@technomoron/api-server-base 2.0.0-beta.11 → 2.0.0-beta.12

package/dist/cjs/auth-api/auth-module.js

@@ -600,15 +600,7 @@ class AuthModule extends module_js_1.BaseAuthModule {
         const params = {
             action,
             login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
-            userAgent: toStringOrNull(body.userAgent) ?? undefined,
-            domain: toStringOrNull(body.domain) ?? undefined,
-            fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
-            label: toStringOrNull(body.label) ?? undefined,
-            browser: toStringOrNull(body.browser) ?? undefined,
-            device: toStringOrNull(body.device) ?? undefined,
-            ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined
         };
         const challenge = await this.storage.createPasskeyChallenge(params);
         return [200, challenge];
@@ -624,18 +616,25 @@ class AuthModule extends module_js_1.BaseAuthModule {
         if (!expectedChallenge || typeof response !== 'object' || response === null) {
             throw new api_server_base_js_1.ApiError({ code: 400, message: 'Malformed passkey verification payload' });
         }
-        const params = {
-            expectedChallenge,
-            response: response,
-            login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+        const rawMetadata = {
             domain: toStringOrNull(body.domain) ?? undefined,
             fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
             label: toStringOrNull(body.label) ?? undefined,
             browser: toStringOrNull(body.browser) ?? undefined,
             device: toStringOrNull(body.device) ?? undefined,
             ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined,
+            os: toStringOrNull(body.os) ?? undefined
+        };
+        const clientInfo = apiReq.getClientInfo();
+        const userAgent = toStringOrNull(body.userAgent) ?? (clientInfo.ua ? clientInfo.ua : null);
+        const requestMetadata = this.enrichTokenMetadata(apiReq, rawMetadata);
+        const params = {
+            expectedChallenge,
+            response: response,
+            login: toStringOrNull(body.login) ?? undefined,
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+            userAgent: userAgent ?? undefined,
+            ...requestMetadata,
             ...sessionPrefs
         };
         const result = await this.storage.verifyPasskeyResponse(params);

package/dist/cjs/passkey/memory.js

@@ -62,9 +62,11 @@ class MemoryPasskeyStore extends base_js_1.PasskeyStore {
     }
     async saveChallenge(record) {
         this.challenges.set(record.challenge, {
-            ...record,
+            challenge: record.challenge,
+            action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : undefined,
-            metadata: record.metadata ? { ...record.metadata } : {}
+            login: record.login ?? undefined,
+            expiresAt: record.expiresAt
         });
     }
     async consumeChallenge(challenge) {
@@ -73,7 +75,7 @@ class MemoryPasskeyStore extends base_js_1.PasskeyStore {
             return null;
         }
         this.challenges.delete(challenge);
-        return { ...record, metadata: record.metadata ? { ...record.metadata } : {} };
+        return { ...record };
     }
     async cleanupChallenges(now) {
         for (const [challenge, record] of this.challenges.entries()) {

package/dist/cjs/passkey/models.d.ts

@@ -1,5 +1,4 @@
 import { Model, type InferAttributes, type InferCreationAttributes, type ModelStatic, type Sequelize } from 'sequelize';
-import type { PasskeyChallengeMetadata } from './service.js';
 export declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCredentialModel>, InferCreationAttributes<PasskeyCredentialModel>> {
     credentialId: Buffer;
     userId: number;
@@ -8,6 +7,13 @@ export declare class PasskeyCredentialModel extends Model<InferAttributes<Passke
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -16,7 +22,6 @@ export declare class PasskeyChallengeModel extends Model<InferAttributes<Passkey
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: PasskeyChallengeMetadata | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/cjs/passkey/models.js

@@ -67,6 +67,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: sequelize_1.DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: sequelize_1.DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: sequelize_1.DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -96,10 +130,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: sequelize_1.DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: sequelize_1.DataTypes.DATE,

package/dist/cjs/passkey/sequelize.d.ts

@@ -10,6 +10,13 @@ declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCreden
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -18,7 +25,6 @@ declare class PasskeyChallengeModel extends Model<InferAttributes<PasskeyChallen
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: Record<string, unknown> | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/cjs/passkey/sequelize.js

