@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/passkey.js

@@ -1,415 +0,0 @@
-import { userIdFromIdentitySubject } from "./identity.js";
-import { siteUrlsFromEnv } from "./utils.js";
-import { authDb } from "./db.js";
-import { callVerifierSignature } from "./mutations/signature.js";
-import { callSignIn } from "./mutations/signin.js";
-import { callVerifier } from "./mutations/verifier.js";
-import { mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateVerifierDelete, queryPasskeyByCredentialId, queryPasskeysByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById } from "./types.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { sha256 } from "@oslojs/crypto/sha2";
-import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
-import { decodePKIXECDSASignature, decodeSEC1PublicKey, p256, verifyECDSASignature } from "@oslojs/crypto/ecdsa";
-import { RSAPublicKey, decodePKCS1RSAPublicKey, sha256ObjectIdentifier, verifyRSASSAPKCS1v15Signature } from "@oslojs/crypto/rsa";
-import { COSEKeyType, ClientDataType, coseAlgorithmES256, coseAlgorithmRS256, createAssertionSignatureMessage, parseAttestationObject, parseAuthenticatorData, parseClientDataJSON } from "@oslojs/webauthn";
-
-//#region src/server/passkey.ts
-/**
-* Server-side WebAuthn ceremony logic for passkey authentication.
-*
-* Handles the four phases of the WebAuthn flow:
-* 1. registerOptions — generate PublicKeyCredentialCreationOptions
-* 2. registerVerify — verify attestation and store credential
-* 3. authOptions — generate PublicKeyCredentialRequestOptions
-* 4. authVerify — verify assertion signature and sign in
-*
-* Uses `@oslojs/webauthn` for attestation/assertion parsing and
-* `@oslojs/crypto` for signature verification.
-*
-* All functions return `Fx<A, ConvexError<any>>` composed via `Fx.chain` pipelines.
-*
-* @module
-*/
-/**
-* Resolve passkey relying party options from provider config and environment.
-*
-* Returns `Fx<RpOptions, ConvexError<any>>` — fails if neither SITE_URL nor rpId
-* is configured.
-*/
-const resolveRpOptionsFx = (provider) => {
-	const configuredSiteUrls = process.env.SITE_URL === void 0 ? null : siteUrlsFromEnv();
-	const siteUrl = configuredSiteUrls?.primaryUrl;
-	const hasSiteUrl = siteUrl !== void 0 && siteUrl !== "";
-	const hasRpId = provider.options.rpId !== void 0;
-	return Fx.succeed({
-		siteUrl,
-		hasSiteUrl,
-		hasRpId
-	}).pipe(Fx.chain(({ siteUrl: siteUrl$1, hasSiteUrl: hasSiteUrl$1, hasRpId: hasRpId$1 }) => !hasSiteUrl$1 && !hasRpId$1 ? Cv.fail({
-		code: "PASSKEY_MISSING_CONFIG",
-		message: "Passkey provider requires SITE_URL env var (your frontend URL) or explicit rpId / origin in the provider config. CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain."
-	}) : Fx.succeed(siteUrl$1)), Fx.map((siteUrl$1) => {
-		const siteHostname = siteUrl$1 ? new URL(siteUrl$1).hostname : void 0;
-		const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl$1;
-		return {
-			rpName: provider.options.rpName ?? siteHostname ?? "localhost",
-			rpId: provider.options.rpId ?? siteHostname ?? "localhost",
-			origin: provider.options.origin ?? defaultOrigin ?? "http://localhost",
-			attestation: provider.options.attestation ?? "none",
-			userVerification: provider.options.userVerification ?? "required",
-			residentKey: provider.options.residentKey ?? "preferred",
-			authenticatorAttachment: provider.options.authenticatorAttachment,
-			algorithms: provider.options.algorithms ?? [coseAlgorithmES256, coseAlgorithmRS256],
-			challengeExpirationMs: provider.options.challengeExpirationMs ?? 3e5
-		};
-	}));
-};
-/** Verify client data type matches expected WebAuthn ceremony type. */
-const verifyClientDataType = (expectedType, label) => (clientData) => clientData.type === expectedType ? Fx.succeed(clientData) : Cv.fail({
-	code: "PASSKEY_INVALID_CLIENT_DATA",
-	message: `Invalid client data type: expected ${label}`
-});
-/** Verify origin is in the allowed list. */
-const verifyOrigin = (rp) => (clientData) => {
-	const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];
-	return allowed.includes(clientData.origin) ? Fx.succeed(clientData) : Cv.fail({
-		code: "PASSKEY_INVALID_ORIGIN",
-		message: `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(", ")}`
-	});
-};
-/** Verify the challenge hash matches the stored verifier, then delete verifier. */
-const verifyAndConsumeChallenge = (ctx, verifierValue) => (clientData) => {
-	const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(clientData.challenge)));
-	return Fx.from({
-		ok: () => queryVerifierById(ctx, verifierValue),
-		err: () => Cv.error({
-			code: "PASSKEY_INVALID_CHALLENGE",
-			message: "Invalid or expired passkey challenge."
-		})
-	}).pipe(Fx.chain((doc) => !doc || doc.signature !== challengeHash ? Cv.fail({
-		code: "PASSKEY_INVALID_CHALLENGE",
-		message: "Invalid or expired passkey challenge."
-	}) : Fx.succeed(doc)), Fx.chain(() => Fx.from({
-		ok: () => mutateVerifierDelete(ctx, verifierValue),
-		err: () => Cv.error({
-			code: "PASSKEY_INVALID_CHALLENGE",
-			message: "Invalid or expired passkey challenge."
-		})
-	})), Fx.map(() => clientData));
-};
-/** Verify RP ID hash matches. */
-const verifyRpId = (rpId) => (authData) => authData.verifyRelyingPartyIdHash(rpId) ? Fx.succeed(authData) : Cv.fail({
-	code: "PASSKEY_RP_MISMATCH",
-	message: "Relying party ID mismatch."
-});
-/** Verify user presence and (optionally) user verification flags. */
-const verifyUserFlags = (rp) => (authData) => !authData.userPresent ? Cv.fail({
-	code: "PASSKEY_USER_PRESENCE",
-	message: "User presence flag not set."
-}) : rp.userVerification === "required" && !authData.userVerified ? Cv.fail({
-	code: "PASSKEY_USER_VERIFICATION",
-	message: "User verification required but not performed."
-}) : Fx.succeed(authData);
-const PASSKEY_FLOW = {
-	registerOptions: "registerOptions",
-	registerVerify: "registerVerify",
-	authOptions: "authOptions",
-	authVerify: "authVerify"
-};
-const PASSKEY_FLOWS = [
-	PASSKEY_FLOW.registerOptions,
-	PASSKEY_FLOW.registerVerify,
-	PASSKEY_FLOW.authOptions,
-	PASSKEY_FLOW.authVerify
-];
-const resolvePasskeyDispatchFx = (params) => {
-	const flow = params.flow;
-	return typeof flow === "string" && PASSKEY_FLOWS.includes(flow) ? Fx.succeed({ flow }) : Cv.fail({
-		code: "PASSKEY_MISSING_FLOW",
-		message: "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify"
-	});
-};
-const requirePasskeyVerifierFx = (verifier) => verifier != null ? Fx.succeed(verifier) : Cv.fail({
-	code: "PASSKEY_MISSING_VERIFIER",
-	message: "Missing verifier for passkey operation."
-});
-/**
-* Main passkey handler dispatched from signIn.ts.
-*
-* Routes to the appropriate phase based on `params.flow` via `dispatchFx`.
-*/
-function handlePasskeyFx(ctx, provider, args) {
-	const params = args.params ?? {};
-	return resolvePasskeyDispatchFx(params).pipe(Fx.chain((dispatch) => {
-		return Fx.match(dispatch).on("flow", {
-			registerOptions: (_) => Fx.zip(Fx.from({
-				ok: () => ctx.auth.getUserIdentity(),
-				err: () => Cv.error({
-					code: "PASSKEY_AUTH_REQUIRED",
-					message: "Sign in first, then add a passkey to your account."
-				})
-			}).pipe(Fx.chain((id) => id === null ? Cv.fail({
-				code: "PASSKEY_AUTH_REQUIRED",
-				message: "Sign in first, then add a passkey to your account."
