@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Passkey.js

@@ -0,0 +1,1185 @@
+import { createAuthEndpoint } from 'better-auth/api';
+import { setSessionCookie } from 'better-auth/cookies';
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { and, asc, eq, gt, inArray, isNotNull, sql } from 'drizzle-orm';
+import { Address, Base64, Hash, Hex, P256, PublicKey } from 'ox';
+import { Authentication, Registration } from 'webauthx/server';
+import { z } from 'zod';
+import * as Schema from '../app/db/schema.js';
+import * as Authorize from './Authorize.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as KeyAuthorization from './KeyAuthorization.js';
+import * as Owner from './Owner.js';
+import * as Verification from './Verification.js';
+/** The user holds {@link registrationLimit} registered passkeys, so Tempo ID registers no other. */
+export class LimitError extends ErrorResponse.define('passkey_limit') {
+    name = 'Passkey.LimitError';
+    constructor() {
+        super({
+            error_description: `Passkey limit reached: the user holds ${registrationLimit} registered passkeys, the most that Tempo ID registers. Sign in with one of them.`,
+            meta: { limit: registrationLimit },
+        });
+    }
+}
+/**
+ * The email step's link to a wallet.tempo passkey expired, or the browser holds no link cookie for it.
+ * The refusal comes before the code is checked, so the code stays valid for a sign-in without the
+ * passkey.
+ */
+export class LinkExpiredError extends ErrorResponse.define('passkey_link_expired') {
+    name = 'Passkey.LinkExpiredError';
+    constructor() {
+        super({
+            error_description: 'Expired passkey sign-in: the link from the passkey step is no longer valid. Enter the code again to sign in with email only, or sign in with the passkey again.',
+            field: 'link',
+        });
+    }
+}
+/**
+ * A passkey sign-in names an app, or reaches a realm, that holds no passkeys for Tempo ID, or no
+ * passkeys whose relying party covers the app's page.
+ */
+export class NotPermittedError extends ErrorResponse.define('passkey_not_permitted') {
+    name = 'Passkey.NotPermittedError';
+    constructor(options = {}) {
+        const { clientId, origin } = options;
+        super((() => {
+            if (clientId && origin)
+                return {
+                    error_description: `Passkey not permitted: no realm of the app ${clientId} holds passkeys for ${origin}. Sign in with an emailed code.`,
+                    meta: { client_id: clientId, origin },
+                };
+            if (clientId)
+                return {
+                    error_description: `Passkey not permitted: the app ${clientId} holds no passkeys. Sign in with an emailed code.`,
+                    meta: { client_id: clientId },
+                };
+            return {
+                error_description: 'Passkey not permitted: no realm holds passkeys for this sign-in. Sign in with an emailed code.',
+            };
+        })());
+    }
+}
+/**
+ * A passkey registration comes from a session that signed in more than {@link registrationFreshness}
+ * seconds before. A session alone, such as one left open in a shared browser, thus adds no passkey.
+ */
+export class ReauthenticationRequiredError extends ErrorResponse.define('reauthentication_required') {
+    name = 'Passkey.ReauthenticationRequiredError';
+    constructor() {
+        super({
+            error_description: `Sign in again: adding a passkey needs a sign-in within the last ${registrationFreshness / 60} minutes.`,
+        });
+    }
+}
+/**
+ * A passkey ceremony failed: its challenge is unknown, spent, or expired, or the response does not
+ * verify. One refusal covers every case, so it reveals neither which check failed nor whether a
+ * credential exists.
+ */
+export class WebAuthnRejectedError extends ErrorResponse.define('webauthn_rejected') {
+    name = 'Passkey.WebAuthnRejectedError';
+    constructor() {
+        super({
+            error_description: 'Passkey rejected. Request new options, then try again with the same passkey or another one.',
+        });
+    }
+}
+/** Seconds a challenge lasts. */
+export const lifetime = 5 * 60;
+/** Seconds a deferred link lasts. */
+export const linkLifetime = 5 * 60;
+/** The prefix of a challenge's `verification` identifier, which its hex value follows. */
+const prefix = 'passkey-challenge:';
+/**
+ * The prefix of a proof challenge's `verification` identifier, which the user's ID and the
+ * challenge follow.
+ */
+const proofPrefix = 'passkey-registration-proof:';
+/**
+ * Seconds after its sign-in that a session can register a passkey. A later registration requires a
+ * new sign-in.
+ */
+export const registrationFreshness = 10 * 60;
+/**
+ * The most passkeys that a user registers. Each owns an account that every account read lists, so
+ * the limit bounds the reads.
+ */
+export const registrationLimit = 10;
+/**
+ * The prefix of a registration challenge's `verification` identifier, which the user's ID and the
+ * challenge follow. It differs from {@link prefix} and {@link proofPrefix}, so a sign-in or a proof
+ * never spends a registration challenge.
+ */
+const registrationPrefix = 'passkey-registration:';
+/**
+ * The prefix of a signature challenge's `verification` identifier, which {@link signatureIdentifier}
+ * completes. It differs from {@link prefix}, so a sign-in never spends a signature challenge.
+ */
+const signaturePrefix = 'passkey-signature:';
+/**
+ * The longest a spent signature's record lasts, in seconds: a year, the longest a headless key
+ * lasts. A redirect's key can name a much later expiry, so the record does not follow it, and each
+ * user's approvals add rows that the cleanup cron removes within the year.
+ */
+const spentLifetime = KeyAuthorization.lifetime;
+/**
+ * The prefix of a spent signature's `verification` identifier, which the SHA-256 digest of the
+ * assertion's authenticator data and signature follows.
+ */
+const spentPrefix = 'passkey-signature-spent:';
+/**
+ * The prefix of the `verification` identifier of an assertion that a sign-in with key signature
+ * spent, which the same digest as {@link spentPrefix} follows.
