@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.16

package/dist/server/passkey.js

@@ -1,4 +1,5 @@
 import { AuthError, Fx } from "./fx.js";
+import { userIdFromIdentitySubject } from "./identity.js";
 import { authDb } from "./db.js";
 import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
@@ -107,7 +108,7 @@ function handlePasskeyFx(ctx, provider, args) {
 			registerOptions: (_) => Fx.zip(Fx.from({
 				ok: () => ctx.auth.getUserIdentity(),
 				err: () => new AuthError("PASSKEY_AUTH_REQUIRED")
-			}).pipe(Fx.chain((id) => id === null ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED")) : Fx.succeed(id.subject.split("|")[0]))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => {
+			}).pipe(Fx.chain((id) => id === null ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED")) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => {
 				const challenge = new Uint8Array(32);
 				crypto.getRandomValues(challenge);
 				const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
@@ -162,7 +163,7 @@ function handlePasskeyFx(ctx, provider, args) {
 			registerVerify: (_) => Fx.zip(Fx.from({
 				ok: () => ctx.auth.getUserIdentity(),
 				err: () => new AuthError("PASSKEY_AUTH_REQUIRED")
-			}).pipe(Fx.chain((id) => id === null ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED")) : Fx.succeed(id.subject.split("|")[0]))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => requirePasskeyVerifierFx(args.verifier).pipe(Fx.chain((verifier) => {
+			}).pipe(Fx.chain((id) => id === null ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED")) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => requirePasskeyVerifierFx(args.verifier).pipe(Fx.chain((verifier) => {
 				const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(params.clientDataJSON));
 				return Fx.succeed(clientData).pipe(Fx.chain(verifyClientDataType(ClientDataType.Create, "webauthn.create")), Fx.chain(verifyOrigin(rp)), Fx.chain(verifyAndConsumeChallenge(ctx, verifier)), Fx.map(() => {
 					return parseAttestationObject(decodeBase64urlIgnorePadding(params.attestationObject)).authenticatorData;

