@robelest/convex-auth 0.0.4-preview.27 → 0.0.4-preview.28

package/dist/server/passkey.js

@@ -1,14 +1,12 @@
 import { userIdFromIdentitySubject } from "./identity.js";
-import { siteUrlsFromEnv } from "./url.js";
-import { authFlowError } from "../shared/errors.js";
-import { toConvexError } from "./errors.js";
 import { authDb } from "./db.js";
-import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
+import { siteUrlsFromEnv } from "./url.js";
+import { authFlowError } from "../shared/errors.js";
+import { toConvexError } from "./errors.js";
 import { mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateVerifierDelete, queryPasskeyByCredentialId, queryPasskeysByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById } from "./types.js";
 import { ConvexError } from "convex/values";
-import { Effect, Match } from "effect";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
 import { decodePKIXECDSASignature, decodeSEC1PublicKey, p256, verifyECDSASignature } from "@oslojs/crypto/ecdsa";
@@ -48,167 +46,204 @@ const requireStringParam = (value, name) => {
 };
 const convexError = (code, message) => toConvexError(authFlowError(code, message));
 const asConvexError = (error, code, message) => error instanceof ConvexError ? error : error instanceof Error ? toConvexError(authFlowError(code, error.message || message)) : convexError(code, message);
-const resolveRpOptionsFx = (provider) => Effect.sync(() => {
-	const configuredSiteUrls = process.env.SITE_URL === void 0 ? null : siteUrlsFromEnv();
-	const siteUrl = configuredSiteUrls?.primaryUrl;
-	const hasSiteUrl = siteUrl !== void 0 && siteUrl !== "";
-	const hasRpId = provider.options.rpId !== void 0;
-	if (!hasSiteUrl && !hasRpId) throw convexError("PASSKEY_MISSING_CONFIG", "Passkey provider requires SITE_URL env var (your frontend URL) or explicit rpId / origin in the provider config. CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.");
-	const siteHostname = siteUrl ? new URL(siteUrl).hostname : void 0;
-	const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl;
-	return {
-		rpName: provider.options.rpName ?? siteHostname ?? "localhost",
-		rpId: provider.options.rpId ?? siteHostname ?? "localhost",
-		origin: provider.options.origin ?? defaultOrigin ?? "http://localhost",
-		attestation: provider.options.attestation ?? "none",
-		userVerification: provider.options.userVerification ?? "required",
-		residentKey: provider.options.residentKey ?? "preferred",
-		authenticatorAttachment: provider.options.authenticatorAttachment,
-		algorithms: provider.options.algorithms ?? [coseAlgorithmES256, coseAlgorithmRS256],
-		challengeExpirationMs: provider.options.challengeExpirationMs ?? 3e5
-	};
-}).pipe(Effect.catch((error) => Effect.fail(asConvexError(error, "PASSKEY_MISSING_CONFIG", "Passkey relying party configuration is invalid."))));
-const verifyClientDataType = (expectedType, label) => (clientData) => clientData.type === expectedType ? Effect.succeed(clientData) : Effect.fail(convexError("PASSKEY_INVALID_CLIENT_DATA", `Invalid client data type: expected ${label}`));
-const verifyOrigin = (rp) => (clientData) => {
+function resolveRpOptions(provider) {
+	try {
+		const configuredSiteUrls = process.env.SITE_URL === void 0 ? null : siteUrlsFromEnv();
+		const siteUrl = configuredSiteUrls?.primaryUrl;
+		const hasSiteUrl = siteUrl !== void 0 && siteUrl !== "";
+		const hasRpId = provider.options.rpId !== void 0;
+		if (!hasSiteUrl && !hasRpId) throw convexError("PASSKEY_MISSING_CONFIG", "Passkey provider requires SITE_URL env var (your frontend URL) or explicit rpId / origin in the provider config. CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.");
+		const siteHostname = siteUrl ? new URL(siteUrl).hostname : void 0;
+		const defaultOrigin = configuredSiteUrls?.allowedUrls ?? siteUrl;
+		return {
+			rpName: provider.options.rpName ?? siteHostname ?? "localhost",
+			rpId: provider.options.rpId ?? siteHostname ?? "localhost",
+			origin: provider.options.origin ?? defaultOrigin ?? "http://localhost",
+			attestation: provider.options.attestation ?? "none",
+			userVerification: provider.options.userVerification ?? "required",