+ */
+const spentSignInPrefix = 'passkey-sign-in-spent:';
+/** Whether the isolate built the curve's table of base point multiples, which {@link table} builds. */
+let tabled = false;
+/** Zod schemas for passkey ceremonies. */
+export var schema;
+(function (schema) {
+    const base64url = z.string().regex(/^[A-Za-z0-9_-]+$/);
+    const hex = z.templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]*$/)]);
+    /**
+     * A credential ID in canonical unpadded base64url, of at most 1,023 bytes, as WebAuthn bounds it:
+     * 1,364 characters.
+     */
+    schema.credentialId = base64url.min(1).max(1364);
+    /** A passkey assertion, as `webauthx/client`'s `Authentication.sign` serializes it. */
+    schema.assertion = z
+        .object({
+        id: schema.credentialId.meta({
+            description: 'The credential ID of the passkey that signed, base64url.',
+            examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+        }),
+        metadata: z
+            .object({
+            authenticatorData: hex.meta({
+                description: 'The authenticator data the passkey signed, as hex: the relying party ID hash, flags, and signature counter.',
+                examples: [
+                    '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d97630500000000',
+                ],
+            }),
+            challengeIndex: z
+                .number()
+                .int()
+                .nonnegative()
+                .optional()
+                .meta({
+                description: 'The character offset of `"challenge"` in `clientDataJSON`. Absent, verification searches for it.',
+                examples: [23],
+            }),
+            clientDataJSON: z
+                .string()
+                .max(4096)
+                .meta({
+                description: 'The client data the browser collected, as a JSON string, which holds the type, challenge, and origin.',
+                examples: [
+                    '{"type":"webauthn.get","challenge":"9jEFijuhEWrM4SOW-tChJbUEHEP44VcjcJ-Bqo1fTM8","origin":"https://id.tempo.xyz","crossOrigin":false}',
+                ],
+            }),
+            typeIndex: z
+                .number()
+                .int()
+                .nonnegative()
+                .optional()
+                .meta({
+                description: 'The character offset of `"type"` in `clientDataJSON`. Absent, verification searches for it.',
+                examples: [1],
+            }),
+            userVerificationRequired: z
+                .boolean()
+                .optional()
+                .meta({
+                description: 'Whether the client required user verification. Verification ignores it and always requires user verification.',
+                examples: [true],
+            }),
+        })
+            .meta({
+            description: 'The signed data that verification reads with `signature`, decoded from the browser response.',
+        }),
+        raw: z
+            .object({
+            authenticatorAttachment: z
+                .string()
+                .nullable()
+                .default(null)
+                .meta({
+                description: 'How the authenticator attaches to the client, such as `platform` or `cross-platform`. Defaults to `null` when the browser reports none.',
+                examples: ['platform'],
+            }),
+            id: base64url.meta({
+                description: 'The credential ID, base64url, as the browser returns it.',
+                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+            }),
+            rawId: base64url.meta({
+                description: 'The bytes of the credential ID, base64url.',
+                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+            }),
+            // Verification reads the top-level `metadata` and `signature`, so other fields are dropped.
+            response: z
+                .object({
+                clientDataJSON: base64url.meta({
+                    description: 'The client data JSON, base64url.',
+                    examples: [
+                        'eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiOWpFRmlqdWhFV3JNNFNPVy10Q2hKYlVFSEVQNDRWY2pjSi1CcW8xZlRNOCIsIm9yaWdpbiI6Imh0dHBzOi8vaWQudGVtcG8ueHl6IiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ',
+                    ],
+                }),
+            })
+                .meta({
+                description: "The authenticator's response. Verification keeps only `clientDataJSON` and drops other fields.",
+            }),
+            type: z.string().meta({
+                description: 'The credential type.',
+                examples: ['public-key'],
+            }),
+        })
+            .meta({
+            description: 'The `PublicKeyCredential` that `navigator.credentials.get()` returns, serialized as JSON.',
+        }),
+        signature: hex.meta({
+            description: 'The P-256 signature over the authenticator data and the client data hash, as 64-byte hex: `r` then `s`.',
+            examples: [
+                '0x6c3f1e0a9b7d24f58e1c3a6b9d0f2e4a7c5b8d1e3f6a9c2b4d7e0f1a3c5b8d9e1f2a7c4b6d8e0f3a5c7b9d1e4f6a8c0b2d5e7f9a1c3b6d8e0f2a4c7b9d1e3f5a',
+            ],
+        }),
+    })
+        .meta({
+        description: 'The assertion, serialized as `webauthx/client` returns it.',
+        id: 'PasskeyAssertion',
+    });
+    /** The client data fields that `take` and `verify` read. */
+    schema.clientData = z.object({
+        challenge: base64url,
+        crossOrigin: z.boolean().optional(),
+    });
+    /** A registration credential, as `webauthx/client`'s `Registration.create` serializes it. */
+    schema.credential = z
+        .object({
+        attestationObject: base64url.max(16384).meta({
+            description: "The authenticator's attestation object, base64url, which holds the new public key.",
+            examples: ['o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjF'],
+        }),
+        clientDataJSON: base64url.max(4096).meta({
+            description: 'The client data the browser collected, base64url, which holds the type, challenge, and origin.',
+            examples: [
+                'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiOWpFRmlqdWhFV3JNNFNPVy10Q2hKYlVFSEVQNDRWY2pjSi1CcW8xZlRNOCIsIm9yaWdpbiI6Imh0dHBzOi8vaWQudGVtcG8ueHl6IiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ',
+            ],
+        }),
+        id: schema.credentialId.meta({
+            description: 'The credential ID of the new passkey, base64url.',
+            examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+        }),
+        // Verification reads the public key from the attestation object, never this copy.