package/dist/server/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","names":["hasSiteUrl","hasRpId","siteUrl"],"sources":["../../src/server/passkey.ts"],"sourcesContent":["/**\n * Server-side WebAuthn ceremony logic for passkey authentication.\n *\n * Handles the four phases of the WebAuthn flow:\n * 1. registerOptions — generate PublicKeyCredentialCreationOptions\n * 2. registerVerify — verify attestation and store credential\n * 3. authOptions — generate PublicKeyCredentialRequestOptions\n * 4. authVerify — verify assertion signature and sign in\n *\n * Uses `@oslojs/webauthn` for attestation/assertion parsing and\n * `@oslojs/crypto` for signature verification.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.chain` pipelines.\n *\n * @module\n */\n\nimport {\n  p256,\n  verifyECDSASignature,\n  decodeSEC1PublicKey,\n  decodePKIXECDSASignature,\n} from \"@oslojs/crypto/ecdsa\";\nimport {\n  RSAPublicKey,\n  decodePKCS1RSAPublicKey,\n  sha256ObjectIdentifier,\n  verifyRSASSAPKCS1v15Signature,\n} from \"@oslojs/crypto/rsa\";\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  encodeBase64urlNoPadding,\n  decodeBase64urlIgnorePadding,\n} from \"@oslojs/encoding\";\nimport {\n  parseAttestationObject,\n  parseClientDataJSON,\n  parseAuthenticatorData,\n  createAssertionSignatureMessage,\n  ClientDataType,\n  coseAlgorithmES256,\n  coseAlgorithmRS256,\n  COSEKeyType,\n} from \"@oslojs/webauthn\";\nimport type { Fx as FxType } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError, Fx } from \"./fx\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryUserByVerifiedEmail,\n  queryPasskeysByUserId,\n  queryPasskeyByCredentialId,\n  queryVerifierById,\n  mutatePasskeyInsert,\n  mutatePasskeyUpdateCounter,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Resolve RP options — Fx pipeline with validation\n// ============================================================================\n\n/** Resolved relying party configuration. */\ninterface RpOptions {\n  rpName: string;\n  rpId: string;\n  origin: string | string[];\n  attestation: string;\n  userVerification: string;\n  residentKey: string;\n  authenticatorAttachment?: string;\n  algorithms: number[];\n  challengeExpirationMs: number;\n}\n\n/**\n * Resolve passkey relying party options from provider config and environment.\n *\n * Returns `Fx<RpOptions, AuthError>` — fails if neither SITE_URL nor rpId\n * is configured.\n */\nconst resolveRpOptionsFx = (\n  provider: PasskeyProviderConfig,\n): FxType<RpOptions, AuthError> => {\n  const siteUrl = process.env.SITE_URL;\n  const hasSiteUrl = siteUrl !== undefined && siteUrl !== \"\";\n  const hasRpId = provider.options.rpId !== undefined;\n\n  return Fx.succeed({ siteUrl, hasSiteUrl, hasRpId }).pipe(\n    Fx.chain(({ siteUrl, hasSiteUrl, hasRpId }) =>\n      !hasSiteUrl && !hasRpId\n        ? Fx.fail(\n            new AuthError(\n              \"PASSKEY_MISSING_CONFIG\",\n              \"Passkey provider requires SITE_URL env var (your frontend URL) \" +\n                \"or explicit rpId / origin in the provider config. \" +\n                \"CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.\",\n            ),\n          )\n        : Fx.succeed(siteUrl),\n    ),\n    Fx.map((siteUrl) => {\n      const siteHostname = siteUrl ? new URL(siteUrl).hostname : undefined;\n      return {\n        rpName: provider.options.rpName ?? siteHostname ?? \"localhost\",\n        rpId: provider.options.rpId ?? siteHostname ?? \"localhost\",\n        origin: provider.options.origin ?? siteUrl ?? \"http://localhost\",\n        attestation: provider.options.attestation ?? \"none\",\n        userVerification: provider.options.userVerification ?? \"required\",\n        residentKey: provider.options.residentKey ?? \"preferred\",\n        authenticatorAttachment: provider.options.authenticatorAttachment,\n        algorithms: provider.options.algorithms ?? [\n          coseAlgorithmES256,\n          coseAlgorithmRS256,\n        ],\n        challengeExpirationMs:\n          provider.options.challengeExpirationMs ?? 300_000,\n      };\n    }),\n  );\n};\n\n// ============================================================================\n// Composable validators — small functions (A) => Fx<B, AuthError>\n// ============================================================================\n\n/** Verify client data type matches expected WebAuthn ceremony type. */\nconst verifyClientDataType =\n  <T extends { type: ClientDataType }>(\n    expectedType: ClientDataType,\n    label: string,\n  ) =>\n  (clientData: T): FxType<T, AuthError> =>\n    clientData.type === expectedType\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_CLIENT_DATA\",\n            `Invalid client data type: expected ${label}`,\n          ),\n        );\n\n/** Verify origin is in the allowed list. */\nconst verifyOrigin =\n  (rp: RpOptions) =>\n  <T extends { origin: string }>(clientData: T): FxType<T, AuthError> => {\n    const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];\n    return allowed.includes(clientData.origin)\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_ORIGIN\",\n            `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(\", \")}`,\n          ),\n        );\n  };\n\n/** Verify the challenge hash matches the stored verifier, then delete verifier. */\nconst verifyAndConsumeChallenge =\n  (ctx: EnrichedActionCtx, verifierValue: string) =>\n  <T extends { challenge: Uint8Array }>(\n    clientData: T,\n  ): FxType<T, AuthError> => {\n    const challengeHash = encodeBase64urlNoPadding(\n      new Uint8Array(sha256(clientData.challenge)),\n    );\n    return Fx.from({\n      ok: () => queryVerifierById(ctx, verifierValue),\n      err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        !doc || doc.signature !== challengeHash\n          ? Fx.fail(new AuthError(\"PASSKEY_INVALID_CHALLENGE\"))\n          : Fx.succeed(doc),\n      ),\n      Fx.chain(() =>\n        Fx.from({\n          ok: () => mutateVerifierDelete(ctx, verifierValue),\n          err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n        }),\n      ),\n      Fx.map(() => clientData),\n    );\n  };\n\n/** Verify RP ID hash matches. */\nconst verifyRpId =\n  (rpId: string) =>\n  <T extends { verifyRelyingPartyIdHash: (id: string) => boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    authData.verifyRelyingPartyIdHash(rpId)\n      ? Fx.succeed(authData)\n      : Fx.fail(new AuthError(\"PASSKEY_RP_MISMATCH\"));\n\n/** Verify user presence and (optionally) user verification flags. */\nconst verifyUserFlags =\n  (rp: RpOptions) =>\n  <T extends { userPresent: boolean; userVerified: boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    !authData.userPresent\n      ? Fx.fail(new AuthError(\"PASSKEY_USER_PRESENCE\"))\n      : rp.userVerification === \"required\" && !authData.userVerified\n        ? Fx.fail(new AuthError(\"PASSKEY_USER_VERIFICATION\"))\n        : Fx.succeed(authData);\n\n// ============================================================================\n// Registration flow\n// ============================================================================\n\n// ============================================================================\n// Authentication flow\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/** Result type for all passkey flows. */\ntype PasskeyResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | { kind: \"passkeyOptions\"; options: Record<string, any>; verifier: string };\n\nconst PASSKEY_FLOW = {\n  registerOptions: \"registerOptions\",\n  registerVerify: \"registerVerify\",\n  authOptions: \"authOptions\",\n  authVerify: \"authVerify\",\n} as const;\n\nconst PASSKEY_FLOWS = [\n  PASSKEY_FLOW.registerOptions,\n  PASSKEY_FLOW.registerVerify,\n  PASSKEY_FLOW.authOptions,\n  PASSKEY_FLOW.authVerify,\n] as const;\n\ntype PasskeyDispatch =\n  | { flow: typeof PASSKEY_FLOW.registerOptions }\n  | { flow: typeof PASSKEY_FLOW.registerVerify }\n  | { flow: typeof PASSKEY_FLOW.authOptions }\n  | { flow: typeof PASSKEY_FLOW.authVerify };\n\nconst resolvePasskeyDispatchFx = (\n  params: Record<string, unknown>,\n): FxType<PasskeyDispatch, AuthError> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && PASSKEY_FLOWS.includes(flow as never)\n    ? Fx.succeed({ flow: flow as (typeof PASSKEY_FLOWS)[number] })\n    : Fx.fail(\n        new AuthError(\n          \"PASSKEY_MISSING_FLOW\",\n          \"Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify\",\n        ),\n      );\n};\n\nconst requirePasskeyVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, AuthError> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Fx.fail(new AuthError(\"PASSKEY_MISSING_VERIFIER\"));\n\n/**\n * Main passkey handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.\n */\nexport function handlePasskeyFx(\n  ctx: EnrichedActionCtx,\n  provider: PasskeyProviderConfig,\n  args: {\n    params?: Record<string, any>;\n    verifier?: string;\n  },\n): FxType<PasskeyResult, AuthError> {\n  const params = (args.params ?? {}) as Record<string, any>;\n\n  return resolvePasskeyDispatchFx(params).pipe(\n    Fx.chain((dispatch) => {\n      const flowFx: FxType<PasskeyResult, AuthError> = Fx.match(dispatch).on(\n        \"flow\",\n        {\n          registerOptions: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(id.subject.split(\"|\")[0]!),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    const user = await queryUserById(ctx, userId);\n                    const userName = params.userName ?? user?.email ?? \"user\";\n                    const userDisplayName =\n                      params.userDisplayName ?? user?.name ?? userName;\n\n                    const existing = await queryPasskeysByUserId(ctx, userId);\n                    const excludeCredentials = existing.map((pk) => ({\n                      id: pk.credentialId,\n                      transports: pk.transports,\n                    }));\n\n                    const userHandle = encodeBase64urlNoPadding(\n                      new TextEncoder().encode(userId),\n                    );\n\n                    const options = {\n                      rp: { name: rp.rpName, id: rp.rpId },\n                      user: {\n                        id: userHandle,\n                        name: userName,\n                        displayName: userDisplayName,\n                      },\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      pubKeyCredParams: rp.algorithms.map((alg) => ({\n                        type: \"public-key\" as const,\n                        alg,\n                      })),\n                      timeout: rp.challengeExpirationMs,\n                      attestation: rp.attestation,\n                      authenticatorSelection: {\n                        residentKey: rp.residentKey,\n                        requireResidentKey: rp.residentKey === \"required\",\n                        userVerification: rp.userVerification,\n                        ...(rp.authenticatorAttachment\n                          ? {\n                              authenticatorAttachment:\n                                rp.authenticatorAttachment,\n                            }\n                          : {}),\n                      },\n                      excludeCredentials,\n                    };\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          registerVerify: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(id.subject.split(\"|\")[0]!),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) =>\n                requirePasskeyVerifierFx(args.verifier).pipe(\n                  Fx.chain((verifier) => {\n                    const clientDataJSON = decodeBase64urlIgnorePadding(\n                      params.clientDataJSON,\n                    );\n                    const clientData = parseClientDataJSON(clientDataJSON);\n\n                    const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                      Fx.chain(\n                        verifyClientDataType(\n                          ClientDataType.Create,\n                          \"webauthn.create\",\n                        ),\n                      ),\n                      Fx.chain(verifyOrigin(rp)),\n                      Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                      Fx.map(() => {\n                        const attestationObjectBytes =\n                          decodeBase64urlIgnorePadding(\n                            params.attestationObject,\n                          );\n                        const attestation = parseAttestationObject(\n                          attestationObjectBytes,\n                        );\n                        return attestation.authenticatorData;\n                      }),\n                    );\n\n                    return verifiedClientDataFx.pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                      Fx.chain((authData) => {\n                        if (authData.credential == null) {\n                          return Fx.fail(\n                            new AuthError(\"PASSKEY_NO_CREDENTIAL\"),\n                          );\n                        }\n                        return Fx.succeed({\n                          authData,\n                          credential: authData.credential,\n                        });\n                      }),\n                      Fx.chain(({ authData, credential }) => {\n                        const credentialId = encodeBase64urlNoPadding(\n                          credential.id,\n                        );\n                        const publicKey = credential.publicKey;\n\n                        let algorithm: number;\n                        if (publicKey.isAlgorithmDefined()) {\n                          algorithm = publicKey.algorithm();\n                        } else {\n                          const keyType = publicKey.type();\n                          algorithm =\n                            keyType === COSEKeyType.EC2\n                              ? coseAlgorithmES256\n                              : keyType === COSEKeyType.RSA\n                                ? coseAlgorithmRS256\n                                : coseAlgorithmES256;\n                        }\n\n                        const handlers: Record<\n                          number,\n                          (() => FxType<Uint8Array, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ec2 = publicKey.ec2();\n                            const xBytes = new Uint8Array(32);\n                            let vx = ec2.x;\n                            for (let i = 31; i >= 0; i--) {\n                              xBytes[i] = Number(vx & 0xffn);\n                              vx >>= 8n;\n                            }\n                            const yBytes = new Uint8Array(32);\n                            let vy = ec2.y;\n                            for (let i = 31; i >= 0; i--) {\n                              yBytes[i] = Number(vy & 0xffn);\n                              vy >>= 8n;\n                            }\n                            const bytes = new Uint8Array(65);\n                            bytes[0] = 0x04;\n                            bytes.set(xBytes, 1);\n                            bytes.set(yBytes, 33);\n                            return Fx.succeed(bytes);\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsa = publicKey.rsa();\n                            const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);\n                            return Fx.succeed(rsaPubKey.encodePKCS1());\n                          },\n                        };\n\n                        const handler = handlers[algorithm];\n                        return (\n                          handler\n                            ? handler()\n                            : Fx.fail(\n                                new AuthError(\n                                  \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                  `Unsupported algorithm: ${algorithm}`,\n                                ),\n                              )\n                        ).pipe(\n                          Fx.chain((publicKeyBytes) =>\n                            Fx.from({\n                              ok: async () => {\n                                const deviceType =\n                                  params.deviceType ?? \"single-device\";\n                                const backedUp = params.backedUp ?? false;\n\n                                const db = authDb(ctx, ctx.auth.config);\n                                await db.accounts.create({\n                                  userId,\n                                  provider: provider.id,\n                                  providerAccountId: credentialId,\n                                });\n\n                                await mutatePasskeyInsert(ctx, {\n                                  userId,\n                                  credentialId,\n                                  publicKey: publicKeyBytes.buffer.slice(\n                                    publicKeyBytes.byteOffset,\n                                    publicKeyBytes.byteOffset +\n                                      publicKeyBytes.byteLength,\n                                  ),\n                                  algorithm,\n                                  counter: authData.signatureCounter,\n                                  transports: params.transports,\n                                  deviceType,\n                                  backedUp,\n                                  name: params.passkeyName,\n                                  createdAt: Date.now(),\n                                });\n\n                                const signInResult = await callSignIn(ctx, {\n                                  userId,\n                                  generateTokens: true,\n                                });\n\n                                return {\n                                  kind: \"signedIn\" as const,\n                                  signedIn: signInResult,\n                                };\n                              },\n                              err: () => new AuthError(\"INTERNAL_ERROR\"),\n                            }),\n                          ),\n                        );\n                      }),\n                    );\n                  }),\n                ),\n              ),\n            ),\n          authOptions: (_) =>\n            resolveRpOptionsFx(provider).pipe(\n              Fx.chain((rp) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    let allowCredentials:\n                      | Array<{\n                          type: string;\n                          id: string;\n                          transports?: string[];\n                        }>\n                      | undefined;\n                    if (params.email) {\n                      const user = await queryUserByVerifiedEmail(\n                        ctx,\n                        params.email,\n                      );\n                      if (user) {\n                        const passkeys = await queryPasskeysByUserId(\n                          ctx,\n                          user._id,\n                        );\n                        if (passkeys.length > 0) {\n                          allowCredentials = passkeys.map((pk) => ({\n                            type: \"public-key\",\n                            id: pk.credentialId,\n                            transports: pk.transports,\n                          }));\n                        }\n                      }\n                    }\n\n                    const options: Record<string, any> = {\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      timeout: rp.challengeExpirationMs,\n                      rpId: rp.rpId,\n                      userVerification: rp.userVerification,\n                    };\n\n                    if (allowCredentials) {\n                      options.allowCredentials = allowCredentials;\n                    }\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          authVerify: (_) =>\n            Fx.zip(\n              resolveRpOptionsFx(provider),\n              requirePasskeyVerifierFx(args.verifier),\n            ).pipe(\n              Fx.chain(([rp, verifier]) => {\n                const clientDataJSON = decodeBase64urlIgnorePadding(\n                  params.clientDataJSON,\n                );\n                const clientData = parseClientDataJSON(clientDataJSON);\n\n                const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                  Fx.chain(\n                    verifyClientDataType(ClientDataType.Get, \"webauthn.get\"),\n                  ),\n                  Fx.chain(verifyOrigin(rp)),\n                  Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                  Fx.chain(() =>\n                    params.credentialId != null\n                      ? Fx.succeed(params.credentialId as string)\n                      : Fx.fail(\n                          new AuthError(\n                            \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                            \"Missing credential ID\",\n                          ),\n                        ),\n                  ),\n                );\n\n                return verifiedClientDataFx.pipe(\n                  Fx.chain((credentialId) =>\n                    Fx.from({\n                      ok: () => queryPasskeyByCredentialId(ctx, credentialId),\n                      err: () => new AuthError(\"PASSKEY_UNKNOWN_CREDENTIAL\"),\n                    }).pipe(\n                      Fx.chain((passkey) =>\n                        passkey\n                          ? Fx.succeed(passkey)\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                                \"Unknown credential\",\n                              ),\n                            ),\n                      ),\n                    ),\n                  ),\n                  Fx.chain((passkey) => {\n                    const authenticatorDataBytes = decodeBase64urlIgnorePadding(\n                      params.authenticatorData,\n                    );\n                    const authenticatorData = parseAuthenticatorData(\n                      authenticatorDataBytes,\n                    );\n\n                    const signature = decodeBase64urlIgnorePadding(\n                      params.signature,\n                    );\n                    const signatureMessage = createAssertionSignatureMessage(\n                      authenticatorDataBytes,\n                      clientDataJSON,\n                    );\n                    const messageHash = sha256(signatureMessage);\n\n                    const checkedAuthenticatorFx = Fx.succeed(\n                      authenticatorData,\n                    ).pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                    );\n\n                    const signatureVerifiedFx = checkedAuthenticatorFx.pipe(\n                      Fx.chain(() => {\n                        const storedPublicKeyBytes = new Uint8Array(\n                          passkey.publicKey,\n                        );\n                        const algorithmHandlers: Record<\n                          number,\n                          (() => FxType<void, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ecPublicKey = decodeSEC1PublicKey(\n                              p256,\n                              storedPublicKeyBytes,\n                            );\n                            const ecdsaSignature =\n                              decodePKIXECDSASignature(signature);\n                            const valid = verifyECDSASignature(\n                              ecPublicKey,\n                              messageHash,\n                              ecdsaSignature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsaPublicKey =\n                              decodePKCS1RSAPublicKey(storedPublicKeyBytes);\n                            const valid = verifyRSASSAPKCS1v15Signature(\n                              rsaPublicKey,\n                              sha256ObjectIdentifier,\n                              messageHash,\n                              signature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                        };\n\n                        const handler = algorithmHandlers[passkey.algorithm];\n                        return handler\n                          ? handler()\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                `Unsupported algorithm: ${passkey.algorithm}`,\n                              ),\n                            );\n                      }),\n                    );\n\n                    const counterValidatedFx = signatureVerifiedFx.pipe(\n                      Fx.chain(() =>\n                        passkey.counter !