@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/core/types.d.ts

@@ -0,0 +1,369 @@
+import { ConvexError } from "convex/values";
+import { FunctionReference } from "convex/server";
+
+//#region src/client/core/types.d.ts
+/**
+ * Structural interface for any Convex client.
+ * Satisfied by `ConvexClient` (`convex/browser`),
+ * `ConvexReactClient` (`convex/react`), and similar transports.
+ *
+ * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`
+ * but not on the simplified `ConvexClient`. When available we call it
+ * during sign-out for a clean deauthentication.
+ */
+interface ConvexTransport {
+  action(action: any, args: any): Promise<any>;
+  setAuth(fetchToken: (args: {
+    forceRefreshToken: boolean;
+  }) => Promise<string | null | undefined>, onChange?: (isAuthenticated: boolean) => void): void;
+  clearAuth?(): void;
+}
+/** Pluggable key-value storage (defaults to `localStorage`). */
+interface Storage {
+  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+}
+/**
+ * Device code response returned when signing in with the `"device"` provider.
+ *
+ * The device displays the `userCode` (or `verificationUriComplete`) and
+ * polls via `auth.device.poll()` until the user authorizes.
+ */
+type DeviceCodeResult = {
+  /** High-entropy device code used for polling (keep secret). */deviceCode: string; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
+  userCode: string; /** Base verification URL (e.g. "https://myapp.com/device"). */
+  verificationUri: string; /** Verification URL with user code pre-filled as `?code=XXXX-XXXX`. */
+  verificationUriComplete: string; /** Lifetime of the codes in seconds. */
+  expiresIn: number; /** Minimum polling interval in seconds. */
+  interval: number;
+};
+/**
+ * Result of a `signIn` call.
+ *
+ * - `kind: "signedIn"` — credentials were accepted and the user is authenticated.
+ * - `kind: "redirect"` — OAuth flow initiated; redirect the user to `redirect.toString()`.
+ * - `kind: "totpRequired"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.
+ * - `kind: "deviceCode"` — device flow initiated; display the code and poll via `auth.device.poll()`.
+ * - `kind: "started"` — a non-immediate flow started (for example email/phone verification).
+ *
+ * @see {@link AuthState}
+ */
+type SignInResult = {
+  kind: "signedIn";
+} | {
+  kind: "redirect";
+  redirect: URL;
+  verifier: string;
+} | {
+  kind: "totpRequired";
+  verifier: string;
+} | {
+  kind: "deviceCode";
+  deviceCode: DeviceCodeResult;
+} | {
+  kind: "started";
+};
+/**
+ * Reactive auth state snapshot returned by `auth.state` and `auth.onChange`.
+ *
+ * @see {@link SignInResult}
+ */
+type AuthState = {
+  /** High-level auth phase for deterministic UI state handling. */phase: "loading" | "handshake" | "authenticated" | "unauthenticated"; /** `true` during initial hydration before the first token is resolved. */
+  isLoading: boolean; /** `true` only after Convex confirms authentication with the backend. */
+  isAuthenticated: boolean; /** The raw JWT string, or `null` when not authenticated. */
+  token: string | null;
+};
+/**
+ * Typed Convex API references for the auth functions.
+ * Pass these from your generated `api` object.
+ *
+ * @typeParam HasPasskey - Whether the passkey provider is configured.
+ * @typeParam HasTotp - Whether the TOTP provider is configured.
+ * @typeParam HasDevice - Whether the device provider is configured.
+ */
+type AuthApiRefs<HasPasskey extends boolean = boolean, HasTotp extends boolean = boolean, HasDevice extends boolean = boolean> = {
+  signIn: FunctionReference<"action", "public", any, any>;
+  signOut: FunctionReference<"action", "public", any, any>;
+  store: FunctionReference<"mutation", "public", any, any>;
+};
+/**
+ * Passkey (WebAuthn) client-side helpers.
+ *
+ * @see {@link TotpClient}
+ * @see {@link DeviceClient}
+ */
+interface PasskeyClient {
+  /**
+   * Check whether the current runtime exposes WebAuthn passkey APIs.
+   *
+   * @returns `true` when `navigator.credentials` is available.
