@vex-chat/spire 1.3.6 → 1.4.0

package/dist/server/passkey.js

@@ -0,0 +1,449 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { XUtils } from "@vex-chat/crypto";
+import { PasskeyAuthFinishPayloadSchema, PasskeyAuthStartPayloadSchema, PasskeyRegistrationFinishPayloadSchema, PasskeyRegistrationStartPayloadSchema, } from "@vex-chat/types";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from "@simplewebauthn/server";
+import jwt from "jsonwebtoken";
+import { JWT_EXPIRY_PASSKEY } from "../Spire.js";
+import { getJwtSecret } from "../utils/jwtSecret.js";
+import { msgpack } from "../utils/msgpack.js";
+import { AppError } from "./errors.js";
+import { authLimiter } from "./rateLimit.js";
+import { censorUser, getParam, getUser } from "./utils.js";
+import { protect } from "./index.js";
+const REGISTRATION_TTL_MS = 5 * 60 * 1000; // 5 min
+const AUTHENTICATION_TTL_MS = 5 * 60 * 1000;
+// Cap each user's passkey count so a compromised JWT can't fill the
+// table. WebAuthn-style apps typically allow ~20; we go conservative.
+const MAX_PASSKEYS_PER_USER = 10;
+const pendingRegistrations = new Map();
+const pendingAuthentications = new Map();
+/**
+ * Returns the WebAuthn relying-party config from the environment.
+ *
+ * - `SPIRE_PASSKEY_RP_ID` — RP ID (eTLD+1 of the user-facing host the
+ *   client is loaded from, e.g. `vex.wtf` or `localhost`). Required.
+ * - `SPIRE_PASSKEY_RP_NAME` — display name for prompts. Defaults to
+ *   "Vex".
+ * - `SPIRE_PASSKEY_ORIGINS` — comma-separated allowlist of expected
+ *   client origins (e.g. `https://app.vex.wtf,tauri://localhost,
+ *   http://localhost:5173`). Required: WebAuthn binds an assertion
+ *   to its origin and we must check it explicitly.
+ */
+function getRpConfig() {
+    const rpID = process.env["SPIRE_PASSKEY_RP_ID"]?.trim();
+    const originsRaw = process.env["SPIRE_PASSKEY_ORIGINS"]?.trim();
+    if (!rpID) {
+        throw new AppError(500, "Passkeys are not configured on this server (SPIRE_PASSKEY_RP_ID is unset).");
+    }
+    if (!originsRaw) {
+        throw new AppError(500, "Passkeys are not configured on this server (SPIRE_PASSKEY_ORIGINS is unset).");
+    }
+    const expectedOrigin = originsRaw
+        .split(",")
+        .map((o) => o.trim())
+        .filter((o) => o.length > 0);
+    if (expectedOrigin.length === 0) {
+        throw new AppError(500, "SPIRE_PASSKEY_ORIGINS is empty.");
+    }
+    return {
+        expectedOrigin,
+        rpID,
+        rpName: process.env["SPIRE_PASSKEY_RP_NAME"]?.trim() || "Vex",
+    };
+}
+function pruneAuthentications(nowMs = Date.now()) {
+    for (const [id, entry] of pendingAuthentications.entries()) {
+        if (nowMs - entry.createdAt > AUTHENTICATION_TTL_MS) {
+            pendingAuthentications.delete(id);
+        }
+    }
+}
+function pruneRegistrations(nowMs = Date.now()) {
+    for (const [id, entry] of pendingRegistrations.entries()) {
+        if (nowMs - entry.createdAt > REGISTRATION_TTL_MS) {
+            pendingRegistrations.delete(id);
+        }
+    }
+}
+const KNOWN_TRANSPORTS = [
+    "ble",
+    "cable",
+    "hybrid",
+    "internal",
+    "nfc",
+    "smart-card",
+    "usb",
+];
+function isKnownTransport(s) {
+    return KNOWN_TRANSPORTS.includes(s);
+}
+function sanitizeTransports(input) {
+    return input.filter(isKnownTransport);
+}
+/**
+ * Issues a passkey-scoped JWT.
+ *
+ * Carries `scope: "passkey"` and the owning userID; deliberately
+ * shorter-lived than a device JWT (5 min vs 7 days) because a
+ * passkey JWT grants destructive admin powers (delete a device,
+ * approve an enrollment) without further user verification. Callers
+ * re-do the WebAuthn ceremony when this expires.