+        publicKey: z
+            .templateLiteral(['0x', z.string().regex(/^04[0-9a-fA-F]{128}$/)])
+            .meta({
+            description: "The new passkey's uncompressed P256 public key, as hex. Verification reads the key from `attestationObject` and ignores this copy.",
+            examples: [
+                '0x04f6310589abb21116acc6e123967ed0a125b5041c43f8e157237093e07eaa354c6c3f1e0a9b7d24f58e1c3a6b9d0f2e4a7c5b8d1e3f6a9c2b4d7e0f1a3c5b8d',
+            ],
+        }),
+        raw: z
+            .object({
+            authenticatorAttachment: z
+                .string()
+                .nullable()
+                .default(null)
+                .meta({
+                description: 'How the authenticator attaches to the client, such as `platform` or `cross-platform`. Defaults to `null` when the browser reports none.',
+                examples: ['platform'],
+            }),
+            id: base64url.max(1364).meta({
+                description: 'The credential ID, base64url, as the browser returns it.',
+                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+            }),
+            rawId: base64url.max(1364).meta({
+                description: 'The bytes of the credential ID, base64url.',
+                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+            }),
+            // Verification reads the top-level `attestationObject` and `clientDataJSON`, so the
+            // response's other fields are dropped.
+            response: z
+                .object({
+                clientDataJSON: base64url.max(4096).meta({
+                    description: 'The client data JSON, base64url.',
+                    examples: [
+                        'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiOWpFRmlqdWhFV3JNNFNPVy10Q2hKYlVFSEVQNDRWY2pjSi1CcW8xZlRNOCIsIm9yaWdpbiI6Imh0dHBzOi8vaWQudGVtcG8ueHl6IiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ',
+                    ],
+                }),
+            })
+                .meta({
+                description: "The authenticator's response. Verification keeps only `clientDataJSON`, and reads the top-level `attestationObject`.",
+            }),
+            type: z
+                .string()
+                .max(32)
+                .meta({
+                description: 'The credential type.',
+                examples: ['public-key'],
+            }),
+        })
+            .meta({
+            description: 'The `PublicKeyCredential` that `navigator.credentials.create()` returns, serialized as JSON.',
+        }),
+    })
+        .meta({
+        description: 'The new passkey, serialized as `webauthx/client` returns it.',
+        id: 'PasskeyCredential',
+    });
+    /** A deferred link, as `seal` encrypts it. */
+    schema.link = z.object({
+        address: z.string(),
+        createdAt: z.number().nullable(),
+        /** When the link expires, in seconds. */
+        expiresAt: z.number(),
+        /** The host that sealed it. Another host that shares the secret does not accept it. */
+        host: z.string(),
+        id: z.string(),
+        /** The value that the email step carries, which the emailed-code sign-in sends back. */
+        nonce: z.string(),
+        publicKey: z.templateLiteral(['0x', z.string()]),
+        rpId: z.string(),
+    });
+    /** A proof challenge's `verification` value. */
+    schema.proof = z.object({
+        id: z.string(),
+        publicKey: hex,
+        rpId: z.string(),
+    });
+    /** A registration challenge's `verification` value. */
+    schema.registration = z.object({
+        rpId: z.string(),
+    });
+    /** A signature challenge's `verification` value. */
+    schema.signature = z.object({
+        account: z.string(),
+        clientId: z.string(),
+        credential: z.object({
+            id: z.string(),
+            publicKey: hex,
+            rpId: z.string(),
+        }),
+    });
+    /** The passkey step, which an approval of a key for a passkey-owned account returns. */
+    schema.step = z
+        .object({
+        step: z
+            .object({
+            options: z
+                .object({
+                publicKey: z
+                    .object({
+                    allowCredentials: z
+                        .array(z
+                        .object({
+                        id: schema.credentialId.meta({
+                            description: "The credential ID of the account's passkey, base64url.",
+                            examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+                        }),
+                        type: z.literal('public-key').meta({
+                            description: 'The credential type.',
+                        }),
+                    })
+                        .meta({
+                        description: 'The passkey that must sign.',
+                    }))
+                        .meta({
+                        description: "The account's passkey, the only one the browser offers.",
+                    }),
+                    challenge: z.templateLiteral(['0x', z.string()]).meta({
+                        description: "The key authorization's digest, as hex. It is single-use, and expires after 5 minutes.",
+                        examples: [
+                            '0xf6310589abb21116acc6e123967ed0a125b5041c43f8e157237093e07eaa354c',
+                        ],
+                    }),
+                    rpId: z.string().meta({
+                        description: "The relying party ID of the account's passkey.",
+                        examples: ['tempo.xyz'],
+                    }),
+                    userVerification: z.literal('required').meta({
+                        description: 'Every passkey signature requires user verification.',
+                    }),
+                })
+                    .meta({
+                    description: 'The `PublicKeyCredentialRequestOptions`, serialized with the challenge as hex.',
+                }),
+            })
+                .meta({
+                description: 'The options for `navigator.credentials.get()`.',
+            }),
+            type: z.literal('passkey').meta({
+                description: 'Sign the options with the passkey, then repeat the approval with `passkey: { assertion }`.',
+            }),
+        })
+            .meta({
+            description: "The next step: the passkey's signature over the key authorization's digest.",
+        }),
+    })
+        .meta({
+        description: 'An approval that continues when the passkey signs the key authorization.',
+        id: 'PasskeyStep',
+    });
+    /** The passkey step of a headless authorization, which the app's page signs on its own origin. */
+    schema.headlessStep = z
+        .object({
+        expiry: z
+            .number()
+            .int()
+            .meta({
+            description: "The key's expiry in Unix seconds. The repeated request sends it as `key_authorization.expiry`, so the digest stays the same.",
+            examples: [1791869364],
+        }),
+        step: schema.step.shape.step
+            .extend({
+            type: z.literal('passkey').meta({
+                description: 'Sign the options with the passkey on the page, then repeat `POST /v1/authorize` with `passkey: { assertion }`.',
+            }),
+        })
+            .meta({
+            description: "The next step: the passkey's signature over the key authorization's digest.",
+        }),
+    })
+        .meta({
+        description: "A headless authorization that continues when the passkey that owns the account signs the key authorization on the app's page.",
+        id: 'HeadlessPasskeyStep',
+    });
+    /** A `user` row that the plugin's endpoint signs in, as `takeWithKey` reads it. */
+    schema.user = z.object({
+        createdAt: z.date(),
+        email: z.string(),
+        emailVerified: z.boolean(),
+        id: z.string(),
+        image: z.string().nullable(),
+        name: z.string(),
+        updatedAt: z.date(),
+    });
+    /** A challenge's `verification` value. */
+    schema.value = z.object({
+        // A key challenge of an app's page stores the request that its sign-in runs.