+   *
+   * @example
+   * ```ts
+   * if (auth.passkey.isSupported()) {
+   *   // Show passkey registration button
+   * }
+   * ```
+   */
+  isSupported(): boolean;
+  /**
+   * Check whether conditional mediation (autofill-style passkeys) is available.
+   *
+   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.
+   *
+   * @example
+   * ```ts
+   * if (await auth.passkey.isAutofillSupported()) {
+   *   await auth.passkey.authenticate({ autofill: true });
+   * }
+   * ```
+   */
+  isAutofillSupported(): Promise<boolean>;
+  /**
+   * Start a passkey registration flow and complete the WebAuthn ceremony.
+   *
+   * Creates a new credential bound to the current user's account.
+   *
+   * @param opts - Optional registration hints.
+   * @param opts.name - Human-readable name for the passkey (e.g. `"MacBook Pro"`).
+   * @param opts.email - Email hint for discoverable credentials.
+   * @param opts.userName - WebAuthn `user.name` override.
+   * @param opts.userDisplayName - WebAuthn `user.displayName` override.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.passkey.register({ name: "My laptop" });
+   * ```
+   */
+  register(opts?: Record<string, any>): Promise<SignInResult>;
+  /**
+   * Authenticate with an existing passkey and complete the WebAuthn ceremony.
+   *
+   * @param opts - Optional authentication hints.
+   * @param opts.email - Email hint to filter discoverable credentials.
+   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.passkey.authenticate();
+   * ```
+   */
+  authenticate(opts?: Record<string, any>): Promise<SignInResult>;
+}
+/**
+ * TOTP two-factor authentication client-side helpers.
+ *
+ * @see {@link PasskeyClient}
+ * @see {@link DeviceClient}
+ */
+interface TotpClient {
+  /**
+   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.
+   *
+   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code
+   * for the user to scan with their authenticator app.
+   *
+   * @param opts - Optional setup hints.
+   * @param opts.name - Issuer name shown in the authenticator app.
+   * @param opts.accountName - Account label in the authenticator app.
+   * @returns An object with `{ uri, secret, verifier, totpId }`.
+   *
+   * @example
+   * ```ts
+   * const { uri, secret, verifier, totpId } = await auth.totp.setup();
+   * // Render `uri` as a QR code, then confirm:
+   * await auth.totp.confirm({ code: userCode, verifier, totpId });
+   * ```
+   */
+  setup(opts?: Record<string, any>): Promise<Record<string, any>>;
+  /**
+   * Confirm a newly created TOTP factor with the first authenticator code.
+   *
+   * Call this after the user scans the QR code and enters the first OTP.
+   *
+   * @param opts - Confirmation parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.
+   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.
+   *
+   * @example
+   * ```ts
+   * await auth.totp.confirm({ code: "123456", verifier, totpId });
+   * ```
+   */
+  confirm(opts: Record<string, any>): Promise<void>;
+  /**
+   * Complete a sign-in that is waiting on TOTP verification.
+   *
+   * Called when `signIn()` returns `{ kind: "totpRequired" }`.
+   *
+   * @param opts - Verification parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string from the `totpRequired` result.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.signIn("password", { email, password });
+   * if (result.kind === "totpRequired") {
+   *   await auth.totp.verify({ code: totpCode, verifier: result.verifier });
+   * }
+   * ```
+   */
+  verify(opts: Record<string, any>): Promise<void>;
+}
+/**
+ * Device authorization (RFC 8628) client-side helpers.
+ *
+ * @see {@link PasskeyClient}
+ * @see {@link TotpClient}
+ */
+interface DeviceClient {
+  /**
+   * Poll until a device flow is approved or expires.
+   *
+   * Polls the server at the interval specified in the {@link DeviceCodeResult}
+   * until the user authorizes the device or the code expires.
+   *
+   * @param opts - Poll options.
+   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn("device")`.
+   * @returns `{ ok: true }` when authorized, or `{ ok: false, expired }` on failure.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.signIn("device");
+   * if (result.kind === "deviceCode") {
+   *   // Display result.deviceCode.userCode to the user
+   *   const poll = await auth.device.poll({ code: result.deviceCode });
+   *   if (poll.ok) console.log("Device authorized!");
+   * }
+   * ```
+   */
+  poll(opts: {
+    code: DeviceCodeResult;
+  }): Promise<{
+    ok: true;
+  } | {
+    ok: false;
+    expired: boolean;
+  }>;
+  /**
+   * Approve a device flow from the verification page using the displayed user code.