@@ -76,6 +76,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: sequelize_1.DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: sequelize_1.DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: sequelize_1.DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -105,10 +139,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: sequelize_1.DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: sequelize_1.DataTypes.DATE,
@@ -148,6 +178,13 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         }));
@@ -170,6 +207,13 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         };
@@ -182,7 +226,14 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             counter: record.counter,
             transports: record.transports ?? null,
             backedUp: record.backedUp,
-            deviceType: record.deviceType
+            deviceType: record.deviceType,
+            label: record.label ?? null,
+            createdDomain: record.createdDomain ?? null,
+            createdUserAgent: record.createdUserAgent ?? null,
+            createdBrowser: record.createdBrowser ?? null,
+            createdOs: record.createdOs ?? null,
+            createdDevice: record.createdDevice ?? null,
+            createdIp: record.createdIp ?? null
         });
     }
     async updateCredentialCounter(credentialId, counter) {
@@ -194,7 +245,6 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : null,
             login: record.login ?? null,
-            metadata: (record.metadata ?? {}),
             expiresAt: record.expiresAt
         });
     }
@@ -209,8 +259,7 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             action: model.action,
             userId: model.userId ?? undefined,
             login: model.login ?? undefined,
-            expiresAt: model.expiresAt,
-            metadata: model.metadata ?? {}
+            expiresAt: model.expiresAt
         };
     }
     async cleanupChallenges(now) {

package/dist/cjs/passkey/service.d.ts

@@ -1,6 +1,6 @@
 import type { PasskeyChallenge, PasskeyChallengeParams, PasskeyStorageAdapter, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, StoredPasskeyCredential } from './types.js';
 import type { AuthIdentifier } from '../auth-api/types.js';
-export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyChallengeMetadata, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
+export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
 type Logger = Pick<typeof console, 'error' | 'warn'>;
 export declare class PasskeyService {
     private readonly config;

package/dist/cjs/passkey/service.js

@@ -54,6 +54,13 @@ function sanitizeTransports(input) {
         .filter((value) => ALLOWED_TRANSPORTS.includes(value));
     return filtered.length > 0 ? filtered : undefined;
 }
+function toOptionalString(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 function toBase64Url(buffer) {
     return helpers_1.isoBase64URL.fromBuffer(new Uint8Array(buffer));
 }
@@ -127,17 +134,11 @@ class PasskeyService {
     }
     async createChallenge(params) {
         await this.adapter.cleanupChallenges?.(new Date());
-        const metadata = {
-            domain: typeof params.domain === 'string' ? params.domain : undefined,
-            fingerprint: typeof params.fingerprint === 'string' ? params.fingerprint : undefined,
-            label: typeof params.label === 'string' ? params.label : undefined,
-            userAgent: typeof params.userAgent === 'string' ? params.userAgent : undefined
-        };
         if (params.action === 'register') {
-            return this.createRegistrationChallenge(params, metadata);
+            return this.createRegistrationChallenge(params);
         }
         if (params.action === 'authenticate') {
-            return this.createAuthenticationChallenge(params, metadata);
+            return this.createAuthenticationChallenge(params);
         }
         throw new Error(`Unsupported passkey action: ${String(params.action)}`);
     }
@@ -163,7 +164,7 @@ class PasskeyService {
         }
         return { verified: false };
     }
-    async createRegistrationChallenge(params, metadata) {
+    async createRegistrationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const existing = await this.adapter.listUserCredentials(user.id);
         const excludeCredentials = existing.map((credential) => {
@@ -186,8 +187,7 @@ class PasskeyService {
             action: 'register',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -196,7 +196,7 @@ class PasskeyService {
             publicKey: options
         };
     }
-    async createAuthenticationChallenge(params, metadata) {
+    async createAuthenticationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const credentials = await this.adapter.listUserCredentials(user.id);
         const allowCredentials = credentials.map((credential) => {
@@ -216,8 +216,7 @@ class PasskeyService {
             action: 'authenticate',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -295,7 +294,14 @@ class PasskeyService {
             counter: registrationInfo.counter ?? 0,
             transports: sanitizeTransports(params.response.transports),
             backedUp: registrationInfo.credentialDeviceType === 'multiDevice',
-            deviceType: registrationInfo.credentialDeviceType
+            deviceType: registrationInfo.credentialDeviceType,
+            label: toOptionalString(params.label),
+            createdDomain: toOptionalString(params.domain),
+            createdUserAgent: toOptionalString(params.userAgent),
+            createdBrowser: toOptionalString(params.browser),
+            createdOs: toOptionalString(params.os),
+            createdDevice: toOptionalString(params.device),
+            createdIp: toOptionalString(params.ip)
         });
         return { verified: true, userId: user.id, login: user.login };
     }