+ */
+function signPasskeyToken(args) {
+    return jwt.sign({
+        passkey: { passkeyID: args.passkeyID },
+        scope: "passkey",
+        user: args.user,
+    }, getJwtSecret(), { expiresIn: JWT_EXPIRY_PASSKEY });
+}
+export const getPasskeyRouter = (db) => {
+    const router = express.Router();
+    // ── Authenticated registration (an existing device adds a passkey) ──
+    router.post("/user/:id/passkeys/register/begin", protect, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        // Passwords/passkey JWTs both come through `protect`; only
+        // a real device session may add a passkey to keep the
+        // recovery story symmetric with device delete (a passkey
+        // can't bootstrap another passkey).
+        if (!req.device) {
+            res.status(401).send({
+                error: "Adding a passkey requires an authenticated device.",
+            });
+            return;
+        }
+        const parsed = PasskeyRegistrationStartPayloadSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid registration payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const existing = await db.retrievePasskeysByUser(userID);
+        if (existing.length >= MAX_PASSKEYS_PER_USER) {
+            res.status(409).send({
+                error: `Each account is limited to ${MAX_PASSKEYS_PER_USER} passkeys.`,
+            });
+            return;
+        }
+        const { rpID, rpName } = getRpConfig();
+        // The userID we hand to the authenticator is the account
+        // userID encoded as bytes; this scopes the credential to
+        // the account so re-registering on the same authenticator
+        // updates the existing credential instead of stacking.
+        const userIDBytes = new TextEncoder().encode(userID);
+        const options = await generateRegistrationOptions({
+            attestationType: "none",
+            authenticatorSelection: {
+                requireResidentKey: false,
+                residentKey: "preferred",
+                userVerification: "preferred",
+            },
+            excludeCredentials: [],
+            rpID,
+            rpName,
+            userDisplayName: userDetails.username,
+            userID: userIDBytes,
+            userName: userDetails.username,
+        });
+        pruneRegistrations();
+        const requestID = crypto.randomUUID();
+        pendingRegistrations.set(requestID, {
+            challenge: options.challenge,
+            createdAt: Date.now(),
+            name: parsed.data.name,
+            userID,
+        });
+        // PasskeyRegistrationOptions in @vex-chat/types uses a
+        // looser interface than @simplewebauthn/server (so this
+        // shared types package doesn't take a runtime dep on
+        // SimpleWebAuthn). The wire shape is identical — both
+        // sides hand the JSON straight to navigator.credentials.
+        res.send(msgpack.encode({
+            options,
+            requestID,
+        }));
+    });
+    router.post("/user/:id/passkeys/register/finish", protect, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        if (!req.device) {
+            res.status(401).send({
+                error: "Adding a passkey requires an authenticated device.",
+            });
+            return;
+        }
+        const parsed = PasskeyRegistrationFinishPayloadSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid finish payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        pruneRegistrations();
+        const pending = pendingRegistrations.get(parsed.data.requestID);
+        if (!pending || pending.userID !== userID) {
+            res.status(404).send({
+                error: "Registration request not found or expired.",
+            });
+            return;
+        }
+        // Single-use challenge: clear immediately so a replay can't
+        // re-bind the credential to a second name.
+        pendingRegistrations.delete(parsed.data.requestID);
+        const { expectedOrigin, rpID } = getRpConfig();
+        let verification;
+        try {
+            // The browser's RegistrationResponseJSON is opaque to
+            // spire — simplewebauthn does the full structural
+            // decode + signature verification on this argument,
+            // so the cast from a generic `Record<string, unknown>`
+            // to the branded type is the trust boundary.
+            const rawResponse = parsed.data.response;
+            verification = await verifyRegistrationResponse({
+                expectedChallenge: pending.challenge,
+                expectedOrigin,
+                expectedRPID: rpID,
+                requireUserVerification: false,
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
+                response: rawResponse,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            res.status(400).send({
+                error: "Passkey attestation invalid: " + message,
+            });
+            return;
+        }
+        if (!verification.verified) {
+            res.status(400).send({ error: "Passkey attestation failed." });
+            return;
+        }
+        const credential = verification.registrationInfo.credential;
+        const dupe = await db.retrievePasskeyByCredentialID(credential.id);
+        if (dupe) {
+            res.status(409).send({
+                error: "This authenticator is already registered.",
+            });
+            return;
+        }
+        const transports = sanitizeTransports(credential.transports ?? []);
+        // Re-check the per-user cap inside the finish step in case
+        // a concurrent request just consumed the last available
+        // slot. `MAX_PASSKEYS_PER_USER` is the source of truth.
