3 returns `Buffer` (a
+ * `Uint8Array` subclass — handled by the first branch), libsql/D1 may
+ * return `ArrayBuffer`. Anything else is a `credential_storage_corrupt`
+ * signal: the response on the wire is fine, but the stored key is
+ * unreadable and the caller needs to know that specifically.
+ *
+ * Exported for direct testing only. NOT part of the `@plumix/core`
+ * public surface — import path is the barrel-less relative one.
+ */
+export function ensureUint8Array(value) {
+    if (value instanceof Uint8Array)
+        return value;
+    if (value instanceof ArrayBuffer)
+        return new Uint8Array(value);
+    throw PasskeyError.credentialStorageCorrupt({
+        reason: "Stored public key has unexpected type",
+    });
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/auth/passkey/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/auth/passkey/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,IAAI,EACJ,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAMjC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,MAA6B,EAC7B,QAAkC,EAAE;IAEpC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtE,OAAO;QACL,SAAS;QACT,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,YAAqB;YAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS;SACtC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,MAA6B,EAC7B,QAAgC;IAEhC,IAAI,eAA2B,CAAC;IAChC,IAAI,sBAAkC,CAAC;IACvC,IAAI,cAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,eAAe,GAAG,4BAA4B,CAC5C,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACjC,CAAC;QACF,sBAAsB,GAAG,4BAA4B,CACnD,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CACpC,CAAC;QACF,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,eAAe,CAAC;YACjC,MAAM,EAAE,gDAAgD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,iBAAiB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,aAAa,CAAC;YAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;IACzE,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;IACvD,KAAK,SAAS,CAAC;IAEf,MAAM,UAAU,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SACtC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,UAAU;QAAE,MAAM,YAAY,CAAC,kBAAkB,EAAE,CAAC;IACzD,IAAI,CAAC,iBAAiB,CAAC,WAAW;QAAE,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC;IAE7E,4EAA4E;IAC5E,8EAA8E;IAC9E,IACE,iBAAiB,CAAC,gBAAgB,KAAK,CAAC;QACxC,iBAAiB,CAAC,gBAAgB,IAAI,UAAU,CAAC,OAAO,EACxD,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,aAAa,GAAG,+BAA+B,CACnD,sBAAsB,EACtB,eAAe,CAChB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,mBAAmB,CACnC,IAAI,EACJ,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CACvC,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC;QACH,OAAO,EAAE,iBAAiB,CAAC,gBAAgB;QAC3C,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,OAAO;QACL,UAAU;QACV,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,YAAY,CAAC,wBAAwB,CAAC;QAC1C,MAAM,EAAE,uCAAuC;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/passkey/challenges.d.ts

@@ -0,0 +1,31 @@
+import type { Db } from "../../context/app.js";
+interface IssuedChallenge {
+    /** Raw challenge (sent to the browser, base64url). */
+    readonly challenge: string;
+    readonly expiresAt: Date;
+}
+interface ChallengeRecord {
+    readonly userId: number | null;
+    readonly expiresAt: Date;
+}
+/**
+ * Persist a single-use WebAuthn challenge. We hash the raw challenge and
+ * store the hash so a DB read does not yield a usable challenge to an
+ * attacker (defence in depth — the challenge is also short-lived).
+ */
+export declare function issueChallenge(db: Db, ttlMs: number, userId?: number | null): Promise<IssuedChallenge>;
+/**
+ * Delete every auth_tokens row whose expiresAt is in the past. Safe to call
+ * at any time — consumed rows are deleted by consumeChallenge, so expired
+ * rows are the only thing this ever removes. Called opportunistically from
+ * issueChallenge until a scheduled-task plugin can run it on a cron.
+ */
+export declare function pruneExpiredAuthTokens(db: Db): Promise<void>;
+/**
+ * Atomic single-use consume: SQLite `RETURNING` deletes and reads the row in
+ * one round-trip — no race window between read and delete (Copenhagen Book:
+ * "atomic deletion to prevent race conditions").
+ */
+export declare function consumeChallenge(db: Db, rawChallenge: string): Promise<ChallengeRecord | null>;
+export {};
+//# sourceMappingURL=challenges.d.ts.map

package/dist/auth/passkey/challenges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenges.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/challenges.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAW/C,UAAU,eAAe;IACvB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAM,GAAG,IAAW,GAC3B,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAUjC"}

