@tyvm/knowhow 0.0.83 → 0.0.85

package/src/types.ts

@@ -46,10 +46,23 @@ export type Config = {
   embedSources: EmbedSource[];
   embeddingModel: string;
 
+  skills?: string[];
+
   plugins: { enabled: string[]; disabled: string[] };
 
+  chat?: {
+    /** Path to a custom root chat module (npm package or local file) */
+    rootModule?: string;
+    /** Path to a custom renderer (npm package or local file, can be .ts) */
+    renderer?: string;
+    /** Additional chat modules to load (npm packages or local files, can be .ts) */
+    modules?: string[];
+  };
+
   modules: string[];
 
+  pluginPackages?: Record<string, string>;
+
   agents: Assistant[];
   mcps: McpConfig[];
   modelProviders: ModelProvider[];
@@ -73,6 +86,18 @@ export type Config = {
     sandbox?: boolean;
     volumes?: string[];
     envFile?: string;
+    auth?: {
+      required?: boolean;
+      passkey?: {
+        publicKey?: string;       // base64-encoded public key
+        credentialId?: string;    // base64-encoded credential ID
+        algorithm?: string;       // e.g. "ES256"
+      };
+      sessionDurationHours?: number;
+    };
+    commandAuth?: {
+      [toolName: string]: "always" | "session" | "never";
+    };
     tunnel?: {
       enabled?: boolean;
       allowedPorts?: number[];
@@ -191,6 +216,12 @@ export const Models = {
   openai: {
     GPT_5_2: "gpt-5.2",
     GPT_5_1: "gpt-5.1",
+    GPT_54: "gpt-5.4",
+    GPT_54_Mini: "gpt-5.4-mini",
+    GPT_54_Nano: "gpt-5.4-nano",
+    GPT_54_Pro: "gpt-5.4-pro",
+    GPT_53_Chat: "gpt-5.3-chat-latest",
+    GPT_53_Codex: "gpt-5.3-codex",
     GPT_5: "gpt-5",
     GPT_5_Mini: "gpt-5-mini",
     GPT_5_Nano: "gpt-5-nano",
@@ -214,6 +245,12 @@ export const Models = {
     GPT_4o_Mini_Search: "gpt-4o-mini-search-preview-2025-03-11",
     GPT_4o_Search: "gpt-4o-search-preview-2025-03-11",
 
+    GPT_4o_Transcribe: "gpt-4o-transcribe",
+    GPT_4o_Mini_Transcribe: "gpt-4o-mini-transcribe",
+    GPT_Realtime_15: "gpt-realtime-1.5",
+    GPT_Realtime_Mini: "gpt-realtime-mini",
+    GPT_Image_15: "gpt-image-1.5",
+    GPT_Image_1_Mini: "gpt-image-1-mini",
     TTS_1: "tts-1",
     Whisper_1: "whisper-1",
     DALL_E_3: "dall-e-3",
@@ -225,19 +262,41 @@ export const Models = {
     // Codex_Mini: "codex-mini-latest",
   },
   google: {
-    Gemini_3_Preview: "gemini-3-pro-preview",
+    // Gemini 3.x
+    Gemini_31_Pro_Preview: "gemini-3.1-pro-preview",
+    Gemini_31_Flash_Image_Preview: "gemini-3.1-flash-image-preview",
+    Gemini_31_Flash_Lite_Preview: "gemini-3.1-flash-lite-preview",
+    Gemini_3_Flash_Preview: "gemini-3-flash-preview",
+    Gemini_3_Pro_Image_Preview: "gemini-3-pro-image-preview",
+    // Gemini 2.5
+    Gemini_25_Pro: "gemini-2.5-pro",
+    Gemini_25_Flash: "gemini-2.5-flash",
+    Gemini_25_Flash_Lite: "gemini-2.5-flash-lite",
     Gemini_25_Flash_Preview: "gemini-2.5-flash-preview-05-20",
     Gemini_25_Pro_Preview: "gemini-2.5-pro-preview-05-06",
+    Gemini_25_Flash_Image: "gemini-2.5-flash-image",
+    Gemini_25_Flash_Live: "gemini-2.5-flash-live-preview",
+    Gemini_25_Flash_Native_Audio: "gemini-2.5-flash-native-audio-preview-12-2025",
+    Gemini_25_Pro_TTS: "gemini-2.5-pro-preview-tts",
+    // Gemini 2.0 (deprecated)
     Gemini_20_Flash: "gemini-2.0-flash",
     Gemini_20_Flash_Preview_Image_Generation:
       "gemini-2.0-flash-exp-image-generation",
     Gemini_20_Flash_Lite: "gemini-2.0-flash-lite",
+    // Gemini 1.5 (legacy)
     Gemini_15_Flash: "gemini-1.5-flash",
     Gemini_15_Flash_8B: "gemini-1.5-flash-8b",
     Gemini_15_Pro: "gemini-1.5-pro",
+    // Media generation
     Imagen_3: "imagen-4.0-generate-001",
+    Imagen_4_Fast: "imagen-4.0-fast-generate-001",
+    Imagen_4_Ultra: "imagen-4.0-ultra-generate-001",
     Veo_2: "veo-2.0-generate-001",
+    Veo_3: "veo-3.0-generate-001",
+    Veo_3_Fast: "veo-3.0-fast-generate-001",
     Veo_3_1: "veo-3.1-generate-preview",
+    Veo_3_1_Fast: "veo-3.1-fast-generate-preview",
+    // Audio / Live
     Gemini_20_Flash_Live: "gemini-2.0-flash-live-001",
     Gemini_25_Flash_TTS: "gemini-2.5-flash-preview-tts",
     Gemini_20_Flash_TTS: "gemini-2.0-flash-preview-tts",
@@ -252,6 +311,7 @@ export const EmbeddingModels = {
   },
   google: {
     Gemini_Embedding: "gemini-embedding-exp",
+    Gemini_Embedding_001: "gemini-embedding-001",
   },
 };
 