+			residentKey: provider.options.residentKey ?? "preferred",
+			authenticatorAttachment: provider.options.authenticatorAttachment,
+			algorithms: provider.options.algorithms ?? [coseAlgorithmES256, coseAlgorithmRS256],
+			challengeExpirationMs: provider.options.challengeExpirationMs ?? 3e5
+		};
+	} catch (error) {
+		throw asConvexError(error, "PASSKEY_MISSING_CONFIG", "Passkey relying party configuration is invalid.");
+	}
+}
+function verifyClientDataType(clientData, expectedType, label) {
+	if (clientData.type !== expectedType) throw convexError("PASSKEY_INVALID_CLIENT_DATA", `Invalid client data type: expected ${label}`);
+	return clientData;
+}
+function verifyOrigin(clientData, rp) {
 	const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];
-	return allowed.includes(clientData.origin) ? Effect.succeed(clientData) : Effect.fail(convexError("PASSKEY_INVALID_ORIGIN", `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(", ")}`));
-};
-const verifyAndConsumeChallenge = (ctx, verifierValue) => (clientData) => {
+	if (!allowed.includes(clientData.origin)) throw convexError("PASSKEY_INVALID_ORIGIN", `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(", ")}`);
+	return clientData;
+}
+async function verifyAndConsumeChallenge(clientData, ctx, verifierValue) {
 	const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(clientData.challenge)));
-	return Effect.gen(function* () {
-		const doc = yield* Effect.tryPromise({
-			try: () => queryVerifierById(ctx, verifierValue),
-			catch: () => convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.")
-		});
-		if (!doc || doc.signature !== challengeHash) return yield* Effect.fail(convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge."));
-		yield* Effect.tryPromise({
-			try: () => mutateVerifierDelete(ctx, verifierValue),
-			catch: () => convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.")
-		});
-		return clientData;
-	});
-};
-const verifyRpId = (rpId) => (authData) => authData.verifyRelyingPartyIdHash(rpId) ? Effect.succeed(authData) : Effect.fail(convexError("PASSKEY_RP_MISMATCH", "Relying party ID mismatch."));
-const verifyUserFlags = (rp) => (authData) => !authData.userPresent ? Effect.fail(convexError("PASSKEY_USER_PRESENCE", "User presence flag not set.")) : rp.userVerification === "required" && !authData.userVerified ? Effect.fail(convexError("PASSKEY_USER_VERIFICATION", "User verification required but not performed.")) : Effect.succeed(authData);
-const resolvePasskeyDispatchFx = (params) => {
+	let doc;
+	try {
+		doc = await queryVerifierById(ctx, verifierValue);
+	} catch {
+		throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	}
+	if (!doc || doc.signature !== challengeHash) throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	try {
+		await mutateVerifierDelete(ctx, verifierValue);
+	} catch {
+		throw convexError("PASSKEY_INVALID_CHALLENGE", "Invalid or expired passkey challenge.");
+	}
+	return clientData;
+}
+function verifyRpId(authData, rpId) {
+	if (!authData.verifyRelyingPartyIdHash(rpId)) throw convexError("PASSKEY_RP_MISMATCH", "Relying party ID mismatch.");
+	return authData;
+}
+function verifyUserFlags(authData, rp) {
+	if (!authData.userPresent) throw convexError("PASSKEY_USER_PRESENCE", "User presence flag not set.");
+	if (rp.userVerification === "required" && !authData.userVerified) throw convexError("PASSKEY_USER_VERIFICATION", "User verification required but not performed.");
+	return authData;
+}
+function resolvePasskeyDispatch(params) {
 	const flow = params.flow;
-	return typeof flow === "string" && PASSKEY_FLOWS.includes(flow) ? Effect.succeed({ flow }) : Effect.fail(convexError("PASSKEY_MISSING_FLOW", "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify"));
-};
-const requirePasskeyVerifierFx = (verifier) => verifier != null ? Effect.succeed(verifier) : Effect.fail(convexError("PASSKEY_MISSING_VERIFIER", "Missing verifier for passkey operation."));
-const requireAuthenticatedUserId = (ctx) => Effect.flatMap(Effect.tryPromise({
-	try: () => ctx.auth.getUserIdentity(),
-	catch: () => convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.")
