@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/passkey.js

@@ -1,12 +1,12 @@
 import { userIdFromIdentitySubject } from "./identity.js";
-import { siteUrlsFromEnv } from "./utils.js";
 import { authDb } from "./db.js";
-import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
+import { siteUrlsFromEnv } from "./url.js";
+import { authFlowError } from "../shared/errors.js";
+import { toConvexError } from "./errors.js";
 import { mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateVerifierDelete, queryPasskeyByCredentialId, queryPasskeysByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById } from "./types.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
+import { ConvexError } from "convex/values";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
 import { decodePKIXECDSASignature, decodeSEC1PublicKey, p256, verifyECDSASignature } from "@oslojs/crypto/ecdsa";
@@ -26,31 +26,35 @@ import { COSEKeyType, ClientDataType, coseAlgorithmES256, coseAlgorithmRS256, cr
 * Uses `@oslojs/webauthn` for attestation/assertion parsing and
 * `@oslojs/crypto` for signature verification.
 *
-* All functions return `Fx<A, ConvexError<any>>` composed via `Fx.chain` pipelines.
-*
 * @module
 */
-/**
-* Resolve passkey relying party options from provider config and environment.
-*
-* Returns `Fx<RpOptions, ConvexError<any>>` — fails if neither SITE_URL nor rpId
-* is configured.
-*/
-const resolveRpOptionsFx = (provider) => {
-	const configuredSiteUrls = process.env.SITE_URL === void 0 ? null : siteUrlsFromEnv();
-	const siteUrl = configuredSiteUrls?.primaryUrl;
-	const hasSiteUrl = siteUrl !== void 0 && siteUrl !== "";
-	const hasRpId = provider.options.rpId !== void 0;
-	return Fx.succeed({
-		siteUrl,
-		hasSiteUrl,
-		hasRpId
-	}).pipe(Fx.chain(({ siteUrl: siteUrl$1, hasSiteUrl: hasSiteUrl$1, hasRpId: hasRpId$1 }) => !hasSiteUrl$1 && !hasRpId$1 ? Cv.fail({
-		code: "PASSKEY_MISSING_CONFIG",
-		message: "Passkey provider requires SITE_URL env var (your frontend URL) or explicit rpId / origin in the provider config. CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain."
-	}) : Fx.succeed(siteUrl$1)), Fx.map((siteUrl$1) => {
-		const siteHostname = siteUrl$1 ? new URL(siteUrl$1).hostname : void 0;
-		const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl$1;
+const PASSKEY_FLOW = {
+	registerOptions: "registerOptions",
+	registerVerify: "registerVerify",
+	authOptions: "authOptions",
+	authVerify: "authVerify"
+};
+const PASSKEY_FLOWS = [
+	PASSKEY_FLOW.registerOptions,
+	PASSKEY_FLOW.registerVerify,
+	PASSKEY_FLOW.authOptions,
+	PASSKEY_FLOW.authVerify
+];
+const requireStringParam = (value, name) => {
+	if (typeof value !== "string") throw convexError("INVALID_PARAMETERS", `Missing \`${name}\` parameter.`);
+	return value;
+};
+const convexError = (code, message) => toConvexError(authFlowError(code, message));
+const asConvexError = (error, code, message) => error instanceof ConvexError ? error : error instanceof Error ? toConvexError(authFlowError(code, error.message || message)) : convexError(code, message);
+function resolveRpOptions(provider) {
+	try {
+		const configuredSiteUrls = process.env.SITE_URL === void 0 ? null : siteUrlsFromEnv();
+		const siteUrl = configuredSiteUrls?.primaryUrl;
+		const hasSiteUrl = siteUrl !== void 0 && siteUrl !== "";
+		const hasRpId = provider.options.rpId !== void 0;
+		if (!hasSiteUrl && !hasRpId) throw convexError("PASSKEY_MISSING_CONFIG", "Passkey provider requires SITE_URL env var (your frontend URL) or explicit rpId / origin in the provider config. CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.");
+		const siteHostname = siteUrl ? new URL(siteUrl).hostname : void 0;
+		const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl;
 		return {
 			rpName: provider.options.rpName ?? siteHostname ?? "localhost",
 			rpId: provider.options.rpId ?? siteHostname ?? "localhost",
@@ -62,352 +66,314 @@ const resolveRpOptionsFx = (provider) => {
 			algorithms: provider.options.algorithms ?? [coseAlgorithmES256, coseAlgorithmRS256],
 			challengeExpirationMs: provider.options.challengeExpirationMs ?? 3e5
 		};
-	}));
-};
-/** Verify client data type matches expected WebAuthn ceremony type. */
-const verifyClientDataType = (expectedType, label) => (clientData) => clientData.type === expectedType ? Fx.succeed(clientData) : Cv.fail({