+   *
+   * Call this on the authorization page where the user enters the short code
+   * shown on the device screen.
+   *
+   * @param opts - Verification options.
+   * @param opts.code - The user code string (e.g. `"WDJB-MJHT"`).
+   * @returns `{ ok: true }` on success, or `{ ok: false, message }` on failure.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.device.verify({ code: "WDJB-MJHT" });
+   * if (!result.ok) console.error(result.message);
+   * ```
+   */
+  verify(opts: {
+    code: string;
+  }): Promise<{
+    ok: true;
+  } | {
+    ok: false;
+    message: string;
+  }>;
+}
+/**
+ * Extract capability flags from an AuthApiRefs type.
+ *
+ * @typeParam Api - An AuthApiRefs type to extract capability flags from.
+ */
+type InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> = Api extends AuthApiRefs<infer P, infer T, infer D> ? {
+  passkey: P;
+  totp: T;
+  device: D;
+} : {
+  passkey: boolean;
+  totp: boolean;
+  device: boolean;
+};
+/** Pending invite detected from URL or recovered from storage after redirect. */
+interface PendingInvite {
+  /**
+   * Raw one-time invite token. Pass to your invite acceptance mutation.
+   * @readonly
+   */
+  readonly token: string;
+  /**
+   * Invite email from the URL or stored redirect state, if available.
+   * @readonly
+   */
+  readonly email: string | null;
+  /** Consume the invite: clears storage/URL params and returns the token. */
+  accept(): Promise<{
+    ok: boolean;
+    token?: string;
+    message?: string;
+  }>;
+}
+/** Base auth client — always present. */
+interface AuthClientBase {
+  /**
+   * Reactive auth state snapshot.
+   * @readonly
+   */
+  readonly state: AuthState;
+  /** SSR-safe query-param reader. */
+  param: (name: string) => string | null;
+  /**
+   * Pending invite recovered from the URL or storage, if present.
+   * @readonly
+   */
+  readonly invite: PendingInvite | null;
+  /** Start a sign-in flow for a provider. */
+  signIn: (provider: string, params?: Record<string, any>) => Promise<SignInResult>;
+  /** Sign out and clear local auth state. */
+  signOut: () => Promise<void>;
+  /** Subscribe to auth state changes. Returns an unsubscribe function. */
+  onChange: (callback: (state: AuthState) => void) => () => void;
+  /** Tear down listeners and reject in-flight handshakes. */
+  destroy: () => void;
+}
+/**
+ * Auth client return type — conditionally includes `passkey`, `totp`, and
+ * `device` helpers based on the capabilities in the `AuthApiRefs` type.
+ *
+ * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
+ */
+type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClientBase & (InferCaps<Api>["passkey"] extends true ? {
+  passkey: PasskeyClient;
+} : {}) & (InferCaps<Api>["totp"] extends true ? {
+  totp: TotpClient;
+} : {}) & (InferCaps<Api>["device"] extends true ? {
+  device: DeviceClient;
+} : {});
+/**
+ * Options for {@link client}.
+ *
+ * @typeParam Api - An AuthApiRefs type.
+ */
+type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {
+  /** Any Convex client implementation used to run auth actions. */convex: ConvexTransport; /** Typed auth function refs from your generated `api` object. */
+  api?: Api; /** Explicit Convex deployment URL when it cannot be inferred from the client. */
+  url?: string;
+  /**
+   * Storage backend for persisted tokens; defaults to `localStorage` in SPA mode.