-}), (identity) => Match.value(identity).pipe(Match.when(null, () => Effect.fail(convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account."))), Match.orElse((identity$1) => Effect.succeed(userIdFromIdentitySubject(identity$1.subject)))));
-const resolveRegistrationPublicKeyBytes = (publicKey, algorithm) => Match.value(algorithm).pipe(Match.when(coseAlgorithmES256, () => {
-	const ec2 = publicKey.ec2();
-	const xBytes = new Uint8Array(32);
-	let vx = ec2.x;
-	for (let i = 31; i >= 0; i--) {
-		xBytes[i] = Number(vx & 255n);
-		vx >>= 8n;
+	if (typeof flow === "string" && PASSKEY_FLOWS.includes(flow)) return { flow };
+	throw convexError("PASSKEY_MISSING_FLOW", "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify");
+}
+function requirePasskeyVerifier(verifier) {
+	if (verifier != null) return verifier;
+	throw convexError("PASSKEY_MISSING_VERIFIER", "Missing verifier for passkey operation.");
+}
+async function requireAuthenticatedUserId(ctx) {
+	let identity;
+	try {
+		identity = await ctx.auth.getUserIdentity();
+	} catch {
+		throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
 	}
-	const yBytes = new Uint8Array(32);
-	let vy = ec2.y;
-	for (let i = 31; i >= 0; i--) {
-		yBytes[i] = Number(vy & 255n);
-		vy >>= 8n;
+	if (identity === null) throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
+	return userIdFromIdentitySubject(identity.subject);
+}
+function resolveRegistrationPublicKeyBytes(publicKey, algorithm) {
+	if (algorithm === coseAlgorithmES256) {
+		const ec2 = publicKey.ec2();
+		const xBytes = new Uint8Array(32);
+		let vx = ec2.x;
+		for (let i = 31; i >= 0; i--) {
+			xBytes[i] = Number(vx & 255n);
+			vx >>= 8n;
+		}
+		const yBytes = new Uint8Array(32);
+		let vy = ec2.y;
+		for (let i = 31; i >= 0; i--) {
+			yBytes[i] = Number(vy & 255n);
+			vy >>= 8n;
+		}
+		const bytes = new Uint8Array(65);
+		bytes[0] = 4;
+		bytes.set(xBytes, 1);
+		bytes.set(yBytes, 33);
+		return bytes;
 	}
-	const bytes = new Uint8Array(65);
-	bytes[0] = 4;
-	bytes.set(xBytes, 1);
-	bytes.set(yBytes, 33);
-	return Effect.succeed(bytes);
-}), Match.when(coseAlgorithmRS256, () => {
-	const rsa = publicKey.rsa();
-	const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);
-	return Effect.succeed(rsaPubKey.encodePKCS1());
-}), Match.orElse((algorithm$1) => Effect.fail(convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${algorithm$1}`))));
-const verifyAssertionSignature = (passkey, signature, messageHash) => Match.value(passkey.algorithm).pipe(Match.when(coseAlgorithmES256, () => {
-	return verifyECDSASignature(decodeSEC1PublicKey(p256, new Uint8Array(passkey.publicKey)), messageHash, decodePKIXECDSASignature(signature)) ? Effect.void : Effect.fail(convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature."));
-}), Match.when(coseAlgorithmRS256, () => {
-	return verifyRSASSAPKCS1v15Signature(decodePKCS1RSAPublicKey(new Uint8Array(passkey.publicKey)), sha256ObjectIdentifier, messageHash, signature) ? Effect.void : Effect.fail(convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature."));
-}), Match.orElse((algorithm) => Effect.fail(convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${algorithm}`))));
-function handlePasskeyFx(ctx, provider, args) {
+	if (algorithm === coseAlgorithmRS256) {
+		const rsa = publicKey.rsa();
+		return new RSAPublicKey(rsa.n, rsa.e).encodePKCS1();
+	}
+	throw convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${algorithm}`);
+}
+function verifyAssertionSignature(passkey, signature, messageHash) {
