qarpeo 0.0.0-alpha.10

package/dist/runtime/server/routes/auth/sso/login.get.mjs

@@ -0,0 +1,94 @@
+import { defineEventHandler, getQuery, sendRedirect, createError, getRequestURL } from "nuxt/server";
+import { getD1Binding } from "../../../../db.mjs";
+import { getKVBinding } from "../../../../kv.mjs";
+import { buildSAMLAuthnRequestUrl, buildOIDCAuthUrl } from "../../../utils/sso.mjs";
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const domain = query.domain?.toLowerCase()?.trim();
+  const orgSlug = query.org?.toLowerCase()?.trim();
+  const connectionId = query.connectionId;
+  const redirect = query.redirect || "/dashboard";
+  if (!domain && !orgSlug && !connectionId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "SSO login requires domain, org, or connectionId parameter."
+    });
+  }
+  let d1;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    d1 = getD1Binding(bindingName, event);
+  } catch {
+    d1 = null;
+  }
+  if (!d1) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: "D1 Database binding required for Enterprise SSO"
+    });
+  }
+  let connection = null;
+  if (connectionId) {
+    connection = await d1.prepare("SELECT * FROM _qarpeo_sso_connections WHERE id = ? AND enabled = 1 LIMIT 1").bind(connectionId).first();
+  } else if (domain) {
+    connection = await d1.prepare("SELECT * FROM _qarpeo_sso_connections WHERE domain = ? AND enabled = 1 LIMIT 1").bind(domain).first();
+  } else if (orgSlug) {
+    connection = await d1.prepare(`
+        SELECT c.* FROM _qarpeo_sso_connections c
+        JOIN _qarpeo_organizations o ON c.organization_id = o.id
+        WHERE o.slug = ? AND c.enabled = 1
+        LIMIT 1
+      `).bind(orgSlug).first();
+  }
+  if (!connection) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Not Found",
+      message: "No active SSO connection found for the specified credentials."
+    });
+  }
+  const reqUrl = getRequestURL(event);
+  const baseUrl = `${reqUrl.protocol}//${reqUrl.host}`;
+  const stateId = crypto.randomUUID();
+  try {
+    const kv = getKVBinding("KV", event);
+    await kv.put(
+      `sso:state:${stateId}`,
+      JSON.stringify({
+        connectionId: connection.id,
+        redirect,
+        timestamp: Date.now()
+      }),
+      { expirationTtl: 600 }
+      // 10 minutes
+    );
+  } catch {
+  }
+  if (connection.provider_type === "saml") {
+    const acsUrl = `${baseUrl}/api/auth/sso/saml/acs`;
+    const targetUrl = buildSAMLAuthnRequestUrl({
+      entityId: baseUrl,
+      acsUrl,
+      ssoUrl: connection.sso_url,
+      relayState: stateId
+    });
+    return sendRedirect(event, targetUrl);
+  }
+  if (connection.provider_type === "oidc") {
+    const callbackUrl = `${baseUrl}/api/auth/sso/oidc/callback`;
+    const targetUrl = buildOIDCAuthUrl({
+      authorizationUrl: connection.sso_url,
+      clientId: connection.client_id || "",
+      redirectUri: callbackUrl,
+      state: stateId
+    });
+    return sendRedirect(event, targetUrl);
+  }
+  throw createError({
+    statusCode: 400,
+    statusMessage: "Bad Request",
+    message: `Unsupported SSO provider type: "${connection.provider_type}"`
+  });
+});

package/dist/runtime/server/routes/auth/sso/oidc/callback.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string>>;
+export default _default;