package/dist/cjs/passkey/types.d.ts

@@ -9,19 +9,12 @@ export interface PasskeyServiceConfig {
     timeoutMs: number;
     userVerification?: 'preferred' | 'required' | 'discouraged';
 }
-export interface PasskeyChallengeMetadata {
-    domain?: string;
-    fingerprint?: string;
-    label?: string;
-    userAgent?: string;
-}
 export interface PasskeyChallengeRecord {
     challenge: string;
     action: 'register' | 'authenticate';
     userId?: AuthIdentifier;
     login?: string;
     expiresAt: Date;
-    metadata: PasskeyChallengeMetadata;
 }
 export interface PasskeyUserDescriptor {
     id: AuthIdentifier;
@@ -36,6 +29,13 @@ export interface StoredPasskeyCredential {
     transports?: AuthenticatorTransportFuture[];
     backedUp: boolean;
     deviceType: CredentialDeviceType;
+    label?: string;
+    createdDomain?: string;
+    createdUserAgent?: string;
+    createdBrowser?: string;
+    createdOs?: string;
+    createdDevice?: string;
+    createdIp?: string;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -53,10 +53,9 @@ export interface PasskeyStorageAdapter {
     consumeChallenge(challenge: string): Promise<PasskeyChallengeRecord | null>;
     cleanupChallenges?(now: Date): Promise<void>;
 }
-export interface PasskeyChallengeParams extends Partial<Omit<Token, 'userId'>> {
+export interface PasskeyChallengeParams {
     action: 'register' | 'authenticate';
     login?: string;
-    userAgent?: string;
     userId?: AuthIdentifier;
 }
 export interface PasskeyChallenge extends Record<string, unknown> {
@@ -69,6 +68,7 @@ export interface PasskeyVerificationParams extends Partial<Omit<Token, 'userId'>
     login?: string;
     response: Record<string, unknown>;
     userId?: AuthIdentifier;
+    userAgent?: string;
 }
 export interface PasskeyVerificationResult extends Record<string, unknown> {
     login?: string;

package/dist/esm/auth-api/auth-module.js

@@ -598,15 +598,7 @@ class AuthModule extends BaseAuthModule {
         const params = {
             action,
             login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
-            userAgent: toStringOrNull(body.userAgent) ?? undefined,
-            domain: toStringOrNull(body.domain) ?? undefined,
-            fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
-            label: toStringOrNull(body.label) ?? undefined,
-            browser: toStringOrNull(body.browser) ?? undefined,
-            device: toStringOrNull(body.device) ?? undefined,
-            ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined
         };
         const challenge = await this.storage.createPasskeyChallenge(params);
         return [200, challenge];
@@ -622,18 +614,25 @@ class AuthModule extends BaseAuthModule {
         if (!expectedChallenge || typeof response !== 'object' || response === null) {
             throw new ApiError({ code: 400, message: 'Malformed passkey verification payload' });
         }
-        const params = {
-            expectedChallenge,
-            response: response,
-            login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+        const rawMetadata = {
             domain: toStringOrNull(body.domain) ?? undefined,
             fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
             label: toStringOrNull(body.label) ?? undefined,
             browser: toStringOrNull(body.browser) ?? undefined,
             device: toStringOrNull(body.device) ?? undefined,
             ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined,
+            os: toStringOrNull(body.os) ?? undefined
+        };
+        const clientInfo = apiReq.getClientInfo();
+        const userAgent = toStringOrNull(body.userAgent) ?? (clientInfo.ua ? clientInfo.ua : null);
+        const requestMetadata = this.enrichTokenMetadata(apiReq, rawMetadata);
+        const params = {
+            expectedChallenge,
+            response: response,
+            login: toStringOrNull(body.login) ?? undefined,
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+            userAgent: userAgent ?? undefined,
+            ...requestMetadata,
             ...sessionPrefs
         };
         const result = await this.storage.verifyPasskeyResponse(params);

package/dist/esm/passkey/memory.js

@@ -59,9 +59,11 @@ export class MemoryPasskeyStore extends PasskeyStore {
     }
     async saveChallenge(record) {
         this.challenges.set(record.challenge, {
-            ...record,
+            challenge: record.challenge,
+            action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : undefined,
-            metadata: record.metadata ? { ...record.metadata } : {}
+            login: record.login ?? undefined,
+            expiresAt: record.expiresAt
         });
     }
     async consumeChallenge(challenge) {
@@ -70,7 +72,7 @@ export class MemoryPasskeyStore extends PasskeyStore {
             return null;
         }
         this.challenges.delete(challenge);
-        return { ...record, metadata: record.metadata ? { ...record.metadata } : {} };
+        return { ...record };
     }
     async cleanupChallenges(now) {
         for (const [challenge, record] of this.challenges.entries()) {