+	if (passkey.algorithm === coseAlgorithmES256) {
+		if (!verifyECDSASignature(decodeSEC1PublicKey(p256, new Uint8Array(passkey.publicKey)), messageHash, decodePKIXECDSASignature(signature))) throw convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature.");
+		return;
+	}
+	if (passkey.algorithm === coseAlgorithmRS256) {
+		if (!verifyRSASSAPKCS1v15Signature(decodePKCS1RSAPublicKey(new Uint8Array(passkey.publicKey)), sha256ObjectIdentifier, messageHash, signature)) throw convexError("PASSKEY_INVALID_SIGNATURE", "Invalid passkey signature.");
+		return;
+	}
+	throw convexError("PASSKEY_UNSUPPORTED_ALGORITHM", `Unsupported algorithm: ${passkey.algorithm}`);
+}
+async function handlePasskeyFx(ctx, provider, args) {
 	const params = args.params ?? {};
-	return Effect.flatMap(resolvePasskeyDispatchFx(params), (dispatch) => Match.value(dispatch).pipe(Match.when({ flow: "registerOptions" }, () => Effect.gen(function* () {
-		const userId = yield* requireAuthenticatedUserId(ctx);
-		const rp = yield* resolveRpOptionsFx(provider);
-		const challenge = new Uint8Array(32);
-		crypto.getRandomValues(challenge);
-		const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-		const verifier = yield* Effect.tryPromise({
-			try: async () => {
-				const verifier$1 = await callVerifier(ctx);
-				await callVerifierSignature(ctx, {
-					verifier: verifier$1,
-					signature: challengeHash
-				});
-				return verifier$1;
-			},
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		});
-		const user = yield* Effect.tryPromise({
-			try: () => queryUserById(ctx, userId),
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		});
-		const userName = params.userName ?? user?.email ?? "user";
-		const userDisplayName = params.userDisplayName ?? user?.name ?? userName;
-		const excludeCredentials = (yield* Effect.tryPromise({
-			try: () => queryPasskeysByUserId(ctx, userId),
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		})).map((pk) => ({
-			id: pk.credentialId,
-			transports: pk.transports
-		}));
-		const userHandle = encodeBase64urlNoPadding(new TextEncoder().encode(userId));
-		return {
-			kind: "passkeyOptions",
-			options: {
-				rp: {
-					name: rp.rpName,
-					id: rp.rpId
-				},
-				user: {
-					id: userHandle,
-					name: userName,
-					displayName: userDisplayName
-				},
-				challenge: encodeBase64urlNoPadding(challenge),
-				pubKeyCredParams: rp.algorithms.map((alg) => ({
-					type: "public-key",
-					alg
-				})),
-				timeout: rp.challengeExpirationMs,
-				attestation: rp.attestation,
-				authenticatorSelection: {
-					residentKey: rp.residentKey,
-					requireResidentKey: rp.residentKey === "required",
-					userVerification: rp.userVerification,
-					...rp.authenticatorAttachment ? { authenticatorAttachment: rp.authenticatorAttachment } : {}
+	const dispatch = resolvePasskeyDispatch(params);
+	const handler = {
+		registerOptions: async () => {
+			const userId = await requireAuthenticatedUserId(ctx);
+			const rp = resolveRpOptions(provider);
+			const challenge = new Uint8Array(32);
+			crypto.getRandomValues(challenge);
+			const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, challengeHash);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let user;
+			try {
+				user = await queryUserById(ctx, userId);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			const userName = params.userName ?? user?.email ?? "user";
+			const userDisplayName = params.userDisplayName ?? user?.name ?? userName;
+			let existing;
+			try {
