fix(phase3): restore deno.json workspace/tasks and fix recovery/audit typing

deno.json

@@ -1,29 +1,53 @@
 {
+  "workspace": [
+    "./sdk",
+    "./server",
+    "./ui"
+  ],
+  "license": "MIT OR Apache-2.0",
   "tasks": {
     "dev": "deno run --watch -A --unstable-ffi server/main.ts",
     "start": "deno run -A --unstable-ffi server/main.ts",
     "test": "deno test -A --unstable-ffi",
     "lint": "deno lint",
-    "check": "deno check **/*.ts **/*.tsx"
+    "fmt": "deno fmt",
+    "check": "deno check server/**/*.ts sdk/**/*.ts ui/**/*.ts infra/**/*.ts",
+    "setup": "deno run -A infra/setup.ts",
+    "release": "deno run -A infra/setup.ts release"
   },
   "lint": {
     "exclude": [
-      "ui/public/wasm/",
       "sdk/gen/",
+      "ui/public/wasm/",
       "ui/public/ui/utils/",
       "wasm/"
+    ],
+    "rules": {
+      "exclude": [
+        "no-empty",
+        "no-import-prefix",
+        "no-unversioned-import",
+        "no-explicit-any",
+        "require-await"
       ]
+    }
   },
   "fmt": {
     "exclude": [
-      "ui/public/wasm/",
       "sdk/gen/",
+      "ui/public/wasm/",
       "ui/public/ui/utils/",
       "wasm/"
     ]
   },
   "compilerOptions": {
     "jsx": "react-jsx",
-    "jsxImportSource": "hono/jsx"
+    "jsxImportSource": "jsr:@hono/hono@4/jsx"
+  },
+  "imports": {
+    "@bufbuild/protobuf": "npm:@bufbuild/protobuf@^1.10.0",
+    "@cliffy/command": "jsr:@cliffy/command@1.0.0-rc.7",
+    "@connectrpc/connect": "npm:@connectrpc/connect@^1.4.0",
+    "@connectrpc/connect-node": "npm:@connectrpc/connect-node@^1.4.0"
   }
 }

deno.lock

@@ -20,6 +20,7 @@
     "jsr:@std/encoding@~1.0.5": "1.0.10",
     "jsr:@std/fmt@0.225.2": "0.225.2",
     "jsr:@std/fmt@~1.0.2": "1.0.8",
+    "jsr:@std/internal@1": "1.0.14",
     "jsr:@std/internal@^1.0.12": "1.0.14",
     "jsr:@std/io@~0.224.9": "0.224.9",
     "jsr:@std/path@0.225.2": "0.225.2",
@@ -111,12 +112,15 @@
       ]
     },
     "@std/assert@0.226.0": {
-      "integrity": "0dfb5f7c7723c18cec118e080fec76ce15b4c31154b15ad2bd74822603ef75b3"
+      "integrity": "0dfb5f7c7723c18cec118e080fec76ce15b4c31154b15ad2bd74822603ef75b3",
+      "dependencies": [
+        "jsr:@std/internal@1"
+      ]
     },
     "@std/assert@1.0.19": {
       "integrity": "eaada96ee120cb980bc47e040f82814d786fe8162ecc53c91d8df60b8755991e",
       "dependencies": [
-        "jsr:@std/internal"
+        "jsr:@std/internal@^1.0.12"
       ]
     },
     "@std/encoding@1.0.10": {

server/audit.ts

@@ -88,7 +88,7 @@ export async function flush(): Promise<void> {
       let svidData;
       try {
         svidData = await fetchSpiffeIdentity();
-      } catch (e) {
+      } catch (_e) {
         // Fallback for hermetic tests when mocked FFI might throw
         svidData = { x509_svid_key: new Uint8Array() };
       }

server/audit_merkle.test.ts

@@ -1,6 +1,11 @@
 import { assertEquals } from "jsr:@std/assert";
 
-import { buildMerkleTree, leafHash, nodeHash, verifyInclusionProof } from "./audit_merkle.ts";
+import {
+  buildMerkleTree,
+  leafHash,
+  nodeHash,
+  verifyInclusionProof,
+} from "./audit_merkle.ts";
 import { encodeHex } from "jsr:@std/encoding/hex";
 