-			}) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => {
-				const challenge = new Uint8Array(32);
-				crypto.getRandomValues(challenge);
-				const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-				return Fx.from({
-					ok: async () => {
-						const verifier = await callVerifier(ctx);
-						await callVerifierSignature(ctx, {
-							verifier,
-							signature: challengeHash
-						});
-						const user = await queryUserById(ctx, userId);
-						const userName = params.userName ?? user?.email ?? "user";
-						const userDisplayName = params.userDisplayName ?? user?.name ?? userName;
-						const excludeCredentials = (await queryPasskeysByUserId(ctx, userId)).map((pk) => ({
-							id: pk.credentialId,
-							transports: pk.transports
-						}));
-						const userHandle = encodeBase64urlNoPadding(new TextEncoder().encode(userId));
-						return {
-							kind: "passkeyOptions",
-							options: {
-								rp: {
-									name: rp.rpName,
-									id: rp.rpId
-								},
-								user: {
-									id: userHandle,
-									name: userName,
-									displayName: userDisplayName
-								},
-								challenge: encodeBase64urlNoPadding(challenge),
-								pubKeyCredParams: rp.algorithms.map((alg) => ({
-									type: "public-key",
-									alg
-								})),
-								timeout: rp.challengeExpirationMs,
-								attestation: rp.attestation,
-								authenticatorSelection: {
-									residentKey: rp.residentKey,
-									requireResidentKey: rp.residentKey === "required",
-									userVerification: rp.userVerification,
-									...rp.authenticatorAttachment ? { authenticatorAttachment: rp.authenticatorAttachment } : {}
-								},
-								excludeCredentials
-							},
-							verifier
-						};
-					},
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "An unexpected error occurred."
-					})
-				});
-			})),
-			registerVerify: (_) => Fx.zip(Fx.from({
-				ok: () => ctx.auth.getUserIdentity(),
-				err: () => Cv.error({
-					code: "PASSKEY_AUTH_REQUIRED",
-					message: "Sign in first, then add a passkey to your account."
-				})
-			}).pipe(Fx.chain((id) => id === null ? Cv.fail({
-				code: "PASSKEY_AUTH_REQUIRED",
-				message: "Sign in first, then add a passkey to your account."
-			}) : Fx.succeed(userIdFromIdentitySubject(id.subject)))), resolveRpOptionsFx(provider)).pipe(Fx.chain(([userId, rp]) => requirePasskeyVerifierFx(args.verifier).pipe(Fx.chain((verifier) => {
-				const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(params.clientDataJSON));
-				return Fx.succeed(clientData).pipe(Fx.chain(verifyClientDataType(ClientDataType.Create, "webauthn.create")), Fx.chain(verifyOrigin(rp)), Fx.chain(verifyAndConsumeChallenge(ctx, verifier)), Fx.map(() => {
-					return parseAttestationObject(decodeBase64urlIgnorePadding(params.attestationObject)).authenticatorData;
-				})).pipe(Fx.chain(verifyRpId(rp.rpId)), Fx.chain(verifyUserFlags(rp)), Fx.chain((authData) => {
-					if (authData.credential == null) return Cv.fail({
-						code: "PASSKEY_NO_CREDENTIAL",
-						message: "No credential in attestation."
-					});
-					return Fx.succeed({
-						authData,
-						credential: authData.credential
-					});
-				}), Fx.chain(({ authData, credential }) => {
-					const credentialId = encodeBase64urlNoPadding(credential.id);
-					const publicKey = credential.publicKey;
-					let algorithm;
-					if (publicKey.isAlgorithmDefined()) algorithm = publicKey.algorithm();
-					else {
-						const keyType = publicKey.type();
-						algorithm = keyType === COSEKeyType.EC2 ? coseAlgorithmES256 : keyType === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
-					}
-					const handler = {
-						[coseAlgorithmES256]: () => {
-							const ec2 = publicKey.ec2();
-							const xBytes = new Uint8Array(32);
-							let vx = ec2.x;
-							for (let i = 31; i >= 0; i--) {
-								xBytes[i] = Number(vx & 255n);
-								vx >>= 8n;
-							}
-							const yBytes = new Uint8Array(32);
-							let vy = ec2.y;
-							for (let i = 31; i >= 0; i--) {
-								yBytes[i] = Number(vy & 255n);
-								vy >>= 8n;
-							}
-							const bytes = new Uint8Array(65);
-							bytes[0] = 4;
-							bytes.set(xBytes, 1);
-							bytes.set(yBytes, 33);
-							return Fx.succeed(bytes);
-						},
-						[coseAlgorithmRS256]: () => {
-							const rsa = publicKey.rsa();
-							const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);
-							return Fx.succeed(rsaPubKey.encodePKCS1());
-						}
-					}[algorithm];
-					return (handler ? handler() : Cv.fail({
-						code: "PASSKEY_UNSUPPORTED_ALGORITHM",
-						message: `Unsupported algorithm: ${algorithm}`
-					})).pipe(Fx.chain((publicKeyBytes) => Fx.from({
-						ok: async () => {
-							const deviceType = params.deviceType ?? "single-device";
-							const backedUp = params.backedUp ?? false;
-							await authDb(ctx, ctx.auth.config).accounts.create({
-								userId,
-								provider: provider.id,
-								providerAccountId: credentialId
-							});
-							await mutatePasskeyInsert(ctx, {
-								userId,
-								credentialId,
-								publicKey: publicKeyBytes.buffer.slice(publicKeyBytes.byteOffset, publicKeyBytes.byteOffset + publicKeyBytes.byteLength),
-								algorithm,
-								counter: authData.signatureCounter,
-								transports: params.transports,
-								deviceType,
-								backedUp,
-								name: params.passkeyName,
-								createdAt: Date.now()
-							});
-							return {
-								kind: "signedIn",
-								signedIn: await callSignIn(ctx, {
-									userId,
-									generateTokens: true
-								})
-							};
-						},
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "An unexpected error occurred."
-						})
-					})));
-				}));
-			})))),
-			authOptions: (_) => resolveRpOptionsFx(provider).pipe(Fx.chain((rp) => {
-				const challenge = new Uint8Array(32);
-				crypto.getRandomValues(challenge);
-				const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-				return Fx.from({
-					ok: async () => {
-						const verifier = await callVerifier(ctx);
-						await callVerifierSignature(ctx, {
-							verifier,
-							signature: challengeHash
-						});
-						let allowCredentials;
-						if (params.email) {
-							const user = await queryUserByVerifiedEmail(ctx, params.email);
-							if (user) {
-								const passkeys = await queryPasskeysByUserId(ctx, user._id);
-								if (passkeys.length > 0) allowCredentials = passkeys.map((pk) => ({
-									type: "public-key",
-									id: pk.credentialId,
-									transports: pk.transports
-								}));
-							}
-						}
-						const options = {
-							challenge: encodeBase64urlNoPadding(challenge),
-							timeout: rp.challengeExpirationMs,
-							rpId: rp.rpId,
-							userVerification: rp.userVerification
-						};
-						if (allowCredentials) options.allowCredentials = allowCredentials;
-						return {
-							kind: "passkeyOptions",
-							options,
-							verifier
-						};
-					},
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "An unexpected error occurred."
-					})
-				});
-			})),
-			authVerify: (_) => Fx.zip(resolveRpOptionsFx(provider), requirePasskeyVerifierFx(args.verifier)).pipe(Fx.chain(([rp, verifier]) => {
-				const clientDataJSON = decodeBase64urlIgnorePadding(params.clientDataJSON);
-				const clientData = parseClientDataJSON(clientDataJSON);
-				return Fx.succeed(clientData).pipe(Fx.chain(verifyClientDataType(ClientDataType.Get, "webauthn.get")), Fx.chain(verifyOrigin(rp)), Fx.chain(verifyAndConsumeChallenge(ctx, verifier)), Fx.chain(() => params.credentialId != null ? Fx.succeed(params.credentialId) : Cv.fail({
-					code: "PASSKEY_UNKNOWN_CREDENTIAL",
-					message: "Missing credential ID"
-				}))).pipe(Fx.chain((credentialId) => Fx.from({
-					ok: () => queryPasskeyByCredentialId(ctx, credentialId),
-					err: () => Cv.error({
-						code: "PASSKEY_UNKNOWN_CREDENTIAL",
-						message: "Unknown passkey credential."
-					})
-				}).pipe(Fx.chain((passkey) => passkey ? Fx.succeed(passkey) : Cv.fail({
-					code: "PASSKEY_UNKNOWN_CREDENTIAL",
-					message: "Unknown credential"
-				})))), Fx.chain((passkey) => {
-					const authenticatorDataBytes = decodeBase64urlIgnorePadding(params.authenticatorData);
-					const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
-					const signature = decodeBase64urlIgnorePadding(params.signature);
-					const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
-					return Fx.succeed(authenticatorData).pipe(Fx.chain(verifyRpId(rp.rpId)), Fx.chain(verifyUserFlags(rp))).pipe(Fx.chain(() => {
-						const storedPublicKeyBytes = new Uint8Array(passkey.publicKey);
-						const handler = {
-							[coseAlgorithmES256]: () => {
-								return verifyECDSASignature(decodeSEC1PublicKey(p256, storedPublicKeyBytes), messageHash, decodePKIXECDSASignature(signature)) ? Fx.succeed(void 0) : Cv.fail({
-									code: "PASSKEY_INVALID_SIGNATURE",
-									message: "Invalid passkey signature."
-								});
-							},
-							[coseAlgorithmRS256]: () => {
-								return verifyRSASSAPKCS1v15Signature(decodePKCS1RSAPublicKey(storedPublicKeyBytes), sha256ObjectIdentifier, messageHash, signature) ? Fx.succeed(void 0) : Cv.fail({
-									code: "PASSKEY_INVALID_SIGNATURE",
-									message: "Invalid passkey signature."