+				existing = await queryPasskeysByUserId(ctx, userId);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			const excludeCredentials = existing.map((pk) => ({
+				id: pk.credentialId,
+				transports: pk.transports
+			}));
+			const userHandle = encodeBase64urlNoPadding(new TextEncoder().encode(userId));
+			return {
+				kind: "passkeyOptions",
+				options: {
+					rp: {
+						name: rp.rpName,
+						id: rp.rpId
+					},
+					user: {
+						id: userHandle,
+						name: userName,
+						displayName: userDisplayName
+					},
+					challenge: encodeBase64urlNoPadding(challenge),
+					pubKeyCredParams: rp.algorithms.map((alg) => ({
+						type: "public-key",
+						alg
+					})),
+					timeout: rp.challengeExpirationMs,
+					attestation: rp.attestation,
+					authenticatorSelection: {
+						residentKey: rp.residentKey,
+						requireResidentKey: rp.residentKey === "required",
+						userVerification: rp.userVerification,
+						...rp.authenticatorAttachment ? { authenticatorAttachment: rp.authenticatorAttachment } : {}
+					},
+					excludeCredentials
 				},
-				excludeCredentials
-			},
-			verifier
-		};
-	})), Match.when({ flow: "registerVerify" }, () => Effect.gen(function* () {
-		const userId = yield* requireAuthenticatedUserId(ctx);
-		const rp = yield* resolveRpOptionsFx(provider);
-		const verifier = yield* requirePasskeyVerifierFx(args.verifier);
-		const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON")));
-		yield* verifyClientDataType(ClientDataType.Create, "webauthn.create")(clientData);
-		yield* verifyOrigin(rp)(clientData);
-		yield* verifyAndConsumeChallenge(ctx, verifier)(clientData);
-		const authData = parseAttestationObject(decodeBase64urlIgnorePadding(requireStringParam(params.attestationObject, "attestationObject"))).authenticatorData;
-		yield* verifyRpId(rp.rpId)(authData);
-		yield* verifyUserFlags(rp)(authData);
-		if (authData.credential == null) return yield* Effect.fail(convexError("PASSKEY_NO_CREDENTIAL", "No credential in attestation."));
-		const credential = authData.credential;
-		const credentialId = encodeBase64urlNoPadding(credential.id);
-		const publicKey = credential.publicKey;
-		const algorithm = publicKey.isAlgorithmDefined() ? publicKey.algorithm() : Match.value(publicKey.type()).pipe(Match.when(COSEKeyType.EC2, () => coseAlgorithmES256), Match.when(COSEKeyType.RSA, () => coseAlgorithmRS256), Match.orElse(() => coseAlgorithmES256));
-		const publicKeyBytes = yield* resolveRegistrationPublicKeyBytes(publicKey, algorithm);
-		yield* Effect.tryPromise({
-			try: async () => {
+				verifier
+			};
+		},
+		registerVerify: async () => {
+			const userId = await requireAuthenticatedUserId(ctx);
+			const rp = resolveRpOptions(provider);
+			const verifier = requirePasskeyVerifier(args.verifier);
+			const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON")));
+			verifyClientDataType(clientData, ClientDataType.Create, "webauthn.create");
+			verifyOrigin(clientData, rp);
+			await verifyAndConsumeChallenge(clientData, ctx, verifier);
+			const authData = parseAttestationObject(decodeBase64urlIgnorePadding(requireStringParam(params.attestationObject, "attestationObject"))).authenticatorData;
+			verifyRpId(authData, rp.rpId);
+			verifyUserFlags(authData, rp);
+			if (authData.credential == null) throw convexError("PASSKEY_NO_CREDENTIAL", "No credential in attestation.");
+			const credential = authData.credential;
+			const credentialId = encodeBase64urlNoPadding(credential.id);
+			const publicKey = credential.publicKey;