@@ -281,6 +341,12 @@ export const OpenAiReasoningModels = [
   Models.openai.o3,
   Models.openai.o3_Pro,
   Models.openai.o4_Mini,
+  Models.openai.GPT_54,
+  Models.openai.GPT_54_Mini,
+  Models.openai.GPT_54_Nano,
+  Models.openai.GPT_54_Pro,
+  Models.openai.GPT_53_Chat,
+  Models.openai.GPT_53_Codex,
   Models.openai.GPT_5,
   Models.openai.GPT_5_Mini,
   Models.openai.GPT_5_Nano,
@@ -296,6 +362,12 @@ export const OpenAiEmbeddingModels = [
 // export const OpenAiResponseOnlyModels = [Models.openai.Codex_Mini];
 
 export const GoogleReasoningModels = [
+  Models.google.Gemini_31_Pro_Preview,
+  Models.google.Gemini_31_Flash_Lite_Preview,
+  Models.google.Gemini_3_Flash_Preview,
+  Models.google.Gemini_25_Pro,
+  Models.google.Gemini_25_Flash,
+  Models.google.Gemini_25_Flash_Lite,
   Models.google.Gemini_25_Flash_Preview,
   Models.google.Gemini_25_Pro_Preview,
   Models.google.Gemini_20_Flash,
@@ -306,13 +378,20 @@ export const GoogleReasoningModels = [
 ];
 
 export const GoogleImageModels = [
+  Models.google.Gemini_31_Flash_Image_Preview,
+  Models.google.Gemini_3_Pro_Image_Preview,
+  Models.google.Gemini_25_Flash_Image,
   Models.google.Gemini_20_Flash_Preview_Image_Generation,
   Models.google.Imagen_3,
+  Models.google.Imagen_4_Fast,
+  Models.google.Imagen_4_Ultra,
 ];
 
 export const OpenAiImageModels = [
   Models.openai.DALL_E_3,
   Models.openai.DALL_E_2,
+  Models.openai.GPT_Image_15,
+  Models.openai.GPT_Image_1_Mini,
 ];
 
 export const OpenAiVideoModels = [
@@ -323,17 +402,36 @@ export const OpenAiVideoModels = [
 
 export const OpenAiTTSModels = [Models.openai.TTS_1];
 
-export const OpenAiTranscriptionModels = [Models.openai.Whisper_1];
-
 export const XaiImageModels = [Models.xai.GrokImagineImage];
+export const OpenAiTranscriptionModels = [
+  Models.openai.Whisper_1,
+  Models.openai.GPT_4o_Transcribe,
+  Models.openai.GPT_4o_Mini_Transcribe,
+];
 