-								});
-							}
-						}[passkey.algorithm];
-						return handler ? handler() : Cv.fail({
-							code: "PASSKEY_UNSUPPORTED_ALGORITHM",
-							message: `Unsupported algorithm: ${passkey.algorithm}`
-						});
-					})).pipe(Fx.chain(() => passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter ? Cv.fail({
-						code: "PASSKEY_COUNTER_ERROR",
-						message: "Authenticator counter did not increase — possible credential cloning detected."
-					}) : Fx.succeed(authenticatorData))).pipe(Fx.chain(() => Fx.from({
-						ok: async () => {
-							await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
-							return {
-								kind: "signedIn",
-								signedIn: await callSignIn(ctx, {
-									userId: passkey.userId,
-									generateTokens: true
-								})
-							};
-						},
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "An unexpected error occurred."
-						})
-					})));
-				}));
-			}))
-		});
-	}));
-}
-
-//#endregion
-export { handlePasskeyFx };
-//# sourceMappingURL=passkey.js.map

package/dist/component/server/passkey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey.js","names":["hasSiteUrl","hasRpId","siteUrl"],"sources":["../../../src/server/passkey.ts"],"sourcesContent":["/**\n * Server-side WebAuthn ceremony logic for passkey authentication.\n *\n * Handles the four phases of the WebAuthn flow:\n * 1. registerOptions — generate PublicKeyCredentialCreationOptions\n * 2. registerVerify — verify attestation and store credential\n * 3. authOptions — generate PublicKeyCredentialRequestOptions\n * 4. authVerify — verify assertion signature and sign in\n *\n * Uses `@oslojs/webauthn` for attestation/assertion parsing and\n * `@oslojs/crypto` for signature verification.\n *\n * All functions return `Fx<A, ConvexError<any>>` composed via `Fx.chain` pipelines.\n *\n * @module\n */\n\nimport {\n  p256,\n  verifyECDSASignature,\n  decodeSEC1PublicKey,\n  decodePKIXECDSASignature,\n} from \"@oslojs/crypto/ecdsa\";\nimport {\n  RSAPublicKey,\n  decodePKCS1RSAPublicKey,\n  sha256ObjectIdentifier,\n  verifyRSASSAPKCS1v15Signature,\n} from \"@oslojs/crypto/rsa\";\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  encodeBase64urlNoPadding,\n  decodeBase64urlIgnorePadding,\n} from \"@oslojs/encoding\";\nimport {\n  parseAttestationObject,\n  parseClientDataJSON,\n  parseAuthenticatorData,\n  createAssertionSignatureMessage,\n  ClientDataType,\n  coseAlgorithmES256,\n  coseAlgorithmRS256,\n  COSEKeyType,\n} from \"@oslojs/webauthn\";\nimport type { Fx as FxType } from \"@robelest/fx\";\nimport { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { ConvexError } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryUserByVerifiedEmail,\n  queryPasskeysByUserId,\n  queryPasskeyByCredentialId,\n  queryVerifierById,\n  mutatePasskeyInsert,\n  mutatePasskeyUpdateCounter,\n  mutateVerifierDelete,\n} from \"./types\";\nimport { siteUrlsFromEnv } from \"./utils\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Resolve RP options — Fx pipeline with validation\n// ============================================================================\n\n/** Resolved relying party configuration. */\ninterface RpOptions {\n  rpName: string;\n  rpId: string;\n  origin: string | string[];\n  attestation: string;\n  userVerification: string;\n  residentKey: string;\n  authenticatorAttachment?: string;\n  algorithms: number[];\n  challengeExpirationMs: number;\n}\n\n/**\n * Resolve passkey relying party options from provider config and environment.\n *\n * Returns `Fx<RpOptions, ConvexError<any>>` — fails if neither SITE_URL nor rpId\n * is configured.\n */\nconst resolveRpOptionsFx = (\n  provider: PasskeyProviderConfig,\n): FxType<RpOptions, ConvexError<any>> => {\n  const configuredSiteUrls =\n    process.env.SITE_URL === undefined ? null : siteUrlsFromEnv();\n  const siteUrl = configuredSiteUrls?.primaryUrl;\n  const hasSiteUrl = siteUrl !== undefined && siteUrl !== \"\";\n  const hasRpId = provider.options.rpId !== undefined;\n\n  return Fx.succeed({ siteUrl, hasSiteUrl, hasRpId }).pipe(\n    Fx.chain(({ siteUrl, hasSiteUrl, hasRpId }) =>\n      !hasSiteUrl && !hasRpId\n        ? Cv.fail({\n            code: \"PASSKEY_MISSING_CONFIG\",\n            message:\n              \"Passkey provider requires SITE_URL env var (your frontend URL) \" +\n              \"or explicit rpId / origin in the provider config. \" +\n              \"CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.\",\n          })\n        : Fx.succeed(siteUrl),\n    ),\n    Fx.map((siteUrl) => {\n      const siteHostname = siteUrl ? new URL(siteUrl).hostname : undefined;\n      const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl;\n      return {\n        rpName: provider.options.rpName ?? siteHostname ?? \"localhost\",\n        rpId: provider.options.rpId ?? siteHostname ?? \"localhost\",\n        origin: provider.options.origin ?? defaultOrigin ?? \"http://localhost\",\n        attestation: provider.options.attestation ?? \"none\",\n        userVerification: provider.options.userVerification ?? \"required\",\n        residentKey: provider.options.residentKey ?? \"preferred\",\n        authenticatorAttachment: provider.options.authenticatorAttachment,\n        algorithms: provider.options.algorithms ?? [\n          coseAlgorithmES256,\n          coseAlgorithmRS256,\n        ],\n        challengeExpirationMs:\n          provider.options.challengeExpirationMs ?? 300_000,\n      };\n    }),\n  );\n};\n\n// ============================================================================\n// Composable validators — small functions (A) => Fx<B, ConvexError<any>>\n// ============================================================================\n\n/** Verify client data type matches expected WebAuthn ceremony type. */\nconst verifyClientDataType =\n  <T extends { type: ClientDataType }>(\n    expectedType: ClientDataType,\n    label: string,\n  ) =>\n  (clientData: T): FxType<T, ConvexError<any>> =>\n    clientData.type === expectedType\n      ? Fx.succeed(clientData)\n      : Cv.fail({\n          code: \"PASSKEY_INVALID_CLIENT_DATA\",\n          message: `Invalid client data type: expected ${label}`,\n        });\n\n/** Verify origin is in the allowed list. */\nconst verifyOrigin =\n  (rp: RpOptions) =>\n  <T extends { origin: string }>(\n    clientData: T,\n  ): FxType<T, ConvexError<any>> => {\n    const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];\n    return allowed.includes(clientData.origin)\n      ? Fx.succeed(clientData)\n      : Cv.fail({\n          code: \"PASSKEY_INVALID_ORIGIN\",\n          message: `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(\", \")}`,\n        });\n  };\n\n/** Verify the challenge hash matches the stored verifier, then delete verifier. */\nconst verifyAndConsumeChallenge =\n  (ctx: EnrichedActionCtx, verifierValue: string) =>\n  <T extends { challenge: Uint8Array }>(\n    clientData: T,\n  ): FxType<T, ConvexError<any>> => {\n    const challengeHash = encodeBase64urlNoPadding(\n      new Uint8Array(sha256(clientData.challenge)),\n    );\n    return Fx.from({\n      ok: () => queryVerifierById(ctx, verifierValue),\n      err: () =>\n        Cv.error({\n          code: \"PASSKEY_INVALID_CHALLENGE\",\n          message: \"Invalid or expired passkey challenge.\",\n        }),\n    }).pipe(\n      Fx.chain((doc) =>\n        !doc || doc.signature !== challengeHash\n          ? Cv.fail({\n              code: \"PASSKEY_INVALID_CHALLENGE\",\n              message: \"Invalid or expired passkey challenge.\",\n            })\n          : Fx.succeed(doc),\n      ),\n      Fx.chain(() =>\n        Fx.from({\n          ok: () => mutateVerifierDelete(ctx, verifierValue),\n          err: () =>\n            Cv.error({\n              code: \"PASSKEY_INVALID_CHALLENGE\",\n              message: \"Invalid or expired passkey challenge.\",\n            }),\n        }),\n      ),\n      Fx.map(() => clientData),\n    );\n  };\n\n/** Verify RP ID hash matches. */\nconst verifyRpId =\n  (rpId: string) =>\n  <T extends { verifyRelyingPartyIdHash: (id: string) => boolean }>(\n    authData: T,\n  ): FxType<T, ConvexError<any>> =>\n    authData.verifyRelyingPartyIdHash(rpId)\n      ? Fx.succeed(authData)\n      : Cv.fail({\n          code: \"PASSKEY_RP_MISMATCH\",\n          message: \"Relying party ID mismatch.