package/dist/runtime/server/routes/auth/sso/oidc/callback.get.mjs

@@ -0,0 +1,113 @@
+import { defineEventHandler, getQuery, sendRedirect, createError, getRequestURL } from "nuxt/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { getKVBinding } from "../../../../../kv.mjs";
+import { exchangeOIDCCode } from "../../../../utils/sso.mjs";
+import { setAuthSession, createDeviceSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const code = query.code;
+  const stateId = query.state;
+  if (!code) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing authorization code in OIDC callback"
+    });
+  }
+  let connectionId = null;
+  let finalRedirect = "/dashboard";
+  if (stateId) {
+    try {
+      const kv = getKVBinding("KV", event);
+      const stateData = await kv.get(`sso:state:${stateId}`, { type: "json" });
+      if (stateData) {
+        connectionId = stateData.connectionId || null;
+        finalRedirect = stateData.redirect || "/dashboard";
+        await kv.delete(`sso:state:${stateId}`);
+      }
+    } catch {
+    }
+  }
+  if (!connectionId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invalid or expired SSO state parameter"
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const now = Date.now();
+  const connection = await d1.prepare("SELECT * FROM _qarpeo_sso_connections WHERE id = ? LIMIT 1").bind(connectionId).first();
+  if (!connection) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Not Found",
+      message: "SSO Connection not found"
+    });
+  }
+  const reqUrl = getRequestURL(event);
+  const redirectUri = `${reqUrl.protocol}//${reqUrl.host}/api/auth/sso/oidc/callback`;
+  const tokenUrl = connection.token_url || `${connection.sso_url}/token`;
+  const oidcUser = await exchangeOIDCCode({
+    tokenUrl,
+    userinfoUrl: connection.userinfo_url ? connection.userinfo_url : void 0,
+    clientId: connection.client_id || "",
+    clientSecret: connection.client_secret ? connection.client_secret : void 0,
+    code,
+    redirectUri
+  });
+  let user = await d1.prepare("SELECT * FROM _qarpeo_users WHERE email = ? LIMIT 1").bind(oidcUser.email).first();
+  if (!user) {
+    const userId = crypto.randomUUID();
+    await d1.prepare(`
+        INSERT INTO _qarpeo_users (id, email, email_verified, name, role, created_at, updated_at)
+        VALUES (?, ?, 1, ?, 'user', ?, ?)
+      `).bind(userId, oidcUser.email, oidcUser.name || null, now, now).run();
+    user = {
+      id: userId,
+      email: oidcUser.email,
+      email_verified: 1,
+      name: oidcUser.name,
+      role: "user"
+    };
+  }
+  let currentOrgId = null;
+  if (connection.organization_id) {
+    currentOrgId = connection.organization_id;
+    const existingMember = await d1.prepare("SELECT * FROM _qarpeo_members WHERE organization_id = ? AND user_id = ? LIMIT 1").bind(currentOrgId, user.id).first();
+    if (!existingMember) {
+      const memberId = crypto.randomUUID();
+      await d1.prepare(`
+          INSERT INTO _qarpeo_members (id, organization_id, user_id, role, created_at)
+          VALUES (?, ?, ?, 'member', ?)
+        `).bind(memberId, currentOrgId, user.id, now).run();
+    }
+  }
+  const finalUser = {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    avatarUrl: user.avatar_url,
+    emailVerified: true,
+    role: user.role || "user"
+  };
+  const sessionData = {
+    user: finalUser,
+    provider: "oidc",
+    loggedInAt: now,
+    ssoConnectionId: connection.id,
+    currentOrganizationId: currentOrgId,
+    // Enterprise SSO authentications satisfy MFA requirement
+    mfaVerified: true
+  };
+  try {
+    const deviceSession = await createDeviceSession(event, finalUser, {
+      provider: "oidc"
+    });
+    sessionData.sessionId = deviceSession.sessionId;
+  } catch {
+  }
+  await setAuthSession(event, sessionData);
+  return sendRedirect(event, finalRedirect);
+});

package/dist/runtime/server/routes/auth/sso/saml/acs.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string>>;
+export default _default;