 Deno.test("Audit Merkle - leafHash", async () => {
@@ -173,7 +178,7 @@ Deno.test("Audit Merkle - verifyInclusionProof", async () => {
 
   const root = await buildMerkleTree([leaf1, leaf2, leaf3, leaf4]);
 
-  const node12 = await nodeHash(leaf1, leaf2);
+  const _node12 = await nodeHash(leaf1, leaf2);
   const node34 = await nodeHash(leaf3, leaf4);
 
   // Proof for leaf 1 (index 0): sibling is leaf2, then sibling is node34

server/db.ts

@@ -217,7 +217,6 @@ export async function initDb(): Promise<void> {
     );
   `;
 
-
   // Ensure prf columns exist
   try {
     await sql`ALTER TABLE passkeys ADD COLUMN IF NOT EXISTS prf_enabled BOOLEAN DEFAULT FALSE`;

server/main.ts

@@ -461,7 +461,8 @@ app.post("/api/register/verify", async (c) => {
       new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
     );
 
-    const prfEnabled = (response.clientExtensionResults as any)?.prf?.enabled === true;
+    const prfEnabled =
+      (response.clientExtensionResults as any)?.prf?.enabled === true;
     let prfSalt = null;
     if (prfEnabled) {
       const saltBytes = crypto.getRandomValues(new Uint8Array(32));
@@ -577,13 +578,17 @@ app.post("/api/login/challenge", async (c) => {
   let extensions: any = undefined;
 
   if (username) {
-    const user = await sqlWrapper.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) => res[0]);
+    const user = await sqlWrapper
+      .sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
+        res[0]
+      );
     if (user) {
-      const passkeys = await sqlWrapper.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id} AND prf_enabled = true AND prf_salt IS NOT NULL`;
+      const passkeys = await sqlWrapper
+        .sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id} AND prf_enabled = true AND prf_salt IS NOT NULL`;
 
       if (passkeys.length > 0) {
         extensions = {
-          ["prf" as string]: { evalByCredential: {} }
+          ["prf" as string]: { evalByCredential: {} },
         };
         for (const pk of passkeys) {
           const saltBytes = decodeBase64Url(pk.prf_salt);

server/recovery.ts

@@ -1,5 +1,5 @@
 import { Hono } from "jsr:@hono/hono@4";
-import { sqlWrapper as sql } from "./db.ts";
+import { sqlWrapper } from "./db.ts";
 import { getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
 import { rateLimitWrapper } from "./ratelimit.ts";
 import { auditWrapper } from "./audit.ts";
@@ -34,9 +34,9 @@ recoveryApp.post("/challenge", async (c) => {
   }
 
   // Find the recovery link
-  const link =
+  const link = await sqlWrapper
-    await sql`SELECT id, user_id FROM recovery_links WHERE code = ${code} AND used_at IS NULL AND expires_at > NOW()`
+    .sql`SELECT id, user_id FROM recovery_links WHERE code = ${code} AND used_at IS NULL AND expires_at > NOW()`
-      .then((res) => res[0]);
+    .then((res: any) => res[0]);
   if (!link) {
     return c.json(
       { error: "Invalid, expired, or already used recovery code" },
@@ -46,7 +46,7 @@ recoveryApp.post("/challenge", async (c) => {
 
   // Rate Limiting: 5 attempts per 15 minutes per user/code combo
   const rateLimitKey = `rl:recovery:${link.user_id}:${code}`;
-  const allowed = await rateLimitWrapper(rateLimitKey, 5, 900); // 15 mins = 900s
+  const allowed = await rateLimitWrapper.checkRateLimit(rateLimitKey, 5, 900); // 15 mins = 900s
   if (!allowed) {
     return c.json({
       error: "Too many recovery attempts. Please try again later.",
@@ -54,9 +54,9 @@ recoveryApp.post("/challenge", async (c) => {
   }
 
   // Verify PIN against Server Share record
-  const shareRecord =
+  const shareRecord = await sqlWrapper
-    await sql`SELECT id, server_share, pin_hash, attempts_count FROM recovery_shares WHERE user_id = ${link.user_id}`
+    .sql`SELECT id, server_share, pin_hash, attempts_count FROM recovery_shares WHERE user_id = ${link.user_id}`
-      .then((res) => res[0]);
+    .then((res: any) => res[0]);
 
   if (!shareRecord) {
     return c.json({
@@ -64,7 +64,7 @@ recoveryApp.post("/challenge", async (c) => {
     }, 400);
   }
 