+        authorize: z.unknown().optional(),
+        clientId: z.string().nullable(),
+        link: z.string().optional(),
+        // A challenge without an origin runs at Tempo ID's own page.
+        origin: z.string().optional(),
+        // A stored challenge can name no realm. It verifies against stored passkeys only.
+        realmId: z.string().optional(),
+        rpId: z.string(),
+        // A key challenge is the digest of a key authorization with this witness.
+        witness: z.templateLiteral(['0x', z.string()]).optional(),
+    });
+})(schema || (schema = {}));
+/**
+ * Issues a challenge for a sign-in at `rpId`, stores it until it expires, and returns it as hex.
+ * The challenge is random, or the digest of a key authorization for a sign-in with key signature,
+ * which stores its witness beside it. Returns `undefined` for a key challenge that a pending
+ * challenge already holds, since an app's challenge can repeat a digest, and one assertion must
+ * select exactly one request.
+ */
+export async function challenge(db, options) {
+    const value = (options.keyChallenge?.digest ??
+        Hex.fromBytes(crypto.getRandomValues(new Uint8Array(32)))).toLowerCase();
+    const identifier = prefix + value;
+    const row = {
+        expiresAt: new Date(Date.now() + lifetime * 1000),
+        id: crypto.randomUUID(),
+        identifier,
+        value: JSON.stringify(schema.value.parse({
+            authorize: options.authorize,
+            clientId: options.clientId,
+            link: options.link,
+            origin: options.origin,
+            realmId: options.realmId,
+            rpId: options.rpId,
+            witness: options.keyChallenge?.witness,
+        })),
+    };
+    // A random challenge never repeats, so only a key challenge needs the claim.
+    if (!options.keyChallenge) {
+        await db.insert(Schema.verification).values(row);
+        return value;
+    }
+    // Concurrent requests for one digest claim one identifier, so only the first stores it.
+    const stored = await Verification.claim(db, row);
+    return stored ? value : undefined;
+}
+/**
+ * Returns why Tempo ID refuses a passkey ceremony on an app's page, or `undefined` when the page may
+ * run one. Tempo ID verifies the assertion for the page's origin, so only a first-party web app's
+ * page, at the origin of one of its redirect URIs, runs a ceremony:
+ *
+ * - A page sends the app's `client_id`, and the app must exist, be enabled, and be first-party.
+ * - A native app's request proves no app, so it signs in through an authentication sheet.
+ * - The request's `Origin` must be the origin of one of the app's redirect URIs.
+ */
+export function checkPage(options) {
+    const { app, clientId, origin } = options;
+    if (!clientId)
+        return new Authorize.InvalidOriginError({
+            error_description: `Invalid \`Origin\`: ${origin ?? 'none'}. A passkey sign-in from an app's page sends the app's \`client_id\`.`,
+            field: 'Origin',
+            ...(origin ? { meta: { origin } } : {}),
+        });
+    if (!app || !app.firstParty)
+        return new Authorize.RejectedError({
+            description: `Passkey sign-in refused: ${clientId} is not a first-party app. Send the user to \`/oauth2/authorize\`, which offers passkey sign-in.`,
+        });
+    if (app.type === 'native')
+        return new Authorize.RejectedError({
+            description: "Passkey sign-in refused: a native app's request does not prove which app sends it. Open `/oauth2/authorize` in an authentication sheet.",
+        });
+    const origins = app.redirectUris.flatMap((uri) => {
+        const url = URL.parse(uri);
+        return url?.protocol === 'https:' || url?.protocol === 'http:'
+            ? [url.origin]
+            : [];
+    });
+    if (!origin || !origins.includes(origin))
+        return new Authorize.InvalidOriginError({
+            error_description: `Invalid \`Origin\`: ${origin ?? 'none'}. Passkey sign-in for ${clientId} must come from the origin of one of its redirect URIs.`,
+            field: 'Origin',
+            ...(origin ? { meta: { origin } } : {}),
+        });
+    return undefined;
+}
+(function (checkPage) {
+    /** The refusals `checkPage` returns. Its return type admits no other. */
+    checkPage.errors = [
+        Authorize.InvalidOriginError,
+        Authorize.RejectedError,
+    ];
+})(checkPage || (checkPage = {}));
+/** Returns the challenge of `clientDataJSON`, as hex, or `undefined` when it does not parse. */
+function clientChallenge(options) {
+    try {
+        const data = schema.clientData.parse(JSON.parse(options.clientDataJSON));
+        return Base64.toHex(data.challenge);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Returns the passkey with the credential `id` that belongs to `rpId`, or `undefined` when Tempo ID
+ * stores none.
+ */
+export async function get(db, options) {
+    const [key] = await db
+        .select()
+        .from(Schema.keys)
+        .where(and(eq(Schema.keys.id, options.id), eq(Schema.keys.rpId, options.rpId)));
+    return key;
+}
+/**
+ * Stores a verified wallet.tempo passkey for `userId`, and returns the user the passkey's row names.
+ * A concurrent first sign-in of the same passkey can store the row first, so the row decides.
+ * Returns `undefined` when another passkey holds the address.
+ */
+export async function link(db, options) {
+    const { credential, id, rpId, userId } = options;
+    // `TempoAccount.create` takes the same lock to claim the realm of a first account, so a link
+    // either commits before the claim, and the claim gives way to it, or after it. A link after the
+    // claim adds the passkey's account beside the created one, as a link after its creation does.
+    return await db.transaction(async (tx) => {
+        await Owner.lock(tx, { userId });
+        // The `default` realm without a row signs in with a relying party that `Realm.withDefaults`
+        // derives. The first linked passkey stores it, so the unique `rp_id` keeps another realm from
+        // taking it, and a later change to `URL` keeps the passkeys that exist. A row already stored
+        // for `default`, or for this relying party, leaves the insert without effect.