== 0 &&\n                        authenticatorData.signatureCounter !== 0 &&\n                        authenticatorData.signatureCounter <= passkey.counter\n                          ? Fx.fail(new AuthError(\"PASSKEY_COUNTER_ERROR\"))\n                          : Fx.succeed(authenticatorData),\n                      ),\n                    );\n\n                    return counterValidatedFx.pipe(\n                      Fx.chain(() =>\n                        Fx.from({\n                          ok: async () => {\n                            await mutatePasskeyUpdateCounter(\n                              ctx,\n                              passkey._id,\n                              authenticatorData.signatureCounter,\n                              Date.now(),\n                            );\n\n                            const signInResult = await callSignIn(ctx, {\n                              userId: passkey.userId,\n                              generateTokens: true,\n                            });\n\n                            return {\n                              kind: \"signedIn\" as const,\n                              signedIn: signInResult,\n                            };\n                          },\n                          err: () => new AuthError(\"INTERNAL_ERROR\"),\n                        }),\n                      ),\n                    );\n                  }),\n                );\n              }),\n            ),\n        },\n      );\n      return flowFx;\n    }),\n  );\n}\n\n// Keep backward-compatible export name — callers can migrate to handlePasskeyFx\nexport { handlePasskeyFx as handlePasskey };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,MAAM,sBACJ,aACiC;CACjC,MAAM,UAAU,QAAQ,IAAI;CAC5B,MAAM,aAAa,YAAY,UAAa,YAAY;CACxD,MAAM,UAAU,SAAS,QAAQ,SAAS;AAE1C,QAAO,GAAG,QAAQ;EAAE;EAAS;EAAY;EAAS,CAAC,CAAC,KAClD,GAAG,OAAO,EAAE,oBAAS,0BAAY,yBAC/B,CAACA,gBAAc,CAACC,YACZ,GAAG,KACD,IAAI,UACF,0BACA,yMAGD,CACF,GACD,GAAG,QAAQC,UAAQ,CACxB,EACD,GAAG,KAAK,cAAY;EAClB,MAAM,eAAeA,YAAU,IAAI,IAAIA,UAAQ,CAAC,WAAW;AAC3D,SAAO;GACL,QAAQ,SAAS,QAAQ,UAAU,gBAAgB;GACnD,MAAM,SAAS,QAAQ,QAAQ,gBAAgB;GAC/C,QAAQ,SAAS,QAAQ,UAAUA,aAAW;GAC9C,aAAa,SAAS,QAAQ,eAAe;GAC7C,kBAAkB,SAAS,QAAQ,oBAAoB;GACvD,aAAa,SAAS,QAAQ,eAAe;GAC7C,yBAAyB,SAAS,QAAQ;GAC1C,YAAY,SAAS,QAAQ,cAAc,CACzC,oBACA,mBACD;GACD,uBACE,SAAS,QAAQ,yBAAyB;GAC7C;GACD,CACH;;;AAQH,MAAM,wBAEF,cACA,WAED,eACC,WAAW,SAAS,eAChB,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,+BACA,sCAAsC,QACvC,CACF;;AAGT,MAAM,gBACH,QAC8B,eAAwC;CACrE,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,OAAO;AAClE,QAAO,QAAQ,SAAS,WAAW,OAAO,GACtC,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,0BACA,mBAAmB,WAAW,OAAO,qBAAqB,QAAQ,KAAK,KAAK,GAC7E,CACF;;;AAIT,MAAM,6BACH,KAAwB,mBAEvB,eACyB;CACzB,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,WAAW,UAAU,CAAC,CAC7C;AACD,QAAO,GAAG,KAAK;EACb,UAAU,kBAAkB,KAAK,cAAc;EAC/C,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,CAAC,OAAO,IAAI,cAAc,gBACtB,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,YACD,GAAG,KAAK;EACN,UAAU,qBAAqB,KAAK,cAAc;EAClD,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CACH,EACD,GAAG,UAAU,WAAW,CACzB;;;AAIL,MAAM,cACH,UAEC,aAEA,SAAS,yBAAyB,KAAK,GACnC,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC;;AAGrD,MAAM,mBACH,QAEC,aAEA,CAAC,SAAS,cACN,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,qBAAqB,cAAc,CAAC,SAAS,eAC9C,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,SAAS;AAmB9B,MAAM,eAAe;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,YAAY;CACb;AAED,MAAM,gBAAgB;CACpB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACd;AAQD,MAAM,4BACJ,WACuC;CACvC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,cAAc,SAAS,KAAc,GACpE,GAAG,QAAQ,EAAQ,MAAwC,CAAC,GAC5D,GAAG,KACD,IAAI,UACF,wBACA,sGACD,CACF;;AAGP,MAAM,4BACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,2BAA2B,CAAC;;;;;;AAOxD,SAAgB,gBACd,KACA,UACA,MAIkC;CAClC,MAAM,SAAU,KAAK,UAAU,EAAE;AAEjC,QAAO,yBAAyB,OAAO,CAAC,KACtC,GAAG,OAAO,aAAa;AAwerB,SAveiD,GAAG,MAAM,SAAS,CAAC,GAClE,QACA;GACE,kBAAkB,MAChB,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,GAAG,QAAQ,MAAM,IAAI,CAAC,GAAI,CAC1C,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QAAQ;IACzB,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,MAAM,OAAO,MAAM,cAAc,KAAK,OAAO;MAC7C,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;MACnD,MAAM,kBACJ,OAAO,mBAAmB,MAAM,QAAQ;MAG1C,MAAM,sBADW,MAAM,sBAAsB,KAAK,OAAO,EACrB,KAAK,QAAQ;OAC/C,IAAI,GAAG;OACP,YAAY,GAAG;OAChB,EAAE;MAEH,MAAM,aAAa,yBACjB,IAAI,aAAa,CAAC,OAAO,OAAO,CACjC;AA8BD,aAAO;OACL,MAAM;OACN,SA9Bc;QACd,IAAI;SAAE,MAAM,GAAG;SAAQ,IAAI,GAAG;SAAM;QACpC,MAAM;SACJ,IAAI;SACJ,MAAM;SACN,aAAa;SACd;QACD,WAAW,yBAAyB,UAAU;QAC9C,kBAAkB,GAAG,WAAW,KAAK,SAAS;SAC5C,MAAM;SACN;SACD,EAAE;QACH,SAAS,GAAG;QACZ,aAAa,GAAG;QAChB,wBAAwB;SACtB,aAAa,GAAG;SAChB,oBAAoB,GAAG,gBAAgB;SACvC,kBAAkB,GAAG;SACrB,GAAI,GAAG,0BACH,EACE,yBACE,GAAG,yBACN,GACD,EAAE;SACP;QACD;QACD;OAKC;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,iBAAiB,MACf,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,GAAG,QAAQ,MAAM,IAAI,CAAC,GAAI,CAC1C,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QACjB,yBAAyB,KAAK,SAAS,CAAC,KACtC,GAAG,OAAO,aAAa;IAIrB,MAAM,aAAa,oBAHI,6BACrB,OAAO,eACR,CACqD;AAuBtD,WArB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBACE,eAAe,QACf,kBACD,CACF,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,UAAU;AAQX,YAHoB,uBAHlB,6BACE,OAAO,kBACR,CAGF,CACkB;MACnB,CACH,CAE2B,KAC1B,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,EAC7B,GAAG,OAAO,aAAa;AACrB,SAAI,SAAS,cAAc,KACzB,QAAO,GAAG,KACR,IAAI,UAAU,wBAAwB,CACvC;AAEH,YAAO,GAAG,QAAQ;MAChB;MACA,YAAY,SAAS;MACtB,CAAC;MACF,EACF,GAAG,OAAO,EAAE,UAAU,iBAAiB;KACrC,MAAM,eAAe,yBACnB,WAAW,GACZ;KACD,MAAM,YAAY,WAAW;KAE7B,IAAI;AACJ,SAAI,UAAU,oBAAoB,CAChC,aAAY,UAAU,WAAW;UAC5B;MACL,MAAM,UAAU,UAAU,MAAM;AAChC,kBACE,YAAY,YAAY,MACpB,qBACA,YAAY,YAAY,MACtB,qBACA;;KAkCV,MAAM,UA5BF;OACD,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAM,KAAK;AACX,aAAM,IAAI,QAAQ,EAAE;AACpB,aAAM,IAAI,QAAQ,GAAG;AACrB,cAAO,GAAG,QAAQ,MAAM;;OAEzB,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,YAAY,IAAI,aAAa,IAAI,GAAG,IAAI,EAAE;AAChD,cAAO,GAAG,QAAQ,UAAU,aAAa,CAAC;;MAE7C,CAEwB;AACzB,aACE,UACI,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,YAC3B,CACF,EACL,KACA,GAAG,OAAO,mBACR,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,aACJ,OAAO,cAAc;OACvB,MAAM,WAAW,OAAO,YAAY;AAGpC,aADW,OAAO,KAAK,IAAI,KAAK,OAAO,CAC9B,SAAS,OAAO;QACvB;QACA,UAAU,SAAS;QACnB,mBAAmB;QACpB,CAAC;AAEF,aAAM,oBAAoB,KAAK;QAC7B;QACA;QACA,WAAW,eAAe,OAAO,MAC/B,eAAe,YACf,eAAe,aACb,eAAe,WAClB;QACD;QACA,SAAS,SAAS;QAClB,YAAY,OAAO;QACnB;QACA;QACA,MAAM,OAAO;QACb,WAAW,KAAK,KAAK;QACtB,CAAC;AAOF,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC;SACA,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH,CACF,CACF;GACH,cAAc,MACZ,mBAAmB,SAAS,CAAC,KAC3B,GAAG,OAAO,OAAO;IACf,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,IAAI;AAOJ,UAAI,OAAO,OAAO;OAChB,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,MACR;AACD,WAAI,MAAM;QACR,MAAM,WAAW,MAAM,sBACrB,KACA,KAAK,IACN;AACD,YAAI,SAAS,SAAS,EACpB,oBAAmB,SAAS,KAAK,QAAQ;SACvC,MAAM;SACN,IAAI,GAAG;SACP,YAAY,GAAG;SAChB,EAAE;;;MAKT,MAAM,UAA+B;OACnC,WAAW,yBAAyB,UAAU;OAC9C,SAAS,GAAG;OACZ,MAAM,GAAG;OACT,kBAAkB,GAAG;OACtB;AAED,UAAI,iBACF,SAAQ,mBAAmB;AAG7B,aAAO;OACL,MAAM;OACN;OACA;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,aAAa,MACX,GAAG,IACD,mBAAmB,SAAS,EAC5B,yBAAyB,KAAK,SAAS,CACxC,CAAC,KACA,GAAG,OAAO,CAAC,IAAI,cAAc;IAC3B,MAAM,iBAAiB,6BACrB,OAAO,eACR;IACD,MAAM,aAAa,oBAAoB,eAAe;AAoBtD,WAlB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBAAqB,eAAe,KAAK,eAAe,CACzD,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,YACD,OAAO,gBAAgB,OACnB,GAAG,QAAQ,OAAO,aAAuB,GACzC,GAAG,KACD,IAAI,UACF,8BACA,wBACD,CACF,CACN,CACF,CAE2B,KAC1B,GAAG,OAAO,iBACR,GAAG,KAAK;KACN,UAAU,2BAA2B,KAAK,aAAa;KACvD,WAAW,IAAI,UAAU,6BAA6B;KACvD,CAAC,CAAC,KACD,GAAG,OAAO,YACR,UACI,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,8BACA,qBACD,CACF,CACN,CACF,CACF,EACD,GAAG,OAAO,YAAY;KACpB,MAAM,yBAAyB,6BAC7B,OAAO,kBACR;KACD,MAAM,oBAAoB,uBACxB,uBACD;KAED,MAAM,YAAY,6BAChB,OAAO,UACR;KAKD,MAAM,cAAc,OAJK,gCACvB,wBACA,eACD,CAC2C;AA2E5C,YAzE+B,GAAG,QAChC,kBACD,CAAC,KACA,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,CAC9B,CAEkD,KACjD,GAAG,YAAY;MACb,MAAM,uBAAuB,IAAI,WAC/B,QAAQ,UACT;MAwCD,MAAM,UApCF;QACD,2BAA2B;AAY1B,eALc,qBANM,oBAClB,MACA,qBACD,EAKC,aAHA,yBAAyB,UAAU,CAKpC,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;QAEN,2BAA2B;AAS1B,eANc,8BADZ,wBAAwB,qBAAqB,EAG7C,wBACA,aACA,UACD,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;OAER,CAEiC,QAAQ;AAC1C,aAAO,UACH,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,QAAQ,YACnC,CACF;OACL,CACH,CAE8C,KAC7C,GAAG,YACD,QAAQ,YAAY,KACpB,kBAAkB,qBAAqB,KACvC,kBAAkB,oBAAoB,QAAQ,UAC1C,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,kBAAkB,CAClC,CACF,CAEyB,KACxB,GAAG,YACD,GAAG,KAAK;MACN,IAAI,YAAY;AACd,aAAM,2BACJ,KACA,QAAQ,KACR,kBAAkB,kBAClB,KAAK,KAAK,CACX;AAOD,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC,QAAQ,QAAQ;SAChB,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH;GACJ,CACF;GAED,CACH"}
+{"version":3,"file":"passkey.js","names":["hasSiteUrl","hasRpId","siteUrl"],"sources":["../../src/server/passkey.ts"],"sourcesContent":["/**\n * Server-side WebAuthn ceremony logic for passkey authentication.\n *\n * Handles the four phases of the WebAuthn flow:\n * 1. registerOptions — generate PublicKeyCredentialCreationOptions\n * 2. registerVerify — verify attestation and store credential\n * 3. authOptions — generate PublicKeyCredentialRequestOptions\n * 4. authVerify — verify assertion signature and sign in\n *\n * Uses `@oslojs/webauthn` for attestation/assertion parsing and\n * `@oslojs/crypto` for signature verification.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.chain` pipelines.\n *\n * @module\n */\n\nimport {\n  p256,\n  verifyECDSASignature,\n  decodeSEC1PublicKey,\n  decodePKIXECDSASignature,\n} from \"@oslojs/crypto/ecdsa\";\nimport {\n  RSAPublicKey,\n  decodePKCS1RSAPublicKey,\n  sha256ObjectIdentifier,\n  verifyRSASSAPKCS1v15Signature,\n} from \"@oslojs/crypto/rsa\";\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  encodeBase64urlNoPadding,\n  decodeBase64urlIgnorePadding,\n} from \"@oslojs/encoding\";\nimport {\n  parseAttestationObject,\n  parseClientDataJSON,\n  parseAuthenticatorData,\n  createAssertionSignatureMessage,\n  ClientDataType,\n  coseAlgorithmES256,\n  coseAlgorithmRS256,\n  COSEKeyType,\n} from \"@oslojs/webauthn\";\nimport type { Fx as FxType } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError, Fx } from \"./fx\";\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryUserByVerifiedEmail,\n  queryPasskeysByUserId,\n  queryPasskeyByCredentialId,\n  queryVerifierById,\n  mutatePasskeyInsert,\n  mutatePasskeyUpdateCounter,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Resolve RP options — Fx pipeline with validation\n// ============================================================================\n\n/** Resolved relying party configuration. */\ninterface RpOptions {\n  rpName: string;\n  rpId: string;\n  origin: string | string[];\n  attestation: string;\n  userVerification: string;\n  residentKey: string;\n  authenticatorAttachment?: string;\n  algorithms: number[];\n  challengeExpirationMs: number;\n}\n\n/**\n * Resolve passkey relying party options from provider config and environment.\n *\n * Returns `Fx<RpOptions, AuthError>` — fails if neither SITE_URL nor rpId\n * is configured.\n */\nconst resolveRpOptionsFx = (\n  provider: PasskeyProviderConfig,\n): FxType<RpOptions, AuthError> => {\n  const siteUrl = process.env.SITE_URL;\n  const hasSiteUrl = siteUrl !== undefined && siteUrl !== \"\";\n  const hasRpId = provider.options.rpId !== undefined;\n\n  return Fx.succeed({ siteUrl, hasSiteUrl, hasRpId }).pipe(\n    Fx.chain(({ siteUrl, hasSiteUrl, hasRpId }) =>\n      !hasSiteUrl && !hasRpId\n        ? Fx.fail(\n            new AuthError(\n              \"PASSKEY_MISSING_CONFIG\",\n              \"Passkey provider requires SITE_URL env var (your frontend URL) \" +\n                \"or explicit rpId / origin in the provider config. \" +\n                \"CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.\",\n            ),\n          )\n        : Fx.succeed(siteUrl),\n    ),\n    Fx.map((siteUrl) => {\n      const siteHostname = siteUrl ? new URL(siteUrl).hostname : undefined;\n      return {\n        rpName: provider.options.rpName ?? siteHostname ?? \"localhost\",\n        rpId: provider.options.rpId ?? siteHostname ?? \"localhost\",\n        origin: provider.options.origin ?? siteUrl ?? \"http://localhost\",\n        attestation: provider.options.attestation ?? \"none\",\n        userVerification: provider.options.userVerification ?? \"required\",\n        residentKey: provider.options.residentKey ?? \"preferred\",\n        authenticatorAttachment: provider.options.authenticatorAttachment,\n        algorithms: provider.options.algorithms ?? [\n          coseAlgorithmES256,\n          coseAlgorithmRS256,\n        ],\n        challengeExpirationMs:\n          provider.options.challengeExpirationMs ?? 300_000,\n      };\n    }),\n  );\n};\n\n// ============================================================================\n// Composable validators — small functions (A) => Fx<B, AuthError>\n// ============================================================================\n\n/** Verify client data type matches expected WebAuthn ceremony type. */\nconst verifyClientDataType =\n  <T extends { type: ClientDataType }>(\n    expectedType: ClientDataType,\n    label: string,\n  ) =>\n  (clientData: T): FxType<T, AuthError> =>\n    clientData.type === expectedType\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_CLIENT_DATA\",\n            `Invalid client data type: expected ${label}`,\n          ),\n        );\n\n/** Verify origin is in the allowed list. */\nconst verifyOrigin =\n  (rp: RpOptions) =>\n  <T extends { origin: string }>(clientData: T): FxType<T, AuthError> => {\n    const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];\n    return allowed.includes(clientData.origin)\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_ORIGIN\",\n            `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(\", \")}`,\n          ),\n        );\n  };\n\n/** Verify the challenge hash matches the stored verifier, then delete verifier. */\nconst verifyAndConsumeChallenge =\n  (ctx: EnrichedActionCtx, verifierValue: string) =>\n  <T extends { challenge: Uint8Array }>(\n    clientData: T,\n  ): FxType<T, AuthError> => {\n    const challengeHash = encodeBase64urlNoPadding(\n      new Uint8Array(sha256(clientData.challenge)),\n    );\n    return Fx.from({\n      ok: () => queryVerifierById(ctx, verifierValue),\n      err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        !doc || doc.signature !== challengeHash\n          ? Fx.fail(new AuthError(\"PASSKEY_INVALID_CHALLENGE\"))\n          : Fx.succeed(doc),\n      ),\n      Fx.chain(() =>\n        Fx.from({\n          ok: () => mutateVerifierDelete(ctx, verifierValue),\n          err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n        }),\n      ),\n      Fx.map(() => clientData),\n    );\n  };\n\n/** Verify RP ID hash matches. */\nconst verifyRpId =\n  (rpId: string) =>\n  <T extends { verifyRelyingPartyIdHash: (id: string) => boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    authData.verifyRelyingPartyIdHash(rpId)\n      ? Fx.succeed(authData)\n      : Fx.fail(new AuthError(\"PASSKEY_RP_MISMATCH\"));\n\n/** Verify user presence and (optionally) user verification flags. */\nconst verifyUserFlags =\n  (rp: RpOptions) =>\n  <T extends { userPresent: boolean; userVerified: boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    !authData.userPresent\n      ? Fx.fail(new AuthError(\"PASSKEY_USER_PRESENCE\"))\n      : rp.userVerification === \"required\" && !authData.userVerified\n        ? Fx.fail(new AuthError(\"PASSKEY_USER_VERIFICATION\"))\n        : Fx.succeed(authData);\n\n// ============================================================================\n// Registration flow\n// ============================================================================\n\n// ============================================================================\n// Authentication flow\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/** Result type for all passkey flows. */\ntype PasskeyResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | { kind: \"passkeyOptions\"; options: Record<string, any>; verifier: string };\n\nconst PASSKEY_FLOW = {\n  registerOptions: \"registerOptions\",\n  registerVerify: \"registerVerify\",\n  authOptions: \"authOptions\",\n  authVerify: \"authVerify\",\n} as const;\n\nconst PASSKEY_FLOWS = [\n  PASSKEY_FLOW.registerOptions,\n  PASSKEY_FLOW.registerVerify,\n  PASSKEY_FLOW.authOptions,\n  PASSKEY_FLOW.authVerify,\n] as const;\n\ntype PasskeyDispatch =\n  | { flow: typeof PASSKEY_FLOW.registerOptions }\n  | { flow: typeof PASSKEY_FLOW.registerVerify }\n  | { flow: typeof PASSKEY_FLOW.authOptions }\n  | { flow: typeof PASSKEY_FLOW.authVerify };\n\nconst resolvePasskeyDispatchFx = (\n  params: Record<string, unknown>,\n): FxType<PasskeyDispatch, AuthError> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && PASSKEY_FLOWS.includes(flow as never)\n    ? Fx.succeed({ flow: flow as (typeof PASSKEY_FLOWS)[number] })\n    : Fx.fail(\n        new AuthError(\n          \"PASSKEY_MISSING_FLOW\",\n          \"Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify\",\n        ),\n      );\n};\n\nconst requirePasskeyVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, AuthError> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Fx.fail(new AuthError(\"PASSKEY_MISSING_VERIFIER\"));\n\n/**\n * Main passkey handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.\n */\nexport function handlePasskeyFx(\n  ctx: EnrichedActionCtx,\n  provider: PasskeyProviderConfig,\n  args: {\n    params?: Record<string, any>;\n    verifier?: string;\n  },\n): FxType<PasskeyResult, AuthError> {\n  const params = (args.params ?? {}) as Record<string, any>;\n\n  return resolvePasskeyDispatchFx(params).pipe(\n    Fx.chain((dispatch) => {\n      const flowFx: FxType<PasskeyResult, AuthError> = Fx.match(dispatch).on(\n        \"flow\",\n        {\n          registerOptions: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    const user = await queryUserById(ctx, userId);\n                    const userName = params.userName ?? user?.email ?? \"user\";\n                    const userDisplayName =\n                      params.userDisplayName ?? user?.name ?? userName;\n\n                    const existing = await queryPasskeysByUserId(ctx, userId);\n                    const excludeCredentials = existing.map((pk) => ({\n                      id: pk.credentialId,\n                      transports: pk.transports,\n                    }));\n\n                    const userHandle = encodeBase64urlNoPadding(\n                      new TextEncoder().encode(userId),\n                    );\n\n                    const options = {\n                      rp: { name: rp.rpName, id: rp.rpId },\n                      user: {\n                        id: userHandle,\n                        name: userName,\n                        displayName: userDisplayName,\n                      },\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      pubKeyCredParams: rp.algorithms.map((alg) => ({\n                        type: \"public-key\" as const,\n                        alg,\n                      })),\n                      timeout: rp.challengeExpirationMs,\n                      attestation: rp.attestation,\n                      authenticatorSelection: {\n                        residentKey: rp.residentKey,\n                        requireResidentKey: rp.residentKey === \"required\",\n                        userVerification: rp.userVerification,\n                        ...