-	code: "PASSKEY_INVALID_CLIENT_DATA",
-	message: `Invalid client data type: expected ${label}`
-});
-/** Verify origin is in the allowed list. */
-const verifyOrigin = (rp) => (clientData) => {
+	} catch (error) {
+		throw asConvexError(error, "PASSKEY_MISSING_CONFIG", "Passkey relying party configuration is invalid.");
+	}
+}
+function verifyClientDataType(clientData, expectedType, label) {
+	if (clientData.type !== expectedType) throw convexError("PASSKEY_INVALID_CLIENT_DATA", `Invalid client data type: expected ${label}`);
+	return clientData;
+}
+function verifyOrigin(clientData, rp) {
 	const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];
-	return allowed.includes(clientData.origin) ? Fx.succeed(clientData) : Cv.fail({
-		code: "PASSKEY_INVALID_ORIGIN",
-		message: `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(", ")}`
-	});
-};
-/** Verify the challenge hash matches the stored verifier, then delete verifier. */
-const verifyAndConsumeChallenge = (ctx, verifierValue) => (clientData) => {
+	if (!allowed.includes(clientData.origin)) throw convexError("PASSKEY_INVALID_ORIGIN", `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(", ")}`);
+	return clientData;
+}
+async function verifyAndConsumeChallenge(clientData, ctx, verifierValue) {
 	const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(clientData.challenge)));
-	return Fx.from({
-		ok: () => queryVerifierById(ctx, verifierValue),
-		err: () => Cv.error({
-			code: "PASSKEY_INVALID_CHALLENGE",
-			message: "Invalid or expired passkey challenge."
-		})
-	}).pipe(Fx.chain((doc) => !doc || doc.signature !== challengeHash ? Cv.fail({
-		code: "PASSKEY_INVALID_CHALLENGE",
-		message: "Invalid or expired passkey challenge."
-	}) : Fx.succeed(doc)), Fx.chain(() => Fx.from({
-		ok: () => mutateVerifierDelete(ctx, verifierValue),
-		err: () => Cv.error({
-			code: "PASSKEY_INVALID_CHALLENGE",
-			message: "Invalid or expired passkey challenge."
-		})
-	})), Fx.map(() => clientData));
-};
-/** Verify RP ID hash matches. */
-const verifyRpId = (rpId) => (authData) => authData.verifyRelyingPartyIdHash(rpId) ? Fx.succeed(authData) : Cv.fail({
-	code: "PASSKEY_RP_MISMATCH",
-	message: "Relying party ID mismatch."
-});
-/** Verify user presence and (optionally) user verification flags. */
-const verifyUserFlags = (rp) => (authData) => !authData.userPresent ? Cv.fail({
-	code: "PASSKEY_USER_PRESENCE",
-	message: "User presence flag not set."
-}) : rp.userVerification === "required" && !authData.userVerified ? Cv.fail({
-	code: "PASSKEY_USER_VERIFICATION",
-	message: "User verification required but not performed."
-}) : Fx.succeed(authData);
-const PASSKEY_FLOW = {
-	registerOptions: "registerOptions",
-	registerVerify: "registerVerify",
-	authOptions: "authOptions",
-	authVerify: "authVerify"
-};
-const PASSKEY_FLOWS = [
-	PASSKEY_FLOW.registerOptions,
-	PASSKEY_FLOW.registerVerify,
-	PASSKEY_FLOW.authOptions,
-	PASSKEY_FLOW.authVerify
-];
-const resolvePasskeyDispatchFx = (params) => {
+	let doc;
+	try {
+		doc = await queryVerifierById(ctx, verifierValue);
+	} catch {
+		throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	}
+	if (!doc || doc.signature !== challengeHash) throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	try {
+		await mutateVerifierDelete(ctx, verifierValue);
+	} catch {
+		throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	}
+	return clientData;
+}
+function verifyRpId(authData, rpId) {
+	if (!authData.verifyRelyingPartyIdHash(rpId)) throw convexError("PASSKEY_RP_MISMATCH", "Relying party ID mismatch.");
+	return authData;
+}
+function verifyUserFlags(authData, rp) {
+	if (!authData.userPresent) throw convexError("PASSKEY_USER_PRESENCE", "User presence flag not set.");
+	if (rp.userVerification === "required" && !authData.userVerified) throw convexError("PASSKEY_USER_VERIFICATION", "User verification required but not performed.");
+	return authData;
+}
+function resolvePasskeyDispatch(params) {
 	const flow = params.flow;
-	return typeof flow === "string" && PASSKEY_FLOWS.includes(flow) ? Fx.succeed({ flow }) : Cv.fail({
-		code: "PASSKEY_MISSING_FLOW",
-		message: "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify"
-	});
-};
-const requirePasskeyVerifierFx = (verifier) => verifier != null ? Fx.succeed(verifier) : Cv.fail({
-	code: "PASSKEY_MISSING_VERIFIER",
-	message: "Missing verifier for passkey operation."