package/dist/runtime/server/routes/auth/sso/saml/acs.post.mjs

@@ -0,0 +1,95 @@
+import { defineEventHandler, readBody, sendRedirect, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { getKVBinding } from "../../../../../kv.mjs";
+import { parseSAMLResponse } from "../../../../utils/sso.mjs";
+import { setAuthSession, createDeviceSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const samlResponse = body?.SAMLResponse;
+  const relayState = body?.RelayState;
+  if (!samlResponse) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing SAMLResponse in request body"
+    });
+  }
+  const assertion = parseSAMLResponse(samlResponse);
+  const email = assertion.email;
+  let connectionId = null;
+  let finalRedirect = "/dashboard";
+  if (relayState) {
+    try {
+      const kv = getKVBinding("KV", event);
+      const stateData = await kv.get(`sso:state:${relayState}`, { type: "json" });
+      if (stateData) {
+        connectionId = stateData.connectionId || null;
+        finalRedirect = stateData.redirect || "/dashboard";
+        await kv.delete(`sso:state:${relayState}`);
+      }
+    } catch {
+    }
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const now = Date.now();
+  let connection = null;
+  if (connectionId) {
+    connection = await d1.prepare("SELECT * FROM _qarpeo_sso_connections WHERE id = ? LIMIT 1").bind(connectionId).first();
+  } else if (assertion.issuer) {
+    connection = await d1.prepare("SELECT * FROM _qarpeo_sso_connections WHERE issuer = ? LIMIT 1").bind(assertion.issuer).first();
+  }
+  let user = await d1.prepare("SELECT * FROM _qarpeo_users WHERE email = ? LIMIT 1").bind(email).first();
+  if (!user) {
+    const userId = crypto.randomUUID();
+    await d1.prepare(`
+        INSERT INTO _qarpeo_users (id, email, email_verified, name, role, created_at, updated_at)
+        VALUES (?, ?, 1, ?, 'user', ?, ?)
+      `).bind(userId, email, assertion.name || null, now, now).run();
+    user = {
+      id: userId,
+      email,
+      email_verified: 1,
+      name: assertion.name,
+      role: "user"
+    };
+  }
+  let currentOrgId = null;
+  if (connection?.organization_id) {
+    currentOrgId = connection.organization_id;
+    const existingMember = await d1.prepare("SELECT * FROM _qarpeo_members WHERE organization_id = ? AND user_id = ? LIMIT 1").bind(currentOrgId, user.id).first();
+    if (!existingMember) {
+      const memberId = crypto.randomUUID();
+      await d1.prepare(`
+          INSERT INTO _qarpeo_members (id, organization_id, user_id, role, created_at)
+          VALUES (?, ?, ?, 'member', ?)
+        `).bind(memberId, currentOrgId, user.id, now).run();
+    }
+  }
+  const finalUser = {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    avatarUrl: user.avatar_url,
+    emailVerified: true,
+    role: user.role || "user"
+  };
+  const sessionData = {
+    user: finalUser,
+    provider: "saml",
+    loggedInAt: now,
+    ssoConnectionId: connection?.id,
+    currentOrganizationId: currentOrgId,
+    // Enterprise SSO authentications satisfy MFA requirement
+    mfaVerified: true
+  };
+  try {
+    const deviceSession = await createDeviceSession(event, finalUser, {
+      provider: "saml"
+    });
+    sessionData.sessionId = deviceSession.sessionId;
+  } catch {
+  }
+  await setAuthSession(event, sessionData);
+  return sendRedirect(event, finalRedirect);
+});

package/dist/runtime/server/routes/auth/tokens/[id].delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/tokens/[id].delete.mjs

@@ -0,0 +1,13 @@
+import { defineEventHandler, getRouterParam, createError } from "nuxt/server";
+import { revokeApiToken } from "../../../utils/impersonation.mjs";
+export default defineEventHandler(async (event) => {
+  const id = getRouterParam(event, "id");
+  if (!id) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Token ID is required"
+    });
+  }
+  return await revokeApiToken(event, id);
+});

package/dist/runtime/server/routes/auth/tokens/create.post.d.ts

@@ -0,0 +1,9 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    id: string;
+    token: string;
+    name: string;
+    scopes: string[];
+    expiresAt: number | null;
+    createdAt: number;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/tokens/create.post.mjs

@@ -0,0 +1,17 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { createApiToken } from "../../../utils/impersonation.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  if (!body.name || typeof body.name !== "string") {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Token name is required"
+    });
+  }
+  return await createApiToken(event, {
+    name: body.name,
+    scopes: body.scopes,
+    expiresInDays: body.expiresInDays
+  });
+});

package/dist/runtime/server/routes/auth/tokens/index.get.d.ts

@@ -0,0 +1,9 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    id: string;
+    name: string;
+    scopes: string[];
+    lastUsedAt: number | null;
+    expiresAt: number | null;
+    createdAt: number;
+}[]>>;
+export default _default;