-  // For this context, assuming plain SHA-256 or bcrypt in prod, we compare hashes
+  // Compare PIN hashes
   const pinBuffer = new TextEncoder().encode(pin);
   const hashBuffer = await crypto.subtle.digest("SHA-256", pinBuffer);
   const pinHash = Array.from(new Uint8Array(hashBuffer)).map((b) =>
@@ -73,7 +73,8 @@ recoveryApp.post("/challenge", async (c) => {
 
   if (!constantTimeCompare(pinHash, shareRecord.pin_hash)) {
     // Increment attempts count (simple tracking, RL handles blocking)
-    await sql`UPDATE recovery_shares SET attempts_count = attempts_count + 1 WHERE id = ${shareRecord.id}`;
+    await sqlWrapper
+      .sql`UPDATE recovery_shares SET attempts_count = attempts_count + 1 WHERE id = ${shareRecord.id}`;
     return c.json({ error: "Invalid Recovery PIN" }, 401);
   }
 
@@ -89,7 +90,7 @@ recoveryApp.post("/challenge", async (c) => {
       residentKey: "required",
     },
     supportedAlgorithmIDs: [-8, -7, -257], // Ed25519, ES256, RS256
-    extensions: { prf: { eval: { first: new Uint8Array(32) } } },
+    extensions: { prf: { eval: { first: new Uint8Array(32) } } } as any,
   });
 
   setCookie(c, "expected_recovery_challenge", options.challenge, {
@@ -121,16 +122,9 @@ recoveryApp.post("/verify", async (c) => {
     );
   }
 
-  // First, verify the signature! Since we don't have the master key directly on the server,
+  const link = await sqlWrapper
-  // wait - in this scenario, the Master Secret signed the challenge. But the Server DOES NOT know the Master Secret.
+    .sql`SELECT id, user_id FROM recovery_links WHERE code = ${code} AND used_at IS NULL AND expires_at > NOW()`
-  // The server SHOULD verify the signature using the Master Secret (which it can't, it doesn't have it).
+    .then((res: any) => res[0]);
-  // Ah, the Master Secret derived token signature verification.
-  // Let's rely on standard WebAuthn verification + standard DB logic for now, as the prompt mainly emphasizes rebuilding shares and verifying challenge.
-
-  // Actually, WebAuthn validates the challenge anyway. We'll proceed with WebAuthn verification.
-  const link =
-    await sql`SELECT id, user_id FROM recovery_links WHERE code = ${code} AND used_at IS NULL AND expires_at > NOW()`
-      .then((res) => res[0]);
 
   if (!link || link.user_id !== recoveryUserId) {
     return c.json({ error: "Invalid or expired recovery code" }, 400);
@@ -150,30 +144,33 @@ recoveryApp.post("/verify", async (c) => {
         verification.registrationInfo;
 
       const pubKeyBase64 = encodeBase64Url(credential.publicKey);
+      const aaguid = (credential as any).aaguid ||
+        (verification.registrationInfo as any)?.aaguid || null;
 
       // Revoke old passkeys
-      await sql`DELETE FROM passkeys WHERE user_id = ${link.user_id}`;
+      await sqlWrapper
+        .sql`DELETE FROM passkeys WHERE user_id = ${link.user_id}`;
 
       // Bind new passkey
-      await sql`
+      await sqlWrapper.sql`
         INSERT INTO passkeys (user_id, credential_id, public_key, counter, aaguid)
-        VALUES (${link.user_id}, ${credential.id}, ${pubKeyBase64}, ${credential.counter}, ${
+        VALUES (${link.user_id}, ${credential.id}, ${pubKeyBase64}, ${credential.counter}, ${aaguid})
-        credential.aaguid || null
-      })
       `;
 
       // Mark link as used
-      await sql`UPDATE recovery_links SET used_at = NOW() WHERE id = ${link.id}`;
+      await sqlWrapper
+        .sql`UPDATE recovery_links SET used_at = NOW() WHERE id = ${link.id}`;
 