-});
-/**
-* Main passkey handler dispatched from signIn.ts.
-*
-* Routes to the appropriate phase based on `params.flow` via `dispatchFx`.
-*/
-function handlePasskeyFx(ctx, provider, args) {
+	if (typeof flow === "string" && PASSKEY_FLOWS.includes(flow)) return { flow };
+	throw convexError("PASSKEY_MISSING_FLOW", "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify");
+}
+function requirePasskeyVerifier(verifier) {
+	if (verifier != null) return verifier;
+	throw convexError("PASSKEY_MISSING_VERIFIER", "Missing verifier for passkey operation.");
+}
+async function requireAuthenticatedUserId(ctx) {
+	let identity;
+	try {
+		identity = await ctx.auth.getUserIdentity();
+	} catch {
+		throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
+	}
+	if (identity === null) throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
+	return userIdFromIdentitySubject(identity.subject);
+}
+function resolveRegistrationPublicKeyBytes(publicKey, algorithm) {
+	if (algorithm === coseAlgorithmES256) {
+		const ec2 = publicKey.ec2();
+		const xBytes = new Uint8Array(32);
+		let vx = ec2.x;
+		for (let i = 31; i >= 0; i--) {
+			xBytes[i] = Number(vx & 255n);
+			vx >>= 8n;
+		}
+		const yBytes = new Uint8Array(32);
+		let vy = ec2.y;
+		for (let i = 31; i >= 0; i--) {
+			yBytes[i] = Number(vy & 255n);
+			vy >>= 8n;
+		}
+		const bytes = new Uint8Array(65);
+		bytes[0] = 4;
+		bytes.set(xBytes, 1);
+		bytes.set(yBytes, 33);
+		return bytes;
+	}
+	if (algorithm === coseAlgorithmRS256) {
+		const rsa = publicKey.rsa();
+		return new RSAPublicKey(rsa.n, rsa.e).encodePKCS1();
+	}
+	throw convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${algorithm}`);
+}
+function verifyAssertionSignature(passkey, signature, messageHash) {
+	if (passkey.algorithm === coseAlgorithmES256) {
+		if (!verifyECDSASignature(decodeSEC1PublicKey(p256, new Uint8Array(passkey.publicKey)), messageHash, decodePKIXECDSASignature(signature))) throw convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature.");
+		return;
+	}
+	if (passkey.algorithm === coseAlgorithmRS256) {
+		if (!verifyRSASSAPKCS1v15Signature(decodePKCS1RSAPublicKey(new Uint8Array(passkey.publicKey)), sha256ObjectIdentifier, messageHash, signature)) throw convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature.");
+		return;
+	}
+	throw convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${passkey.algorithm}`);
+}
+async function handlePasskeyFx(ctx, provider, args) {
 	const params = args.params ?? {};
-	return resolvePasskeyDispatchFx(params).pipe(Fx.chain((dispatch) => {
-		return Fx.match(dispatch).on("flow", {
-			registerOptions: (_) => Fx.zip(Fx.from({
-				ok: () => ctx.auth.getUserIdentity(),
-				err: () => Cv.error({
-					code: "PASSKEY_AUTH_REQUIRED",
-					message: "Sign in first, then add a passkey to your account."
-				})
-			}).pipe(Fx.chain((id) => id === null ? Cv.fail({
-				code: "PASSKEY_AUTH_REQUIRED",
-				message: "Sign in first, then add a passkey to your account."