+        await tx
+            .insert(Schema.realmPasskeys)
+            .values({ realmId: 'default', rpId })
+            .onConflictDoNothing();
+        const [inserted] = await tx
+            .insert(Schema.keys)
+            .values({
+            address: credential.address.toLowerCase(),
+            ...(credential.createdAt === null
+                ? {}
+                : { createdAt: new Date(credential.createdAt) }),
+            id,
+            publicKey: credential.publicKey,
+            rpId,
+            source: 'tempo-wallet',
+            type: 'passkey',
+            userId,
+        })
+            .onConflictDoNothing()
+            .returning({ userId: Schema.keys.userId });
+        if (inserted)
+            return inserted.userId;
+        const existing = await get(tx, { id, rpId });
+        return existing?.userId;
+    });
+}
+/**
+ * Derives the link cookie's own key from `secret` with HKDF-SHA256, as hex. The cookie thus shares
+ * no key with anything else that `SECRET` encrypts, such as the signing keys.
+ */
+async function linkKey(secret) {
+    const encoder = new TextEncoder();
+    const material = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveBits']);
+    const bits = await crypto.subtle.deriveBits({
+        hash: 'SHA-256',
+        info: encoder.encode('tempo-id:passkey-link:v1'),
+        name: 'HKDF',
+        salt: new Uint8Array(),
+    }, material, 256);
+    return Hex.fromBytes(new Uint8Array(bits));
+}
+/**
+ * Returns the passkeys that the user with `userId` holds, of every relying party, oldest first. Each
+ * entry marks whether it counts toward {@link registrationLimit}, as {@link registered} counts it, so
+ * one read serves both the limit and the passkeys that a new registration excludes.
+ */
+export async function list(db, options) {
+    return await db
+        .select({
+        id: Schema.keys.id,
+        registered: sql `(${registeredKeys(options)})`,
+        rpId: Schema.keys.rpId,
+    })
+        .from(Schema.keys)
+        .where(eq(Schema.keys.userId, options.userId))
+        .orderBy(asc(Schema.keys.createdAt), asc(Schema.keys.id));
+}
+/**
+ * Instantiates a passkey sign-in plugin for Better Auth. Its server-only `signInPasskey` endpoint
+ * creates a session for a user whose assertion a route verified, and sets the session cookie. Like
+ * every sign-in, it continues an app's authorization that `oauth_query` names.
+ */
+export function plugin() {
+    return {
+        endpoints: {
+            signInPasskey: createAuthEndpoint.serverOnly({
+                body: z.object({
+                    oauth_query: z.string().optional(),
+                    // The user row that the route already read with the passkey, which spares the read.
+                    user: schema.user.optional(),
+                    userId: z.string(),
+                }),
+                method: 'POST',
+            }, async (ctx) => {
+                const { user: read, userId } = ctx.body;
+                const user = read?.id === userId
+                    ? read
+                    : await ctx.context.internalAdapter.findUserById(userId);
+                if (!user)
+                    throw new Error('The passkey user is missing.');
+                const session = await ctx.context.internalAdapter.createSession(user.id);
+                await setSessionCookie(ctx, { session, user });
+                return ctx.json({ user: { email: user.email, id: user.id } });
+            }),
+        },
+        id: 'tempo-id-passkey',
+    };
+}
+/**
+ * Returns how many passkeys the user with `userId` registered, of {@link registrationLimit} at most.
+ */
+export async function registered(db, options) {
+    const [row] = await db
+        .select({ count: sql `count(*)::int` })
+        .from(Schema.keys)
+        .where(registeredKeys(options));
+    return row?.count ?? 0;
+}
+/**
+ * Stores a passkey that the user with `userId` registered, once `verifyRegistration` accepted its
+ * credential and `verify` its proof. Like a linked wallet.tempo passkey, it signs in, and owns the
+ * Tempo Account at the address that its public key derives. It never replaces a stored row. Returns:
+ *
+ * - `stored` once it stores the passkey.
+ * - `held` when Tempo ID already stores the credential ID or the address.
+ * - `limit` when the user holds {@link registrationLimit} registered passkeys.
+ * - `stale` when the `default` realm's relying party is no longer the challenge's.
+ */
+export async function register(db, options) {
+    const { id, publicKey, rpId, userId } = options;
+    return await db.transaction(async (tx) => {
+        // The same lock as `link`, so a registration before the claim of a first account prevents the
+        // Privy account, and one after it adds the passkey's account beside it. It also serializes the
+        // count with the insert, so concurrent registrations stay within the limit.
+        await Owner.lock(tx, { userId });
+        // As in `link`, the first stored passkey stores the relying party that `Realm.withDefaults`
+        // derives for the `default` realm, so another realm cannot take it. A row that names another
+        // relying party, set after the options, leaves the passkey outside the realm. One statement
+        // counts the user's passkeys, and below the limit stores the relying party and locks its row.
+        // The row lock holds until the insert commits, so a change of the relying party, such as
+        // `Realm.setPasskeys`, waits for it and cannot land between the check and the insert.
+        const counted = tx.$with('counted').as(tx
+            .select({ count: sql `count(*)::int`.as('count') })
+            .from(Schema.keys)
+            .where(registeredKeys({ userId })));
+        const stored = tx.$with('stored').as(tx
+            .insert(Schema.realmPasskeys)
+            // An insert from a query lists every column in the table's order.
+            .select(sql `select now(), 'default', ${rpId} from ${counted} where ${counted.count} < ${registrationLimit}`)
+            .onConflictDoNothing()
+            .returning({ rpId: Schema.realmPasskeys.rpId }));
+        const locked = tx
+            .select({ rpId: Schema.realmPasskeys.rpId })
+            .from(Schema.realmPasskeys)
+            .where(eq(Schema.realmPasskeys.realmId, 'default'))
+            .for('update');
+        const [checked] = await tx
+            .with(counted, stored)
+            .select({
+            count: counted.count,
+            rpId: sql `coalesce((select ${stored.rpId} from ${stored}), (${locked}))`,
+        })
+            .from(counted);
+        if ((checked?.count ?? 0) >= registrationLimit)
+            return 'limit';
+        // The statement reads only the rows that committed before it started, so it misses a `default`
+        // row that another transaction stored during it. A second read returns that row.