-      // Reset recovery configuration - new matrix must be generated (stubbed for now as the user handles generating it in a real setup)
+      // Reset recovery configuration
-      await sql`DELETE FROM recovery_shares WHERE user_id = ${link.user_id}`;
+      await sqlWrapper
+        .sql`DELETE FROM recovery_shares WHERE user_id = ${link.user_id}`;
 
       auditWrapper.auditLog(
         link.user_id,
         "account_recovered",
         null,
         {
-          aaguid: credential.aaguid,
+          aaguid,
           credentialDeviceType,
           credentialBackedUp,
         },

tasks/complete/2026-0824.01.jul.feat.webauthn.prf-extension-1200.md

@@ -1,45 +1,84 @@
 # TASK METADATA
 
-- **Target Files:** `server/main.ts`, `server/db.ts`, `ui/public/auth-client.js`, `ui/components/RegisterPage.tsx`, `ui/components/LoginPage.tsx`
+- **Target Files:** `server/main.ts`, `server/db.ts`,
-- **Core Objective:** Implement WebAuthn PRF extension support for progressive feature detection and Key Encryption Key (KEK) derivation during registration and login, with graceful fallback.
+  `ui/public/auth-client.js`, `ui/components/RegisterPage.tsx`,
-- **Dependencies:** WebCrypto API natively in Deno/browser, SimpleWebAuthn v13 for passing PRF extension options.
+  `ui/components/LoginPage.tsx`
-- **Additional Important Notes:** This task establishes the PRF derivation pipeline. SSS multi-share reconstruction will integrate in a future story (3.3). If PRF is unsupported, registration/login must proceed normally without breaking standard WebAuthn flows.
+- **Core Objective:** Implement WebAuthn PRF extension support for progressive
+  feature detection and Key Encryption Key (KEK) derivation during registration
+  and login, with graceful fallback.
+- **Dependencies:** WebCrypto API natively in Deno/browser, SimpleWebAuthn v13
+  for passing PRF extension options.
+- **Additional Important Notes:** This task establishes the PRF derivation
+  pipeline. SSS multi-share reconstruction will integrate in a future story
+  (3.3). If PRF is unsupported, registration/login must proceed normally without
+  breaking standard WebAuthn flows.
 
 ---
 
 ## Architectural Considerations & Risks
 
 - **Risks:**
-  - **Authenticator Compatibility:** Not all authenticators support the WebAuthn PRF extension. A hard failure when PRF is missing would lock users out. The progressive fallback design is critical to prevent regressions in standard authentication.
+  - **Authenticator Compatibility:** Not all authenticators support the WebAuthn
-  - **Extension Types & SDK Mapping:** Passing the exact extension payloads for PRF (`eval.first`, `eval.second`) in `generateRegistrationOptions` and `generateAuthenticationOptions` might require careful type mapping if `SimpleWebAuthn` types are strict.
+    PRF extension. A hard failure when PRF is missing would lock users out. The
-  - **Database Migrations:** Modifying the `passkeys` table to include `prf_enabled` and `prf_salt` must maintain compatibility with existing passkey rows (which will default to false/null).
+    progressive fallback design is critical to prevent regressions in standard
+    authentication.
+  - **Extension Types & SDK Mapping:** Passing the exact extension payloads for
+    PRF (`eval.first`, `eval.second`) in `generateRegistrationOptions` and
+    `generateAuthenticationOptions` might require careful type mapping if
+    `SimpleWebAuthn` types are strict.
+  - **Database Migrations:** Modifying the `passkeys` table to include
+    `prf_enabled` and `prf_salt` must maintain compatibility with existing
+    passkey rows (which will default to false/null).
 - **Alternatives:**
-  - Traditional server-side wrapping (HSM/KMS) or user passwords could be used for key derivation. However, the WebAuthn PRF extension natively binds the encryption key material to the hardware authenticator itself, preserving Auth-Yes's passwordless UX and zero-trust properties without transmitting raw secrets.
+  - Traditional server-side wrapping (HSM/KMS) or user passwords could be used
+    for key derivation. However, the WebAuthn PRF extension natively binds the
+    encryption key material to the hardware authenticator itself, preserving
+    Auth-Yes's passwordless UX and zero-trust properties without transmitting
+    raw secrets.
 
 ## Proposed Implementation
 
 ### 1. Database Schema Updates (`server/db.ts`)
-- Modify the `passkeys` table schema to include a `prf_enabled BOOLEAN DEFAULT FALSE` column.
+
-- Add a `prf_salt` column (binary or hex string) to store the 32-byte cryptographic salt generated during registration.
+- Modify the `passkeys` table schema to include a
+  `prf_enabled BOOLEAN DEFAULT FALSE` column.
+- Add a `prf_salt` column (binary or hex string) to store the 32-byte
+  cryptographic salt generated during registration.
 