package/dist/esm/passkey/models.d.ts

@@ -1,5 +1,4 @@
 import { Model, type InferAttributes, type InferCreationAttributes, type ModelStatic, type Sequelize } from 'sequelize';
-import type { PasskeyChallengeMetadata } from './service.js';
 export declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCredentialModel>, InferCreationAttributes<PasskeyCredentialModel>> {
     credentialId: Buffer;
     userId: number;
@@ -8,6 +7,13 @@ export declare class PasskeyCredentialModel extends Model<InferAttributes<Passke
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -16,7 +22,6 @@ export declare class PasskeyChallengeModel extends Model<InferAttributes<Passkey
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: PasskeyChallengeMetadata | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/esm/passkey/models.js

@@ -60,6 +60,40 @@ export function initPasskeyCredentialModel(sequelize) {
             type: DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -89,10 +123,6 @@ export function initPasskeyChallengeModel(sequelize) {
             type: DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: DataTypes.DATE,

package/dist/esm/passkey/sequelize.d.ts

@@ -10,6 +10,13 @@ declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCreden
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -18,7 +25,6 @@ declare class PasskeyChallengeModel extends Model<InferAttributes<PasskeyChallen
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: Record<string, unknown> | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/esm/passkey/sequelize.js

@@ -73,6 +73,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -102,10 +136,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: DataTypes.DATE,
@@ -145,6 +175,13 @@ export class SequelizePasskeyStore extends PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         }));
@@ -167,6 +204,13 @@ export class SequelizePasskeyStore extends PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         };
@@ -179,7 +223,14 @@ export class SequelizePasskeyStore extends PasskeyStore {
             counter: record.counter,
             transports: record.transports ?? null,
             backedUp: record.backedUp,
-            deviceType: record.deviceType
+            deviceType: record.deviceType,
+            label: record.label ?? null,
+            createdDomain: record.createdDomain ?? null,
+            createdUserAgent: record.createdUserAgent ?? null,
+            createdBrowser: record.createdBrowser ?? null,
+            createdOs: record.createdOs ?? null,
+            createdDevice: record.createdDevice ?? null,
+            createdIp: record.createdIp ?? null
         });
     }
     async updateCredentialCounter(credentialId, counter) {
@@ -191,7 +242,6 @@ export class SequelizePasskeyStore extends PasskeyStore {
             action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : null,
             login: record.login ?? null,
-            metadata: (record.metadata ?? {}),
             expiresAt: record.expiresAt
         });
     }
@@ -206,8 +256,7 @@ export class SequelizePasskeyStore extends PasskeyStore {
             action: model.action,
             userId: model.userId ?? undefined,
             login: model.login ?? undefined,
-            expiresAt: model.expiresAt,
-            metadata: model.metadata ?? {}
+            expiresAt: model.expiresAt
         };
     }
     async cleanupChallenges(now) {

package/dist/esm/passkey/service.d.ts

@@ -1,6 +1,6 @@
 import type { PasskeyChallenge, PasskeyChallengeParams, PasskeyStorageAdapter, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, StoredPasskeyCredential } from './types.js';
 import type { AuthIdentifier } from '../auth-api/types.js';
-export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyChallengeMetadata, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
+export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
 type Logger = Pick<typeof console, 'error' | 'warn'>;
 export declare class PasskeyService {
     private readonly config;