package/dist/runtime/server/routes/auth/tokens/index.get.mjs

@@ -0,0 +1,5 @@
+import { defineEventHandler } from "nuxt/server";
+import { listApiTokens } from "../../../utils/impersonation.mjs";
+export default defineEventHandler(async (event) => {
+  return await listApiTokens(event);
+});

package/dist/runtime/server/routes/auth/turnstile/verify.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<import("../../../utils/turnstile").TurnstileVerificationResult>>;
+export default _default;

package/dist/runtime/server/routes/auth/turnstile/verify.post.mjs

@@ -0,0 +1,15 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { verifyTurnstileToken } from "../../../utils/turnstile.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const token = body?.token || body?.turnstileToken;
+  if (!token) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing Turnstile verification token"
+    });
+  }
+  const result = await verifyTurnstileToken(event, token);
+  return result;
+});

package/dist/runtime/server/routes/auth/user.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<import("../../..").QarpeoUser>>;
+export default _default;

package/dist/runtime/server/routes/auth/user.get.mjs

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "nuxt/server";
+import { requireAuth } from "../../utils/context.mjs";
+export default defineEventHandler(async (event) => {
+  const { user } = await requireAuth(event);
+  return user;
+});

package/dist/runtime/server/routes/auth/webauthn/login/options.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>>;
+export default _default;

package/dist/runtime/server/routes/auth/webauthn/login/options.post.mjs

@@ -0,0 +1,17 @@
+import { defineEventHandler, getRequestURL } from "nuxt/server";
+import { generateAuthenticationOptions } from "@simplewebauthn/server";
+import { getKVBinding } from "../../../../../kv.mjs";
+export default defineEventHandler(async (event) => {
+  const reqUrl = getRequestURL(event);
+  const rpID = reqUrl.hostname;
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: "preferred"
+  });
+  try {
+    const kv = getKVBinding("KV", event);
+    await kv.put(`webauthn:login-challenge:${options.challenge}`, "1", { expirationTtl: 300 });
+  } catch {
+  }
+  return options;
+});

package/dist/runtime/server/routes/auth/webauthn/login/verify.post.d.ts

@@ -0,0 +1,6 @@
+import type { QarpeoUser } from "../../../../../types/auth";
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    user: QarpeoUser;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/webauthn/login/verify.post.mjs