(rp.authenticatorAttachment\n                          ? {\n                              authenticatorAttachment:\n                                rp.authenticatorAttachment,\n                            }\n                          : {}),\n                      },\n                      excludeCredentials,\n                    };\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          registerVerify: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) =>\n                requirePasskeyVerifierFx(args.verifier).pipe(\n                  Fx.chain((verifier) => {\n                    const clientDataJSON = decodeBase64urlIgnorePadding(\n                      params.clientDataJSON,\n                    );\n                    const clientData = parseClientDataJSON(clientDataJSON);\n\n                    const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                      Fx.chain(\n                        verifyClientDataType(\n                          ClientDataType.Create,\n                          \"webauthn.create\",\n                        ),\n                      ),\n                      Fx.chain(verifyOrigin(rp)),\n                      Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                      Fx.map(() => {\n                        const attestationObjectBytes =\n                          decodeBase64urlIgnorePadding(\n                            params.attestationObject,\n                          );\n                        const attestation = parseAttestationObject(\n                          attestationObjectBytes,\n                        );\n                        return attestation.authenticatorData;\n                      }),\n                    );\n\n                    return verifiedClientDataFx.pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                      Fx.chain((authData) => {\n                        if (authData.credential == null) {\n                          return Fx.fail(\n                            new AuthError(\"PASSKEY_NO_CREDENTIAL\"),\n                          );\n                        }\n                        return Fx.succeed({\n                          authData,\n                          credential: authData.credential,\n                        });\n                      }),\n                      Fx.chain(({ authData, credential }) => {\n                        const credentialId = encodeBase64urlNoPadding(\n                          credential.id,\n                        );\n                        const publicKey = credential.publicKey;\n\n                        let algorithm: number;\n                        if (publicKey.isAlgorithmDefined()) {\n                          algorithm = publicKey.algorithm();\n                        } else {\n                          const keyType = publicKey.type();\n                          algorithm =\n                            keyType === COSEKeyType.EC2\n                              ? coseAlgorithmES256\n                              : keyType === COSEKeyType.RSA\n                                ? coseAlgorithmRS256\n                                : coseAlgorithmES256;\n                        }\n\n                        const handlers: Record<\n                          number,\n                          (() => FxType<Uint8Array, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ec2 = publicKey.ec2();\n                            const xBytes = new Uint8Array(32);\n                            let vx = ec2.x;\n                            for (let i = 31; i >= 0; i--) {\n                              xBytes[i] = Number(vx & 0xffn);\n                              vx >>= 8n;\n                            }\n                            const yBytes = new Uint8Array(32);\n                            let vy = ec2.y;\n                            for (let i = 31; i >= 0; i--) {\n                              yBytes[i] = Number(vy & 0xffn);\n                              vy >>= 8n;\n                            }\n                            const bytes = new Uint8Array(65);\n                            bytes[0] = 0x04;\n                            bytes.set(xBytes, 1);\n                            bytes.set(yBytes, 33);\n                            return Fx.succeed(bytes);\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsa = publicKey.rsa();\n                            const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);\n                            return Fx.succeed(rsaPubKey.encodePKCS1());\n                          },\n                        };\n\n                        const handler = handlers[algorithm];\n                        return (\n                          handler\n                            ? handler()\n                            : Fx.fail(\n                                new AuthError(\n                                  \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                  `Unsupported algorithm: ${algorithm}`,\n                                ),\n                              )\n                        ).pipe(\n                          Fx.chain((publicKeyBytes) =>\n                            Fx.from({\n                              ok: async () => {\n                                const deviceType =\n                                  params.deviceType ?? \"single-device\";\n                                const backedUp = params.backedUp ?? false;\n\n                                const db = authDb(ctx, ctx.auth.config);\n                                await db.accounts.create({\n                                  userId,\n                                  provider: provider.id,\n                                  providerAccountId: credentialId,\n                                });\n\n                                await mutatePasskeyInsert(ctx, {\n                                  userId,\n                                  credentialId,\n                                  publicKey: publicKeyBytes.buffer.slice(\n                                    publicKeyBytes.byteOffset,\n                                    publicKeyBytes.byteOffset +\n                                      publicKeyBytes.byteLength,\n                                  ),\n                                  algorithm,\n                                  counter: authData.signatureCounter,\n                                  transports: params.transports,\n                                  deviceType,\n                                  backedUp,\n                                  name: params.passkeyName,\n                                  createdAt: Date.now(),\n                                });\n\n                                const signInResult = await callSignIn(ctx, {\n                                  userId,\n                                  generateTokens: true,\n                                });\n\n                                return {\n                                  kind: \"signedIn\" as const,\n                                  signedIn: signInResult,\n                                };\n                              },\n                              err: () => new AuthError(\"INTERNAL_ERROR\"),\n                            }),\n                          ),\n                        );\n                      }),\n                    );\n                  }),\n                ),\n              ),\n            ),\n          authOptions: (_) =>\n            resolveRpOptionsFx(provider).pipe(\n              Fx.chain((rp) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    let allowCredentials:\n                      | Array<{\n                          type: string;\n                          id: string;\n                          transports?: string[];\n                        }>\n                      | undefined;\n                    if (params.email) {\n                      const user = await queryUserByVerifiedEmail(\n                        ctx,\n                        params.email,\n                      );\n                      if (user) {\n                        const passkeys = await queryPasskeysByUserId(\n                          ctx,\n                          user._id,\n                        );\n                        if (passkeys.length > 0) {\n                          allowCredentials = passkeys.map((pk) => ({\n                            type: \"public-key\",\n                            id: pk.credentialId,\n                            transports: pk.transports,\n                          }));\n                        }\n                      }\n                    }\n\n                    const options: Record<string, any> = {\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      timeout: rp.challengeExpirationMs,\n                      rpId: rp.rpId,\n                      userVerification: rp.userVerification,\n                    };\n\n                    if (allowCredentials) {\n                      options.allowCredentials = allowCredentials;\n                    }\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          authVerify: (_) =>\n            Fx.zip(\n              resolveRpOptionsFx(provider),\n              requirePasskeyVerifierFx(args.verifier),\n            ).pipe(\n              Fx.chain(([rp, verifier]) => {\n                const clientDataJSON = decodeBase64urlIgnorePadding(\n                  params.clientDataJSON,\n                );\n                const clientData = parseClientDataJSON(clientDataJSON);\n\n                const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                  Fx.chain(\n                    verifyClientDataType(ClientDataType.Get, \"webauthn.get\"),\n                  ),\n                  Fx.chain(verifyOrigin(rp)),\n                  Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                  Fx.chain(() =>\n                    params.credentialId != null\n                      ? Fx.succeed(params.credentialId as string)\n                      : Fx.fail(\n                          new AuthError(\n                            \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                            \"Missing credential ID\",\n                          ),\n                        ),\n                  ),\n                );\n\n                return verifiedClientDataFx.pipe(\n                  Fx.chain((credentialId) =>\n                    Fx.from({\n                      ok: () => queryPasskeyByCredentialId(ctx, credentialId),\n                      err: () => new AuthError(\"PASSKEY_UNKNOWN_CREDENTIAL\"),\n                    }).pipe(\n                      Fx.chain((passkey) =>\n                        passkey\n                          ? Fx.succeed(passkey)\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                                \"Unknown credential\",\n                              ),\n                            ),\n                      ),\n                    ),\n                  ),\n                  Fx.chain((passkey) => {\n                    const authenticatorDataBytes = decodeBase64urlIgnorePadding(\n                      params.authenticatorData,\n                    );\n                    const authenticatorData = parseAuthenticatorData(\n                      authenticatorDataBytes,\n                    );\n\n                    const signature = decodeBase64urlIgnorePadding(\n                      params.signature,\n                    );\n                    const signatureMessage = createAssertionSignatureMessage(\n                      authenticatorDataBytes,\n                      clientDataJSON,\n                    );\n                    const messageHash = sha256(signatureMessage);\n\n                    const checkedAuthenticatorFx = Fx.succeed(\n                      authenticatorData,\n                    ).pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                    );\n\n                    const signatureVerifiedFx = checkedAuthenticatorFx.pipe(\n                      Fx.chain(() => {\n                        const storedPublicKeyBytes = new Uint8Array(\n                          passkey.publicKey,\n                        );\n                        const algorithmHandlers: Record<\n                          number,\n                          (() => FxType<void, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ecPublicKey = decodeSEC1PublicKey(\n                              p256,\n                              storedPublicKeyBytes,\n                            );\n                            const ecdsaSignature =\n                              decodePKIXECDSASignature(signature);\n                            const valid = verifyECDSASignature(\n                              ecPublicKey,\n                              messageHash,\n                              ecdsaSignature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsaPublicKey =\n                              decodePKCS1RSAPublicKey(storedPublicKeyBytes);\n                            const valid = verifyRSASSAPKCS1v15Signature(\n                              rsaPublicKey,\n                              sha256ObjectIdentifier,\n                              messageHash,\n                              signature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                        };\n\n                        const handler = algorithmHandlers[passkey.algorithm];\n                        return handler\n                          ? handler()\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                `Unsupported algorithm: ${passkey.algorithm}`,\n                              ),\n                            );\n                      }),\n                    );\n\n                    const counterValidatedFx = signatureVerifiedFx.pipe(\n                      Fx.chain(() =>\n                        passkey.counter !== 0 &&\n                        authenticatorData.signatureCounter !== 0 &&\n                        authenticatorData.signatureCounter <= passkey.counter\n                          ? Fx.fail(new AuthError(\"PASSKEY_COUNTER_ERROR\"))\n                          : Fx.succeed(authenticatorData),\n                      ),\n                    );\n\n                    return counterValidatedFx.pipe(\n                      Fx.chain(() =>\n                        Fx.from({\n                          ok: async () => {\n                            await mutatePasskeyUpdateCounter(\n                              ctx,\n                              passkey._id,\n                              authenticatorData.signatureCounter,\n                              Date.now(),\n                            );\n\n                            const signInResult = await callSignIn(ctx, {\n                              userId: passkey.userId,\n                              generateTokens: true,\n                            });\n\n                            return {\n                              kind: \"signedIn\" as const,\n                              signedIn: signInResult,\n                            };\n                          },\n                          err: () => new AuthError(\"INTERNAL_ERROR\"),\n                        }),\n                      ),\n                    );\n                  }),\n                );\n              }),\n            ),\n        },\n      );\n      return flowFx;\n    }),\n  );\n}\n\n// Keep backward-compatible export name — callers can migrate to handlePasskeyFx\nexport { handlePasskeyFx as handlePasskey };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,MAAM,sBACJ,aACiC;CACjC,MAAM,UAAU,QAAQ,IAAI;CAC5B,MAAM,aAAa,YAAY,UAAa,YAAY;CACxD,MAAM,UAAU,SAAS,QAAQ,SAAS;AAE1C,QAAO,GAAG,QAAQ;EAAE;EAAS;EAAY;EAAS,CAAC,CAAC,KAClD,GAAG,OAAO,EAAE,oBAAS,0BAAY,yBAC/B,CAACA,gBAAc,CAACC,YACZ,GAAG,KACD,IAAI,UACF,0BACA,yMAGD,CACF,GACD,GAAG,QAAQC,UAAQ,CACxB,EACD,GAAG,KAAK,cAAY;EAClB,MAAM,eAAeA,YAAU,IAAI,IAAIA,UAAQ,CAAC,WAAW;AAC3D,SAAO;GACL,QAAQ,SAAS,QAAQ,UAAU,gBAAgB;GACnD,MAAM,SAAS,QAAQ,QAAQ,gBAAgB;GAC/C,QAAQ,SAAS,QAAQ,UAAUA,aAAW;GAC9C,aAAa,SAAS,QAAQ,eAAe;GAC7C,kBAAkB,SAAS,QAAQ,oBAAoB;GACvD,aAAa,SAAS,QAAQ,eAAe;GAC7C,yBAAyB,SAAS,QAAQ;GAC1C,YAAY,SAAS,QAAQ,cAAc,CACzC,oBACA,mBACD;GACD,uBACE,SAAS,QAAQ,yBAAyB;GAC7C;GACD,CACH;;;AAQH,MAAM,wBAEF,cACA,WAED,eACC,WAAW,SAAS,eAChB,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,+BACA,sCAAsC,QACvC,CACF;;AAGT,MAAM,gBACH,QAC8B,eAAwC;CACrE,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,OAAO;AAClE,QAAO,QAAQ,SAAS,WAAW,OAAO,GACtC,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,0BACA,mBAAmB,WAAW,OAAO,qBAAqB,QAAQ,KAAK,KAAK,GAC7E,CACF;;;AAIT,MAAM,6BACH,KAAwB,mBAEvB,eACyB;CACzB,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,WAAW,UAAU,CAAC,CAC7C;AACD,QAAO,GAAG,KAAK;EACb,UAAU,kBAAkB,KAAK,cAAc;EAC/C,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,CAAC,OAAO,IAAI,cAAc,gBACtB,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,YACD,GAAG,KAAK;EACN,UAAU,qBAAqB,KAAK,cAAc;EAClD,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CACH,EACD,GAAG,UAAU,WAAW,CACzB;;;AAIL,MAAM,cACH,UAEC,aAEA,SAAS,yBAAyB,KAAK,GACnC,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC;;AAGrD,MAAM,mBACH,QAEC,aAEA,CAAC,SAAS,cACN,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,qBAAqB,cAAc,CAAC,SAAS,eAC9C,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,SAAS;AAmB9B,MAAM,eAAe;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,YAAY;CACb;AAED,MAAM,gBAAgB;CACpB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACd;AAQD,MAAM,4BACJ,WACuC;CACvC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,cAAc,SAAS,KAAc,GACpE,GAAG,QAAQ,EAAQ,MAAwC,CAAC,GAC5D,GAAG,KACD,IAAI,UACF,wBACA,sGACD,CACF;;AAGP,MAAM,4BACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,2BAA2B,CAAC;;;;;;AAOxD,SAAgB,gBACd,KACA,UACA,MAIkC;CAClC,MAAM,SAAU,KAAK,UAAU,EAAE;AAEjC,QAAO,yBAAyB,OAAO,CAAC,KACtC,GAAG,OAAO,aAAa;AAwerB,SAveiD,GAAG,MAAM,SAAS,CAAC,GAClE,QACA;GACE,kBAAkB,MAChB,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QAAQ;IACzB,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,MAAM,OAAO,MAAM,cAAc,KAAK,OAAO;MAC7C,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;MACnD,MAAM,kBACJ,OAAO,mBAAmB,MAAM,QAAQ;MAG1C,MAAM,sBADW,MAAM,sBAAsB,KAAK,OAAO,EACrB,KAAK,QAAQ;OAC/C,IAAI,GAAG;OACP,YAAY,GAAG;OAChB,EAAE;MAEH,MAAM,aAAa,yBACjB,IAAI,aAAa,CAAC,OAAO,OAAO,CACjC;AA8BD,aAAO;OACL,MAAM;OACN,SA9Bc;QACd,IAAI;SAAE,MAAM,GAAG;SAAQ,IAAI,GAAG;SAAM;QACpC,MAAM;SACJ,IAAI;SACJ,MAAM;SACN,aAAa;SACd;QACD,WAAW,yBAAyB,UAAU;QAC9C,kBAAkB,GAAG,WAAW,KAAK,SAAS;SAC5C,MAAM;SACN;SACD,EAAE;QACH,SAAS,GAAG;QACZ,aAAa,GAAG;QAChB,wBAAwB;SACtB,aAAa,GAAG;SAChB,oBAAoB,GAAG,gBAAgB;SACvC,kBAAkB,GAAG;SACrB,GAAI,GAAG,0BACH,EACE,yBACE,GAAG,yBACN,GACD,EAAE;SACP;QACD;QACD;OAKC;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,iBAAiB,MACf,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QACjB,yBAAyB,KAAK,SAAS,CAAC,KACtC,GAAG,OAAO,aAAa;IAIrB,MAAM,aAAa,oBAHI,6BACrB,OAAO,eACR,CACqD;AAuBtD,WArB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBACE,eAAe,QACf,kBACD,CACF,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,UAAU;AAQX,YAHoB,uBAHlB,6BACE,OAAO,kBACR,CAGF,CACkB;MACnB,CACH,CAE2B,KAC1B,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,EAC7B,GAAG,OAAO,aAAa;AACrB,SAAI,SAAS,cAAc,KACzB,QAAO,GAAG,KACR,IAAI,UAAU,wBAAwB,CACvC;AAEH,YAAO,GAAG,QAAQ;MAChB;MACA,YAAY,SAAS;MACtB,CAAC;MACF,EACF,GAAG,OAAO,EAAE,UAAU,iBAAiB;KACrC,MAAM,eAAe,yBACnB,WAAW,GACZ;KACD,MAAM,YAAY,WAAW;KAE7B,IAAI;AACJ,SAAI,UAAU,oBAAoB,CAChC,aAAY,UAAU,WAAW;UAC5B;MACL,MAAM,UAAU,UAAU,MAAM;AAChC,kBACE,YAAY,YAAY,MACpB,qBACA,YAAY,YAAY,MACtB,qBACA;;KAkCV,MAAM,UA5BF;OACD,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAM,KAAK;AACX,aAAM,IAAI,QAAQ,EAAE;AACpB,aAAM,IAAI,QAAQ,GAAG;AACrB,cAAO,GAAG,QAAQ,MAAM;;OAEzB,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,YAAY,IAAI,aAAa,IAAI,GAAG,IAAI,EAAE;AAChD,cAAO,GAAG,QAAQ,UAAU,aAAa,CAAC;;MAE7C,CAEwB;AACzB,aACE,UACI,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,YAC3B,CACF,EACL,KACA,GAAG,OAAO,mBACR,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,aACJ,OAAO,cAAc;OACvB,MAAM,WAAW,OAAO,YAAY;AAGpC,aADW,OAAO,KAAK,IAAI,KAAK,OAAO,CAC9B,SAAS,OAAO;QACvB;QACA,UAAU,SAAS;QACnB,mBAAmB;QACpB,CAAC;AAEF,aAAM,oBAAoB,KAAK;QAC7B;QACA;QACA,WAAW,eAAe,OAAO,MAC/B,eAAe,YACf,eAAe,aACb,eAAe,WAClB;QACD;QACA,SAAS,SAAS;QAClB,YAAY,OAAO;QACnB;QACA;QACA,MAAM,OAAO;QACb,WAAW,KAAK,KAAK;QACtB,CAAC;AAOF,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC;SACA,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH,CACF,CACF;GACH,cAAc,MACZ,mBAAmB,SAAS,CAAC,KAC3B,GAAG,OAAO,OAAO;IACf,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,IAAI;AAOJ,UAAI,OAAO,OAAO;OAChB,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,MACR;AACD,WAAI,MAAM;QACR,MAAM,WAAW,MAAM,sBACrB,KACA,KAAK,IACN;AACD,YAAI,SAAS,SAAS,EACpB,oBAAmB,SAAS,KAAK,QAAQ;SACvC,MAAM;SACN,IAAI,GAAG;SACP,YAAY,GAAG;SAChB,EAAE;;;MAKT,MAAM,UAA+B;OACnC,WAAW,yBAAyB,UAAU;OAC9C,SAAS,GAAG;OACZ,MAAM,GAAG;OACT,kBAAkB,GAAG;OACtB;AAED,UAAI,iBACF,SAAQ,mBAAmB;AAG7B,aAAO;OACL,MAAM;OACN;OACA;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,aAAa,MACX,GAAG,IACD,mBAAmB,SAAS,EAC5B,yBAAyB,KAAK,SAAS,CACxC,CAAC,KACA,GAAG,OAAO,CAAC,IAAI,cAAc;IAC3B,MAAM,iBAAiB,6BACrB,OAAO,eACR;IACD,MAAM,aAAa,oBAAoB,eAAe;AAoBtD,WAlB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBAAqB,eAAe,KAAK,eAAe,CACzD,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,YACD,OAAO,gBAAgB,OACnB,GAAG,QAAQ,OAAO,aAAuB,GACzC,GAAG,KACD,IAAI,UACF,8BACA,wBACD,CACF,CACN,CACF,CAE2B,KAC1B,GAAG,OAAO,iBACR,GAAG,KAAK;KACN,UAAU,2BAA2B,KAAK,aAAa;KACvD,WAAW,IAAI,UAAU,6BAA6B;KACvD,CAAC,CAAC,KACD,GAAG,OAAO,YACR,UACI,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,8BACA,qBACD,CACF,CACN,CACF,CACF,EACD,GAAG,OAAO,YAAY;KACpB,MAAM,yBAAyB,6BAC7B,OAAO,kBACR;KACD,MAAM,oBAAoB,uBACxB,uBACD;KAED,MAAM,YAAY,6BAChB,OAAO,UACR;KAKD,MAAM,cAAc,OAJK,gCACvB,wBACA,eACD,CAC2C;AA2E5C,YAzE+B,GAAG,QAChC,kBACD,CAAC,KACA,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,CAC9B,CAEkD,KACjD,GAAG,YAAY;MACb,MAAM,uBAAuB,IAAI,WAC/B,QAAQ,UACT;MAwCD,MAAM,UApCF;QACD,2BAA2B;AAY1B,eALc,qBANM,oBAClB,MACA,qBACD,EAKC,aAHA,yBAAyB,UAAU,CAKpC,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;QAEN,2BAA2B;AAS1B,eANc,8BADZ,wBAAwB,qBAAqB,EAG7C,wBACA,aACA,UACD,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;OAER,CAEiC,QAAQ;AAC1C,aAAO,UACH,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,QAAQ,YACnC,CACF;OACL,CACH,CAE8C,KAC7C,GAAG,YACD,QAAQ,YAAY,KACpB,kBAAkB,qBAAqB,KACvC,kBAAkB,oBAAoB,QAAQ,UAC1C,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,kBAAkB,CAClC,CACF,CAEyB,KACxB,GAAG,YACD,GAAG,KAAK;MACN,IAAI,YAAY;AACd,aAAM,2BACJ,KACA,QAAQ,KACR,kBAAkB,kBAClB,KAAK,KAAK,CACX;AAOD,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC,QAAQ,QAAQ;SAChB,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH;GACJ,CACF;GAED,CACH"}