\",\n        });\n\n/** Verify user presence and (optionally) user verification flags. */\nconst verifyUserFlags =\n  (rp: RpOptions) =>\n  <T extends { userPresent: boolean; userVerified: boolean }>(\n    authData: T,\n  ): FxType<T, ConvexError<any>> =>\n    !authData.userPresent\n      ? Cv.fail({\n          code: \"PASSKEY_USER_PRESENCE\",\n          message: \"User presence flag not set.\",\n        })\n      : rp.userVerification === \"required\" && !authData.userVerified\n        ? Cv.fail({\n            code: \"PASSKEY_USER_VERIFICATION\",\n            message: \"User verification required but not performed.\",\n          })\n        : Fx.succeed(authData);\n\n// ============================================================================\n// Registration flow\n// ============================================================================\n\n// ============================================================================\n// Authentication flow\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/** Result type for all passkey flows. */\ntype PasskeyResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | { kind: \"passkeyOptions\"; options: Record<string, any>; verifier: string };\n\nconst PASSKEY_FLOW = {\n  registerOptions: \"registerOptions\",\n  registerVerify: \"registerVerify\",\n  authOptions: \"authOptions\",\n  authVerify: \"authVerify\",\n} as const;\n\nconst PASSKEY_FLOWS = [\n  PASSKEY_FLOW.registerOptions,\n  PASSKEY_FLOW.registerVerify,\n  PASSKEY_FLOW.authOptions,\n  PASSKEY_FLOW.authVerify,\n] as const;\n\ntype PasskeyDispatch =\n  | { flow: typeof PASSKEY_FLOW.registerOptions }\n  | { flow: typeof PASSKEY_FLOW.registerVerify }\n  | { flow: typeof PASSKEY_FLOW.authOptions }\n  | { flow: typeof PASSKEY_FLOW.authVerify };\n\nconst resolvePasskeyDispatchFx = (\n  params: Record<string, unknown>,\n): FxType<PasskeyDispatch, ConvexError<any>> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && PASSKEY_FLOWS.includes(flow as never)\n    ? Fx.succeed({ flow: flow as (typeof PASSKEY_FLOWS)[number] })\n    : Cv.fail({\n        code: \"PASSKEY_MISSING_FLOW\",\n        message:\n          \"Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify\",\n      });\n};\n\nconst requirePasskeyVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, ConvexError<any>> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Cv.fail({\n        code: \"PASSKEY_MISSING_VERIFIER\",\n        message: \"Missing verifier for passkey operation.\",\n      });\n\n/**\n * Main passkey handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.\n */\nexport function handlePasskeyFx(\n  ctx: EnrichedActionCtx,\n  provider: PasskeyProviderConfig,\n  args: {\n    params?: Record<string, any>;\n    verifier?: string;\n  },\n): FxType<PasskeyResult, ConvexError<any>> {\n  const params = (args.params ?? {}) as Record<string, any>;\n\n  return resolvePasskeyDispatchFx(params).pipe(\n    Fx.chain((dispatch) => {\n      const flowFx: FxType<PasskeyResult, ConvexError<any>> = Fx.match(\n        dispatch,\n      ).on(\"flow\", {\n        registerOptions: (_) =>\n          Fx.zip(\n            Fx.from({\n              ok: () => ctx.auth.getUserIdentity(),\n              err: () =>\n                Cv.error({\n                  code: \"PASSKEY_AUTH_REQUIRED\",\n                  message: \"Sign in first, then add a passkey to your account.\",\n                }),\n            }).pipe(\n              Fx.chain((id) =>\n                id === null\n                  ? Cv.fail({\n                      code: \"PASSKEY_AUTH_REQUIRED\",\n                      message:\n                        \"Sign in first, then add a passkey to your account.\",\n                    })\n                  : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n              ),\n            ),\n            resolveRpOptionsFx(provider),\n          ).pipe(\n            Fx.chain(([userId, rp]) => {\n              const challenge = new Uint8Array(32);\n              crypto.getRandomValues(challenge);\n              const challengeHash = encodeBase64urlNoPadding(\n                new Uint8Array(sha256(challenge)),\n              );\n\n              return Fx.from({\n                ok: async () => {\n                  const verifier = await callVerifier(ctx);\n                  await callVerifierSignature(ctx, {\n                    verifier,\n                    signature: challengeHash,\n                  });\n\n                  const user = await queryUserById(ctx, userId);\n                  const userName = params.userName ?? user?.email ?? \"user\";\n                  const userDisplayName =\n                    params.userDisplayName ?? user?.name ?? userName;\n\n                  const existing = await queryPasskeysByUserId(ctx, userId);\n                  const excludeCredentials = existing.map((pk) => ({\n                    id: pk.credentialId,\n                    transports: pk.transports,\n                  }));\n\n                  const userHandle = encodeBase64urlNoPadding(\n                    new TextEncoder().encode(userId),\n                  );\n\n                  const options = {\n                    rp: { name: rp.rpName, id: rp.rpId },\n                    user: {\n                      id: userHandle,\n                      name: userName,\n                      displayName: userDisplayName,\n                    },\n                    challenge: encodeBase64urlNoPadding(challenge),\n                    pubKeyCredParams: rp.algorithms.map((alg) => ({\n                      type: \"public-key\" as const,\n                      alg,\n                    })),\n                    timeout: rp.challengeExpirationMs,\n                    attestation: rp.attestation,\n                    authenticatorSelection: {\n                      residentKey: rp.residentKey,\n                      requireResidentKey: rp.residentKey === \"required\",\n                      userVerification: rp.userVerification,\n                      ...(rp.authenticatorAttachment\n                        ? {\n                            authenticatorAttachment: rp.authenticatorAttachment,\n                          }\n                        : {}),\n                    },\n                    excludeCredentials,\n                  };\n\n                  return {\n                    kind: \"passkeyOptions\" as const,\n                    options,\n                    verifier,\n                  };\n                },\n                err: () =>\n                  Cv.error({\n                    code: \"INTERNAL_ERROR\",\n                    message: \"An unexpected error occurred.\",\n                  }),\n              });\n            }),\n          ),\n        registerVerify: (_) =>\n          Fx.zip(\n            Fx.from({\n              ok: () => ctx.auth.getUserIdentity(),\n              err: () =>\n                Cv.error({\n                  code: \"PASSKEY_AUTH_REQUIRED\",\n                  message: \"Sign in first, then add a passkey to your account.\",\n                }),\n            }).pipe(\n              Fx.chain((id) =>\n                id === null\n                  ? Cv.fail({\n                      code: \"PASSKEY_AUTH_REQUIRED\",\n                      message:\n                        \"Sign in first, then add a passkey to your account.\",\n                    })\n                  : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n              ),\n            ),\n            resolveRpOptionsFx(provider),\n          ).pipe(\n            Fx.chain(([userId, rp]) =>\n              requirePasskeyVerifierFx(args.verifier).pipe(\n                Fx.chain((verifier) => {\n                  const clientDataJSON = decodeBase64urlIgnorePadding(\n                    params.clientDataJSON,\n                  );\n                  const clientData = parseClientDataJSON(clientDataJSON);\n\n                  const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                    Fx.chain(\n                      verifyClientDataType(\n                        ClientDataType.Create,\n                        \"webauthn.create\",\n                      ),\n                    ),\n                    Fx.chain(verifyOrigin(rp)),\n                    Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                    Fx.map(() => {\n                      const attestationObjectBytes =\n                        decodeBase64urlIgnorePadding(params.attestationObject);\n                      const attestation = parseAttestationObject(\n                        attestationObjectBytes,\n                      );\n                      return attestation.authenticatorData;\n                    }),\n                  );\n\n                  return verifiedClientDataFx.pipe(\n                    Fx.chain(verifyRpId(rp.rpId)),\n                    Fx.chain(verifyUserFlags(rp)),\n                    Fx.chain((authData) => {\n                      if (authData.credential == null) {\n                        return Cv.fail({\n                          code: \"PASSKEY_NO_CREDENTIAL\",\n                          message: \"No credential in attestation.