-			}) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => {
-				const challenge = new Uint8Array(32);
-				crypto.getRandomValues(challenge);
-				const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-				return Fx.from({
-					ok: async () => {
-						const verifier = await callVerifier(ctx);
-						await callVerifierSignature(ctx, {
-							verifier,
-							signature: challengeHash
-						});
-						const user = await queryUserById(ctx, userId);
-						const userName = params.userName ?? user?.email ?? "user";
-						const userDisplayName = params.userDisplayName ?? user?.name ?? userName;
-						const excludeCredentials = (await queryPasskeysByUserId(ctx, userId)).map((pk) => ({
-							id: pk.credentialId,
-							transports: pk.transports
-						}));
-						const userHandle = encodeBase64urlNoPadding(new TextEncoder().encode(userId));
-						return {
-							kind: "passkeyOptions",
-							options: {
-								rp: {
-									name: rp.rpName,
-									id: rp.rpId
-								},
-								user: {
-									id: userHandle,
-									name: userName,
-									displayName: userDisplayName
-								},
-								challenge: encodeBase64urlNoPadding(challenge),
-								pubKeyCredParams: rp.algorithms.map((alg) => ({
-									type: "public-key",
-									alg
-								})),
-								timeout: rp.challengeExpirationMs,
-								attestation: rp.attestation,
-								authenticatorSelection: {
-									residentKey: rp.residentKey,
-									requireResidentKey: rp.residentKey === "required",
-									userVerification: rp.userVerification,
-									...rp.authenticatorAttachment ? { authenticatorAttachment: rp.authenticatorAttachment } : {}
-								},
-								excludeCredentials
-							},
-							verifier
-						};
+	const dispatch = resolvePasskeyDispatch(params);
+	const handler = {
+		registerOptions: async () => {
+			const userId = await requireAuthenticatedUserId(ctx);
+			const rp = resolveRpOptions(provider);
+			const challenge = new Uint8Array(32);
+			crypto.getRandomValues(challenge);
+			const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, challengeHash);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let user;
+			try {
+				user = await queryUserById(ctx, userId);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			const userName = params.userName ?? user?.email ?? "user";
+			const userDisplayName = params.userDisplayName ?? user?.name ?? userName;
+			let existing;
+			try {
+				existing = await queryPasskeysByUserId(ctx, userId);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			const excludeCredentials = existing.map((pk) => ({
+				id: pk.credentialId,
+				transports: pk.transports
+			}));
+			const userHandle = encodeBase64urlNoPadding(new TextEncoder().encode(userId));
+			return {
+				kind: "passkeyOptions",
+				options: {
+					rp: {
+						name: rp.rpName,
+						id: rp.rpId
+					},
+					user: {
+						id: userHandle,
+						name: userName,
+						displayName: userDisplayName
+					},
+					challenge: encodeBase64urlNoPadding(challenge),
+					pubKeyCredParams: rp.algorithms.map((alg) => ({
+						type: "public-key",
+						alg
+					})),
+					timeout: rp.challengeExpirationMs,
+					attestation: rp.attestation,
+					authenticatorSelection: {
+						residentKey: rp.residentKey,
+						requireResidentKey: rp.residentKey === "required",
+						userVerification: rp.userVerification,
+						...rp.authenticatorAttachment ? { authenticatorAttachment: rp.authenticatorAttachment } : {}
 					},
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "An unexpected error occurred."