package/dist/server/provider.d.ts

@@ -1,21 +1,8 @@
 import { AuthProviderMaterializedConfig, ConvexAuthMaterializedConfig } from "./types.js";
-import { AuthError } from "./fx.js";
-import { Fx } from "@robelest/fx";
 
 //#region src/server/provider.d.ts
-/**
- * Hash a secret using the provider's `crypto.hashSecret` function.
- *
- * Validates that the provider is a credentials provider and has the
- * required crypto function, returning typed errors through the Fx channel.
- */
-declare const hash: (provider: any, secret: string) => Fx<string, AuthError>;
-/**
- * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
- */
-declare const verify: (provider: AuthProviderMaterializedConfig, secret: string, hashValue: string) => Fx<boolean, AuthError>;
 type GetProviderOrThrowFunc = (provider: string, allowExtraProviders?: boolean) => AuthProviderMaterializedConfig;
 type Config = ConvexAuthMaterializedConfig;
 //#endregion
-export { Config, GetProviderOrThrowFunc, hash, verify };
+export { Config, GetProviderOrThrowFunc };
 //# sourceMappingURL=provider.d.ts.map

package/dist/server/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","names":[],"sources":["../../src/server/provider.ts"],"mappings":";;;;;;AAaA;;;;;cAAa,IAAA,GAAQ,QAAA,OAAe,MAAA,aAAiB,EAAA,SAAW,SAAA;;;;cAiCnD,MAAA,GACX,QAAA,EAAU,8BAAA,EACV,MAAA,UACA,SAAA,aACC,EAAA,UAAY,SAAA;AAAA,KA8BH,sBAAA,IACV,QAAA,UACA,mBAAA,eACG,8BAAA;AAAA,KAEO,MAAA,GAAS,4BAAA"}
+{"version":3,"file":"provider.d.ts","names":[],"sources":["../../src/server/provider.ts"],"mappings":";;;KAkFY,sBAAA,IACV,QAAA,UACA,mBAAA,eACG,8BAAA;AAAA,KAEO,MAAA,GAAS,4BAAA"}

package/dist/server/provider.js

@@ -9,6 +9,7 @@ import { Fx } from "@robelest/fx";
 * Validates that the provider is a credentials provider and has the
 * required crypto function, returning typed errors through the Fx channel.
 */
+/** @internal */
 const hash = (provider, secret) => Fx.gen(function* () {
 	if (provider.type !== "credentials") return yield* Fx.fail(new AuthError("INVALID_CREDENTIALS_PROVIDER", `Provider ${provider.id} is not a credentials provider`));
 	const hashSecretFn = provider.crypto?.hashSecret;
@@ -21,6 +22,7 @@ const hash = (provider, secret) => Fx.gen(function* () {
 /**
 * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
 */
+/** @internal */
 const verify = (provider, secret, hashValue) => Fx.gen(function* () {
 	if (provider.type !== "credentials") return yield* Fx.fail(new AuthError("INVALID_CREDENTIALS_PROVIDER", `Provider ${provider.id} is not a credentials provider`));
 	const verifySecretFn = provider.crypto?.verifySecret;

package/dist/server/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","names":[],"sources":["../../src/server/provider.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { AuthError } from \"./fx\";\nimport { AuthProviderMaterializedConfig } from \"./types\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\n/**\n * Hash a secret using the provider's `crypto.hashSecret` function.\n *\n * Validates that the provider is a credentials provider and has the\n * required crypto function, returning typed errors through the Fx channel.\n */\nexport const hash = (provider: any, secret: string): Fx<string, AuthError> =>\n  Fx.gen(function* () {\n    if (provider.type !== \"credentials\") {\n      return yield* Fx.fail(\n        new AuthError(\n          \"INVALID_CREDENTIALS_PROVIDER\",\n          `Provider ${provider.id} is not a credentials provider`,\n        ),\n      );\n    }\n\n    const hashSecretFn = provider.crypto?.hashSecret as\n      | ((s: string) => Promise<string>)\n      | undefined;\n    if (!hashSecretFn) {\n      return yield* Fx.fail(\n        new AuthError(\n          \"MISSING_CRYPTO_FUNCTION\",\n          `Provider ${provider.id} does not have a \\`crypto.hashSecret\\` function`,\n        ),\n      );\n    }\n\n    return yield* Fx.from({\n      ok: () => hashSecretFn(secret),\n      err: (e) =>\n        new AuthError(\"INTERNAL_ERROR\", `Hash failed: ${errorMessage(e)}`),\n    });\n  });\n\n/**\n * Verify a secret against a hash using the provider's `crypto.verifySecret` function.\n */\nexport const verify = (\n  provider: AuthProviderMaterializedConfig,\n  secret: string,\n  hashValue: string,\n): Fx<boolean, AuthError> =>\n  Fx.gen(function* () {\n    if (provider.type !== \"credentials\") {\n      return yield* Fx.fail(\n        new AuthError(\n          \"INVALID_CREDENTIALS_PROVIDER\",\n          `Provider ${provider.id} is not a credentials provider`,\n        ),\n      );\n    }\n\n    const verifySecretFn = (provider as any).crypto?.verifySecret as\n      | ((s: string, h: string) => Promise<boolean>)\n      | undefined;\n    if (!verifySecretFn) {\n      return yield* Fx.fail(\n        new AuthError(\n          \"MISSING_CRYPTO_FUNCTION\",\n          `Provider ${provider.id} does not have a \\`crypto.verifySecret\\` function`,\n        ),\n      );\n    }\n\n    return yield* Fx.from({\n      ok: () => verifySecretFn(secret, hashValue),\n      err: (e) =>\n        new AuthError(\"INTERNAL_ERROR\", `Verify failed: ${errorMessage(e)}`),\n    });\n  });\n\nexport type GetProviderOrThrowFunc = (\n  provider: string,\n  allowExtraProviders?: boolean,\n) => AuthProviderMaterializedConfig;\n\nexport type Config = ConvexAuthMaterializedConfig;\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,QAAQ,UAAe,WAClC,GAAG,IAAI,aAAa;AAClB,KAAI,SAAS,SAAS,cACpB,QAAO,OAAO,GAAG,KACf,IAAI,UACF,gCACA,YAAY,SAAS,GAAG,gCACzB,CACF;CAGH,MAAM,eAAe,SAAS,QAAQ;AAGtC,KAAI,CAAC,aACH,QAAO,OAAO,GAAG,KACf,IAAI,UACF,2BACA,YAAY,SAAS,GAAG,iDACzB,CACF;AAGH,QAAO,OAAO,GAAG,KAAK;EACpB,UAAU,aAAa,OAAO;EAC9B,MAAM,MACJ,IAAI,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,GAAG;EACrE,CAAC;EACF;;;;AAKJ,MAAa,UACX,UACA,QACA,cAEA,GAAG,IAAI,aAAa;AAClB,KAAI,SAAS,SAAS,cACpB,QAAO,OAAO,GAAG,KACf,IAAI,UACF,gCACA,YAAY,SAAS,GAAG,gCACzB,CACF;CAGH,MAAM,iBAAkB,SAAiB,QAAQ;AAGjD,KAAI,CAAC,eACH,QAAO,OAAO,GAAG,KACf,IAAI,UACF,2BACA,YAAY,SAAS,GAAG,mDACzB,CACF;AAGH,QAAO,OAAO,GAAG,KAAK;EACpB,UAAU,eAAe,QAAQ,UAAU;EAC3C,MAAM,MACJ,IAAI,UAAU,kBAAkB,kBAAkB,aAAa,EAAE,GAAG;EACvE,CAAC;EACF"}
+{"version":3,"file":"provider.js","names":[],"sources":["../../src/server/provider.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { AuthError } from \"./fx\";\nimport { AuthProviderMaterializedConfig } from \"./types\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\n/**\n * Hash a secret using the provider's `crypto.hashSecret` function.\n *\n * Validates that the provider is a credentials provider and has the\n * required crypto function, returning typed errors through the Fx channel.\n */\n/** @internal */\nexport const hash = (provider: any, secret: string): Fx<string, AuthError> =>\n  Fx.gen(function* () {\n    if (provider.type !== \"credentials\") {\n      return yield* Fx.fail(\n        new AuthError(\n          \"INVALID_CREDENTIALS_PROVIDER\",\n          `Provider ${provider.id} is not a credentials provider`,\n        ),\n      );\n    }\n\n    const hashSecretFn = provider.crypto?.hashSecret as\n      | ((s: string) => Promise<string>)\n      | undefined;\n    if (!hashSecretFn) {\n      return yield* Fx.fail(\n        new AuthError(\n          \"MISSING_CRYPTO_FUNCTION\",\n          `Provider ${provider.id} does not have a \\`crypto.hashSecret\\` function`,\n        ),\n      );\n    }\n\n    return yield* Fx.from({\n      ok: () => hashSecretFn(secret),\n      err: (e) =>\n        new AuthError(\"INTERNAL_ERROR\", `Hash failed: ${errorMessage(e)}`),\n    });\n  });\n\n/**\n * Verify a secret against a hash using the provider's `crypto.verifySecret` function.\n */\n/** @internal */\nexport const verify = (\n  provider: AuthProviderMaterializedConfig,\n  secret: string,\n  hashValue: string,\n): Fx<boolean, AuthError> =>\n  Fx.gen(function* () {\n    if (provider.type !== \"credentials\") {\n      return yield* Fx.fail(\n        new AuthError(\n          \"INVALID_CREDENTIALS_PROVIDER\",\n          `Provider ${provider.id} is not a credentials provider`,\n        ),\n      );\n    }\n\n    const verifySecretFn = (provider as any).crypto?.verifySecret as\n      | ((s: string, h: string) => Promise<boolean>)\n      | undefined;\n    if (!verifySecretFn) {\n      return yield* Fx.fail(\n        new AuthError(\n          \"MISSING_CRYPTO_FUNCTION\",\n          `Provider ${provider.id} does not have a \\`crypto.verifySecret\\` function`,\n        ),\n      );\n    }\n\n    return yield* Fx.from({\n      ok: () => verifySecretFn(secret, hashValue),\n      err: (e) =>\n        new AuthError(\"INTERNAL_ERROR\", `Verify failed: ${errorMessage(e)}`),\n    });\n  });\n\nexport type GetProviderOrThrowFunc = (\n  provider: string,\n  allowExtraProviders?: boolean,\n) => AuthProviderMaterializedConfig;\n\nexport type Config = ConvexAuthMaterializedConfig;\n"],"mappings":";;;;;;;;;;;;AAcA,MAAa,QAAQ,UAAe,WAClC,GAAG,IAAI,aAAa;AAClB,KAAI,SAAS,SAAS,cACpB,QAAO,OAAO,GAAG,KACf,IAAI,UACF,gCACA,YAAY,SAAS,GAAG,gCACzB,CACF;CAGH,MAAM,eAAe,SAAS,QAAQ;AAGtC,KAAI,CAAC,aACH,QAAO,OAAO,GAAG,KACf,IAAI,UACF,2BACA,YAAY,SAAS,GAAG,iDACzB,CACF;AAGH,QAAO,OAAO,GAAG,KAAK;EACpB,UAAU,aAAa,OAAO;EAC9B,MAAM,MACJ,IAAI,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,GAAG;EACrE,CAAC;EACF;;;;;AAMJ,MAAa,UACX,UACA,QACA,cAEA,GAAG,IAAI,aAAa;AAClB,KAAI,SAAS,SAAS,cACpB,QAAO,OAAO,GAAG,KACf,IAAI,UACF,gCACA,YAAY,SAAS,GAAG,gCACzB,CACF;CAGH,MAAM,iBAAkB,SAAiB,QAAQ;AAGjD,KAAI,CAAC,eACH,QAAO,OAAO,GAAG,KACf,IAAI,UACF,2BACA,YAAY,SAAS,GAAG,mDACzB,CACF;AAGH,QAAO,OAAO,GAAG,KAAK;EACpB,UAAU,eAAe,QAAQ,UAAU;EAC3C,MAAM,MACJ,IAAI,UAAU,kBAAkB,kBAAkB,aAAa,EAAE,GAAG;EACvE,CAAC;EACF"}