\",\n                        });\n                      }\n                      return Fx.succeed({\n                        authData,\n                        credential: authData.credential,\n                      });\n                    }),\n                    Fx.chain(({ authData, credential }) => {\n                      const credentialId = encodeBase64urlNoPadding(\n                        credential.id,\n                      );\n                      const publicKey = credential.publicKey;\n\n                      let algorithm: number;\n                      if (publicKey.isAlgorithmDefined()) {\n                        algorithm = publicKey.algorithm();\n                      } else {\n                        const keyType = publicKey.type();\n                        algorithm =\n                          keyType === COSEKeyType.EC2\n                            ? coseAlgorithmES256\n                            : keyType === COSEKeyType.RSA\n                              ? coseAlgorithmRS256\n                              : coseAlgorithmES256;\n                      }\n\n                      const handlers: Record<\n                        number,\n                        (() => FxType<Uint8Array, ConvexError<any>>) | undefined\n                      > = {\n                        [coseAlgorithmES256]: () => {\n                          const ec2 = publicKey.ec2();\n                          const xBytes = new Uint8Array(32);\n                          let vx = ec2.x;\n                          for (let i = 31; i >= 0; i--) {\n                            xBytes[i] = Number(vx & 0xffn);\n                            vx >>= 8n;\n                          }\n                          const yBytes = new Uint8Array(32);\n                          let vy = ec2.y;\n                          for (let i = 31; i >= 0; i--) {\n                            yBytes[i] = Number(vy & 0xffn);\n                            vy >>= 8n;\n                          }\n                          const bytes = new Uint8Array(65);\n                          bytes[0] = 0x04;\n                          bytes.set(xBytes, 1);\n                          bytes.set(yBytes, 33);\n                          return Fx.succeed(bytes);\n                        },\n                        [coseAlgorithmRS256]: () => {\n                          const rsa = publicKey.rsa();\n                          const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);\n                          return Fx.succeed(rsaPubKey.encodePKCS1());\n                        },\n                      };\n\n                      const handler = handlers[algorithm];\n                      return (\n                        handler\n                          ? handler()\n                          : Cv.fail({\n                              code: \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                              message: `Unsupported algorithm: ${algorithm}`,\n                            })\n                      ).pipe(\n                        Fx.chain((publicKeyBytes) =>\n                          Fx.from({\n                            ok: async () => {\n                              const deviceType =\n                                params.deviceType ?? \"single-device\";\n                              const backedUp = params.backedUp ?? false;\n\n                              const db = authDb(ctx, ctx.auth.config);\n                              await db.accounts.create({\n                                userId,\n                                provider: provider.id,\n                                providerAccountId: credentialId,\n                              });\n\n                              await mutatePasskeyInsert(ctx, {\n                                userId,\n                                credentialId,\n                                publicKey: publicKeyBytes.buffer.slice(\n                                  publicKeyBytes.byteOffset,\n                                  publicKeyBytes.byteOffset +\n                                    publicKeyBytes.byteLength,\n                                ),\n                                algorithm,\n                                counter: authData.signatureCounter,\n                                transports: params.transports,\n                                deviceType,\n                                backedUp,\n                                name: params.passkeyName,\n                                createdAt: Date.now(),\n                              });\n\n                              const signInResult = await callSignIn(ctx, {\n                                userId,\n                                generateTokens: true,\n                              });\n\n                              return {\n                                kind: \"signedIn\" as const,\n                                signedIn: signInResult,\n                              };\n                            },\n                            err: () =>\n                              Cv.error({\n                                code: \"INTERNAL_ERROR\",\n                                message: \"An unexpected error occurred.\",\n                              }),\n                          }),\n                        ),\n                      );\n                    }),\n                  );\n                }),\n              ),\n            ),\n          ),\n        authOptions: (_) =>\n          resolveRpOptionsFx(provider).pipe(\n            Fx.chain((rp) => {\n              const challenge = new Uint8Array(32);\n              crypto.getRandomValues(challenge);\n              const challengeHash = encodeBase64urlNoPadding(\n                new Uint8Array(sha256(challenge)),\n              );\n\n              return Fx.from({\n                ok: async () => {\n                  const verifier = await callVerifier(ctx);\n                  await callVerifierSignature(ctx, {\n                    verifier,\n                    signature: challengeHash,\n                  });\n\n                  let allowCredentials:\n                    | Array<{\n                        type: string;\n                        id: string;\n                        transports?: string[];\n                      }>\n                    | undefined;\n                  if (params.email) {\n                    const user = await queryUserByVerifiedEmail(\n                      ctx,\n                      params.email,\n                    );\n                    if (user) {\n                      const passkeys = await queryPasskeysByUserId(\n                        ctx,\n                        user._id,\n                      );\n                      if (passkeys.length > 0) {\n                        allowCredentials = passkeys.map((pk) => ({\n                          type: \"public-key\",\n                          id: pk.credentialId,\n                          transports: pk.transports,\n                        }));\n                      }\n                    }\n                  }\n\n                  const options: Record<string, any> = {\n                    challenge: encodeBase64urlNoPadding(challenge),\n                    timeout: rp.challengeExpirationMs,\n                    rpId: rp.rpId,\n                    userVerification: rp.userVerification,\n                  };\n\n                  if (allowCredentials) {\n                    options.allowCredentials = allowCredentials;\n                  }\n\n                  return {\n                    kind: \"passkeyOptions\" as const,\n                    options,\n                    verifier,\n                  };\n                },\n                err: () =>\n                  Cv.error({\n                    code: \"INTERNAL_ERROR\",\n                    message: \"An unexpected error occurred.