+        const after = await db.retrievePasskeysByUser(userID);
+        if (after.length >= MAX_PASSKEYS_PER_USER) {
+            res.status(409).send({
+                error: `Each account is limited to ${MAX_PASSKEYS_PER_USER} passkeys.`,
+            });
+            return;
+        }
+        const created = await db.createPasskey(userID, pending.name, credential.id, XUtils.encodeHex(credential.publicKey), 
+        // The COSE alg is reported back in `info.fmt`-adjacent
+        // helpers, but `WebAuthnCredential` only carries the
+        // public key; verifyAuthenticationResponse re-derives
+        // the alg from the COSE_Key bytes. We persist a
+        // best-effort algorithm hint as 0 when unavailable and
+        // refuse no algorithms here — verification time is
+        // where the real check happens.
+        0, transports);
+        res.send(msgpack.encode(created));
+    });
+    router.get("/user/:id/passkeys", protect, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const list = await db.retrievePasskeysByUser(userID);
+        res.send(msgpack.encode(list));
+    });
+    router.delete("/user/:id/passkeys/:passkeyID", protect, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        const passkeyID = getParam(req, "passkeyID");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const row = await db.retrievePasskeyInternal(passkeyID);
+        if (!row || row.userID !== userID) {
+            res.sendStatus(404);
+            return;
+        }
+        await db.deletePasskey(passkeyID);
+        res.sendStatus(200);
+    });
+    // ── Public passkey login ───────────────────────────────────────────
+    router.post("/auth/passkey/begin", authLimiter, async (req, res) => {
+        const parsed = PasskeyAuthStartPayloadSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid begin payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const user = await db.retrieveUser(parsed.data.username);
+        if (!user) {
+            // Don't reveal whether the username exists — return a
+            // generic 401 here. (Some flows return a generated stub
+            // challenge for username-less / discoverable creds; not
+            // implemented yet.)
+            res.sendStatus(401);
+            return;
+        }
+        const passkeys = await db.retrievePasskeysByUser(user.userID);
+        if (passkeys.length === 0) {
+            res.sendStatus(401);
+            return;
+        }
+        const allowCredentials = await Promise.all(passkeys.map(async (pk) => {
+            const internal = await db.retrievePasskeyInternal(pk.passkeyID);
+            return {
+                id: internal?.credentialID ?? "",
+                transports: pk.transports.filter(isKnownTransport),
+                type: "public-key",
+            };
+        }));
+        const { rpID } = getRpConfig();
+        const options = await generateAuthenticationOptions({
+            allowCredentials: allowCredentials.filter((c) => c.id.length > 0),
+            rpID,
+            userVerification: "preferred",
+        });
+        pruneAuthentications();
+        const requestID = crypto.randomUUID();
+        pendingAuthentications.set(requestID, {
+            challenge: options.challenge,
+            createdAt: Date.now(),
+            userID: user.userID,
+        });
+        res.send(msgpack.encode({
+            options,
+            requestID,
+        }));
+    });
+    router.post("/auth/passkey/finish", authLimiter, async (req, res) => {
+        const parsed = PasskeyAuthFinishPayloadSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid finish payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        pruneAuthentications();
+        const pending = pendingAuthentications.get(parsed.data.requestID);
+        if (!pending) {
+            res.status(401).send({
+                error: "Authentication challenge not found or expired.",
+            });
+            return;
+        }
+        // Single-use.
+        pendingAuthentications.delete(parsed.data.requestID);
+        // The browser's AuthenticationResponseJSON is opaque to spire
+        // — simplewebauthn does the structural decode + signature
+        // verification. The cast from `Record<string, unknown>` to
+        // the branded type is the trust boundary.