+        const realm = checked?.rpId ? { rpId: checked.rpId } : (await locked)[0];
+        if (realm?.rpId !== rpId)
+            return 'stale';
+        const [inserted] = await tx
+            .insert(Schema.keys)
+            .values({
+            address: Address.fromPublicKey(PublicKey.fromHex(publicKey)).toLowerCase(),
+            id,
+            publicKey,
+            rpId,
+            source: 'tempo-id',
+            type: 'passkey',
+            userId,
+        })
+            .onConflictDoNothing()
+            .returning({ id: Schema.keys.id });
+        return inserted ? 'stored' : 'held';
+    });
+}
+/**
+ * Returns the condition of the keys that count as passkeys that the user with `userId` registered.
+ */
+function registeredKeys(options) {
+    return and(
+    // A registered passkey is Tempo ID's own and owns an account, so it holds an address.
+    // `registered` is the earlier name of the same source, until a migration renames it.
+    inArray(Schema.keys.source, ['registered', 'tempo-id']), isNotNull(Schema.keys.address), eq(Schema.keys.userId, options.userId));
+}
+/**
+ * Returns the first of `realms` that holds passkeys which can sign in at `origin`, and at `page`
+ * when given, with its relying party ID, or `undefined` when none can. A WebAuthn ceremony runs
+ * only at an origin whose host is the relying party ID or one of its subdomains.
+ */
+export function relyingParty(realms, options) {
+    const hosts = [options.origin, options.page].flatMap((origin) => origin ? [new URL(origin).hostname] : []);
+    for (const realm of realms) {
+        const rpId = realm.passkeys?.rpId;
+        if (rpId !== undefined &&
+            hosts.every((host) => host === rpId || host.endsWith(`.${rpId}`)))
+            return { realmId: realm.id, rpId };
+    }
+    return undefined;
+}
+/**
+ * Issues a random challenge for the new passkey `credential` to sign, stores it with the passkey
+ * until it expires, and returns it as hex. Only the user with `userId` spends it. The attestation
+ * of format `none` carries no signature, so only this assertion proves that the user holds the
+ * passkey's private key.
+ */
+export async function requestProof(db, options) {
+    const { credential, rpId, userId } = options;
+    const challenge = Hex.fromBytes(crypto.getRandomValues(new Uint8Array(32)));
+    await db.insert(Schema.verification).values({
+        expiresAt: new Date(Date.now() + lifetime * 1000),
+        id: crypto.randomUUID(),
+        identifier: registrationIdentifier({
+            challenge,
+            prefix: proofPrefix,
+            userId,
+        }),
+        value: JSON.stringify(schema.proof.parse({ ...credential, rpId })),
+    });
+    return challenge;
+}
+/**
+ * Issues a random challenge for the registration of a passkey of `rpId` by the user with `userId`,
+ * stores it until it expires, and returns it as hex. Only that user spends it.
+ */
+export async function requestRegistration(db, options) {
+    const challenge = Hex.fromBytes(crypto.getRandomValues(new Uint8Array(32)));
+    await db.insert(Schema.verification).values({
+        expiresAt: new Date(Date.now() + lifetime * 1000),
+        id: crypto.randomUUID(),
+        identifier: registrationIdentifier({
+            challenge,
+            prefix: registrationPrefix,
+            userId: options.userId,
+        }),
+        value: JSON.stringify(schema.registration.parse({ rpId: options.rpId })),
+    });
+    return challenge;
+}
+/**
+ * Returns the `verification` identifier of a registration or proof challenge, which names its step,
+ * its user, and the challenge. JSON keeps each value apart, whatever characters it holds.
+ */
+function registrationIdentifier(options) {
+    return (options.prefix +
+        JSON.stringify([options.userId, options.challenge.toLowerCase()]));
+}
+/**
+ * Stores the digest of a key authorization as the challenge of a signature by `credential`, until it
+ * expires. Only the user with `userId` spends it, for the same account, app, and passkey.
+ */
+export async function requestSignature(db, options) {
+    const { account, clientId, credential, digest, userId } = options;
+    await db.insert(Schema.verification).values({
+        expiresAt: new Date(Date.now() + lifetime * 1000),
+        id: crypto.randomUUID(),
+        identifier: signatureIdentifier({
+            account,
+            clientId,
+            credentialId: credential.id,
+            digest,
+            userId,
+        }),
+        value: JSON.stringify(schema.signature.parse({
+            account: account.toLowerCase(),
+            clientId,
+            credential,
+        })),
+    });
+}
+/**
+ * Encrypts a deferred link with a key derived from `secret`, for the link cookie. The cookie cannot
+ * be read, changed, or forged without the secret.
+ */
+export async function seal(value, options) {
+    return await symmetricEncrypt({
+        data: JSON.stringify(schema.link.parse(value)),
+        key: await linkKey(options.secret),
+    });
+}
+/**
+ * Spends the challenge that `clientDataJSON` names, and returns it, or `undefined` when it is
+ * unknown, spent, or expired. One statement deletes and returns the row, so two concurrent
+ * assertions over one challenge cannot both spend it.
+ */
+export async function take(db, options) {
+    const challenge = clientChallenge(options);
+    if (!challenge)
+        return undefined;
+    const [row] = await db
+        .delete(Schema.verification)
+        .where(and(eq(Schema.verification.identifier, prefix + challenge.toLowerCase()), gt(Schema.verification.expiresAt, new Date())))
+        .returning({ value: Schema.verification.value });
+    if (!row)
+        return undefined;
+    return toChallenge(row.value, { challenge });
+}
+/** Returns the challenge that a stored `value` describes, once spent. */
+function toChallenge(value, options) {
+    const parsed = schema.value.parse(JSON.parse(value));
+    return {
+        authorize: parsed.authorize,
+        challenge: options.challenge,
+        clientId: parsed.clientId,
+        link: parsed.link,
+        origin: parsed.origin,
+        realmId: parsed.realmId,
+        rpId: parsed.rpId,
+        witness: parsed.witness,
+    };
+}
+/**
+ * Spends the challenge that `clientDataJSON` names, as {@link take} does, and returns it with the
+ * passkey with the credential `id` at the challenge's relying party and that passkey's user, in one
+ * statement. The challenge is spent whether or not the passkey exists. Returns `undefined` when the
+ * challenge is unknown, spent, or expired, and no `key` when Tempo ID stores no such passkey.