\",\n                  }),\n              });\n            }),\n          ),\n        authVerify: (_) =>\n          Fx.zip(\n            resolveRpOptionsFx(provider),\n            requirePasskeyVerifierFx(args.verifier),\n          ).pipe(\n            Fx.chain(([rp, verifier]) => {\n              const clientDataJSON = decodeBase64urlIgnorePadding(\n                params.clientDataJSON,\n              );\n              const clientData = parseClientDataJSON(clientDataJSON);\n\n              const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                Fx.chain(\n                  verifyClientDataType(ClientDataType.Get, \"webauthn.get\"),\n                ),\n                Fx.chain(verifyOrigin(rp)),\n                Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                Fx.chain(() =>\n                  params.credentialId != null\n                    ? Fx.succeed(params.credentialId as string)\n                    : Cv.fail({\n                        code: \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                        message: \"Missing credential ID\",\n                      }),\n                ),\n              );\n\n              return verifiedClientDataFx.pipe(\n                Fx.chain((credentialId) =>\n                  Fx.from({\n                    ok: () => queryPasskeyByCredentialId(ctx, credentialId),\n                    err: () =>\n                      Cv.error({\n                        code: \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                        message: \"Unknown passkey credential.\",\n                      }),\n                  }).pipe(\n                    Fx.chain((passkey) =>\n                      passkey\n                        ? Fx.succeed(passkey)\n                        : Cv.fail({\n                            code: \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                            message: \"Unknown credential\",\n                          }),\n                    ),\n                  ),\n                ),\n                Fx.chain((passkey) => {\n                  const authenticatorDataBytes = decodeBase64urlIgnorePadding(\n                    params.authenticatorData,\n                  );\n                  const authenticatorData = parseAuthenticatorData(\n                    authenticatorDataBytes,\n                  );\n\n                  const signature = decodeBase64urlIgnorePadding(\n                    params.signature,\n                  );\n                  const signatureMessage = createAssertionSignatureMessage(\n                    authenticatorDataBytes,\n                    clientDataJSON,\n                  );\n                  const messageHash = sha256(signatureMessage);\n\n                  const checkedAuthenticatorFx = Fx.succeed(\n                    authenticatorData,\n                  ).pipe(\n                    Fx.chain(verifyRpId(rp.rpId)),\n                    Fx.chain(verifyUserFlags(rp)),\n                  );\n\n                  const signatureVerifiedFx = checkedAuthenticatorFx.pipe(\n                    Fx.chain(() => {\n                      const storedPublicKeyBytes = new Uint8Array(\n                        passkey.publicKey,\n                      );\n                      const algorithmHandlers: Record<\n                        number,\n                        (() => FxType<void, ConvexError<any>>) | undefined\n                      > = {\n                        [coseAlgorithmES256]: () => {\n                          const ecPublicKey = decodeSEC1PublicKey(\n                            p256,\n                            storedPublicKeyBytes,\n                          );\n                          const ecdsaSignature =\n                            decodePKIXECDSASignature(signature);\n                          const valid = verifyECDSASignature(\n                            ecPublicKey,\n                            messageHash,\n                            ecdsaSignature,\n                          );\n                          return valid\n                            ? Fx.succeed(undefined as void)\n                            : Cv.fail({\n                                code: \"PASSKEY_INVALID_SIGNATURE\",\n                                message: \"Invalid passkey signature.\",\n                              });\n                        },\n                        [coseAlgorithmRS256]: () => {\n                          const rsaPublicKey =\n                            decodePKCS1RSAPublicKey(storedPublicKeyBytes);\n                          const valid = verifyRSASSAPKCS1v15Signature(\n                            rsaPublicKey,\n                            sha256ObjectIdentifier,\n                            messageHash,\n                            signature,\n                          );\n                          return valid\n                            ? Fx.succeed(undefined as void)\n                            : Cv.fail({\n                                code: \"PASSKEY_INVALID_SIGNATURE\",\n                                message: \"Invalid passkey signature.\",\n                              });\n                        },\n                      };\n\n                      const handler = algorithmHandlers[passkey.algorithm];\n                      return handler\n                        ? handler()\n                        : Cv.fail({\n                            code: \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                            message: `Unsupported algorithm: ${passkey.algorithm}`,\n                          });\n                    }),\n                  );\n\n                  const counterValidatedFx = signatureVerifiedFx.pipe(\n                    Fx.chain(() =>\n                      passkey.counter !== 0 &&\n                      authenticatorData.signatureCounter !== 0 &&\n                      authenticatorData.signatureCounter <= passkey.counter\n                        ? Cv.fail({\n                            code: \"PASSKEY_COUNTER_ERROR\",\n                            message:\n                              \"Authenticator counter did not increase — possible credential cloning detected.\",\n                          })\n                        : Fx.succeed(authenticatorData),\n                    ),\n                  );\n\n                  return counterValidatedFx.pipe(\n                    Fx.chain(() =>\n                      Fx.from({\n                        ok: async () => {\n                          await mutatePasskeyUpdateCounter(\n                            ctx,\n                            passkey._id,\n                            authenticatorData.signatureCounter,\n                            Date.now(),\n                          );\n\n                          const signInResult = await callSignIn(ctx, {\n                            userId: passkey.userId,\n                            generateTokens: true,\n                          });\n\n                          return {\n                            kind: \"signedIn\" as const,\n                            signedIn: signInResult,\n                          };\n                        },\n                        err: () =>\n                          Cv.error({\n                            code: \"INTERNAL_ERROR\",\n                            message: \"An unexpected error occurred.