-					})
+					excludeCredentials
+				},
+				verifier
+			};
+		},
+		registerVerify: async () => {
+			const userId = await requireAuthenticatedUserId(ctx);
+			const rp = resolveRpOptions(provider);
+			const verifier = requirePasskeyVerifier(args.verifier);
+			const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON")));
+			verifyClientDataType(clientData, ClientDataType.Create, "webauthn.create");
+			verifyOrigin(clientData, rp);
+			await verifyAndConsumeChallenge(clientData, ctx, verifier);
+			const authData = parseAttestationObject(decodeBase64urlIgnorePadding(requireStringParam(params.attestationObject, "attestationObject"))).authenticatorData;
+			verifyRpId(authData, rp.rpId);
+			verifyUserFlags(authData, rp);
+			if (authData.credential == null) throw convexError("PASSKEY_NO_CREDENTIAL", "No credential in attestation.");
+			const credential = authData.credential;
+			const credentialId = encodeBase64urlNoPadding(credential.id);
+			const publicKey = credential.publicKey;
+			const algorithm = publicKey.isAlgorithmDefined() ? publicKey.algorithm() : publicKey.type() === COSEKeyType.EC2 ? coseAlgorithmES256 : publicKey.type() === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
+			const publicKeyBytes = resolveRegistrationPublicKeyBytes(publicKey, algorithm);
+			try {
+				const deviceType = params.deviceType ?? "single-device";
+				const backedUp = params.backedUp ?? false;
+				await authDb(ctx, ctx.auth.config).accounts.create({
+					userId,
+					provider: provider.id,
+					providerAccountId: credentialId
 				});
-			})),
-			registerVerify: (_) => Fx.zip(Fx.from({
-				ok: () => ctx.auth.getUserIdentity(),
-				err: () => Cv.error({
-					code: "PASSKEY_AUTH_REQUIRED",
-					message: "Sign in first, then add a passkey to your account."
-				})
-			}).pipe(Fx.chain((id) => id === null ? Cv.fail({
-				code: "PASSKEY_AUTH_REQUIRED",
-				message: "Sign in first, then add a passkey to your account."
-			}) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => requirePasskeyVerifierFx(args.verifier).pipe(Fx.chain((verifier) => {
-				const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(params.clientDataJSON));
-				return Fx.succeed(clientData).pipe(Fx.chain(verifyClientDataType(ClientDataType.Create, "webauthn.create")), Fx.chain(verifyOrigin(rp)), Fx.chain(verifyAndConsumeChallenge(ctx, verifier)), Fx.map(() => {
-					return parseAttestationObject(decodeBase64urlIgnorePadding(params.attestationObject)).authenticatorData;
-				})).pipe(Fx.chain(verifyRpId(rp.rpId)), Fx.chain(verifyUserFlags(rp)), Fx.chain((authData) => {
-					if (authData.credential == null) return Cv.fail({
-						code: "PASSKEY_NO_CREDENTIAL",
-						message: "No credential in attestation."
-					});
-					return Fx.succeed({
-						authData,
-						credential: authData.credential
-					});
-				}), Fx.chain(({ authData, credential }) => {
-					const credentialId = encodeBase64urlNoPadding(credential.id);
-					const publicKey = credential.publicKey;
-					let algorithm;
-					if (publicKey.isAlgorithmDefined()) algorithm = publicKey.algorithm();
-					else {
-						const keyType = publicKey.type();
-						algorithm = keyType === COSEKeyType.EC2 ? coseAlgorithmES256 : keyType === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
+				await mutatePasskeyInsert(ctx, {
+					userId,
+					credentialId,
+					publicKey: publicKeyBytes.buffer.slice(publicKeyBytes.byteOffset, publicKeyBytes.byteOffset + publicKeyBytes.byteLength),
+					algorithm,
+					counter: authData.signatureCounter,
+					transports: params.transports,
+					deviceType,
+					backedUp,
+					name: params.passkeyName,
+					createdAt: Date.now()
+				});
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let signInResult;
+			try {
+				signInResult = await callSignIn(ctx, {
+					userId,
+					generateTokens: true
+				});
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		},
+		authOptions: async () => {
+			const rp = resolveRpOptions(provider);
+			const challenge = new Uint8Array(32);
+			crypto.getRandomValues(challenge);
+			const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, challengeHash);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let allowCredentials;
+			if (params.email) {
+				const email = requireStringParam(params.email, "email");
+				let user;
+				try {
+					user = await queryUserByVerifiedEmail(ctx, email);
+				} catch {
+					throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+				}
+				if (user) {
+					let passkeys;
+					try {
+						passkeys = await queryPasskeysByUserId(ctx, user._id);