package/dist/auth/passkey/challenges.js

@@ -0,0 +1,57 @@
+import { and, eq, lt } from "drizzle-orm";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { generateToken, hashToken } from "../tokens.js";
+const CHALLENGE_TYPE = "webauthn_challenge";
+// Run the opportunistic sweep on a fraction of issueChallenge calls so the
+// amortised cost is ~O(1) per request while still bounding table growth.
+// At 10% we expect the sweep to fire ~1 in 10 registrations/logins.
+const OPPORTUNISTIC_PRUNE_PROBABILITY = 0.1;
+/**
+ * Persist a single-use WebAuthn challenge. We hash the raw challenge and
+ * store the hash so a DB read does not yield a usable challenge to an
+ * attacker (defence in depth — the challenge is also short-lived).
+ */
+export async function issueChallenge(db, ttlMs, userId = null) {
+    const challenge = generateToken();
+    const hash = await hashToken(challenge);
+    const expiresAt = new Date(Date.now() + ttlMs);
+    await db.insert(authTokens).values({
+        hash,
+        type: CHALLENGE_TYPE,
+        userId,
+        expiresAt,
+    });
+    if (Math.random() < OPPORTUNISTIC_PRUNE_PROBABILITY) {
+        await pruneExpiredAuthTokens(db);
+    }
+    return { challenge, expiresAt };
+}
+/**
+ * Delete every auth_tokens row whose expiresAt is in the past. Safe to call
+ * at any time — consumed rows are deleted by consumeChallenge, so expired
+ * rows are the only thing this ever removes. Called opportunistically from
+ * issueChallenge until a scheduled-task plugin can run it on a cron.
+ */
+export async function pruneExpiredAuthTokens(db) {
+    await db.delete(authTokens).where(lt(authTokens.expiresAt, new Date()));
+}
+/**
+ * Atomic single-use consume: SQLite `RETURNING` deletes and reads the row in
+ * one round-trip — no race window between read and delete (Copenhagen Book:
+ * "atomic deletion to prevent race conditions").
+ */
+export async function consumeChallenge(db, rawChallenge) {
+    if (!rawChallenge)
+        return null;
+    const hash = await hashToken(rawChallenge);
+    const [row] = await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.hash, hash), eq(authTokens.type, CHALLENGE_TYPE)))
+        .returning();
+    if (!row)
+        return null;
+    if (row.expiresAt.getTime() < Date.now())
+        return null;
+    return { userId: row.userId, expiresAt: row.expiresAt };
+}
+//# sourceMappingURL=challenges.js.map

package/dist/auth/passkey/challenges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenges.js","sourceRoot":"","sources":["../../../src/auth/passkey/challenges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,cAAc,GAAG,oBAA6B,CAAC;AAErD,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAa5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,KAAa,EACb,SAAwB,IAAI;IAE5B,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACjC,IAAI;QACJ,IAAI,EAAE,cAAc;QACpB,MAAM;QACN,SAAS;KACV,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,+BAA+B,EAAE,CAAC;QACpD,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAM;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,YAAoB;IAEpB,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;SAC1E,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC1D,CAAC"}

package/dist/auth/passkey/config.d.ts

@@ -0,0 +1,18 @@
+export interface PasskeyConfig {
+    /** Display name shown in the OS passkey prompt. */
+    readonly rpName: string;
+    /** RP-ID — usually the bare hostname, no protocol. */
+    readonly rpId: string;
+    /** Expected origin string the browser puts in clientDataJSON. */
+    readonly origin: string;
+}
+export interface ResolvedPasskeyConfig extends PasskeyConfig {
+    readonly challengeTtlMs: number;
+    readonly maxCredentialsPerUser: number;
+}
+export declare const PASSKEY_DEFAULTS: {
+    readonly challengeTtlMs: number;
+    readonly maxCredentialsPerUser: 10;
+};
+export declare function resolvePasskeyConfig(config: PasskeyConfig, overrides?: Partial<typeof PASSKEY_DEFAULTS>): ResolvedPasskeyConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/passkey/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/auth/passkey/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,EACrB,SAAS,GAAE,OAAO,CAAC,OAAO,gBAAgB,CAAM,GAC/C,qBAAqB,CASvB"}

package/dist/auth/passkey/config.js

@@ -0,0 +1,14 @@
+export const PASSKEY_DEFAULTS = {
+    challengeTtlMs: 5 * 60 * 1000,
+    maxCredentialsPerUser: 10,
+};
+export function resolvePasskeyConfig(config, overrides = {}) {
+    return {
+        rpName: config.rpName,
+        rpId: config.rpId,
+        origin: config.origin,
+        challengeTtlMs: overrides.challengeTtlMs ?? PASSKEY_DEFAULTS.challengeTtlMs,
+        maxCredentialsPerUser: overrides.maxCredentialsPerUser ?? PASSKEY_DEFAULTS.maxCredentialsPerUser,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/passkey/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/auth/passkey/config.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAC7B,qBAAqB,EAAE,EAAE;CACjB,CAAC;AAEX,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,YAA8C,EAAE;IAEhD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc;QAC3E,qBAAqB,EACnB,SAAS,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,qBAAqB;KAC5E,CAAC;AACJ,CAAC"}