\",\n                          }),\n                      }),\n                    ),\n                  );\n                }),\n              );\n            }),\n          ),\n      });\n      return flowFx;\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FA,MAAM,sBACJ,aACwC;CACxC,MAAM,qBACJ,QAAQ,IAAI,aAAa,SAAY,OAAO,iBAAiB;CAC/D,MAAM,UAAU,oBAAoB;CACpC,MAAM,aAAa,YAAY,UAAa,YAAY;CACxD,MAAM,UAAU,SAAS,QAAQ,SAAS;AAE1C,QAAO,GAAG,QAAQ;EAAE;EAAS;EAAY;EAAS,CAAC,CAAC,KAClD,GAAG,OAAO,EAAE,oBAAS,0BAAY,yBAC/B,CAACA,gBAAc,CAACC,YACZ,GAAG,KAAK;EACN,MAAM;EACN,SACE;EAGH,CAAC,GACF,GAAG,QAAQC,UAAQ,CACxB,EACD,GAAG,KAAK,cAAY;EAClB,MAAM,eAAeA,YAAU,IAAI,IAAIA,UAAQ,CAAC,WAAW;EAC3D,MAAM,gBAAgB,oBAAoB,eAAeA;AACzD,SAAO;GACL,QAAQ,SAAS,QAAQ,UAAU,gBAAgB;GACnD,MAAM,SAAS,QAAQ,QAAQ,gBAAgB;GAC/C,QAAQ,SAAS,QAAQ,UAAU,iBAAiB;GACpD,aAAa,SAAS,QAAQ,eAAe;GAC7C,kBAAkB,SAAS,QAAQ,oBAAoB;GACvD,aAAa,SAAS,QAAQ,eAAe;GAC7C,yBAAyB,SAAS,QAAQ;GAC1C,YAAY,SAAS,QAAQ,cAAc,CACzC,oBACA,mBACD;GACD,uBACE,SAAS,QAAQ,yBAAyB;GAC7C;GACD,CACH;;;AAQH,MAAM,wBAEF,cACA,WAED,eACC,WAAW,SAAS,eAChB,GAAG,QAAQ,WAAW,GACtB,GAAG,KAAK;CACN,MAAM;CACN,SAAS,sCAAsC;CAChD,CAAC;;AAGV,MAAM,gBACH,QAEC,eACgC;CAChC,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,OAAO;AAClE,QAAO,QAAQ,SAAS,WAAW,OAAO,GACtC,GAAG,QAAQ,WAAW,GACtB,GAAG,KAAK;EACN,MAAM;EACN,SAAS,mBAAmB,WAAW,OAAO,qBAAqB,QAAQ,KAAK,KAAK;EACtF,CAAC;;;AAIV,MAAM,6BACH,KAAwB,mBAEvB,eACgC;CAChC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,WAAW,UAAU,CAAC,CAC7C;AACD,QAAO,GAAG,KAAK;EACb,UAAU,kBAAkB,KAAK,cAAc;EAC/C,WACE,GAAG,MAAM;GACP,MAAM;GACN,SAAS;GACV,CAAC;EACL,CAAC,CAAC,KACD,GAAG,OAAO,QACR,CAAC,OAAO,IAAI,cAAc,gBACtB,GAAG,KAAK;EACN,MAAM;EACN,SAAS;EACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,YACD,GAAG,KAAK;EACN,UAAU,qBAAqB,KAAK,cAAc;EAClD,WACE,GAAG,MAAM;GACP,MAAM;GACN,SAAS;GACV,CAAC;EACL,CAAC,CACH,EACD,GAAG,UAAU,WAAW,CACzB;;;AAIL,MAAM,cACH,UAEC,aAEA,SAAS,yBAAyB,KAAK,GACnC,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC;;AAGV,MAAM,mBACH,QAEC,aAEA,CAAC,SAAS,cACN,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC,GACF,GAAG,qBAAqB,cAAc,CAAC,SAAS,eAC9C,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC,GACF,GAAG,QAAQ,SAAS;AAmB9B,MAAM,eAAe;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,YAAY;CACb;AAED,MAAM,gBAAgB;CACpB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACd;AAQD,MAAM,4BACJ,WAC8C;CAC9C,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,cAAc,SAAS,KAAc,GACpE,GAAG,QAAQ,EAAQ,MAAwC,CAAC,GAC5D,GAAG,KAAK;EACN,MAAM;EACN,SACE;EACH,CAAC;;AAGR,MAAM,4BACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK;CACN,MAAM;CACN,SAAS;CACV,CAAC;;;;;;AAOR,SAAgB,gBACd,KACA,UACA,MAIyC;CACzC,MAAM,SAAU,KAAK,UAAU,EAAE;AAEjC,QAAO,yBAAyB,OAAO,CAAC,KACtC,GAAG,OAAO,aAAa;AAugBrB,SAtgBwD,GAAG,MACzD,SACD,CAAC,GAAG,QAAQ;GACX,kBAAkB,MAChB,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WACE,GAAG,MAAM;KACP,MAAM;KACN,SAAS;KACV,CAAC;IACL,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK;IACN,MAAM;IACN,SACE;IACH,CAAC,GACF,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QAAQ;IACzB,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,MAAM,OAAO,MAAM,cAAc,KAAK,OAAO;MAC7C,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;MACnD,MAAM,kBACJ,OAAO,mBAAmB,MAAM,QAAQ;MAG1C,MAAM,sBADW,MAAM,sBAAsB,KAAK,OAAO,EACrB,KAAK,QAAQ;OAC/C,IAAI,GAAG;OACP,YAAY,GAAG;OAChB,EAAE;MAEH,MAAM,aAAa,yBACjB,IAAI,aAAa,CAAC,OAAO,OAAO,CACjC;AA6BD,aAAO;OACL,MAAM;OACN,SA7Bc;QACd,IAAI;SAAE,MAAM,GAAG;SAAQ,IAAI,GAAG;SAAM;QACpC,MAAM;SACJ,IAAI;SACJ,MAAM;SACN,aAAa;SACd;QACD,WAAW,yBAAyB,UAAU;QAC9C,kBAAkB,GAAG,WAAW,KAAK,SAAS;SAC5C,MAAM;SACN;SACD,EAAE;QACH,SAAS,GAAG;QACZ,aAAa,GAAG;QAChB,wBAAwB;SACtB,aAAa,GAAG;SAChB,oBAAoB,GAAG,gBAAgB;SACvC,kBAAkB,GAAG;SACrB,GAAI,GAAG,0BACH,EACE,yBAAyB,GAAG,yBAC7B,GACD,EAAE;SACP;QACD;QACD;OAKC;OACD;;KAEH,WACE,GAAG,MAAM;MACP,MAAM;MACN,SAAS;MACV,CAAC;KACL,CAAC;KACF,CACH;GACH,iBAAiB,MACf,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WACE,GAAG,MAAM;KACP,MAAM;KACN,SAAS;KACV,CAAC;IACL,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK;IACN,MAAM;IACN,SACE;IACH,CAAC,GACF,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QACjB,yBAAyB,KAAK,SAAS,CAAC,KACtC,GAAG,OAAO,aAAa;IAIrB,MAAM,aAAa,oBAHI,6BACrB,OAAO,eACR,CACqD;AAqBtD,WAnB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBACE,eAAe,QACf,kBACD,CACF,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,UAAU;AAMX,YAHoB,uBADlB,6BAA6B,OAAO,kBAAkB,CAGvD,CACkB;MACnB,CACH,CAE2B,KAC1B,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,EAC7B,GAAG,OAAO,aAAa;AACrB,SAAI,SAAS,cAAc,KACzB,QAAO,GAAG,KAAK;MACb,MAAM;MACN,SAAS;MACV,CAAC;AAEJ,YAAO,GAAG,QAAQ;MAChB;MACA,YAAY,SAAS;MACtB,CAAC;MACF,EACF,GAAG,OAAO,EAAE,UAAU,iBAAiB;KACrC,MAAM,eAAe,yBACnB,WAAW,GACZ;KACD,MAAM,YAAY,WAAW;KAE7B,IAAI;AACJ,SAAI,UAAU,oBAAoB,CAChC,aAAY,UAAU,WAAW;UAC5B;MACL,MAAM,UAAU,UAAU,MAAM;AAChC,kBACE,YAAY,YAAY,MACpB,qBACA,YAAY,YAAY,MACtB,qBACA;;KAkCV,MAAM,UA5BF;OACD,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAM,KAAK;AACX,aAAM,IAAI,QAAQ,EAAE;AACpB,aAAM,IAAI,QAAQ,GAAG;AACrB,cAAO,GAAG,QAAQ,MAAM;;OAEzB,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,YAAY,IAAI,aAAa,IAAI,GAAG,IAAI,EAAE;AAChD,cAAO,GAAG,QAAQ,UAAU,aAAa,CAAC;;MAE7C,CAEwB;AACzB,aACE,UACI,SAAS,GACT,GAAG,KAAK;MACN,MAAM;MACN,SAAS,0BAA0B;MACpC,CAAC,EACN,KACA,GAAG,OAAO,mBACR,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,aACJ,OAAO,cAAc;OACvB,MAAM,WAAW,OAAO,YAAY;AAGpC,aADW,OAAO,KAAK,IAAI,KAAK,OAAO,CAC9B,SAAS,OAAO;QACvB;QACA,UAAU,SAAS;QACnB,mBAAmB;QACpB,CAAC;AAEF,aAAM,oBAAoB,KAAK;QAC7B;QACA;QACA,WAAW,eAAe,OAAO,MAC/B,eAAe,YACf,eAAe,aACb,eAAe,WAClB;QACD;QACA,SAAS,SAAS;QAClB,YAAY,OAAO;QACnB;QACA;QACA,MAAM,OAAO;QACb,WAAW,KAAK,KAAK;QACtB,CAAC;AAOF,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC;SACA,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WACE,GAAG,MAAM;OACP,MAAM;OACN,SAAS;OACV,CAAC;MACL,CAAC,CACH,CACF;MACD,CACH;KACD,CACH,CACF,CACF;GACH,cAAc,MACZ,mBAAmB,SAAS,CAAC,KAC3B,GAAG,OAAO,OAAO;IACf,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,IAAI;AAOJ,UAAI,OAAO,OAAO;OAChB,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,MACR;AACD,WAAI,MAAM;QACR,MAAM,WAAW,MAAM,sBACrB,KACA,KAAK,IACN;AACD,YAAI,SAAS,SAAS,EACpB,oBAAmB,SAAS,KAAK,QAAQ;SACvC,MAAM;SACN,IAAI,GAAG;SACP,YAAY,GAAG;SAChB,EAAE;;;MAKT,MAAM,UAA+B;OACnC,WAAW,yBAAyB,UAAU;OAC9C,SAAS,GAAG;OACZ,MAAM,GAAG;OACT,kBAAkB,GAAG;OACtB;AAED,UAAI,iBACF,SAAQ,mBAAmB;AAG7B,aAAO;OACL,MAAM;OACN;OACA;OACD;;KAEH,WACE,GAAG,MAAM;MACP,MAAM;MACN,SAAS;MACV,CAAC;KACL,CAAC;KACF,CACH;GACH,aAAa,MACX,GAAG,IACD,mBAAmB,SAAS,EAC5B,yBAAyB,KAAK,SAAS,CACxC,CAAC,KACA,GAAG,OAAO,CAAC,IAAI,cAAc;IAC3B,MAAM,iBAAiB,6BACrB,OAAO,eACR;IACD,MAAM,aAAa,oBAAoB,eAAe;AAkBtD,WAhB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBAAqB,eAAe,KAAK,eAAe,CACzD,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,YACD,OAAO,gBAAgB,OACnB,GAAG,QAAQ,OAAO,aAAuB,GACzC,GAAG,KAAK;KACN,MAAM;KACN,SAAS;KACV,CAAC,CACP,CACF,CAE2B,KAC1B,GAAG,OAAO,iBACR,GAAG,KAAK;KACN,UAAU,2BAA2B,KAAK,aAAa;KACvD,WACE,GAAG,MAAM;MACP,MAAM;MACN,SAAS;MACV,CAAC;KACL,CAAC,CAAC,KACD,GAAG,OAAO,YACR,UACI,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK;KACN,MAAM;KACN,SAAS;KACV,CAAC,CACP,CACF,CACF,EACD,GAAG,OAAO,YAAY;KACpB,MAAM,yBAAyB,6BAC7B,OAAO,kBACR;KACD,MAAM,oBAAoB,uBACxB,uBACD;KAED,MAAM,YAAY,6BAChB,OAAO,UACR;KAKD,MAAM,cAAc,OAJK,gCACvB,wBACA,eACD,CAC2C;AA+E5C,YA7E+B,GAAG,QAChC,kBACD,CAAC,KACA,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,CAC9B,CAEkD,KACjD,GAAG,YAAY;MACb,MAAM,uBAAuB,IAAI,WAC/B,QAAQ,UACT;MA0CD,MAAM,UAtCF;QACD,2BAA2B;AAY1B,eALc,qBANM,oBAClB,MACA,qBACD,EAKC,aAHA,yBAAyB,UAAU,CAKpC,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KAAK;SACN,MAAM;SACN,SAAS;SACV,CAAC;;QAEP,2BAA2B;AAS1B,eANc,8BADZ,wBAAwB,qBAAqB,EAG7C,wBACA,aACA,UACD,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KAAK;SACN,MAAM;SACN,SAAS;SACV,CAAC;;OAET,CAEiC,QAAQ;AAC1C,aAAO,UACH,SAAS,GACT,GAAG,KAAK;OACN,MAAM;OACN,SAAS,0BAA0B,QAAQ;OAC5C,CAAC;OACN,CACH,CAE8C,KAC7C,GAAG,YACD,QAAQ,YAAY,KACpB,kBAAkB,qBAAqB,KACvC,kBAAkB,oBAAoB,QAAQ,UAC1C,GAAG,KAAK;MACN,MAAM;MACN,SACE;MACH,CAAC,GACF,GAAG,QAAQ,kBAAkB,CAClC,CACF,CAEyB,KACxB,GAAG,YACD,GAAG,KAAK;MACN,IAAI,YAAY;AACd,aAAM,2BACJ,KACA,QAAQ,KACR,kBAAkB,kBAClB,KAAK,KAAK,CACX;AAOD,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC,QAAQ,QAAQ;SAChB,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WACE,GAAG,MAAM;OACP,MAAM;OACN,SAAS;OACV,CAAC;MACL,CAAC,CACH,CACF;MACD,CACH;KACD,CACH;GACJ,CAAC;GAEF,CACH"}

package/dist/component/server/redirects.js

@@ -1,40 +0,0 @@
-import { requireEnv } from "./utils.js";
-import { Cv } from "@robelest/fx/convex";
-
-//#region src/server/redirects.ts
-/** @internal */
-async function redirectAbsoluteUrl(config, params) {
-	if (params.redirectTo === void 0) return requireEnv("SITE_URL").replace(/\/$/, "");
-	if (typeof params.redirectTo !== "string") throw Cv.error({
-		code: "INVALID_REDIRECT",
-		message: `Expected \`redirectTo\` to be a string, got ${params.redirectTo}`
-	});
-	const redirectCallback = config.callbacks?.redirect ?? defaultRedirectCallback;
-	try {
-		return await redirectCallback({ redirectTo: params.redirectTo });
-	} catch {
-		throw Cv.error({
-			code: "INTERNAL_ERROR",
-			message: "An unexpected error occurred."