+   *
+   * @defaultValue localStorage
+   */
+  storage?: Storage | null; /** Override how OAuth code cleanup updates the current URL. */
+  replaceUrl?: (relativeUrl: string) => void | Promise<void>; /** SSR proxy endpoint used instead of direct Convex auth calls. */
+  proxyPath?: string; /** Server-provided JWT seed used for flash-free SSR hydration. */
+  tokenSeed?: string | null; /** SSR-safe URL source for reading query parameters. */
+  location?: URL | (() => URL | null);
+};
+//#endregion
+export { AuthApiRefs, AuthClient, AuthState, ClientOptions, DeviceClient, DeviceCodeResult, PasskeyClient, PendingInvite, SignInResult, Storage, TotpClient };
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/client/core/types.ts"],"mappings":";;;;;;AAYA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,OAAa,IAAA,QAAY,OAAA;EAChC,OAAA,CACE,UAAA,GAAa,IAAA;IACX,iBAAA;EAAA,MACI,OAAA,6BACN,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,OAAA;EACf,OAAA,CACE,GAAA,uCAC6B,OAAA;EAC/B,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;;;;;;KAqCtB,gBAAA;EA+BF,+DA7BR,UAAA,UAoCmB;EAlCnB,QAAA,UAkCmB;EAhCnB,eAAA,UAoCA;EAlCA,uBAAA,UAsCA;EApCA,SAAA,UAoCK;EAlCL,QAAA;AAAA;;;;;;;;;;;;KAcU,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;;;;;;KAOM,SAAA;EAuFV,iEArFA,KAAA,iEAqFS;EAnFT,SAAA,WAmF8C;EAjF9C,eAAA,WAgGoB;EA9FpB,KAAA;AAAA;;;;AAuGF;;;;;KA5FY,WAAA;EAKV,MAAA,EAAQ,iBAAA;EACR,OAAA,EAAS,iBAAA;EACT,KAAA,EAAO,iBAAA;AAAA;;;;;;;UAeQ,aAAA;EA0Gf;;;;;;;;;;AA4BF;;EAzHE,WAAA;EA+IQ;;;;;;;;;;;;EAjIR,mBAAA,IAAuB,OAAA;EAoJvB;;;;;;;;;AAUF;;;;;;;;EA3IE,QAAA,CAAS,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,YAAA;EA6IV;;;;;;;;;;;;;EA9HpC,YAAA,CAAa,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,YAAA;AAAA;;;;;;AAkIpD;UAzHiB,UAAA;;;;;;;;;;;;AAyIjB;;;;;;;EAtHE,KAAA,CAAM,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,MAAA;EAyI5B;;;;;;;;;;;;;;;EAxHf,OAAA,CAAQ,IAAA,EAAM,MAAA,gBAAsB,OAAA;EAwHpC;;;;;;;;;AAaF;;;;;;;;EAlHE,MAAA,CAAO,IAAA,EAAM,MAAA,gBAAsB,OAAA;AAAA;;;;;;;UASpB,YAAA;EA0Gf;;;;;;;;;;;;;;;;;;AAWF;;EAhGE,IAAA,CAAK,IAAA;IACH,IAAA,EAAM,gBAAA;EAAA,IACJ,OAAA;IAAU,EAAA;EAAA;IAAe,EAAA;IAAW,OAAA;EAAA;EAoHhB;;;;;;;;;;;;;;;;EAlGxB,MAAA,CAAO,IAAA;IACL,IAAA;EAAA,IACE,OAAA;IAAU,EAAA;EAAA;IAAe,EAAA;IAAW,OAAA;EAAA;AAAA;;;;;;KAQ9B,SAAA,aAAsB,WAAA,+BAChC,GAAA,SAAY,WAAA;EACN,OAAA,EAAS,CAAA;EAAG,IAAA,EAAM,CAAA;EAAG,MAAA,EAAQ,CAAA;AAAA;EAC7B,OAAA;EAAkB,IAAA;EAAe,MAAA;AAAA;;UAGxB,aAAA;;;;;WAKN,KAAA;;;;;WAKA,KAAA;;EAET,MAAA,IAAU,OAAA;IAAU,EAAA;IAAa,KAAA;IAAgB,OAAA;EAAA;AAAA;;UAIlC,cAAA;;;;;WAKN,KAAA,EAAO,SAAA;;EAEhB,KAAA,GAAQ,IAAA;;;;;WAKC,MAAA,EAAQ,aAAA;;EAEjB,MAAA,GACE,QAAA,UACA,MAAA,GAAS,MAAA,kBACN,OAAA,CAAQ,YAAA;;EAEb,OAAA,QAAe,OAAA;;EAEf,QAAA,GAAW,QAAA,GAAW,KAAA,EAAO,SAAA;;EAE7B,OAAA;AAAA;;;;;;;KASU,UAAA,aACE,WAAA,8BAAyC,WAAA,IACnD,cAAA,IACD,SAAA,CAAU,GAAA;EAAiC,OAAA,EAAS,aAAA;AAAA,WACpD,SAAA,CAAU,GAAA;EAA8B,IAAA,EAAM,UAAA;AAAA,WAC9C,SAAA,CAAU,GAAA;EAAgC,MAAA,EAAQ,YAAA;AAAA;;;;;;KAOzC,aAAA,aACE,WAAA,8BAAyC,WAAA;mEAGrD,MAAA,EAAQ,eAAA;EAER,GAAA,GAAM,GAAA;EAEN,GAAA;;;;;;EAMA,OAAA,GAAU,OAAA;EAEV,UAAA,IAAc,WAAA,oBAA+B,OAAA;EAE7C,SAAA;EAEA,SAAA;EAEA,QAAA,GAAW,GAAA,UAAa,GAAA;AAAA"}