@@ -0,0 +1,127 @@
+import { defineEventHandler, readBody, createError, getRequestURL } from "nuxt/server";
+import { verifyAuthenticationResponse } from "@simplewebauthn/server";
+import { getQarpeoConfig } from "../../../../utils/config.mjs";
+import { getD1Binding } from "../../../../../db.mjs";
+import { getKVBinding } from "../../../../../kv.mjs";
+import { createDeviceSession, setAuthSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const credentialId = body?.id || body?.credentialId;
+  if (!credentialId || !body?.response?.clientDataJSON) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Credential ID and response payload are required"
+    });
+  }
+  let clientChallenge = "";
+  try {
+    const rawClientData = Buffer.from(body.response.clientDataJSON, "base64url").toString("utf-8");
+    const clientDataObj = JSON.parse(rawClientData);
+    clientChallenge = clientDataObj.challenge;
+  } catch {
+  }
+  if (!clientChallenge) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Malformed clientDataJSON in WebAuthn response"
+    });
+  }
+  const kv = getKVBinding("KV", event);
+  const challengeValid = await kv.get(`webauthn:login-challenge:${clientChallenge}`);
+  if (!challengeValid) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "WebAuthn challenge expired or invalid"
+    });
+  }
+  await kv.delete(`webauthn:login-challenge:${clientChallenge}`).catch(() => {
+  });
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const authRecord = await d1.prepare(
+    "SELECT user_id, public_key, counter FROM _qarpeo_authenticators WHERE credential_id = ? LIMIT 1"
+  ).bind(credentialId).first();
+  if (!authRecord) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "Unrecognized WebAuthn credential"
+    });
+  }
+  const reqUrl = getRequestURL(event);
+  const expectedOrigin = reqUrl.origin;
+  const expectedRPID = reqUrl.hostname;
+  const storedPublicKey = authRecord.public_key instanceof Uint8Array ? authRecord.public_key : new Uint8Array(authRecord.public_key);
+  let verification;
+  try {
+    verification = await verifyAuthenticationResponse({
+      response: body,
+      expectedChallenge: clientChallenge,
+      expectedOrigin,
+      expectedRPID,
+      credential: {
+        id: credentialId,
+        publicKey: storedPublicKey,
+        counter: authRecord.counter || 0
+      },
+      requireUserVerification: false
+    });
+  } catch (err) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: `WebAuthn assertion verification failed: ${err.message}`
+    });
+  }
+  if (!verification.verified || !verification.authenticationInfo) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "Invalid WebAuthn passkey assertion"
+    });
+  }
+  const newCounter = verification.authenticationInfo.newCounter;
+  await d1.prepare("UPDATE _qarpeo_authenticators SET counter = ? WHERE credential_id = ?").bind(newCounter, credentialId).run();
+  const dbUser = await d1.prepare("SELECT * FROM _qarpeo_users WHERE id = ? LIMIT 1").bind(authRecord.user_id).first();
+  if (!dbUser) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "User associated with WebAuthn credential not found"
+    });
+  }
+  const user = {
+    id: dbUser.id,
+    email: dbUser.email,
+    name: dbUser.name,
+    avatarUrl: dbUser.avatar_url,
+    emailVerified: Boolean(dbUser.email_verified),
+    role: dbUser.role || "user"
+  };
+  const authConfig = getQarpeoConfig(event).auth;
+  const sessionConfig = authConfig.session || {};
+  const now = Date.now();
+  let sessionId;
+  try {
+    const deviceSession = await createDeviceSession(event, user, {
+      provider: "webauthn",
+      maxAge: sessionConfig.maxAge || 604800,
+      maxSessionsPerUser: sessionConfig.maxSessionsPerUser ?? 5,
+      backend: sessionConfig.backend || "cookie"
+    });
+    sessionId = deviceSession.sessionId;
+  } catch {
+  }
+  const sessionData = {
+    user,
+    provider: "webauthn",
+    sessionId,
+    loggedInAt: now,
+    tenantId: event?.context?.tenant?.id ?? void 0
+  };
+  await setAuthSession(event, sessionData);
+  return { success: true, user };
+});

package/dist/runtime/server/routes/auth/webauthn/register/options.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>>;
+export default _default;

package/dist/runtime/server/routes/auth/webauthn/register/options.post.mjs

@@ -0,0 +1,47 @@
+import { defineEventHandler, createError, getRequestURL, useRuntimeConfig } from "nuxt/server";
+import { generateRegistrationOptions } from "@simplewebauthn/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { getKVBinding } from "../../../../../kv.mjs";
+import { requireAuthSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const user = session?.user;
+  if (!user || !user.id) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const runtimeConfig = useRuntimeConfig();
+  const appName = runtimeConfig.public?.qarpeo?.site?.name || process.env.CLOUDFLARE_PROJECT_NAME || "Qarpeo App";
+  const reqUrl = getRequestURL(event);
+  const rpID = reqUrl.hostname;
+  let excludeCredentials = [];
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    const existing = await d1.prepare("SELECT credential_id, transports FROM _qarpeo_authenticators WHERE user_id = ?").bind(user.id).all();
+    excludeCredentials = (existing.results || []).map((row) => ({
+      id: row.credential_id,
+      transports: row.transports ? JSON.parse(row.transports) : void 0
+    }));
+  } catch {
+  }
+  const encoder = new TextEncoder();
+  const options = await generateRegistrationOptions({
+    rpName: appName,
+    rpID,
+    userID: encoder.encode(user.id),
+    userName: user.email || user.name || "User",
+    userDisplayName: user.name || user.email || "User",
+    attestationType: "none",
+    excludeCredentials,
+    authenticatorSelection: {
+      residentKey: "preferred",
+      userVerification: "preferred"
+    }
+  });
+  try {
+    const kv = getKVBinding("KV", event);
+    await kv.put(`webauthn:challenge:${user.id}`, options.challenge, { expirationTtl: 300 });
+  } catch {
+  }
+  return options;
+});

package/dist/runtime/server/routes/auth/webauthn/register/verify.post.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    verified: boolean;
+    credentialId: any;
+}>>;
+export default _default;