+ */
+export async function takeWithKey(db, options) {
+    const challenge = clientChallenge(options);
+    if (!challenge)
+        return undefined;
+    // A data-modifying CTE runs once, to completion, whatever the outer query reads, so the delete
+    // spends the challenge even when no passkey matches.
+    const spent = db.$with('spent').as(db
+        .delete(Schema.verification)
+        .where(and(eq(Schema.verification.identifier, prefix + challenge.toLowerCase()), gt(Schema.verification.expiresAt, new Date())))
+        .returning({ value: Schema.verification.value }));
+    const [row] = await db
+        .with(spent)
+        .select({
+        // Drizzle reads a joined object as absent when its first column is null, and `address` is
+        // null for a sign-in passkey, so the key selects only columns that are never null.
+        key: {
+            id: Schema.keys.id,
+            publicKey: Schema.keys.publicKey,
+            userId: Schema.keys.userId,
+        },
+        user: Schema.user,
+        value: spent.value,
+    })
+        .from(spent)
+        .leftJoin(Schema.keys, and(eq(Schema.keys.id, options.id), eq(Schema.keys.rpId, sql `(${spent.value})::jsonb ->> 'rpId'`)))
+        .leftJoin(Schema.user, eq(Schema.user.id, Schema.keys.userId));
+    if (!row)
+        return undefined;
+    return {
+        challenge: toChallenge(row.value, { challenge }),
+        key: row.key && row.user ? { ...row.key, user: row.user } : undefined,
+    };
+}
+/**
+ * Spends the proof challenge that `clientDataJSON` names for the user with `userId`, and returns it
+ * with the new passkey, or `undefined` when it is unknown, spent, expired, or another user's. One
+ * statement deletes and returns the row, so two concurrent proofs cannot both spend it.
+ */
+export async function takeProof(db, options) {
+    const challenge = (() => {
+        try {
+            const data = schema.clientData.parse(JSON.parse(options.clientDataJSON));
+            return Base64.toHex(data.challenge);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!challenge)
+        return undefined;
+    const [row] = await db
+        .delete(Schema.verification)
+        .where(and(eq(Schema.verification.identifier, registrationIdentifier({
+        challenge,
+        prefix: proofPrefix,
+        userId: options.userId,
+    })), gt(Schema.verification.expiresAt, new Date())))
+        .returning({ value: Schema.verification.value });
+    if (!row)
+        return undefined;
+    return { ...schema.proof.parse(JSON.parse(row.value)), challenge };
+}
+/**
+ * Spends the registration challenge that `clientDataJSON` names for the user with `userId`, and
+ * returns it, or `undefined` when it is unknown, spent, expired, or another user's. One statement
+ * deletes and returns the row, so two concurrent registrations over one challenge cannot both
+ * spend it.
+ */
+export async function takeRegistration(db, options) {
+    const challenge = (() => {
+        try {
+            const data = schema.clientData.parse(JSON.parse(Base64.toString(options.clientDataJSON)));
+            return Base64.toHex(data.challenge);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!challenge)
+        return undefined;
+    const [row] = await db
+        .delete(Schema.verification)
+        .where(and(eq(Schema.verification.identifier, registrationIdentifier({
+        challenge,
+        prefix: registrationPrefix,
+        userId: options.userId,
+    })), gt(Schema.verification.expiresAt, new Date())))
+        .returning({ value: Schema.verification.value });
+    if (!row)
+        return undefined;
+    const value = schema.registration.parse(JSON.parse(row.value));
+    return { challenge, rpId: value.rpId };
+}
+/**
+ * Records the assertion of a sign-in with key signature on an app's page as spent until `expiry`, once it
+ * verified, and returns whether neither a sign-in nor a signature spent it before. The assertion
+ * becomes public once its key reaches the chain, and an app's challenge can repeat its digest, so
+ * the record holds whatever signs the key, and also when the authorization fails.
+ */
+export async function spendSignIn(db, options) {
+    const signed = spentIdentifier(options);
+    const signedIn = spentSignInPrefix + signed.slice(spentPrefix.length);
+    return await db.transaction(async (tx) => {
+        // The same lock as `takeSignature`, so a sign-in and a signature of one assertion serialize, and
+        // the claim reads the record of a signature that committed while it waited.
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtextextended(${signed}, 0))`);
+        return await Verification.claim(tx, {
+            expiresAt: new Date(Math.min(Math.max(options.expiry * 1000, Date.now() + lifetime * 1000), Date.now() + spentLifetime * 1000)),
+            identifier: signedIn,
+            others: [signed],
+            value: '{}',
+        });
+    });
+}
+/**
+ * Records the assertion of a sign-in with key signature as a spent signature until `expiry`, for a year at
+ * most, and returns whether no signature spent it before. The sign-in's challenge was the key's
+ * digest, so no signature challenge precedes it, and the caller verifies the assertion over that
+ * digest first. It takes the lock of {@link takeSignature}, so an approval that repeats the
+ * assertion records it once.
+ */
+export async function spendSignature(db, options) {
+    const spentId = spentIdentifier(options);
+    return await db.transaction(async (tx) => {
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtextextended(${spentId}, 0))`);
+        return await Verification.claim(tx, {
+            expiresAt: new Date(Math.min(Math.max(options.expiry * 1000, Date.now() + lifetime * 1000), Date.now() + spentLifetime * 1000)),
+            identifier: spentId,
+            value: '{}',
+        });
+    });
+}
+/**
+ * Spends the signature challenge that `clientDataJSON` names, for the user, app, account, and
+ * passkey of `options`, and returns it, or `undefined` when it is unknown, spent, or expired. One
+ * statement deletes and returns the rows, so two concurrent assertions over one challenge cannot
+ * both spend it, and an approval for another app, account, or passkey spends none of its rows.