+					} catch {
+						throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
 					}
-					const handler = {
-						[coseAlgorithmES256]: () => {
-							const ec2 = publicKey.ec2();
-							const xBytes = new Uint8Array(32);
-							let vx = ec2.x;
-							for (let i = 31; i >= 0; i--) {
-								xBytes[i] = Number(vx & 255n);
-								vx >>= 8n;
-							}
-							const yBytes = new Uint8Array(32);
-							let vy = ec2.y;
-							for (let i = 31; i >= 0; i--) {
-								yBytes[i] = Number(vy & 255n);
-								vy >>= 8n;
-							}
-							const bytes = new Uint8Array(65);
-							bytes[0] = 4;
-							bytes.set(xBytes, 1);
-							bytes.set(yBytes, 33);
-							return Fx.succeed(bytes);
-						},
-						[coseAlgorithmRS256]: () => {
-							const rsa = publicKey.rsa();
-							const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);
-							return Fx.succeed(rsaPubKey.encodePKCS1());
-						}
-					}[algorithm];
-					return (handler ? handler() : Cv.fail({
-						code: "PASSKEY_UNSUPPORTED_ALGORITHM",
-						message: `Unsupported algorithm: ${algorithm}`
-					})).pipe(Fx.chain((publicKeyBytes) => Fx.from({
-						ok: async () => {
-							const deviceType = params.deviceType ?? "single-device";
-							const backedUp = params.backedUp ?? false;
-							await authDb(ctx, ctx.auth.config).accounts.create({
-								userId,
-								provider: provider.id,
-								providerAccountId: credentialId
-							});
-							await mutatePasskeyInsert(ctx, {
-								userId,
-								credentialId,
-								publicKey: publicKeyBytes.buffer.slice(publicKeyBytes.byteOffset, publicKeyBytes.byteOffset + publicKeyBytes.byteLength),
-								algorithm,
-								counter: authData.signatureCounter,
-								transports: params.transports,
-								deviceType,
-								backedUp,
-								name: params.passkeyName,
-								createdAt: Date.now()
-							});
-							return {
-								kind: "signedIn",
-								signedIn: await callSignIn(ctx, {
-									userId,
-									generateTokens: true
-								})
-							};
-						},
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "An unexpected error occurred."
-						})
-					})));
-				}));
-			})))),
-			authOptions: (_) => resolveRpOptionsFx(provider).pipe(Fx.chain((rp) => {
-				const challenge = new Uint8Array(32);
-				crypto.getRandomValues(challenge);
-				const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-				return Fx.from({
-					ok: async () => {
-						const verifier = await callVerifier(ctx);
-						await callVerifierSignature(ctx, {
-							verifier,
-							signature: challengeHash
-						});
-						let allowCredentials;
-						if (params.email) {
-							const user = await queryUserByVerifiedEmail(ctx, params.email);
-							if (user) {
-								const passkeys = await queryPasskeysByUserId(ctx, user._id);
-								if (passkeys.length > 0) allowCredentials = passkeys.map((pk) => ({
-									type: "public-key",
-									id: pk.credentialId,
-									transports: pk.transports
-								}));
-							}
-						}
-						const options = {
-							challenge: encodeBase64urlNoPadding(challenge),
-							timeout: rp.challengeExpirationMs,
-							rpId: rp.rpId,
-							userVerification: rp.userVerification
-						};
-						if (allowCredentials) options.allowCredentials = allowCredentials;
-						return {
-							kind: "passkeyOptions",
-							options,
-							verifier
-						};
-					},
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "An unexpected error occurred."
-					})
+					if (passkeys.length > 0) allowCredentials = passkeys.map((pk) => ({
+						type: "public-key",
+						id: pk.credentialId,
+						transports: pk.transports
+					}));
+				}
+			}
+			const options = {
+				challenge: encodeBase64urlNoPadding(challenge),
+				timeout: rp.challengeExpirationMs,
+				rpId: rp.rpId,
+				userVerification: rp.userVerification
+			};
+			if (allowCredentials) options.allowCredentials = allowCredentials;
+			return {
+				kind: "passkeyOptions",
+				options,
+				verifier
+			};
+		},
+		authVerify: async () => {
+			const rp = resolveRpOptions(provider);
+			const verifier = requirePasskeyVerifier(args.verifier);
+			const clientDataJSON = decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON"));
+			const clientData = parseClientDataJSON(clientDataJSON);
+			verifyClientDataType(clientData, ClientDataType.Get, "webauthn.get");
+			verifyOrigin(clientData, rp);
+			await verifyAndConsumeChallenge(clientData, ctx, verifier);
+			const credentialId = params.credentialId;
+			if (credentialId == null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Missing credential ID");