+export const OpenAiRealtimeModels = [
+  Models.openai.GPT_4o_Realtime,
+  Models.openai.GPT_4o_Mini_Realtime,
+  Models.openai.GPT_Realtime_15,
+  Models.openai.GPT_Realtime_Mini,
+];
 export const XaiVideoModels = [Models.xai.GrokImagineVideo];
 
 export const GoogleTTSModels = [
   Models.google.Gemini_25_Flash_TTS,
+  Models.google.Gemini_25_Pro_TTS,
   Models.google.Gemini_20_Flash_TTS,
 ];
 
-export const GoogleVideoModels = [Models.google.Veo_2, Models.google.Veo_3_1];
+export const GoogleVideoModels = [
+  Models.google.Veo_2,
+  Models.google.Veo_3,
+  Models.google.Veo_3_Fast,
+  Models.google.Veo_3_1,
+  Models.google.Veo_3_1_Fast,
+];
 
-export const GoogleEmbeddingModels = [EmbeddingModels.google.Gemini_Embedding];
+export const GoogleEmbeddingModels = [
+  EmbeddingModels.google.Gemini_Embedding,
+  EmbeddingModels.google.Gemini_Embedding_001,
+];

package/src/worker.ts

@@ -4,6 +4,9 @@ import { createTunnelHandler, TunnelHandler } from "@tyvm/knowhow-tunnel";
 import { includedTools } from "./agents/tools/list";
 import { loadJwt } from "./login";
 import { services } from "./services";
+import { PasskeySetupService } from "./workers/auth/PasskeySetup";
+import { WorkerPasskeyAuthService } from "./workers/auth/WorkerPasskeyAuth";
+import { makeUnlockTool, makeLockTool } from "./workers/tools";
 import { McpServerService } from "./services/Mcp";
 import * as allTools from "./agents/tools";
 import workerTools from "./workers/tools";
@@ -85,9 +88,33 @@ export async function worker(options?: {
   unshare?: boolean;
   sandbox?: boolean;
   noSandbox?: boolean;
+  passkey?: boolean;
+  passkeyReset?: boolean;
 }) {
   const config = await getConfig();
 
+  // Handle --passkey-reset: remove passkey from config
+  if (options?.passkeyReset) {
+    const passkeySetup = new PasskeySetupService();
+    await passkeySetup.reset();
+    return;
+  }
+
+  // Handle --passkey: run browser-based passkey registration flow
+  if (options?.passkey) {
+    let jwt: string;
+    try {
+      jwt = await loadJwt();
+    } catch {
+      console.error("❌ You must be logged in to set up a passkey.");
+      console.error("   Run 'knowhow login' first.");
+      process.exit(1);
+    }
+    const passkeySetup = new PasskeySetupService();
+    await passkeySetup.setup(jwt);
+    return;
+  }
+
   // Check if we're already running inside a Docker container
   const isInsideDocker = process.env.KNOWHOW_DOCKER === "true";
 
@@ -158,6 +185,24 @@ export async function worker(options?: {
   const clientName = "knowhow-worker";
   const clientVersion = "1.1.1";
 
+  // ---------------------------------------------------------------------------
+  // Passkey auth gating
+  // ---------------------------------------------------------------------------
+  let authService: WorkerPasskeyAuthService | null = null;
+  const passkeyConfig = config.worker?.auth?.passkey;
+
+  if (passkeyConfig?.publicKey && passkeyConfig?.credentialId) {
+    authService = new WorkerPasskeyAuthService(
+      {
+        publicKey: passkeyConfig.publicKey,
+        credentialId: passkeyConfig.credentialId,
+        algorithm: -7, // ES256
+      },
+      config.worker?.auth?.sessionDurationHours ?? 3
+    );
+    console.log("🔒 Passkey auth enabled — worker starts locked");
+  }
+
   if (!shouldUseSandbox) {
     console.log(`🖥️  Using host mode (${sandboxSource})`);
   }
@@ -172,7 +217,6 @@ export async function worker(options?: {
       ...config.worker,
       allowedTools: Tools.getToolNames(),
     };
-
     await updateConfig(config);
     return;
   }
@@ -183,7 +227,41 @@ export async function worker(options?: {
     return;
   }
 