+        const rawAssertion = parsed.data.response;
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
+        const assertion = rawAssertion;
+        const credentialID = typeof assertion.id === "string" ? assertion.id : "";
+        if (!credentialID) {
+            res.status(400).send({
+                error: "Assertion is missing a credential id.",
+            });
+            return;
+        }
+        const passkeyRow = await db.retrievePasskeyByCredentialID(credentialID);
+        if (!passkeyRow || passkeyRow.userID !== pending.userID) {
+            res.status(401).send({
+                error: "No matching passkey for this account.",
+            });
+            return;
+        }
+        const { expectedOrigin, rpID } = getRpConfig();
+        // Force `Uint8Array<ArrayBuffer>` (not `ArrayBufferLike`) so
+        // simplewebauthn's strict generic accepts the buffer; the
+        // raw decoded bytes are identical.
+        const credentialPublicKey = new Uint8Array(XUtils.decodeHex(passkeyRow.publicKey));
+        let verification;
+        try {
+            verification = await verifyAuthenticationResponse({
+                credential: {
+                    counter: passkeyRow.signCount,
+                    id: passkeyRow.credentialID,
+                    publicKey: credentialPublicKey,
+                    transports: passkeyRow.transports
+                        .split(",")
+                        .filter(isKnownTransport),
+                },
+                expectedChallenge: pending.challenge,
+                expectedOrigin,
+                expectedRPID: rpID,
+                requireUserVerification: false,
+                response: assertion,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            res.status(401).send({
+                error: "Passkey assertion invalid: " + message,
+            });
+            return;
+        }
+        if (!verification.verified) {
+            res.status(401).send({ error: "Passkey assertion failed." });
+            return;
+        }
+        // Counter should be strictly increasing per the WebAuthn spec.
+        // FIDO authenticators that report 0 are excused (the spec says
+        // 0→0 is legitimate when the authenticator has no counter).
+        const newCounter = verification.authenticationInfo.newCounter;
+        if (newCounter !== 0 &&
+            passkeyRow.signCount !== 0 &&
+            newCounter <= passkeyRow.signCount) {
+            res.status(401).send({
+                error: "Authenticator counter regressed (possible cloned credential).",
+            });
+            return;
+        }
+        await db.markPasskeyUsed(passkeyRow.passkeyID, newCounter);
+        const user = await db.retrieveUser(pending.userID);
+        if (!user) {
+            res.status(404).send({ error: "Account not found." });
+            return;
+        }
+        const censored = censorUser(user);
+        const token = signPasskeyToken({
+            passkeyID: passkeyRow.passkeyID,
+            user: censored,
+        });
+        res.send(msgpack.encode({
+            passkeyID: passkeyRow.passkeyID,
+            token,
+            user: censored,
+        }));
+    });
+    return router;
+};
+//# sourceMappingURL=passkey.js.map

package/dist/server/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACH,8BAA8B,EAC9B,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,GACxC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACH,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAejC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,SAAS,WAAW;IAKhB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,8EAA8E,CACjF,CAAC;IACN,CAAC;IACD,MAAM,cAAc,GAAG,UAAU;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACH,cAAc;QACd,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK;KAChE,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAClD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG;IACrB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACmD,CAAC;AAE7D,SAAS,gBAAgB,CAAC,CAAS;IAC/B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAGzB;IACG,OAAO,GAAG,CAAC,IAAI,CACX;QACI,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,SAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,EACD,YAAY,EAAE,EACd,EAAE,SAAS,EAAE,kBAAkB,EAAE,CACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACP,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,2DAA2D;QAC3D,sDAAsD;QACtD,yDAAyD;QACzD,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B;gBACrC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC9C,eAAe,EAAE,MAAM;YACvB,sBAAsB,EAAE;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAChC;YACD,kBAAkB,EAAE,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ;YACrC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,kBAAkB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM;SACT,CAAC,CAAC;QAEH,uDAAuD;QACvD,wDAAwD;QACxD,qDAAqD;QACrD,sDAAsD;QACtD,yDAAyD;QACzD,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,oCAAoC,EACpC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC3D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,kBAAkB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,4DAA4D;QAC5D,2CAA2C;QAC3C,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,sDAAsD;YACtD,kDAAkD;YAClD,oDAAoD;YACpD,uDAAuD;YACvD,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;YACpD,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,yHAAyH;gBACzH,QAAQ,EAAE,WAAuC;aACpD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GACT,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+BAA+B,GAAG,OAAO;aACnD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;aACrD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAClC,MAAM,EACN,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,EAAE,EACb,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,uDAAuD;QACvD,qDAAqD;QACrD,sDAAsD;QACtD,gDAAgD;QAChD,uDAAuD;QACvD,mDAAmD;QACnD,gCAAgC;QAChC,CAAC,EACD,UAAU,CACb,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACT,+BAA+B,EAC/B,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,sDAAsD;YACtD,wDAAwD;YACxD,wDAAwD;YACxD,oBAAoB;YACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO;gBACH,EAAE,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;gBAChC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAClD,IAAI,EAAE,YAAqB;aAC9B,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAChD,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjE,IAAI;YACJ,gBAAgB,EAAE,WAAW;SAChC,CAAC,CAAC;QAEH,oBAAoB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,oBAAoB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,gDAAgD;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,cAAc;QACd,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,8DAA8D;QAC9D,0DAA0D;QAC1D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;QACrD,yHAAyH;QACzH,MAAM,SAAS,GAAG,YAA0C,CAAC;QAC7D,MAAM,YAAY,GACd,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,6DAA6D;QAC7D,0DAA0D;QAC1D,mCAAmC;QACnC,MAAM,mBAAmB,GAAG,IAAI,UAAU,CACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CACzC,CAAC;QAEF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,UAAU,EAAE;oBACR,OAAO,EAAE,UAAU,CAAC,SAAS;oBAC7B,EAAE,EAAE,UAAU,CAAC,YAAY;oBAC3B,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,UAAU,CAAC,UAAU;yBAC5B,KAAK,CAAC,GAAG,CAAC;yBACV,MAAM,CAAC,gBAAgB,CAAC;iBAChC;gBACD,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B,GAAG,OAAO;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IACI,UAAU,KAAK,CAAC;YAChB,UAAU,CAAC,SAAS,KAAK,CAAC;YAC1B,UAAU,IAAI,UAAU,CAAC,SAAS,EACpC,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK;YACL,IAAI,EAAE,QAAQ;SACjB,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/passkeyDevices.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+/**
+ * Routes that grant a passkey-authenticated session a strictly
+ * bounded admin/recovery surface:
+ *
+ * - `GET    /user/:id/passkey/devices`                              — list
+ * - `DELETE /user/:id/passkey/devices/:deviceID`                    — remove
+ * - `POST   /user/:id/passkey/devices/requests/:requestID/approve`  — approve
+ * - `POST   /user/:id/passkey/devices/requests/:requestID/reject`   — reject
+ *
+ * The route family is parallel to `/user/:id/devices/...` so the
+ * existing device-authenticated flow stays untouched (and there's no
+ * confusion about which kind of credential is doing what when a
+ * single endpoint accepts both).
+ *
+ * Mail/server/permissions/etc. routes are intentionally NOT mirrored
+ * here — passkeys are an administrative credential, not a messaging
+ * device.
+ */
+export declare const getPasskeyDeviceRouter: (db: Database, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;

package/dist/server/passkeyDevices.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { msgpack } from "../utils/msgpack.js";
+import { resolveDeviceEnrollmentRequest } from "./user.js";
+import { getParam, getUser } from "./utils.js";
+import { protectPasskey } from "./index.js";
+/**
+ * Routes that grant a passkey-authenticated session a strictly
+ * bounded admin/recovery surface:
+ *
+ * - `GET    /user/:id/passkey/devices`                              — list
+ * - `DELETE /user/:id/passkey/devices/:deviceID`                    — remove
+ * - `POST   /user/:id/passkey/devices/requests/:requestID/approve`  — approve
+ * - `POST   /user/:id/passkey/devices/requests/:requestID/reject`   — reject
+ *
+ * The route family is parallel to `/user/:id/devices/...` so the
+ * existing device-authenticated flow stays untouched (and there's no
+ * confusion about which kind of credential is doing what when a
+ * single endpoint accepts both).
+ *
+ * Mail/server/permissions/etc. routes are intentionally NOT mirrored
+ * here — passkeys are an administrative credential, not a messaging
+ * device.