package/dist/esm/passkey/service.js

@@ -18,6 +18,13 @@ function sanitizeTransports(input) {
         .filter((value) => ALLOWED_TRANSPORTS.includes(value));
     return filtered.length > 0 ? filtered : undefined;
 }
+function toOptionalString(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 function toBase64Url(buffer) {
     return isoBase64URL.fromBuffer(new Uint8Array(buffer));
 }
@@ -91,17 +98,11 @@ export class PasskeyService {
     }
     async createChallenge(params) {
         await this.adapter.cleanupChallenges?.(new Date());
-        const metadata = {
-            domain: typeof params.domain === 'string' ? params.domain : undefined,
-            fingerprint: typeof params.fingerprint === 'string' ? params.fingerprint : undefined,
-            label: typeof params.label === 'string' ? params.label : undefined,
-            userAgent: typeof params.userAgent === 'string' ? params.userAgent : undefined
-        };
         if (params.action === 'register') {
-            return this.createRegistrationChallenge(params, metadata);
+            return this.createRegistrationChallenge(params);
         }
         if (params.action === 'authenticate') {
-            return this.createAuthenticationChallenge(params, metadata);
+            return this.createAuthenticationChallenge(params);
         }
         throw new Error(`Unsupported passkey action: ${String(params.action)}`);
     }
@@ -127,7 +128,7 @@ export class PasskeyService {
         }
         return { verified: false };
     }
-    async createRegistrationChallenge(params, metadata) {
+    async createRegistrationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const existing = await this.adapter.listUserCredentials(user.id);
         const excludeCredentials = existing.map((credential) => {
@@ -150,8 +151,7 @@ export class PasskeyService {
             action: 'register',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -160,7 +160,7 @@ export class PasskeyService {
             publicKey: options
         };
     }
-    async createAuthenticationChallenge(params, metadata) {
+    async createAuthenticationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const credentials = await this.adapter.listUserCredentials(user.id);
         const allowCredentials = credentials.map((credential) => {
@@ -180,8 +180,7 @@ export class PasskeyService {
             action: 'authenticate',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -259,7 +258,14 @@ export class PasskeyService {
             counter: registrationInfo.counter ?? 0,
             transports: sanitizeTransports(params.response.transports),
             backedUp: registrationInfo.credentialDeviceType === 'multiDevice',
-            deviceType: registrationInfo.credentialDeviceType
+            deviceType: registrationInfo.credentialDeviceType,
+            label: toOptionalString(params.label),
+            createdDomain: toOptionalString(params.domain),
+            createdUserAgent: toOptionalString(params.userAgent),
+            createdBrowser: toOptionalString(params.browser),
+            createdOs: toOptionalString(params.os),
+            createdDevice: toOptionalString(params.device),
+            createdIp: toOptionalString(params.ip)
         });
         return { verified: true, userId: user.id, login: user.login };
     }

package/dist/esm/passkey/types.d.ts

@@ -9,19 +9,12 @@ export interface PasskeyServiceConfig {
     timeoutMs: number;
     userVerification?: 'preferred' | 'required' | 'discouraged';
 }
-export interface PasskeyChallengeMetadata {
-    domain?: string;
-    fingerprint?: string;
-    label?: string;
-    userAgent?: string;
-}
 export interface PasskeyChallengeRecord {
     challenge: string;
     action: 'register' | 'authenticate';
     userId?: AuthIdentifier;
     login?: string;
     expiresAt: Date;
-    metadata: PasskeyChallengeMetadata;
 }
 export interface PasskeyUserDescriptor {
     id: AuthIdentifier;
@@ -36,6 +29,13 @@ export interface StoredPasskeyCredential {
     transports?: AuthenticatorTransportFuture[];
     backedUp: boolean;
     deviceType: CredentialDeviceType;
+    label?: string;
+    createdDomain?: string;
+    createdUserAgent?: string;
+    createdBrowser?: string;
+    createdOs?: string;
+    createdDevice?: string;
+    createdIp?: string;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -53,10 +53,9 @@ export interface PasskeyStorageAdapter {
     consumeChallenge(challenge: string): Promise<PasskeyChallengeRecord | null>;
     cleanupChallenges?(now: Date): Promise<void>;
 }
-export interface PasskeyChallengeParams extends Partial<Omit<Token, 'userId'>> {
+export interface PasskeyChallengeParams {
     action: 'register' | 'authenticate';
     login?: string;
-    userAgent?: string;
     userId?: AuthIdentifier;
 }
 export interface PasskeyChallenge extends Record<string, unknown> {
@@ -69,6 +68,7 @@ export interface PasskeyVerificationParams extends Partial<Omit<Token, 'userId'>
     login?: string;
     response: Record<string, unknown>;
     userId?: AuthIdentifier;
+    userAgent?: string;
 }
 export interface PasskeyVerificationResult extends Record<string, unknown> {
     login?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@technomoron/api-server-base",
-	"version": "2.0.0-beta.11",
+	"version": "2.0.0-beta.12",
 	"description": "Api Server Skeleton / Base Class",
 	"type": "module",
 	"main": "./dist/cjs/index.cjs",