+			const algorithm = publicKey.isAlgorithmDefined() ? publicKey.algorithm() : publicKey.type() === COSEKeyType.EC2 ? coseAlgorithmES256 : publicKey.type() === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
+			const publicKeyBytes = resolveRegistrationPublicKeyBytes(publicKey, algorithm);
+			try {
 				const deviceType = params.deviceType ?? "single-device";
 				const backedUp = params.backedUp ?? false;
 				await authDb(ctx, ctx.auth.config).accounts.create({
@@ -228,103 +263,117 @@ function handlePasskeyFx(ctx, provider, args) {
 					name: params.passkeyName,
 					createdAt: Date.now()
 				});
-			},
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		});
-		return {
-			kind: "signedIn",
-			signedIn: yield* Effect.tryPromise({
-				try: () => callSignIn(ctx, {
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let signInResult;
+			try {
+				signInResult = await callSignIn(ctx, {
 					userId,
 					generateTokens: true
-				}),
-				catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-			})
-		};
-	})), Match.when({ flow: "authOptions" }, () => Effect.gen(function* () {
-		const rp = yield* resolveRpOptionsFx(provider);
-		const challenge = new Uint8Array(32);
-		crypto.getRandomValues(challenge);
-		const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
-		const verifier = yield* Effect.tryPromise({
-			try: async () => {
-				const verifier$1 = await callVerifier(ctx);
-				await callVerifierSignature(ctx, {
-					verifier: verifier$1,
-					signature: challengeHash
-				});
-				return verifier$1;
-			},
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		});
-		let allowCredentials;
-		if (params.email) {
-			const email = requireStringParam(params.email, "email");
-			const user = yield* Effect.tryPromise({
-				try: () => queryUserByVerifiedEmail(ctx, email),
-				catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-			});
-			if (user) {
-				const passkeys = yield* Effect.tryPromise({
-					try: () => queryPasskeysByUserId(ctx, user._id),
-					catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
 				});
-				if (passkeys.length > 0) allowCredentials = passkeys.map((pk) => ({
-					type: "public-key",
-					id: pk.credentialId,
-					transports: pk.transports
-				}));
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
 			}
-		}
-		const options = {
-			challenge: encodeBase64urlNoPadding(challenge),
-			timeout: rp.challengeExpirationMs,
-			rpId: rp.rpId,
-			userVerification: rp.userVerification
-		};
-		if (allowCredentials) options.allowCredentials = allowCredentials;
-		return {
-			kind: "passkeyOptions",
-			options,
-			verifier
-		};
-	})), Match.when({ flow: "authVerify" }, () => Effect.gen(function* () {
-		const rp = yield* resolveRpOptionsFx(provider);
-		const verifier = yield* requirePasskeyVerifierFx(args.verifier);
-		const clientDataJSON = decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON"));
-		const clientData = parseClientDataJSON(clientDataJSON);
-		yield* verifyClientDataType(ClientDataType.Get, "webauthn.get")(clientData);
-		yield* verifyOrigin(rp)(clientData);
-		yield* verifyAndConsumeChallenge(ctx, verifier)(clientData);
-		const credentialId = params.credentialId;
-		if (credentialId == null) return yield* Effect.fail(convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Missing credential ID"));
-		const passkey = yield* Effect.flatMap(Effect.tryPromise({
-			try: () => queryPasskeyByCredentialId(ctx, credentialId),
-			catch: () => convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown passkey credential.")