+ */
+export const getPasskeyDeviceRouter = (db, notify) => {
+    const router = express.Router();
+    router.get("/user/:id/passkey/devices", protectPasskey, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const list = await db.retrieveUserDeviceList([userID]);
+        res.send(msgpack.encode(list));
+    });
+    router.delete("/user/:id/passkey/devices/:deviceID", protectPasskey, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        const deviceID = getParam(req, "deviceID");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const device = await db.retrieveDevice(deviceID);
+        if (!device || device.owner !== userID) {
+            res.sendStatus(404);
+            return;
+        }
+        // The device-auth `DELETE /user/:id/devices/:deviceID`
+        // refuses to delete the user's last device (a device
+        // can't lock itself out). Passkeys may delete the last
+        // device on purpose: that's the entire recovery story —
+        // "I lost my phone, sign in with the passkey, wipe the
+        // old device, then enroll a new one with the passkey
+        // standing in as the approver."
+        await db.deleteDevice(deviceID);
+        // Tell whoever's online that the device-list shape
+        // changed; clients use this to refresh the Settings →
+        // Devices view in real time.
+        notify(userID, "deviceListChanged", crypto.randomUUID());
+        res.sendStatus(200);
+    });
+    router.post("/user/:id/passkey/devices/requests/:requestID/approve", protectPasskey, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        const requestID = getParam(req, "requestID");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        // No second-factor signature here: the passkey JWT itself
+        // is fresh proof of user presence (5 min TTL, freshly
+        // minted from a WebAuthn ceremony with userVerification).
+        // Reusing it within those 5 minutes to approve an
+        // enrollment is fine — the equivalent guarantee that the
+        // device flow gets from a per-request Ed25519 sig.
+        const result = await resolveDeviceEnrollmentRequest({
+            action: "approve",
+            db,
+            notify,
+            requestID,
+            userID,
+        });
+        if (result.kind === "ok") {
+            res.send(msgpack.encode(result.device));
+            return;
+        }
+        res.status(result.status).send({ error: result.error });
+    });
+    router.post("/user/:id/passkey/devices/requests/:requestID/reject", protectPasskey, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        const requestID = getParam(req, "requestID");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const result = await resolveDeviceEnrollmentRequest({
+            action: "reject",
+            db,
+            notify,
+            requestID,
+            userID,
+        });
+        if (result.kind === "ok") {
+            res.sendStatus(200);
+            return;
+        }
+        res.status(result.status).send({ error: result.error });
+    });
+    return router;
+};
+//# sourceMappingURL=passkeyDevices.js.map

package/dist/server/passkeyDevices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyDevices.js","sourceRoot":"","sources":["../../src/server/passkeyDevices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,EAAY,EACZ,MAMS,EACX,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,2BAA2B,EAC3B,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CACT,qCAAqC,EACrC,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,uDAAuD;QACvD,qDAAqD;QACrD,uDAAuD;QACvD,wDAAwD;QACxD,uDAAuD;QACvD,qDAAqD;QACrD,gCAAgC;QAChC,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,mDAAmD;QACnD,sDAAsD;QACtD,6BAA6B;QAC7B,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,uDAAuD,EACvD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,0DAA0D;QAC1D,sDAAsD;QACtD,0DAA0D;QAC1D,kDAAkD;QAClD,yDAAyD;QACzD,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,SAAS;YACjB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,sDAAsD,EACtD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/user.d.ts

@@ -4,12 +4,38 @@
  * Commercial licenses available at vex.wtf
  */
 import type { Database } from "../Database.ts";
-import type { DevicePayload } from "@vex-chat/types";
+import type { Device, DevicePayload } from "@vex-chat/types";
 import { TokenScopes } from "@vex-chat/types";
 export declare function createPendingDeviceEnrollmentRequest(userID: string, devicePayload: DevicePayload, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void): {
     challenge: string;
     expiresAt: string;
     requestID: string;
     status: "pending_approval";
+    userID: string;
 };
+/**
+ * Reusable approve/reject side of a pending device-enrollment
+ * request. Lives here so both the device-authenticated router
+ * (signs an approval challenge with the approving device's
+ * Ed25519 key) and the passkey-authenticated router (relies on
+ * the freshness of the passkey JWT instead) can share the same
+ * state-machine + enrollment lifecycle.
+ *
+ * The device-auth caller is expected to have already verified the
+ * approving device's signature before invoking this helper.
+ */
+export declare function resolveDeviceEnrollmentRequest(args: {
+    action: "approve" | "reject";
+    db: Database;
+    notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void;
+    requestID: string;
+    userID: string;
+}): Promise<{
+    device: Device;
+    kind: "ok";
+} | {
+    error: string;
+    kind: "err";
+    status: number;
+}>;
 export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;