+ *
+ * Returns the challenge only when `verify` accepts it with the assertion. Every step for the same
+ * key issues the same digest, so the transaction then records the assertion as spent until
+ * `expiry`, for a year at most, and returns `undefined` for an assertion that it recorded before. A captured assertion
+ * thus signs no second approval, and an assertion that does not verify leaves no record.
+ */
+export async function takeSignature(db, options) {
+    const digest = (() => {
+        try {
+            const data = schema.clientData.parse(JSON.parse(options.clientDataJSON));
+            return Base64.toHex(data.challenge);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!digest)
+        return undefined;
+    const spentId = spentIdentifier(options);
+    return await db.transaction(async (tx) => {
+        // The lock serializes requests with one assertion, so only the first records it.
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtextextended(${spentId}, 0))`);
+        const [used] = await tx
+            .select({ id: Schema.verification.id })
+            .from(Schema.verification)
+            .where(and(eq(Schema.verification.identifier, spentId), gt(Schema.verification.expiresAt, new Date())));
+        // Each approval of one request issues the same digest, so every row that it names is spent.
+        // A replayed assertion spends the challenge too, so the step must run again.
+        const [row] = await tx
+            .delete(Schema.verification)
+            .where(and(eq(Schema.verification.identifier, signatureIdentifier({ ...options, digest })), gt(Schema.verification.expiresAt, new Date())))
+            .returning({ value: Schema.verification.value });
+        if (!row || used)
+            return undefined;
+        const value = { ...schema.signature.parse(JSON.parse(row.value)), digest };
+        if (!options.verify(value))
+            return undefined;
+        // A signed request with the same key can reach a new step until the key expires.
+        await tx.insert(Schema.verification).values({
+            expiresAt: new Date(Math.min(Math.max(options.expiry * 1000, Date.now() + lifetime * 1000), Date.now() + spentLifetime * 1000)),
+            id: crypto.randomUUID(),
+            identifier: spentId,
+            value: '{}',
+        });
+        return value;
+    });
+}
+/**
+ * Returns the `verification` identifier of a signature challenge, which names its user, app,
+ * account, passkey, and digest. JSON keeps each value apart, whatever characters it holds.
+ */
+function signatureIdentifier(options) {
+    return (signaturePrefix +
+        JSON.stringify([
+            options.userId,
+            options.clientId,
+            options.account.toLowerCase(),
+            options.credentialId,
+            options.digest.toLowerCase(),
+        ]));
+}
+/**
+ * Returns the `verification` identifier of an assertion that a signature spent. Verification
+ * refuses the high-`s` form of a P-256 signature, so each verified assertion has one identifier.
+ */
+function spentIdentifier(options) {
+    return (spentPrefix +
+        Hash.sha256(Hex.concat(options.authenticatorData, options.signature)));
+}
+/**
+ * Decrypts the link cookie's value, and returns the deferred link, or `undefined` when the value
+ * does not decrypt with `secret`, has another shape, came from another host, or expired.
+ */
+export async function unseal(sealed, options) {
+    const value = await symmetricDecrypt({
+        data: sealed,
+        key: await linkKey(options.secret),
+    })
+        .then((data) => schema.link.safeParse(JSON.parse(data)))
+        .catch(() => undefined);
+    if (!value?.success)
+        return undefined;
+    if (value.data.host !== options.host)
+        return undefined;
+    if (value.data.expiresAt <= Date.now() / 1000)
+        return undefined;
+    return value.data;
+}
+/**
+ * Builds the curve's table of base point multiples once for each isolate, at window 4. Otherwise
+ * the first verification builds the table at window 8, which takes about six times the CPU, and
+ * verifies at the same speed.
+ */
+function table() {
+    if (tabled)
+        return;
+    P256.noble.utils.precompute(4);
+    tabled = true;
+}
+/**
+ * Returns whether `assertion` signs `challenge` with `publicKey`, at `origin`, for `rpId`, with the
+ * user present and verified, outside a cross-origin iframe. The client cannot waive user
+ * verification.
+ */
+export function verify(assertion, options) {
+    table();
+    try {
+        // WebAuthn verification leaves `crossOrigin` to the relying party. A frame on another site
+        // could otherwise run the ceremony for Tempo ID's origin.
+        const data = schema.clientData.parse(JSON.parse(assertion.metadata.clientDataJSON));
+        if (data.crossOrigin)
+            return false;
+        return Authentication.verify({
+            ...assertion,
+            metadata: { ...assertion.metadata, userVerificationRequired: true },
+        }, {
+            challenge: options.challenge,
+            origin: options.origin,
+            publicKey: options.publicKey,
+            rpId: options.rpId,
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Returns the credential ID and public key of the passkey that `credential` creates, or `undefined`
+ * when it does not create one over `challenge`, at `origin`, for `rpId`, with the user present and
+ * verified, outside a cross-origin iframe. The public key comes from the attestation object. An
+ * attestation of format `none` passes, as most authenticators return no other. It proves nothing
+ * about the private key, so the passkey must then sign a proof challenge from `requestProof`.
+ */
+export function verifyRegistration(credential, options) {
+    try {
+        // As in `verify`, a frame on another site could otherwise run the ceremony for Tempo ID's origin.
+        const data = schema.clientData.parse(JSON.parse(Base64.toString(credential.clientDataJSON)));
+        if (data.crossOrigin)
+            return undefined;
+        const result = Registration.verify(credential, {
+            attestation: 'none',
+            challenge: options.challenge,
+            origin: options.origin,
+            rpId: options.rpId,
+            userVerification: 'required',
+        });
+        return { id: result.credential.id, publicKey: result.credential.publicKey };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=Passkey.js.map