package/dist/server/providers.js

@@ -10,11 +10,13 @@ function isClassProvider(provider) {
 *
 * @internal
 */
+/** @internal */
 function configDefaults(config_) {
 	const config = materializeAndDefaultProviders(config_);
 	const extraProviders = config.providers.filter((p) => p.type === "credentials").map((p) => p.extraProviders).flat().filter((p) => p !== void 0);
 	return {
 		...config,
+		authorization: normalizeAuthorizationConfig(config.authorization),
 		extraProviders: materializeProviders(extraProviders)
 	};
 }
@@ -23,6 +25,7 @@ function configDefaults(config_) {
 *
 * @internal
 */
+/** @internal */
 function materializeProvider(provider) {
 	const config = {
 		providers: [provider],
@@ -36,6 +39,7 @@ function materializeProvider(provider) {
 *
 * @internal
 */
+/** @internal */
 function listAvailableProviders(config, allowExtraProviders) {
 	const availableProviders = config.providers.concat(allowExtraProviders ? config.extraProviders : []).map((provider) => `\`${provider.id}\``);
 	return availableProviders.length > 0 ? availableProviders.join(", ") : "no providers have been configured";
@@ -93,6 +97,12 @@ function materializeAndDefaultProviders(config_) {
 	});
 	return config;
 }
+function normalizeAuthorizationConfig(authorization) {
+	return { roles: Object.fromEntries(Object.entries(authorization?.roles ?? {}).map(([roleId, role]) => [roleId, {
+		...role.label ? { label: role.label } : {},
+		grants: Array.from(new Set(role.grants)).sort()
+	}])) };
+}
 /**
 * Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.
 */