-		});
-	}
-}
-async function defaultRedirectCallback({ redirectTo }) {
-	if (redirectTo.startsWith("?") || redirectTo.startsWith("/")) return `${requireEnv("SITE_URL").replace(/\/$/, "")}${redirectTo}`;
-	return redirectTo;
-}
-/** @internal */
-function setURLSearchParam(absoluteUrl, param, value) {
-	const pattern = /([^:]+):(.*)/;
-	const [, scheme, rest] = absoluteUrl.match(pattern);
-	const hasNoDomain = /^\/\/(?:\/|$|\?)/.test(rest);
-	const startsWithPath = hasNoDomain && rest.startsWith("///");
-	const url = new URL(`http:${hasNoDomain ? "//googblibok" + rest.slice(2) : rest}`);
-	url.searchParams.set(param, value);
-	const [, , withParam] = url.toString().match(pattern);
-	return `${scheme}:${hasNoDomain ? (startsWithPath ? "/" : "") + "//" + withParam.slice(13) : withParam}`;
-}
-
-//#endregion
-export { redirectAbsoluteUrl, setURLSearchParam };
-//# sourceMappingURL=redirects.js.map

package/dist/component/server/redirects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirects.js","names":[],"sources":["../../../src/server/redirects.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\n\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { requireEnv } from \"./utils\";\n\n/** @internal */\nexport async function redirectAbsoluteUrl(\n  config: ConvexAuthMaterializedConfig,\n  params: { redirectTo: unknown },\n) {\n  if (params.redirectTo === undefined) {\n    return requireEnv(\"SITE_URL\").replace(/\\/$/, \"\");\n  }\n  if (typeof params.redirectTo !== \"string\") {\n    throw Cv.error({\n      code: \"INVALID_REDIRECT\",\n      message: `Expected \\`redirectTo\\` to be a string, got ${params.redirectTo as any}`,\n    });\n  }\n  const redirectCallback =\n    config.callbacks?.redirect ?? defaultRedirectCallback;\n  try {\n    return await redirectCallback({ redirectTo: params.redirectTo });\n  } catch {\n    throw Cv.error({\n      code: \"INTERNAL_ERROR\",\n      message: \"An unexpected error occurred.\",\n    });\n  }\n}\n\nasync function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {\n  // Resolve relative paths against SITE_URL; absolute URLs are passed through\n  // as-is. The developer is trusted to provide valid redirect targets.\n  if (redirectTo.startsWith(\"?\") || redirectTo.startsWith(\"/\")) {\n    return `${requireEnv(\"SITE_URL\").replace(/\\/$/, \"\")}${redirectTo}`;\n  }\n  return redirectTo;\n}\n\n// Temporary work-around because Convex doesn't support\n// schemes other than http and https.\n/** @internal */\nexport function setURLSearchParam(\n  absoluteUrl: string,\n  param: string,\n  value: string,\n) {\n  const pattern = /([^:]+):(.*)/;\n  const [, scheme, rest] = absoluteUrl.match(pattern)!;\n  const hasNoDomain = /^\\/\\/(?:\\/|$|\\?)/.test(rest);\n  const startsWithPath = hasNoDomain && rest.startsWith(\"///\");\n  const url = new URL(\n    `http:${hasNoDomain ? \"//googblibok\" + rest.slice(2) : rest}`,\n  );\n  url.searchParams.set(param, value);\n  const [, , withParam] = url.toString().match(pattern)!;\n  return `${scheme}:${hasNoDomain ? (startsWithPath ? \"/\" : \"\") + \"//\" + withParam.slice(13) : withParam}`;\n}\n"],"mappings":";;;;;AAMA,eAAsB,oBACpB,QACA,QACA;AACA,KAAI,OAAO,eAAe,OACxB,QAAO,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG;AAElD,KAAI,OAAO,OAAO,eAAe,SAC/B,OAAM,GAAG,MAAM;EACb,MAAM;EACN,SAAS,+CAA+C,OAAO;EAChE,CAAC;CAEJ,MAAM,mBACJ,OAAO,WAAW,YAAY;AAChC,KAAI;AACF,SAAO,MAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,CAAC;SAC1D;AACN,QAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS;GACV,CAAC;;;AAIN,eAAe,wBAAwB,EAAE,cAAsC;AAG7E,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,IAAI,CAC1D,QAAO,GAAG,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG,GAAG;AAExD,QAAO;;;AAMT,SAAgB,kBACd,aACA,OACA,OACA;CACA,MAAM,UAAU;CAChB,MAAM,GAAG,QAAQ,QAAQ,YAAY,MAAM,QAAQ;CACnD,MAAM,cAAc,mBAAmB,KAAK,KAAK;CACjD,MAAM,iBAAiB,eAAe,KAAK,WAAW,MAAM;CAC5D,MAAM,MAAM,IAAI,IACd,QAAQ,cAAc,iBAAiB,KAAK,MAAM,EAAE,GAAG,OACxD;AACD,KAAI,aAAa,IAAI,OAAO,MAAM;CAClC,MAAM,KAAK,aAAa,IAAI,UAAU,CAAC,MAAM,QAAQ;AACrD,QAAO,GAAG,OAAO,GAAG,eAAe,iBAAiB,MAAM,MAAM,OAAO,UAAU,MAAM,GAAG,GAAG"}

package/dist/component/server/refresh.js

@@ -1,99 +0,0 @@
-import { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, logWithLevel, maybeRedact } from "./utils.js";
-import { authDb } from "./db.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/refresh.ts
-const DEFAULT_SESSION_INACTIVE_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
-/** @internal */
-const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1e3;
-/**
-* Create a new refresh token for the given session.
-*/
-/** @internal */
-async function createRefreshToken(ctx, config, sessionId, parentRefreshTokenId) {
-	const expirationTime = Date.now() + (config.session?.inactiveDurationMs ?? (process.env.AUTH_SESSION_INACTIVE_DURATION_MS !== void 0 ? Number(process.env.AUTH_SESSION_INACTIVE_DURATION_MS) : void 0) ?? DEFAULT_SESSION_INACTIVE_DURATION_MS);
-	return authDb(ctx, config).refreshTokens.create({
-		sessionId,
-		expirationTime,
-		parentRefreshTokenId: parentRefreshTokenId ?? void 0
-	});
-}
-/**
-* Parse a compound refresh token string into its constituent IDs.
-*/
-/** @internal */
-const parseRefreshToken = (refreshToken) => {
-	const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);
-	const msg = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;
-	return (refreshTokenId != null ? Fx.succeed(refreshTokenId) : Cv.fail({
-		code: "INVALID_REFRESH_TOKEN",
-		message: msg
-	})).pipe(Fx.chain((rtId) => {
-		return (sessionId != null ? Fx.succeed(sessionId) : Cv.fail({
-			code: "INVALID_REFRESH_TOKEN",
-			message: msg
-		})).pipe(Fx.map((sId) => ({
-			refreshTokenId: rtId,
-			sessionId: sId
-		})));
-	}));
-};
-/**
-* Mark all refresh tokens descending from the given refresh token as invalid
-* immediately. Used when we detect token reuse — revoke the entire tree.
-*/
-/** @internal */
-async function invalidateRefreshTokensInSubtree(ctx, refreshToken, config) {
-	const db = authDb(ctx, config);
-	const tokensToInvalidate = [refreshToken];
-	const visited = new Set([refreshToken._id]);
-	let frontier = [refreshToken._id];
-	while (frontier.length > 0) {
-		const nextFrontier = [];
-		for (const currentTokenId of frontier) {
-			const children = await db.refreshTokens.getChildren(refreshToken.sessionId, currentTokenId);
-			for (const child of children) {
-				if (visited.has(child._id)) continue;
-				visited.add(child._id);
-				tokensToInvalidate.push(child);
-				nextFrontier.push(child._id);
-			}
-		}
-		frontier = nextFrontier;
-	}
-	await Fx.run(Fx.each(tokensToInvalidate, (token) => token.firstUsedTime === void 0 || token.firstUsedTime > Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS ? Fx.promise(() => db.refreshTokens.patch(token._id, { firstUsedTime: Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS })) : Fx.unit));
-	return tokensToInvalidate;
-}
-/**
-* Validate a refresh token and its associated session.
-*
-* Returns `null` on any validation failure (matching original semantics).
-* Each validation step is a small composable function chained with `Fx.chain`.
-* On failure, the error message is logged and the pipeline folds to `null`.
-*/
-/** @internal */
-const refreshTokenIfValid = (ctx, refreshTokenId, tokenSessionId, config) => {
-	const db = authDb(ctx, config);
-	const fetchDoc = (promise, failMsg) => Fx.from({
-		ok: promise,
-		err: () => failMsg
-	}).pipe(Fx.recover((msg) => {
-		logWithLevel(LOG_LEVELS.ERROR, msg);
-		return Fx.succeed(null);
-	}));
-	return fetchDoc(() => db.refreshTokens.getById(refreshTokenId), "Invalid refresh token format").pipe(Fx.chain((doc) => doc !== null ? Fx.succeed(doc) : Fx.fail("Invalid refresh token")), Fx.chain((doc) => doc.expirationTime >= Date.now() ? Fx.succeed(doc) : Fx.fail("Expired refresh token")), Fx.chain((doc) => doc.sessionId === tokenSessionId ? Fx.succeed(doc) : Fx.fail("Invalid refresh token session ID"))).pipe(Fx.chain((doc) => fetchDoc(() => db.sessions.getById(doc.sessionId), "Invalid refresh token session format").pipe(Fx.chain((session) => session !== null ? Fx.succeed(session) : Fx.fail("Invalid refresh token session")), Fx.chain((session) => session.expirationTime >= Date.now() ? Fx.succeed(session) : Fx.fail("Expired refresh token session")), Fx.map((session) => ({
-		session,
-		refreshTokenDoc: doc
-	})))), Fx.fold({
-		ok: (result) => result,
-		err: (msg) => {
-			logWithLevel(LOG_LEVELS.ERROR, msg);
-			return null;
-		}
-	}));
-};
-
-//#endregion
-export { REFRESH_TOKEN_REUSE_WINDOW_MS, createRefreshToken, invalidateRefreshTokensInSubtree, parseRefreshToken, refreshTokenIfValid };
-//# sourceMappingURL=refresh.js.map