package/dist/factors/device.js

@@ -0,0 +1,105 @@
+import { Fx } from "@robelest/fx";
+import { ConvexError } from "convex/values";
+
+//#region src/client/factors/device.ts
+/** @internal */
+function createDeviceClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	return {
+		poll: async (opts) => {
+			const { code } = opts;
+			const intervalMs = code.interval * 1e3;
+			const expiresAt = Date.now() + code.expiresIn * 1e3;
+			while (Date.now() < expiresAt) {
+				await new Promise((resolve) => setTimeout(resolve, intervalMs));
+				const pollResult = await Fx.run(Fx.from({
+					ok: async () => {
+						let result;
+						const params = {
+							flow: "poll",
+							deviceCode: code.deviceCode
+						};
+						if (proxy) result = await proxyFetch({
+							action: "auth:signIn",
+							args: {
+								provider: "device",
+								params
+							}
+						});
+						else result = await convex.action(requireApiRefs().signIn, {
+							provider: "device",
+							params
+						});
+						return result;
+					},
+					err: (e) => e
+				}).pipe(Fx.recover((e) => {
+					const dispatch = e instanceof ConvexError ? { tag: e.data?.code === "DEVICE_AUTHORIZATION_PENDING" ? "continue" : e.data?.code === "DEVICE_SLOW_DOWN" ? "slowDown" : "fatal" } : { tag: "fatal" };
+					return Fx.match(dispatch, dispatch.tag, {
+						continue: () => Fx.succeed({ _poll: "continue" }),
+						slowDown: () => Fx.succeed({ _poll: "slow_down" }),
+						fatal: () => Fx.fatal(e)
+					});
+				})));
+				if ("_poll" in pollResult) {
+					if (pollResult._poll === "slow_down") await new Promise((resolve) => setTimeout(resolve, intervalMs));
+					continue;
+				}
+				if (pollResult.tokens) {
+					if (proxy) await setTokenAndMaybeWait({
+						shouldStore: false,
+						tokens: pollResult.tokens === null ? null : { token: pollResult.tokens.token },
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					else await setTokenAndMaybeWait({
+						shouldStore: true,
+						tokens: pollResult.tokens ?? null,
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					return { ok: true };
+				}
+			}
+			return {
+				ok: false,
+				expired: true
+			};
+		},
+		verify: async (opts) => {
+			const params = {
+				flow: "verify",
+				userCode: opts.code
+			};
+			try {
+				if (proxy) await proxyFetch({
+					action: "auth:signIn",
+					args: {
+						provider: "device",
+						params
+					}
+				});
+				else await convex.action(requireApiRefs().signIn, {
+					provider: "device",
+					params
+				});
+				return { ok: true };
+			} catch (e) {
+				return {
+					ok: false,
+					message: e instanceof Error ? e.message : "Invalid or expired code."