package/dist/server/providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"providers.js","names":[],"sources":["../../src/server/providers.ts"],"sourcesContent":["import {\n  isOAuthProvider,\n  type OAuthProviderInstance,\n} from \"../providers/oauth\";\nimport {\n  AuthProviderConfig,\n  AuthProviderMaterializedConfig,\n  ConvexAuthConfig,\n  OAuthMaterializedConfig,\n} from \"./types\";\n\n// ============================================================================\n// Provider class detection\n// ============================================================================\n\n/** Check if something is a new-style class provider with `_toMaterialized()`. */\nfunction isClassProvider(\n  provider: any,\n): provider is { _toMaterialized(): AuthProviderMaterializedConfig } {\n  return (\n    typeof provider === \"object\" &&\n    provider !== null &&\n    typeof provider._toMaterialized === \"function\"\n  );\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Resolve raw provider configs into materialized form and apply defaults.\n *\n * @internal\n */\nexport function configDefaults(config_: ConvexAuthConfig) {\n  const config = materializeAndDefaultProviders(config_);\n  // Collect extra providers from credentials providers\n  const extraProviders = config.providers\n    .filter((p) => p.type === \"credentials\")\n    .map((p) => p.extraProviders)\n    .flat()\n    .filter((p) => p !== undefined);\n  return {\n    ...config,\n    extraProviders: materializeProviders(extraProviders),\n  };\n}\n\n/**\n * Materialize a single provider config into its runtime form.\n *\n * @internal\n */\nexport function materializeProvider(provider: AuthProviderConfig) {\n  const config = { providers: [provider], component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers[0] as AuthProviderMaterializedConfig;\n}\n\n/**\n * List available provider IDs for error messages.\n *\n * @internal\n */\nexport function listAvailableProviders(\n  config: ReturnType<typeof configDefaults>,\n  allowExtraProviders: boolean,\n) {\n  const availableProviders = config.providers\n    .concat(allowExtraProviders ? config.extraProviders : [])\n    .map((provider) => `\\`${provider.id}\\``);\n  return availableProviders.length > 0\n    ? availableProviders.join(\", \")\n    : \"no providers have been configured\";\n}\n\n// ============================================================================\n// Internal helpers\n// ============================================================================\n\nfunction materializeProviders(providers: AuthProviderConfig[]) {\n  const config = { providers, component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers as AuthProviderMaterializedConfig[];\n}\n\ntype ProviderMaterializationDispatch =\n  | { tag: \"oauth\"; raw: OAuthProviderInstance }\n  | {\n      tag: \"class\";\n      raw: { _toMaterialized(): AuthProviderMaterializedConfig };\n    }\n  | { tag: \"factoryOrObject\"; raw: AuthProviderConfig };\n\ntype ProviderMaterializationHandlers<T> = {\n  oauth: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"oauth\" }>,\n  ) => T;\n  class: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"class\" }>,\n  ) => T;\n  factoryOrObject: (\n    dispatch: Extract<\n      ProviderMaterializationDispatch,\n      { tag: \"factoryOrObject\" }\n    >,\n  ) => T;\n};\n\nfunction decodeProviderMaterializationDispatch(\n  raw: AuthProviderConfig,\n): ProviderMaterializationDispatch {\n  if (isOAuthProvider(raw)) {\n    return { tag: \"oauth\", raw };\n  }\n  if (isClassProvider(raw)) {\n    return { tag: \"class\", raw };\n  }\n  return { tag: \"factoryOrObject\", raw };\n}\n\nfunction matchProviderMaterializationDispatch<T>(\n  dispatch: ProviderMaterializationDispatch,\n  handlers: ProviderMaterializationHandlers<T>,\n): T {\n  return (\n    handlers[dispatch.tag] as (dispatch: ProviderMaterializationDispatch) => T\n  )(dispatch);\n}\n\nfunction materializeProviderConfig(raw: AuthProviderConfig) {\n  const dispatch = decodeProviderMaterializationDispatch(raw);\n  return matchProviderMaterializationDispatch(dispatch, {\n    oauth: (d) => materializeOAuthProvider(d.raw),\n    class: (d) => d.raw._toMaterialized(),\n    factoryOrObject: (d) => {\n      const resolved = typeof d.raw === \"function\" ? d.raw() : (d.raw as any);\n      const merged = resolved.options\n        ? { ...resolved, ...resolved.options }\n        : resolved;\n      return merged as AuthProviderMaterializedConfig;\n    },\n  });\n}\n\nfunction materializeAndDefaultProviders(config_: ConvexAuthConfig) {\n  const allProviders: AuthProviderMaterializedConfig[] = [];\n\n  for (const raw of config_.providers) {\n    allProviders.push(materializeProviderConfig(raw));\n  }\n\n  const config = { ...config_, providers: allProviders };\n\n  // Set phone provider API key from env\n  config.providers.forEach((provider) => {\n    if (provider.type === \"phone\") {\n      const ID = provider.id.toUpperCase().replace(/-/g, \"_\");\n      provider.apiKey ??= process.env[`AUTH_${ID}_KEY`];\n    }\n  });\n\n  return config;\n}\n\n/**\n * Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.\n */\nfunction materializeOAuthProvider(\n  instance: OAuthProviderInstance,\n): OAuthMaterializedConfig {\n  return {\n    id: instance.id,\n    type: \"oauth\",\n    provider: instance.provider,\n    scopes: instance.scopes,\n    profile: instance.profile,\n  };\n}\n"],"mappings":";;;;AAgBA,SAAS,gBACP,UACmE;AACnE,QACE,OAAO,aAAa,YACpB,aAAa,QACb,OAAO,SAAS,oBAAoB;;;;;;;AAaxC,SAAgB,eAAe,SAA2B;CACxD,MAAM,SAAS,+BAA+B,QAAQ;CAEtD,MAAM,iBAAiB,OAAO,UAC3B,QAAQ,MAAM,EAAE,SAAS,cAAc,CACvC,KAAK,MAAM,EAAE,eAAe,CAC5B,MAAM,CACN,QAAQ,MAAM,MAAM,OAAU;AACjC,QAAO;EACL,GAAG;EACH,gBAAgB,qBAAqB,eAAe;EACrD;;;;;;;AAQH,SAAgB,oBAAoB,UAA8B;CAChE,MAAM,SAAS;EAAE,WAAW,CAAC,SAAS;EAAE,WAAW,EAAE;EAAS;AAC9D,gCAA+B,OAAO;AACtC,QAAO,OAAO,UAAU;;;;;;;AAQ1B,SAAgB,uBACd,QACA,qBACA;CACA,MAAM,qBAAqB,OAAO,UAC/B,OAAO,sBAAsB,OAAO,iBAAiB,EAAE,CAAC,CACxD,KAAK,aAAa,KAAK,SAAS,GAAG,IAAI;AAC1C,QAAO,mBAAmB,SAAS,IAC/B,mBAAmB,KAAK,KAAK,GAC7B;;AAON,SAAS,qBAAqB,WAAiC;CAC7D,MAAM,SAAS;EAAE;EAAW,WAAW,EAAE;EAAS;AAClD,gCAA+B,OAAO;AACtC,QAAO,OAAO;;AA0BhB,SAAS,sCACP,KACiC;AACjC,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,QAAO;EAAE,KAAK;EAAmB;EAAK;;AAGxC,SAAS,qCACP,UACA,UACG;AACH,QACE,SAAS,SAAS,KAClB,SAAS;;AAGb,SAAS,0BAA0B,KAAyB;AAE1D,QAAO,qCADU,sCAAsC,IAAI,EACL;EACpD,QAAQ,MAAM,yBAAyB,EAAE,IAAI;EAC7C,QAAQ,MAAM,EAAE,IAAI,iBAAiB;EACrC,kBAAkB,MAAM;GACtB,MAAM,WAAW,OAAO,EAAE,QAAQ,aAAa,EAAE,KAAK,GAAI,EAAE;AAI5D,UAHe,SAAS,UACpB;IAAE,GAAG;IAAU,GAAG,SAAS;IAAS,GACpC;;EAGP,CAAC;;AAGJ,SAAS,+BAA+B,SAA2B;CACjE,MAAM,eAAiD,EAAE;AAEzD,MAAK,MAAM,OAAO,QAAQ,UACxB,cAAa,KAAK,0BAA0B,IAAI,CAAC;CAGnD,MAAM,SAAS;EAAE,GAAG;EAAS,WAAW;EAAc;AAGtD,QAAO,UAAU,SAAS,aAAa;AACrC,MAAI,SAAS,SAAS,SAAS;GAC7B,MAAM,KAAK,SAAS,GAAG,aAAa,CAAC,QAAQ,MAAM,IAAI;AACvD,YAAS,WAAW,QAAQ,IAAI,QAAQ,GAAG;;GAE7C;AAEF,QAAO;;;;;AAMT,SAAS,yBACP,UACyB;AACzB,QAAO;EACL,IAAI,SAAS;EACb,MAAM;EACN,UAAU,SAAS;EACnB,QAAQ,SAAS;EACjB,SAAS,SAAS;EACnB"}
+{"version":3,"file":"providers.js","names":[],"sources":["../../src/server/providers.ts"],"sourcesContent":["import {\n  isOAuthProvider,\n  type OAuthProviderInstance,\n} from \"../providers/oauth\";\nimport {\n  AuthAuthorizationConfig,\n  AuthProviderConfig,\n  AuthProviderMaterializedConfig,\n  ConvexAuthConfig,\n  OAuthMaterializedConfig,\n} from \"./types\";\n\n// ============================================================================\n// Provider class detection\n// ============================================================================\n\n/** Check if something is a new-style class provider with `_toMaterialized()`. */\nfunction isClassProvider(\n  provider: any,\n): provider is { _toMaterialized(): AuthProviderMaterializedConfig } {\n  return (\n    typeof provider === \"object\" &&\n    provider !== null &&\n    typeof provider._toMaterialized === \"function\"\n  );\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Resolve raw provider configs into materialized form and apply defaults.\n *\n * @internal\n */\n/** @internal */\nexport function configDefaults(config_: ConvexAuthConfig) {\n  const config = materializeAndDefaultProviders(config_);\n  // Collect extra providers from credentials providers\n  const extraProviders = config.providers\n    .filter((p) => p.type === \"credentials\")\n    .map((p) => p.extraProviders)\n    .flat()\n    .filter((p) => p !== undefined);\n  return {\n    ...config,\n    authorization: normalizeAuthorizationConfig(config.authorization),\n    extraProviders: materializeProviders(extraProviders),\n  };\n}\n\n/**\n * Materialize a single provider config into its runtime form.\n *\n * @internal\n */\n/** @internal */\nexport function materializeProvider(provider: AuthProviderConfig) {\n  const config = { providers: [provider], component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers[0] as AuthProviderMaterializedConfig;\n}\n\n/**\n * List available provider IDs for error messages.\n *\n * @internal\n */\n/** @internal */\nexport function listAvailableProviders(\n  config: ReturnType<typeof configDefaults>,\n  allowExtraProviders: boolean,\n) {\n  const availableProviders = config.providers\n    .concat(allowExtraProviders ? config.extraProviders : [])\n    .map((provider) => `\\`${provider.id}\\``);\n  return availableProviders.length > 0\n    ? availableProviders.join(\", \")\n    : \"no providers have been configured\";\n}\n\n// ============================================================================\n// Internal helpers\n// ============================================================================\n\nfunction materializeProviders(providers: AuthProviderConfig[]) {\n  const config = { providers, component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers as AuthProviderMaterializedConfig[];\n}\n\ntype ProviderMaterializationDispatch =\n  | { tag: \"oauth\"; raw: OAuthProviderInstance }\n  | {\n      tag: \"class\";\n      raw: { _toMaterialized(): AuthProviderMaterializedConfig };\n    }\n  | { tag: \"factoryOrObject\"; raw: AuthProviderConfig };\n\ntype ProviderMaterializationHandlers<T> = {\n  oauth: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"oauth\" }>,\n  ) => T;\n  class: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"class\" }>,\n  ) => T;\n  factoryOrObject: (\n    dispatch: Extract<\n      ProviderMaterializationDispatch,\n      { tag: \"factoryOrObject\" }\n    >,\n  ) => T;\n};\n\nfunction decodeProviderMaterializationDispatch(\n  raw: AuthProviderConfig,\n): ProviderMaterializationDispatch {\n  if (isOAuthProvider(raw)) {\n    return { tag: \"oauth\", raw };\n  }\n  if (isClassProvider(raw)) {\n    return { tag: \"class\", raw };\n  }\n  return { tag: \"factoryOrObject\", raw };\n}\n\nfunction matchProviderMaterializationDispatch<T>(\n  dispatch: ProviderMaterializationDispatch,\n  handlers: ProviderMaterializationHandlers<T>,\n): T {\n  return (\n    handlers[dispatch.tag] as (dispatch: ProviderMaterializationDispatch) => T\n  )(dispatch);\n}\n\nfunction materializeProviderConfig(raw: AuthProviderConfig) {\n  const dispatch = decodeProviderMaterializationDispatch(raw);\n  return matchProviderMaterializationDispatch(dispatch, {\n    oauth: (d) => materializeOAuthProvider(d.raw),\n    class: (d) => d.raw._toMaterialized(),\n    factoryOrObject: (d) => {\n      const resolved = typeof d.raw === \"function\" ? d.raw() : (d.raw as any);\n      const merged = resolved.options\n        ? { ...resolved, ...resolved.options }\n        : resolved;\n      return merged as AuthProviderMaterializedConfig;\n    },\n  });\n}\n\nfunction materializeAndDefaultProviders(config_: ConvexAuthConfig) {\n  const allProviders: AuthProviderMaterializedConfig[] = [];\n\n  for (const raw of config_.providers) {\n    allProviders.push(materializeProviderConfig(raw));\n  }\n\n  const config = { ...config_, providers: allProviders };\n\n  // Set phone provider API key from env\n  config.providers.forEach((provider) => {\n    if (provider.type === \"phone\") {\n      const ID = provider.id.toUpperCase().replace(/-/g, \"_\");\n      provider.apiKey ??= process.env[`AUTH_${ID}_KEY`];\n    }\n  });\n\n  return config;\n}\n\nfunction normalizeAuthorizationConfig(\n  authorization: ConvexAuthConfig[\"authorization\"],\n): AuthAuthorizationConfig {\n  const roles = Object.fromEntries(\n    Object.entries(authorization?.roles ?? {}).map(([roleId, role]) => [\n      roleId,\n      {\n        ...(role.label ? { label: role.label } : {}),\n        grants: Array.from(new Set(role.grants)).sort(),\n      },\n    ]),\n  );\n  return { roles };\n}\n\n/**\n * Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.\n */\nfunction materializeOAuthProvider(\n  instance: OAuthProviderInstance,\n): OAuthMaterializedConfig {\n  return {\n    id: instance.id,\n    type: \"oauth\",\n    provider: instance.provider,\n    scopes: instance.scopes,\n    profile: instance.profile,\n  };\n}\n"],"mappings":";;;;AAiBA,SAAS,gBACP,UACmE;AACnE,QACE,OAAO,aAAa,YACpB,aAAa,QACb,OAAO,SAAS,oBAAoB;;;;;;;;AAcxC,SAAgB,eAAe,SAA2B;CACxD,MAAM,SAAS,+BAA+B,QAAQ;CAEtD,MAAM,iBAAiB,OAAO,UAC3B,QAAQ,MAAM,EAAE,SAAS,cAAc,CACvC,KAAK,MAAM,EAAE,eAAe,CAC5B,MAAM,CACN,QAAQ,MAAM,MAAM,OAAU;AACjC,QAAO;EACL,GAAG;EACH,eAAe,6BAA6B,OAAO,cAAc;EACjE,gBAAgB,qBAAqB,eAAe;EACrD;;;;;;;;AASH,SAAgB,oBAAoB,UAA8B;CAChE,MAAM,SAAS;EAAE,WAAW,CAAC,SAAS;EAAE,WAAW,EAAE;EAAS;AAC9D,gCAA+B,OAAO;AACtC,QAAO,OAAO,UAAU;;;;;;;;AAS1B,SAAgB,uBACd,QACA,qBACA;CACA,MAAM,qBAAqB,OAAO,UAC/B,OAAO,sBAAsB,OAAO,iBAAiB,EAAE,CAAC,CACxD,KAAK,aAAa,KAAK,SAAS,GAAG,IAAI;AAC1C,QAAO,mBAAmB,SAAS,IAC/B,mBAAmB,KAAK,KAAK,GAC7B;;AAON,SAAS,qBAAqB,WAAiC;CAC7D,MAAM,SAAS;EAAE;EAAW,WAAW,EAAE;EAAS;AAClD,gCAA+B,OAAO;AACtC,QAAO,OAAO;;AA0BhB,SAAS,sCACP,KACiC;AACjC,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,QAAO;EAAE,KAAK;EAAmB;EAAK;;AAGxC,SAAS,qCACP,UACA,UACG;AACH,QACE,SAAS,SAAS,KAClB,SAAS;;AAGb,SAAS,0BAA0B,KAAyB;AAE1D,QAAO,qCADU,sCAAsC,IAAI,EACL;EACpD,QAAQ,MAAM,yBAAyB,EAAE,IAAI;EAC7C,QAAQ,MAAM,EAAE,IAAI,iBAAiB;EACrC,kBAAkB,MAAM;GACtB,MAAM,WAAW,OAAO,EAAE,QAAQ,aAAa,EAAE,KAAK,GAAI,EAAE;AAI5D,UAHe,SAAS,UACpB;IAAE,GAAG;IAAU,GAAG,SAAS;IAAS,GACpC;;EAGP,CAAC;;AAGJ,SAAS,+BAA+B,SAA2B;CACjE,MAAM,eAAiD,EAAE;AAEzD,MAAK,MAAM,OAAO,QAAQ,UACxB,cAAa,KAAK,0BAA0B,IAAI,CAAC;CAGnD,MAAM,SAAS;EAAE,GAAG;EAAS,WAAW;EAAc;AAGtD,QAAO,UAAU,SAAS,aAAa;AACrC,MAAI,SAAS,SAAS,SAAS;GAC7B,MAAM,KAAK,SAAS,GAAG,aAAa,CAAC,QAAQ,MAAM,IAAI;AACvD,YAAS,WAAW,QAAQ,IAAI,QAAQ,GAAG;;GAE7C;AAEF,QAAO;;AAGT,SAAS,6BACP,eACyB;AAUzB,QAAO,EAAE,OATK,OAAO,YACnB,OAAO,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,UAAU,CACjE,QACA;EACE,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;EAC3C,QAAQ,MAAM,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;EAChD,CACF,CAAC,CACH,EACe;;;;;AAMlB,SAAS,yBACP,UACyB;AACzB,QAAO;EACL,IAAI,SAAS;EACb,MAAM;EACN,UAAU,SAAS;EACnB,QAAQ,SAAS;EACjB,SAAS,SAAS;EACnB"}

package/dist/server/ratelimit.d.ts

@@ -1,22 +1 @@
-import { ConvexAuthConfig, MutationCtx } from "./types.js";
-import { AuthError } from "./fx.js";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/ratelimit.d.ts
-/**
- * Check whether the given identifier is currently rate-limited.
- */
-declare const isSignInRateLimited: (ctx: MutationCtx, identifier: string, config: ConvexAuthConfig) => Fx<boolean, AuthError>;
-/**
- * Record a failed sign-in attempt for the given identifier.
- *
- * If a record exists, decrement; otherwise create.
- */
-declare const recordFailedSignIn: (ctx: MutationCtx, identifier: string, config: ConvexAuthConfig) => Fx<void, AuthError>;
-/**
- * Reset the rate limit for the given identifier (e.g. after successful sign-in).
- */
-declare const resetSignInRateLimit: (ctx: MutationCtx, identifier: string, config: ConvexAuthConfig) => Fx<void, AuthError>;
-//#endregion
-export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };
-//# sourceMappingURL=ratelimit.d.ts.map
+export { };

package/dist/server/ratelimit.js

@@ -8,12 +8,14 @@ const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /**
 * Check whether the given identifier is currently rate-limited.
 */
+/** @internal */
 const isSignInRateLimited = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.map((state) => state !== null && state.attemptsLeft < 1));
 /**
 * Record a failed sign-in attempt for the given identifier.
 *
 * If a record exists, decrement; otherwise create.
 */
+/** @internal */
 const recordFailedSignIn = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.chain((state) => state !== null ? Fx.from({
 	ok: () => authDb(ctx, config).rateLimits.patch(state.limit._id, {
 		attemptsLeft: state.attemptsLeft - 1,
@@ -31,6 +33,7 @@ const recordFailedSignIn = (ctx, identifier, config) => getRateLimitState(ctx, i
 /**
 * Reset the rate limit for the given identifier (e.g. after successful sign-in).
 */
+/** @internal */
 const resetSignInRateLimit = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.chain((state) => state !== null ? Fx.from({
 	ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),
 	err: (e) => new AuthError("INTERNAL_ERROR", `Failed to delete rate limit: ${errorMessage(e)}`)

package/dist/server/ratelimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"ratelimit.js","names":[],"sources":["../../src/server/ratelimit.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.patch(state.limit._id, {\n                attemptsLeft: state.attemptsLeft - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to patch rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.create({\n                identifier,\n                attemptsLeft:\n                  (config.signIn?.maxFailedAttemptsPerHour ??\n                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to create rate limit: ${errorMessage(e)}`,\n              ),\n          }),\n    ),\n    Fx.map(() => undefined),\n  );\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to delete rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.unit,\n    ),\n  );\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, AuthError> => {\n  const now = Date.now();\n  const maxAttemptsPerHour =\n    config.signIn?.maxFailedAttemptsPerHour ??\n    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n  return Fx.from({\n    ok: () => authDb(ctx, config).rateLimits.get(identifier),\n    err: (e) =>\n      new AuthError(\n        \"INTERNAL_ERROR\",\n        `Failed to get rate limit: ${errorMessage(e)}`,\n      ),\n  }).pipe(\n    Fx.map((raw) => {\n      const limit = raw as\n        | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n        | null;\n      if (limit === null) return null;\n      const elapsed = now - limit.lastAttemptTime;\n      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n      const attemptsLeft = Math.min(\n        maxAttemptsPerHour,\n        limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n      );\n      return { limit, attemptsLeft };\n    }),\n  );\n};\n"],"mappings":";;;;;;AAQA,MAAM,wCAAwC;;;;AAK9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;AAOH,MAAa,sBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,+BAA+B,aAAa,EAAE,GAC/C;CACJ,CAAC,GACF,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,CACP,EACD,GAAG,UAAU,OAAU,CACxB;;;;AAKH,MAAa,wBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI;CAChE,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,GACF,GAAG,KACR,CACF;AAWH,MAAM,qBACJ,KACA,YACA,WACkC;CAClC,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;AAEF,QAAO,GAAG,KAAK;EACb,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW;EACxD,MAAM,MACJ,IAAI,UACF,kBACA,6BAA6B,aAAa,EAAE,GAC7C;EACJ,CAAC,CAAC,KACD,GAAG,KAAK,QAAQ;EACd,MAAM,QAAQ;AAGd,MAAI,UAAU,KAAM,QAAO;EAC3B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,SAAO;GAAE;GAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;GAC6B;GAC9B,CACH"}
+{"version":3,"file":"ratelimit.js","names":[],"sources":["../../src/server/ratelimit.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\n/** @internal */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\n/** @internal */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.patch(state.limit._id, {\n                attemptsLeft: state.attemptsLeft - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to patch rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.create({\n                identifier,\n                attemptsLeft:\n                  (config.signIn?.maxFailedAttemptsPerHour ??\n                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to create rate limit: ${errorMessage(e)}`,\n              ),\n          }),\n    ),\n    Fx.map(() => undefined),\n  );\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\n/** @internal */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to delete rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.unit,\n    ),\n  );\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, AuthError> => {\n  const now = Date.now();\n  const maxAttemptsPerHour =\n    config.signIn?.maxFailedAttemptsPerHour ??\n    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n  return Fx.from({\n    ok: () => authDb(ctx, config).rateLimits.get(identifier),\n    err: (e) =>\n      new AuthError(\n        \"INTERNAL_ERROR\",\n        `Failed to get rate limit: ${errorMessage(e)}`,\n      ),\n  }).pipe(\n    Fx.map((raw) => {\n      const limit = raw as\n        | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n        | null;\n      if (limit === null) return null;\n      const elapsed = now - limit.lastAttemptTime;\n      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n      const attemptsLeft = Math.min(\n        maxAttemptsPerHour,\n        limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n      );\n      return { limit, attemptsLeft };\n    }),\n  );\n};\n"],"mappings":";;;;;;AAQA,MAAM,wCAAwC;;;;;AAM9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;;AAQH,MAAa,sBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,+BAA+B,aAAa,EAAE,GAC/C;CACJ,CAAC,GACF,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,CACP,EACD,GAAG,UAAU,OAAU,CACxB;;;;;AAMH,MAAa,wBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI;CAChE,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,GACF,GAAG,KACR,CACF;AAWH,MAAM,qBACJ,KACA,YACA,WACkC;CAClC,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;AAEF,QAAO,GAAG,KAAK;EACb,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW;EACxD,MAAM,MACJ,IAAI,UACF,kBACA,6BAA6B,aAAa,EAAE,GAC7C;EACJ,CAAC,CAAC,KACD,GAAG,KAAK,QAAQ;EACd,MAAM,QAAQ;AAGd,MAAI,UAAU,KAAM,QAAO;EAC3B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,SAAO;GAAE;GAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;GAC6B;GAC9B,CACH"}

package/dist/server/redirects.d.ts

@@ -1,10 +1 @@
-import { ConvexAuthMaterializedConfig } from "./types.js";
-
-//#region src/server/redirects.d.ts
-declare function redirectAbsoluteUrl(config: ConvexAuthMaterializedConfig, params: {
-  redirectTo: unknown;
-}): Promise<string>;
-declare function setURLSearchParam(absoluteUrl: string, param: string, value: string): string;
-//#endregion
-export { redirectAbsoluteUrl, setURLSearchParam };
-//# sourceMappingURL=redirects.d.ts.map
+export { };

package/dist/server/redirects.js

@@ -2,6 +2,7 @@ import { AuthError } from "./fx.js";
 import { requireEnv } from "./utils.js";
 