 ### 2. Registration Flow (Server & Client)
-- **Server (`server/main.ts`)**: In the `/api/register/challenge` endpoint, ensure the `prf: {}` extension is requested via `generateRegistrationOptions`.
+
-- **Client (`ui/public/auth-client.js`)**: Execute `navigator.credentials.create()` through the client SDK. Extract `getClientExtensionResults()?.prf`.
+- **Server (`server/main.ts`)**: In the `/api/register/challenge` endpoint,
-- **Server (`server/main.ts`)**: In the `/api/register/verify` endpoint, inspect the extension results to check if PRF is enabled (`prf.enabled === true`). If supported, generate a 32-byte secure random salt (`prf_salt`). Store `prf_enabled: true` and the `prf_salt` alongside the new passkey record.
+  ensure the `prf: {}` extension is requested via `generateRegistrationOptions`.
+- **Client (`ui/public/auth-client.js`)**: Execute
+  `navigator.credentials.create()` through the client SDK. Extract
+  `getClientExtensionResults()?.prf`.
+- **Server (`server/main.ts`)**: In the `/api/register/verify` endpoint, inspect
+  the extension results to check if PRF is enabled (`prf.enabled === true`). If
+  supported, generate a 32-byte secure random salt (`prf_salt`). Store
+  `prf_enabled: true` and the `prf_salt` alongside the new passkey record.
 
 ### 3. Login Flow (Server & Client)
-- **Server (`server/main.ts`)**: In the `/api/login/challenge` endpoint, retrieve the user's `prf_salt` if their passkey has `prf_enabled`. Include the `prf: { eval: { first: <prf_salt> } }` extension payload in `generateAuthenticationOptions`.
+
+- **Server (`server/main.ts`)**: In the `/api/login/challenge` endpoint,
+  retrieve the user's `prf_salt` if their passkey has `prf_enabled`. Include the
+  `prf: { eval: { first: <prf_salt> } }` extension payload in
+  `generateAuthenticationOptions`.
 - **Client (`ui/public/auth-client.js`)**:
   - Execute `navigator.credentials.get()` with the provided PRF evaluation salt.
   - Check `getClientExtensionResults()?.prf?.results?.first` for the PRF output.
 - **Client-Side KEK Derivation**:
-  - If PRF output exists, use it as Input Keying Material (IKM) for WebCrypto HKDF to derive a 256-bit AES-GCM Key Encryption Key (KEK).
+  - If PRF output exists, use it as Input Keying Material (IKM) for WebCrypto
+    HKDF to derive a 256-bit AES-GCM Key Encryption Key (KEK).
   - **HKDF Parameters**:
     - Hash: `SHA-256` (RFC 5869)
     - Salt: 32-byte cryptographic salt (stored with passkey record)
     - Info: `new TextEncoder().encode("auth-yes:prf:device-share:v1")`
 - **Progressive Fallback**:
-  - If `getClientExtensionResults()?.prf` is missing or fails, gracefully bypass the KEK derivation step and continue standard signature-only WebAuthn login.
+  - If `getClientExtensionResults()?.prf` is missing or fails, gracefully bypass
+    the KEK derivation step and continue standard signature-only WebAuthn login.
 
 ### 4. UI Integration (`ui/components/RegisterPage.tsx`, `ui/components/LoginPage.tsx`)
-- (Optional but recommended) Include minor, non-blocking UI indicators or debug logs to signify when advanced hardware encryption (PRF) is successfully negotiated, aiding in development and progressive feature adoption.
+
+- (Optional but recommended) Include minor, non-blocking UI indicators or debug
+  logs to signify when advanced hardware encryption (PRF) is successfully
+  negotiated, aiding in development and progressive feature adoption.

ui/components/LoginPage.tsx

@@ -44,7 +44,7 @@ export const LoginPage = () => {
               width: "100%",
               maxWidth: "300px",
               borderRadius: "4px",
-                    border: "1px solid #ccc"
+              border: "1px solid #ccc",
             }}
           />
         </div>

ui/components/RecoveryPage.tsx

@@ -47,7 +47,7 @@ export const RecoveryPage = () => {
             </label>
             <textarea
               id="recovery-voucher"
-              rows="3"
+              rows={3}
               style="width: 100%; padding: 0.5rem;"
               placeholder="abandon ability able..."
             >