+				};
+			}
+		}
+	};
+}
+
+//#endregion
+export { createDeviceClient };
+//# sourceMappingURL=device.js.map

package/dist/factors/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","names":[],"sources":["../../src/client/factors/device.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { ConvexError } from \"convex/values\";\n\nimport type {\n  AuthSession,\n  ConvexTransport,\n  DeviceClient,\n  DeviceCodeResult,\n} from \"../core/types\";\n\ntype DeviceDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createDeviceClient(deps: DeviceDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  return {\n    poll: async (opts: {\n      code: DeviceCodeResult;\n    }): Promise<{ ok: true } | { ok: false; expired: boolean }> => {\n      const { code } = opts;\n      const intervalMs = code.interval * 1000;\n      const expiresAt = Date.now() + code.expiresIn * 1000;\n\n      while (Date.now() < expiresAt) {\n        await new Promise((resolve) => setTimeout(resolve, intervalMs));\n\n        const pollResult = await Fx.run(\n          Fx.from({\n            ok: async () => {\n              let result: any;\n              const params: Record<string, any> = {\n                flow: \"poll\",\n                deviceCode: code.deviceCode,\n              };\n\n              if (proxy) {\n                result = await proxyFetch({\n                  action: \"auth:signIn\",\n                  args: { provider: \"device\", params },\n                });\n              } else {\n                result = await convex.action(requireApiRefs().signIn, {\n                  provider: \"device\",\n                  params,\n                });\n              }\n\n              return result;\n            },\n            err: (e) => e,\n          }).pipe(\n            Fx.recover((e: unknown) => {\n              const dispatch =\n                e instanceof ConvexError\n                  ? {\n                      tag:\n                        (e.data as Record<string, unknown> | undefined)\n                          ?.code === \"DEVICE_AUTHORIZATION_PENDING\"\n                          ? \"continue\"\n                          : (e.data as Record<string, unknown> | undefined)\n                                ?.code === \"DEVICE_SLOW_DOWN\"\n                            ? \"slowDown\"\n                            : \"fatal\",\n                    }\n                  : ({ tag: \"fatal\" } as const);\n\n              return Fx.match(dispatch, dispatch.tag, {\n                continue: () => Fx.succeed({ _poll: \"continue\" as const }),\n                slowDown: () => Fx.succeed({ _poll: \"slow_down\" as const }),\n                fatal: () => Fx.fatal(e),\n              });\n            }),\n          ),\n        );\n\n        if (\"_poll\" in pollResult) {\n          if (pollResult._poll === \"slow_down\") {\n            await new Promise((resolve) => setTimeout(resolve, intervalMs));\n          }\n          continue;\n        }\n\n        if (pollResult.tokens) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens:\n                pollResult.tokens === null\n                  ? null\n                  : { token: pollResult.tokens.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.tokens as AuthSession | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return { ok: true as const };\n        }\n      }\n\n      return { ok: false as const, expired: true };\n    },\n\n    verify: async (opts: {\n      code: string;\n    }): Promise<{ ok: true } | { ok: false; message: string }> => {\n      const params: Record<string, any> = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        if (proxy) {\n          await proxyFetch({\n            action: \"auth:signIn\",\n            args: { provider: \"device\", params },\n          });\n        } else {\n          await convex.action(requireApiRefs().signIn, {\n            provider: \"device\",\n            params,\n          });\n        }\n        return { ok: true as const };\n      } catch (e: unknown) {\n        return {\n          ok: false as const,\n          message: e instanceof Error ? e.message : \"Invalid or expired code.