-  const toolsToUse = Tools.getToolsByNames(config.worker.allowedTools);
+  let toolsToUse = Tools.getToolsByNames(config.worker.allowedTools);
+
+  // If passkey auth is enabled, wrap all tool functions to check locked state
+  // and register the unlock/lock auth tools
+  if (authService) {
+    const _authService = authService;
+
+    // Wrap every configured tool to gate on locked state
+    for (const tool of toolsToUse) {
+      const toolName = tool.function.name;
+      const originalFn = Tools.getFunction(toolName);
+      Tools.addFunctions({
+        [toolName]: async (...args: any[]) => {
+          if (_authService.isLocked()) {
+            return {
+              error: "WORKER_LOCKED",
+              message:
+                "Worker is locked. Call the `unlock` tool with your passkey assertion to unlock it first.",
+            };
+          }
+          return originalFn(...args);
+        },
+      });
+    }
+
+    // Build and register the auth tools
+    const { unlock, unlockDefinition } = makeUnlockTool(_authService);
+    const { lock, lockDefinition } = makeLockTool(_authService);
+
+    Tools.addFunctions({ unlock, lock });
+    toolsToUse = [unlockDefinition, lockDefinition, ...toolsToUse];
+
+    console.log("🔑 Auth tools registered: unlock, lock");
+  }
+
   mcpServer.createServer(clientName, clientVersion).withTools(toolsToUse);
 
   let connected = false;

package/src/workers/auth/PasskeySetup.ts

@@ -0,0 +1,185 @@
+import axios from "axios";
+import { KNOWHOW_API_URL } from "../../services/KnowhowClient";
+import { openBrowser } from "../../auth/browserLogin";
+import { Spinner } from "../../auth/spinner";
+import { getConfig, updateConfig } from "../../config";
+import { PasskeySetupSession, PasskeySetupStatus, PasskeyCredential } from "./types";
+
+/**
+ * Service that handles the CLI-side passkey setup flow.
+ *
+ * Flow:
+ *  1. POST /api/worker/passkey/setup/session  → get sessionId + browserUrl
+ *  2. Open browser to browserUrl
+ *  3. Poll /api/worker/passkey/setup/status/:sessionId until status === 'complete'
+ *  4. Save the returned credential to local config
+ */
+export class PasskeySetupService {
+  private baseUrl: string;
+
+  constructor(baseUrl: string = KNOWHOW_API_URL) {
+    if (!baseUrl) {
+      throw new Error("KNOWHOW_API_URL environment variable not set");
+    }
+    this.baseUrl = baseUrl;
+  }
+
+  /**
+   * Run the full passkey setup flow.
+   */
+  async setup(jwt: string): Promise<void> {
+    const spinner = new Spinner();
+
+    try {
+      spinner.start("Creating passkey setup session");
+      const session = await this.createSetupSession(jwt);
+      spinner.stop();
+
+      await openBrowser(session.browserUrl);
+      console.log(
+        `\nIf the browser didn't open automatically, please visit:\n  ${session.browserUrl}\n`
+      );
+
+      spinner.start("Waiting for passkey registration in browser…");
+
+      const credential = await this.pollForCompletion(session.sessionId, spinner);
+
+      spinner.stop();
+      spinner.start("Saving passkey credential to config");
+
+      await this.saveCredential(credential);
+
+      spinner.stop();
+      console.log("✅ Passkey registered successfully!");
+      console.log(
+        "   Worker will now require passkey authentication for new connections."
+      );
+    } catch (error) {
+      spinner.stop();
+      throw error;
+    }
+  }