+			let passkey;
+			try {
+				passkey = await queryPasskeyByCredentialId(ctx, credentialId);
+			} catch {
+				throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown passkey credential.");
+			}
+			if (passkey === null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown credential");
+			const authenticatorDataBytes = decodeBase64urlIgnorePadding(requireStringParam(params.authenticatorData, "authenticatorData"));
+			const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
+			const signatureBytes = decodeBase64urlIgnorePadding(requireStringParam(params.signature, "signature"));
+			const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
+			verifyRpId(authenticatorData, rp.rpId);
+			verifyUserFlags(authenticatorData, rp);
+			verifyAssertionSignature(passkey, signatureBytes, messageHash);
+			if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) throw convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected.");
+			try {
+				await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let signInResult;
+			try {
+				signInResult = await callSignIn(ctx, {
+					userId: passkey.userId,
+					generateTokens: true
 				});
-			})),
-			authVerify: (_) => Fx.zip(resolveRpOptionsFx(provider), requirePasskeyVerifierFx(args.verifier)).pipe(Fx.chain(([rp, verifier]) => {
-				const clientDataJSON = decodeBase64urlIgnorePadding(params.clientDataJSON);
-				const clientData = parseClientDataJSON(clientDataJSON);
-				return Fx.succeed(clientData).pipe(Fx.chain(verifyClientDataType(ClientDataType.Get, "webauthn.get")), Fx.chain(verifyOrigin(rp)), Fx.chain(verifyAndConsumeChallenge(ctx, verifier)), Fx.chain(() => params.credentialId != null ? Fx.succeed(params.credentialId) : Cv.fail({
-					code: "PASSKEY_UNKNOWN_CREDENTIAL",
-					message: "Missing credential ID"
-				}))).pipe(Fx.chain((credentialId) => Fx.from({
-					ok: () => queryPasskeyByCredentialId(ctx, credentialId),
-					err: () => Cv.error({
-						code: "PASSKEY_UNKNOWN_CREDENTIAL",
-						message: "Unknown passkey credential."
-					})
-				}).pipe(Fx.chain((passkey) => passkey ? Fx.succeed(passkey) : Cv.fail({
-					code: "PASSKEY_UNKNOWN_CREDENTIAL",
-					message: "Unknown credential"
-				})))), Fx.chain((passkey) => {
-					const authenticatorDataBytes = decodeBase64urlIgnorePadding(params.authenticatorData);
-					const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
-					const signature = decodeBase64urlIgnorePadding(params.signature);
-					const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
-					return Fx.succeed(authenticatorData).pipe(Fx.chain(verifyRpId(rp.rpId)), Fx.chain(verifyUserFlags(rp))).pipe(Fx.chain(() => {
-						const storedPublicKeyBytes = new Uint8Array(passkey.publicKey);
-						const handler = {
-							[coseAlgorithmES256]: () => {
-								return verifyECDSASignature(decodeSEC1PublicKey(p256, storedPublicKeyBytes), messageHash, decodePKIXECDSASignature(signature)) ? Fx.succeed(void 0) : Cv.fail({
-									code: "PASSKEY_INVALID_SIGNATURE",
-									message: "Invalid passkey signature."
-								});
-							},
-							[coseAlgorithmRS256]: () => {
-								return verifyRSASSAPKCS1v15Signature(decodePKCS1RSAPublicKey(storedPublicKeyBytes), sha256ObjectIdentifier, messageHash, signature) ? Fx.succeed(void 0) : Cv.fail({
-									code: "PASSKEY_INVALID_SIGNATURE",
-									message: "Invalid passkey signature."
-								});
-							}
-						}[passkey.algorithm];
-						return handler ? handler() : Cv.fail({
-							code: "PASSKEY_UNSUPPORTED_ALGORITHM",
-							message: `Unsupported algorithm: ${passkey.algorithm}`
-						});
-					})).pipe(Fx.chain(() => passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter ? Cv.fail({
-						code: "PASSKEY_COUNTER_ERROR",
-						message: "Authenticator counter did not increase — possible credential cloning detected."
-					}) : Fx.succeed(authenticatorData))).pipe(Fx.chain(() => Fx.from({
-						ok: async () => {
-							await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
-							return {
-								kind: "signedIn",
-								signedIn: await callSignIn(ctx, {
-									userId: passkey.userId,
-									generateTokens: true
-								})
-							};
-						},
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "An unexpected error occurred."
-						})
-					})));
-				}));
-			}))
-		});
-	}));
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		}
+	}[dispatch.flow];
+	if (!handler) throw convexError("PASSKEY_MISSING_FLOW", `Unknown passkey flow: ${dispatch.flow}`);
+	return handler();
 }
 
 //#endregion