\",\n        };\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAiCA,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;AAEF,QAAO;EACL,MAAM,OAAO,SAEkD;GAC7D,MAAM,EAAE,SAAS;GACjB,MAAM,aAAa,KAAK,WAAW;GACnC,MAAM,YAAY,KAAK,KAAK,GAAG,KAAK,YAAY;AAEhD,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,WAAW,CAAC;IAE/D,MAAM,aAAa,MAAM,GAAG,IAC1B,GAAG,KAAK;KACN,IAAI,YAAY;MACd,IAAI;MACJ,MAAM,SAA8B;OAClC,MAAM;OACN,YAAY,KAAK;OAClB;AAED,UAAI,MACF,UAAS,MAAM,WAAW;OACxB,QAAQ;OACR,MAAM;QAAE,UAAU;QAAU;QAAQ;OACrC,CAAC;UAEF,UAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;OACpD,UAAU;OACV;OACD,CAAC;AAGJ,aAAO;;KAET,MAAM,MAAM;KACb,CAAC,CAAC,KACD,GAAG,SAAS,MAAe;KACzB,MAAM,WACJ,aAAa,cACT,EACE,KACG,EAAE,MACC,SAAS,iCACT,aACC,EAAE,MACG,SAAS,qBACb,aACA,SACT,GACA,EAAE,KAAK,SAAS;AAEvB,YAAO,GAAG,MAAM,UAAU,SAAS,KAAK;MACtC,gBAAgB,GAAG,QAAQ,EAAE,OAAO,YAAqB,CAAC;MAC1D,gBAAgB,GAAG,QAAQ,EAAE,OAAO,aAAsB,CAAC;MAC3D,aAAa,GAAG,MAAM,EAAE;MACzB,CAAC;MACF,CACH,CACF;AAED,QAAI,WAAW,YAAY;AACzB,SAAI,WAAW,UAAU,YACvB,OAAM,IAAI,SAAS,YAAY,WAAW,SAAS,WAAW,CAAC;AAEjE;;AAGF,QAAI,WAAW,QAAQ;AACrB,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QACE,WAAW,WAAW,OAClB,OACA,EAAE,OAAO,WAAW,OAAO,OAAO;MACxC,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,UAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ,YAAO,EAAE,IAAI,MAAe;;;AAIhC,UAAO;IAAE,IAAI;IAAgB,SAAS;IAAM;;EAG9C,QAAQ,OAAO,SAE+C;GAC5D,MAAM,SAA8B;IAClC,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,QAAI,MACF,OAAM,WAAW;KACf,QAAQ;KACR,MAAM;MAAE,UAAU;MAAU;MAAQ;KACrC,CAAC;QAEF,OAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;KAC3C,UAAU;KACV;KACD,CAAC;AAEJ,WAAO,EAAE,IAAI,MAAe;YACrB,GAAY;AACnB,WAAO;KACL,IAAI;KACJ,SAAS,aAAa,QAAQ,EAAE,UAAU;KAC3C;;;EAGN"}

package/dist/factors/passkey.js

@@ -0,0 +1,181 @@
+import { base64urlDecode, base64urlEncode } from "../runtime/browser.js";
+import { Fx } from "@robelest/fx";
+
+//#region src/client/factors/passkey.ts
+/** @internal */
+function createPasskeyClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	const handleSignedInResult = async (result, flow) => {
+		return Fx.run(Fx.match(result, result.kind, {
+			signedIn: (signedInResult) => Fx.from({
+				ok: async () => {
+					return await setTokenAndMaybeWait(proxy ? {
+						shouldStore: false,
+						tokens: signedInResult.tokens === null ? null : { token: signedInResult.tokens.token },
+						waitForHandshake: true,
+						context: {
+							provider: "passkey",
+							flow
+						}
+					} : {
+						shouldStore: true,
+						tokens: signedInResult.tokens,
+						waitForHandshake: true,
+						context: {
+							provider: "passkey",
+							flow
+						}
+					}) ? { kind: "signedIn" } : { kind: "started" };
+				},
+				err: (e) => e
+			}),
+			redirect: () => Fx.succeed({ kind: "started" }),
+			started: () => Fx.succeed({ kind: "started" }),
+			passkeyOptions: () => Fx.succeed({ kind: "started" }),
+			totpRequired: () => Fx.succeed({ kind: "started" }),
+			totpSetup: () => Fx.succeed({ kind: "started" }),
+			deviceCode: () => Fx.succeed({ kind: "started" })
+		}));
+	};
+	return {
+		isSupported: () => {
+			return typeof window !== "undefined" && typeof window.PublicKeyCredential !== "undefined";
+		},
+		isAutofillSupported: async () => {
+			if (typeof window === "undefined") return false;
+			if (typeof window.PublicKeyCredential === "undefined") return false;
+			if (typeof window.PublicKeyCredential.isConditionalMediationAvailable !== "function") return false;
+			return window.PublicKeyCredential.isConditionalMediationAvailable();
+		},
+		register: async (opts) => {
+			const phase1Params = {
+				flow: "registerOptions",
+				email: opts?.email,
+				userName: opts?.userName,
+				userDisplayName: opts?.userDisplayName
+			};
+			let phase1Result;
+			if (proxy) phase1Result = await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "passkey",
+					params: phase1Params
+				}
+			});