+
+  /**
+   * Remove passkey requirement from config.
+   */
+  async reset(): Promise<void> {
+    const config = await getConfig();
+
+    if (!config.worker?.auth?.passkey) {
+      console.log("ℹ️  No passkey configured for this worker.");
+      return;
+    }
+
+    const updatedConfig = {
+      ...config,
+      worker: {
+        ...config.worker,
+        auth: {
+          ...config.worker.auth,
+          required: false,
+          passkey: undefined,
+        },
+      },
+    };
+
+    await updateConfig(updatedConfig);
+    console.log("✅ Passkey requirement removed from config.");
+  }
+
+  // ---------------------------------------------------------------------------
+  // Private helpers
+  // ---------------------------------------------------------------------------
+
+  private async createSetupSession(jwt: string): Promise<PasskeySetupSession> {
+    try {
+      const response = await axios.post<PasskeySetupSession>(
+        `${this.baseUrl}/api/worker/passkey/setup/session`,
+        {},
+        {
+          headers: { Authorization: `Bearer ${jwt}` },
+          timeout: 10000,
+        }
+      );
+      return response.data;
+    } catch (error) {
+      if (axios.isAxiosError(error)) {
+        throw new Error(
+          `Failed to create passkey setup session: ${
+            error.response?.data?.message || error.message
+          }`
+        );
+      }
+      throw error;
+    }
+  }
+
+  private async pollForCompletion(
+    sessionId: string,
+    spinner: Spinner
+  ): Promise<PasskeyCredential> {
+    const maxAttempts = 60; // 5 minutes at 5-second intervals
+    let attempt = 0;
+
+    while (attempt < maxAttempts) {
+      attempt++;
+
+      try {
+        const response = await axios.get<PasskeySetupStatus>(
+          `${this.baseUrl}/api/worker/passkey/setup/status/${sessionId}`,
+          { timeout: 10000 }
+        );
+
+        const { status, credential } = response.data;
+
+        if (status === "complete" && credential) {
+          return credential;
+        } else if (status === "expired") {
+          throw new Error(
+            "Passkey setup session expired. Please run 'knowhow worker --passkey' again."
+          );
+        }
+      } catch (error) {
+        if (axios.isAxiosError(error) && error.code === "ECONNABORTED") {
+          // Timeout — keep polling
+        } else if (!(error instanceof Error && error.message.includes("expired"))) {
+          // Re-throw non-timeout, non-expected errors
+          throw error;
+        } else {
+          throw error;
+        }
+      }
+
+      await this.sleep(5000);
+    }
+
+    throw new Error("Passkey setup timed out. Please try again.");
+  }
+
+  private async saveCredential(credential: PasskeyCredential): Promise<void> {
+    const config = await getConfig();
+
+    const updatedConfig = {
+      ...config,
+      worker: {
+        ...config.worker,
+        auth: {
+          ...config.worker?.auth,
+          required: true,
+          passkey: {
+            publicKey: credential.publicKey,
+            credentialId: credential.credentialId,
+            algorithm: credential.algorithm,
+          },
+          sessionDurationHours: config.worker?.auth?.sessionDurationHours ?? 3,
+        },
+      },
+    };
+
+    await updateConfig(updatedConfig);
+  }
+
+  private async sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+}