-		}), (passkey$1) => Match.value(passkey$1).pipe(Match.when(null, () => Effect.fail(convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown credential"))), Match.orElse((passkey$2) => Effect.succeed(passkey$2))));
-		const authenticatorDataBytes = decodeBase64urlIgnorePadding(requireStringParam(params.authenticatorData, "authenticatorData"));
-		const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
-		const signature = decodeBase64urlIgnorePadding(requireStringParam(params.signature, "signature"));
-		const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
-		yield* verifyRpId(rp.rpId)(authenticatorData);
-		yield* verifyUserFlags(rp)(authenticatorData);
-		yield* verifyAssertionSignature(passkey, signature, messageHash);
-		if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) return yield* Effect.fail(convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected."));
-		yield* Effect.tryPromise({
-			try: () => mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now()),
-			catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-		});
-		return {
-			kind: "signedIn",
-			signedIn: yield* Effect.tryPromise({
-				try: () => callSignIn(ctx, {
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		},
+		authOptions: async () => {
+			const rp = resolveRpOptions(provider);
+			const challenge = new Uint8Array(32);
+			crypto.getRandomValues(challenge);
+			const challengeHash = encodeBase64urlNoPadding(new Uint8Array(sha256(challenge)));
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, challengeHash);
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let allowCredentials;
+			if (params.email) {
+				const email = requireStringParam(params.email, "email");
+				let user;
+				try {
+					user = await queryUserByVerifiedEmail(ctx, email);
+				} catch {
+					throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+				}
+				if (user) {
+					let passkeys;
+					try {
+						passkeys = await queryPasskeysByUserId(ctx, user._id);
+					} catch {
+						throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+					}
+					if (passkeys.length > 0) allowCredentials = passkeys.map((pk) => ({
+						type: "public-key",
+						id: pk.credentialId,
+						transports: pk.transports
+					}));
+				}
+			}
+			const options = {
+				challenge: encodeBase64urlNoPadding(challenge),
+				timeout: rp.challengeExpirationMs,
+				rpId: rp.rpId,
+				userVerification: rp.userVerification
+			};
+			if (allowCredentials) options.allowCredentials = allowCredentials;
+			return {
+				kind: "passkeyOptions",
+				options,
+				verifier
+			};
+		},
+		authVerify: async () => {
+			const rp = resolveRpOptions(provider);
+			const verifier = requirePasskeyVerifier(args.verifier);
+			const clientDataJSON = decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON"));
+			const clientData = parseClientDataJSON(clientDataJSON);
+			verifyClientDataType(clientData, ClientDataType.Get, "webauthn.get");
+			verifyOrigin(clientData, rp);
+			await verifyAndConsumeChallenge(clientData, ctx, verifier);
+			const credentialId = params.credentialId;
+			if (credentialId == null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Missing credential ID");
+			let passkey;
+			try {
+				passkey = await queryPasskeyByCredentialId(ctx, credentialId);
+			} catch {
+				throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown passkey credential.");
+			}
+			if (passkey === null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown credential");
+			const authenticatorDataBytes = decodeBase64urlIgnorePadding(requireStringParam(params.authenticatorData, "authenticatorData"));
+			const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
+			const signatureBytes = decodeBase64urlIgnorePadding(requireStringParam(params.signature, "signature"));
+			const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
+			verifyRpId(authenticatorData, rp.rpId);
+			verifyUserFlags(authenticatorData, rp);
+			verifyAssertionSignature(passkey, signatureBytes, messageHash);
+			if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) throw convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected.");
+			try {
+				await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			let signInResult;
+			try {
+				signInResult = await callSignIn(ctx, {
 					userId: passkey.userId,
 					generateTokens: true
-				}),
-				catch: () => convexError("INTERNAL_ERROR", "An unexpected error occurred.")
-			})
-		};
-	})), Match.exhaustive));
+				});
+			} catch {
+				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			}
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		}
+	}[dispatch.flow];
+	if (!handler) throw convexError("PASSKEY_MISSING_FLOW", `Unknown passkey flow: ${dispatch.flow}`);
+	return handler();
 }
 
 //#endregion