+			else phase1Result = await convex.action(requireApiRefs().signIn, {
+				provider: "passkey",
+				params: phase1Params
+			});
+			if (phase1Result.kind !== "passkeyOptions") throw new Error("Server did not return passkey registration options");
+			const options = phase1Result.options;
+			const createOptions = { publicKey: {
+				rp: options.rp,
+				user: {
+					id: base64urlDecode(options.user.id).buffer,
+					name: options.user.name,
+					displayName: options.user.displayName
+				},
+				challenge: base64urlDecode(options.challenge).buffer,
+				pubKeyCredParams: options.pubKeyCredParams,
+				timeout: options.timeout,
+				attestation: options.attestation,
+				authenticatorSelection: options.authenticatorSelection,
+				excludeCredentials: (options.excludeCredentials ?? []).map((cred) => ({
+					type: cred.type ?? "public-key",
+					id: base64urlDecode(cred.id).buffer,
+					transports: cred.transports
+				}))
+			} };
+			const credential = await navigator.credentials.create(createOptions);
+			if (!credential) throw new Error("Passkey registration was cancelled");
+			const response = credential.response;
+			const transports = typeof response.getTransports === "function" ? response.getTransports() : void 0;
+			const phase2Params = {
+				flow: "registerVerify",
+				clientDataJSON: base64urlEncode(response.clientDataJSON),
+				attestationObject: base64urlEncode(response.attestationObject),
+				transports,
+				passkeyName: opts?.name,
+				email: opts?.email
+			};
+			let phase2Result;
+			if (proxy) phase2Result = await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "passkey",
+					params: phase2Params,
+					verifier: phase1Result.verifier
+				}
+			});
+			else phase2Result = await convex.action(requireApiRefs().signIn, {
+				provider: "passkey",
+				params: phase2Params,
+				verifier: phase1Result.verifier
+			});
+			return handleSignedInResult(phase2Result, "registerVerify");
+		},
+		authenticate: async (opts) => {
+			const phase1Params = {
+				flow: "authOptions",
+				email: opts?.email
+			};
+			let phase1Result;
+			if (proxy) phase1Result = await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "passkey",
+					params: phase1Params
+				}
+			});
+			else phase1Result = await convex.action(requireApiRefs().signIn, {
+				provider: "passkey",
+				params: phase1Params
+			});
+			if (phase1Result.kind !== "passkeyOptions") throw new Error("Server did not return passkey authentication options");
+			const options = phase1Result.options;
+			const getOptions = {
+				publicKey: {
+					challenge: base64urlDecode(options.challenge).buffer,
+					timeout: options.timeout,
+					rpId: options.rpId,
+					userVerification: options.userVerification,
+					allowCredentials: (options.allowCredentials ?? []).map((cred) => ({
+						type: cred.type ?? "public-key",
+						id: base64urlDecode(cred.id).buffer,
+						transports: cred.transports
+					}))
+				},
+				...opts?.autofill ? { mediation: "conditional" } : {}
+			};
+			const credential = await navigator.credentials.get(getOptions);
+			if (!credential) throw new Error("Passkey authentication was cancelled");
+			const response = credential.response;
+			const phase2Params = {
+				flow: "authVerify",
+				credentialId: base64urlEncode(credential.rawId),
+				clientDataJSON: base64urlEncode(response.clientDataJSON),
+				authenticatorData: base64urlEncode(response.authenticatorData),
+				signature: base64urlEncode(response.signature)
+			};
+			let phase2Result;
+			if (proxy) phase2Result = await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "passkey",
+					params: phase2Params,
+					verifier: phase1Result.verifier
+				}
+			});
+			else phase2Result = await convex.action(requireApiRefs().signIn, {
+				provider: "passkey",
+				params: phase2Params,
+				verifier: phase1Result.verifier
+			});
+			return handleSignedInResult(phase2Result, "authVerify");
+		}
+	};
+}
+
+//#endregion
+export { createPasskeyClient };
+//# sourceMappingURL=passkey.js.map