package/src/workers/auth/WorkerPasskeyAuth.ts

@@ -0,0 +1,190 @@
+import crypto from "crypto";
+import { verifyAuthenticationResponse } from "@simplewebauthn/server";
+
+/**
+ * Manages the locked/unlocked state of the worker's passkey auth.
+ * When the worker has passkey configured, it starts locked.
+ * The user must call `unlock` with a valid WebAuthn assertion to unlock.
+ * The worker verifies the signature locally using the stored public key.
+ */
+
+export interface PasskeyConfig {
+  publicKey: string;    // base64url-encoded COSE public key
+  credentialId: string; // base64url-encoded credential ID
+  algorithm: number;    // e.g. -7 for ES256
+}
+
+export interface UnlockParams {
+  /** base64url-encoded signature from WebAuthn assertion */
+  signature: string;
+  /** base64url-encoded credential ID */
+  credentialId: string;
+  /** base64url-encoded authenticatorData */
+  authenticatorData: string;
+  /** base64url-encoded clientDataJSON */
+  clientDataJSON: string;
+  /** The challenge that was signed (base64url) */
+  challenge: string;
+}
+
+export class WorkerPasskeyAuthService {
+  private locked = true;
+  private sessionExpiry: number | null = null;
+  private sessionDurationMs: number;
+  // Pending challenge: base64url
+  private pendingChallenge: string | null = null;
+  private pendingChallengeExpiry: number | null = null;
+  private readonly CHALLENGE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+  constructor(
+    private passkeyConfig: PasskeyConfig,
+    sessionDurationHours: number = 3
+  ) {
+    this.sessionDurationMs = sessionDurationHours * 60 * 60 * 1000;
+  }
+
+  isLocked(): boolean {
+    if (!this.locked) {
+      // Check if session has expired
+      if (this.sessionExpiry && Date.now() > this.sessionExpiry) {
+        console.log("🔒 Passkey session expired, locking worker");
+        this.locked = true;
+        this.sessionExpiry = null;
+      }
+    }
+    return this.locked;
+  }
+
+  /**
+   * Generate a new challenge for the client to sign.
+   * Returns base64url-encoded challenge bytes.
+   */
+  generateChallenge(): string {
+    const challengeBytes = crypto.randomBytes(32);
+    const challenge = challengeBytes.toString("base64url");
+    this.pendingChallenge = challenge;
+    this.pendingChallengeExpiry = Date.now() + this.CHALLENGE_TTL_MS;
+    return challenge;
+  }
+
+  /**
+   * Attempt to unlock the worker by verifying a WebAuthn assertion.
+   * Returns true if the signature is valid and the worker is now unlocked.
+   */
+  async unlock(params: UnlockParams): Promise<{ success: boolean; reason?: string }> {
+    // Verify the challenge matches what we issued
+    if (!this.pendingChallenge) {
+      return { success: false, reason: "No pending challenge. Call getChallenge first." };
+    }
+    if (this.pendingChallengeExpiry && Date.now() > this.pendingChallengeExpiry) {
+      this.pendingChallenge = null;
+      this.pendingChallengeExpiry = null;
+      return { success: false, reason: "Challenge expired. Please request a new challenge." };
+    }
+
+    // Verify the challenge in clientDataJSON matches our pending challenge
+    let clientData: { type: string; challenge: string; origin: string };
+    try {
+      const clientDataBytes = Buffer.from(params.clientDataJSON, "base64url");
+      clientData = JSON.parse(clientDataBytes.toString("utf8"));
+    } catch {
+      return { success: false, reason: "Invalid clientDataJSON" };
+    }
+
+    // The challenge in clientDataJSON is base64url-encoded
+    if (clientData.challenge !== this.pendingChallenge) {
+      return { success: false, reason: "Challenge mismatch" };
+    }
+
+    if (clientData.type !== "webauthn.get") {
+      return { success: false, reason: "Invalid clientData type" };
+    }
+
+    // Verify credential ID matches our stored credential
+    if (params.credentialId !== this.passkeyConfig.credentialId) {
+      return { success: false, reason: "Unknown credential" };
+    }
+
+    // Verify the signature using @simplewebauthn/server
+    const valid = await this.verifySignature(params, clientData.origin);
+    if (!valid) {
+      return { success: false, reason: "Invalid signature" };
+    }
+
+    // Unlock!
+    this.locked = false;
+    this.sessionExpiry = Date.now() + this.sessionDurationMs;
+    this.pendingChallenge = null;
+    this.pendingChallengeExpiry = null;
+
+    const expiresAt = new Date(this.sessionExpiry).toISOString();
+    console.log(`🔓 Worker unlocked! Session expires at ${expiresAt}`);
+    return { success: true };
+  }
+
+  lock(): void {
+    this.locked = true;
+    this.sessionExpiry = null;
+    this.pendingChallenge = null;
+    this.pendingChallengeExpiry = null;
+    console.log("🔒 Worker locked");
+  }
+
+  getSessionInfo() {
+    if (this.locked || !this.sessionExpiry) {
+      return { locked: true, expiresAt: null };
+    }
+    return {
+      locked: false,
+      expiresAt: new Date(this.sessionExpiry).toISOString(),
+    };
+  }
+
+  /**
+   * Returns the credential ID stored in the passkey config.
+   */
+  getCredentialId(): string {
+    return this.passkeyConfig.credentialId;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Signature verification via @simplewebauthn/server
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Verify a WebAuthn assertion using @simplewebauthn/server's verifyAuthenticationResponse.
+   * This handles all COSE key format complexity automatically.
+   */
+  private async verifySignature(params: UnlockParams, origin: string): Promise<boolean> {
+    try {
+      const { verified } = await verifyAuthenticationResponse({
+        response: {
+          id: params.credentialId,
+          rawId: params.credentialId,
+          response: {
+            authenticatorData: params.authenticatorData,
+            clientDataJSON: params.clientDataJSON,
+            signature: params.signature,
+          },
+          type: "public-key",
+          clientExtensionResults: {},
+        },
+        expectedChallenge: this.pendingChallenge!,
+        expectedOrigin: origin,
+        expectedRPID: new URL(origin).hostname,
+        credential: {
+          id: this.passkeyConfig.credentialId,
+          publicKey: Buffer.from(this.passkeyConfig.publicKey, "base64url"),
+          counter: 0,
+          transports: undefined,
+        },
+        requireUserVerification: false,
+      });
+
+      return verified;
+    } catch (err) {
+      console.error("Signature verification error:", err);
+      return false;
+    }
+  }
+}