 //#region src/server/redirects.ts
+/** @internal */
 async function redirectAbsoluteUrl(config, params) {
 	if (params.redirectTo === void 0) return requireEnv("SITE_URL").replace(/\/$/, "");
 	if (typeof params.redirectTo !== "string") throw new AuthError("INVALID_REDIRECT", `Expected \`redirectTo\` to be a string, got ${params.redirectTo}`);
@@ -16,6 +17,7 @@ async function defaultRedirectCallback({ redirectTo }) {
 	if (redirectTo.startsWith("?") || redirectTo.startsWith("/")) return `${requireEnv("SITE_URL").replace(/\/$/, "")}${redirectTo}`;
 	return redirectTo;
 }
+/** @internal */
 function setURLSearchParam(absoluteUrl, param, value) {
 	const pattern = /([^:]+):(.*)/;
 	const [, scheme, rest] = absoluteUrl.match(pattern);

package/dist/server/redirects.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirects.js","names":[],"sources":["../../src/server/redirects.ts"],"sourcesContent":["import { AuthError } from \"./fx\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { requireEnv } from \"./utils\";\n\nexport async function redirectAbsoluteUrl(\n  config: ConvexAuthMaterializedConfig,\n  params: { redirectTo: unknown },\n) {\n  if (params.redirectTo === undefined) {\n    return requireEnv(\"SITE_URL\").replace(/\\/$/, \"\");\n  }\n  if (typeof params.redirectTo !== \"string\") {\n    throw new AuthError(\n      \"INVALID_REDIRECT\",\n      `Expected \\`redirectTo\\` to be a string, got ${params.redirectTo as any}`,\n    );\n  }\n  const redirectCallback =\n    config.callbacks?.redirect ?? defaultRedirectCallback;\n  try {\n    return await redirectCallback({ redirectTo: params.redirectTo });\n  } catch {\n    throw new AuthError(\"INTERNAL_ERROR\");\n  }\n}\n\nasync function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {\n  // Resolve relative paths against SITE_URL; absolute URLs are passed through\n  // as-is. The developer is trusted to provide valid redirect targets.\n  if (redirectTo.startsWith(\"?\") || redirectTo.startsWith(\"/\")) {\n    return `${requireEnv(\"SITE_URL\").replace(/\\/$/, \"\")}${redirectTo}`;\n  }\n  return redirectTo;\n}\n\n// Temporary work-around because Convex doesn't support\n// schemes other than http and https.\nexport function setURLSearchParam(\n  absoluteUrl: string,\n  param: string,\n  value: string,\n) {\n  const pattern = /([^:]+):(.*)/;\n  const [, scheme, rest] = absoluteUrl.match(pattern)!;\n  const hasNoDomain = /^\\/\\/(?:\\/|$|\\?)/.test(rest);\n  const startsWithPath = hasNoDomain && rest.startsWith(\"///\");\n  const url = new URL(\n    `http:${hasNoDomain ? \"//googblibok\" + rest.slice(2) : rest}`,\n  );\n  url.searchParams.set(param, value);\n  const [, , withParam] = url.toString().match(pattern)!;\n  return `${scheme}:${hasNoDomain ? (startsWithPath ? \"/\" : \"\") + \"//\" + withParam.slice(13) : withParam}`;\n}\n"],"mappings":";;;;AAIA,eAAsB,oBACpB,QACA,QACA;AACA,KAAI,OAAO,eAAe,OACxB,QAAO,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG;AAElD,KAAI,OAAO,OAAO,eAAe,SAC/B,OAAM,IAAI,UACR,oBACA,+CAA+C,OAAO,aACvD;CAEH,MAAM,mBACJ,OAAO,WAAW,YAAY;AAChC,KAAI;AACF,SAAO,MAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,CAAC;SAC1D;AACN,QAAM,IAAI,UAAU,iBAAiB;;;AAIzC,eAAe,wBAAwB,EAAE,cAAsC;AAG7E,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,IAAI,CAC1D,QAAO,GAAG,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG,GAAG;AAExD,QAAO;;AAKT,SAAgB,kBACd,aACA,OACA,OACA;CACA,MAAM,UAAU;CAChB,MAAM,GAAG,QAAQ,QAAQ,YAAY,MAAM,QAAQ;CACnD,MAAM,cAAc,mBAAmB,KAAK,KAAK;CACjD,MAAM,iBAAiB,eAAe,KAAK,WAAW,MAAM;CAC5D,MAAM,MAAM,IAAI,IACd,QAAQ,cAAc,iBAAiB,KAAK,MAAM,EAAE,GAAG,OACxD;AACD,KAAI,aAAa,IAAI,OAAO,MAAM;CAClC,MAAM,KAAK,aAAa,IAAI,UAAU,CAAC,MAAM,QAAQ;AACrD,QAAO,GAAG,OAAO,GAAG,eAAe,iBAAiB,MAAM,MAAM,OAAO,UAAU,MAAM,GAAG,GAAG"}
+{"version":3,"file":"redirects.js","names":[],"sources":["../../src/server/redirects.ts"],"sourcesContent":["import { AuthError } from \"./fx\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { requireEnv } from \"./utils\";\n\n/** @internal */\nexport async function redirectAbsoluteUrl(\n  config: ConvexAuthMaterializedConfig,\n  params: { redirectTo: unknown },\n) {\n  if (params.redirectTo === undefined) {\n    return requireEnv(\"SITE_URL\").replace(/\\/$/, \"\");\n  }\n  if (typeof params.redirectTo !== \"string\") {\n    throw new AuthError(\n      \"INVALID_REDIRECT\",\n      `Expected \\`redirectTo\\` to be a string, got ${params.redirectTo as any}`,\n    );\n  }\n  const redirectCallback =\n    config.callbacks?.redirect ?? defaultRedirectCallback;\n  try {\n    return await redirectCallback({ redirectTo: params.redirectTo });\n  } catch {\n    throw new AuthError(\"INTERNAL_ERROR\");\n  }\n}\n\nasync function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {\n  // Resolve relative paths against SITE_URL; absolute URLs are passed through\n  // as-is. The developer is trusted to provide valid redirect targets.\n  if (redirectTo.startsWith(\"?\") || redirectTo.startsWith(\"/\")) {\n    return `${requireEnv(\"SITE_URL\").replace(/\\/$/, \"\")}${redirectTo}`;\n  }\n  return redirectTo;\n}\n\n// Temporary work-around because Convex doesn't support\n// schemes other than http and https.\n/** @internal */\nexport function setURLSearchParam(\n  absoluteUrl: string,\n  param: string,\n  value: string,\n) {\n  const pattern = /([^:]+):(.*)/;\n  const [, scheme, rest] = absoluteUrl.match(pattern)!;\n  const hasNoDomain = /^\\/\\/(?:\\/|$|\\?)/.test(rest);\n  const startsWithPath = hasNoDomain && rest.startsWith(\"///\");\n  const url = new URL(\n    `http:${hasNoDomain ? \"//googblibok\" + rest.slice(2) : rest}`,\n  );\n  url.searchParams.set(param, value);\n  const [, , withParam] = url.toString().match(pattern)!;\n  return `${scheme}:${hasNoDomain ? (startsWithPath ? \"/\" : \"\") + \"//\" + withParam.slice(13) : withParam}`;\n}\n"],"mappings":";;;;;AAKA,eAAsB,oBACpB,QACA,QACA;AACA,KAAI,OAAO,eAAe,OACxB,QAAO,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG;AAElD,KAAI,OAAO,OAAO,eAAe,SAC/B,OAAM,IAAI,UACR,oBACA,+CAA+C,OAAO,aACvD;CAEH,MAAM,mBACJ,OAAO,WAAW,YAAY;AAChC,KAAI;AACF,SAAO,MAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,CAAC;SAC1D;AACN,QAAM,IAAI,UAAU,iBAAiB;;;AAIzC,eAAe,wBAAwB,EAAE,cAAsC;AAG7E,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,IAAI,CAC1D,QAAO,GAAG,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG,GAAG;AAExD,QAAO;;;AAMT,SAAgB,kBACd,aACA,OACA,OACA;CACA,MAAM,UAAU;CAChB,MAAM,GAAG,QAAQ,QAAQ,YAAY,MAAM,QAAQ;CACnD,MAAM,cAAc,mBAAmB,KAAK,KAAK;CACjD,MAAM,iBAAiB,eAAe,KAAK,WAAW,MAAM;CAC5D,MAAM,MAAM,IAAI,IACd,QAAQ,cAAc,iBAAiB,KAAK,MAAM,EAAE,GAAG,OACxD;AACD,KAAI,aAAa,IAAI,OAAO,MAAM;CAClC,MAAM,KAAK,aAAa,IAAI,UAAU,CAAC,MAAM,QAAQ;AACrD,QAAO,GAAG,OAAO,GAAG,eAAe,iBAAiB,MAAM,MAAM,OAAO,UAAU,MAAM,GAAG,GAAG"}

package/dist/server/refresh.d.ts

@@ -1,37 +1 @@
-import { ConvexAuthConfig, Doc, MutationCtx } from "./types.js";
-import { AuthError } from "./fx.js";
-import { Fx } from "@robelest/fx";
-import { GenericId } from "convex/values";
-
-//#region src/server/refresh.d.ts
-declare const REFRESH_TOKEN_REUSE_WINDOW_MS: number;
-/**
- * Create a new refresh token for the given session.
- */
-declare function createRefreshToken(ctx: MutationCtx, config: ConvexAuthConfig, sessionId: GenericId<"Session">, parentRefreshTokenId: GenericId<"RefreshToken"> | null): Promise<GenericId<"RefreshToken">>;
-/**
- * Parse a compound refresh token string into its constituent IDs.
- */
-declare const parseRefreshToken: (refreshToken: string) => Fx<{
-  refreshTokenId: GenericId<"RefreshToken">;
-  sessionId: GenericId<"Session">;
-}, AuthError>;
-/**
- * Mark all refresh tokens descending from the given refresh token as invalid
- * immediately. Used when we detect token reuse — revoke the entire tree.
- */
-declare function invalidateRefreshTokensInSubtree(ctx: MutationCtx, refreshToken: Doc<"RefreshToken">, config: ConvexAuthConfig): Promise<Doc<"RefreshToken">[]>;
-/**
- * Validate a refresh token and its associated session.
- *
- * Returns `null` on any validation failure (matching original semantics).
- * Each validation step is a small composable function chained with `Fx.chain`.
- * On failure, the error message is logged and the pipeline folds to `null`.
- */
-declare const refreshTokenIfValid: (ctx: MutationCtx, refreshTokenId: string, tokenSessionId: string, config: ConvexAuthConfig) => Fx<{
-  session: Doc<"Session">;
-  refreshTokenDoc: Doc<"RefreshToken">;
-} | null, never>;
-//#endregion
-export { REFRESH_TOKEN_REUSE_WINDOW_MS, createRefreshToken, invalidateRefreshTokensInSubtree, parseRefreshToken, refreshTokenIfValid };
-//# sourceMappingURL=refresh.d.ts.map
+export { };

package/dist/server/refresh.js

@@ -5,10 +5,12 @@ import { Fx } from "@robelest/fx";
 
 //#region src/server/refresh.ts
 const DEFAULT_SESSION_INACTIVE_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
+/** @internal */
 const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1e3;
 /**
 * Create a new refresh token for the given session.
 */
+/** @internal */
 async function createRefreshToken(ctx, config, sessionId, parentRefreshTokenId) {
 	const expirationTime = Date.now() + (config.session?.inactiveDurationMs ?? (process.env.AUTH_SESSION_INACTIVE_DURATION_MS !== void 0 ? Number(process.env.AUTH_SESSION_INACTIVE_DURATION_MS) : void 0) ?? DEFAULT_SESSION_INACTIVE_DURATION_MS);
 	return authDb(ctx, config).refreshTokens.create({
@@ -20,6 +22,7 @@ async function createRefreshToken(ctx, config, sessionId, parentRefreshTokenId)
 /**
 * Parse a compound refresh token string into its constituent IDs.
 */
+/** @internal */
 const parseRefreshToken = (refreshToken) => {
 	const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);
 	const msg = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;
@@ -34,6 +37,7 @@ const parseRefreshToken = (refreshToken) => {
 * Mark all refresh tokens descending from the given refresh token as invalid
 * immediately. Used when we detect token reuse — revoke the entire tree.
 */
+/** @internal */
 async function invalidateRefreshTokensInSubtree(ctx, refreshToken, config) {
 	const db = authDb(ctx, config);
 	const tokensToInvalidate = [refreshToken];
@@ -65,6 +69,7 @@ async function invalidateRefreshTokensInSubtree(ctx, refreshToken, config) {
 * Each validation step is a small composable function chained with `Fx.chain`.
 * On failure, the error message is logged and the pipeline folds to `null`.
 */
+/** @internal */
 const refreshTokenIfValid = (ctx, refreshTokenId, tokenSessionId, config) => {
 	const db = authDb(ctx, config);
 	const fetchDoc = (promise, failMsg) => Fx.from({