@finueva/auth 0.10.0 → 0.11.0

package/dist/index.js

@@ -383,6 +383,109 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/query.mjs
+const isServer$1 = () => typeof window === "undefined";
+function isAuthQueryStateEqual(a, b) {
+	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
+}
+const useAuthQuery = (initializedAtom, path, $fetch, options) => {
+	const value = atom({
+		data: null,
+		error: null,
+		isPending: true,
+		isRefetching: false,
+		refetch: (queryParams) => fn(queryParams)
+	});
+	withEquality(value, isAuthQueryStateEqual);
+	const fn = async (queryParams) => {
+		return new Promise((resolve) => {
+			const opts = typeof options === "function" ? options({
+				data: value.get().data,
+				error: value.get().error,
+				isPending: value.get().isPending
+			}) : options;
+			$fetch(path, {
+				...opts,
+				query: {
+					...opts?.query,
+					...queryParams?.query
+				},
+				async onSuccess(context) {
+					const current = value.get();
+					const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
+					value.set({
+						data: stableData,
+						error: null,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onSuccess?.(context);
+				},
+				async onError(context) {
+					const { request } = context;
+					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
+					const retryAttempt = request.retryAttempt || 0;
+					if (retryAttempts && retryAttempt < retryAttempts) return;
+					const isUnauthorized = context.error.status === 401;
+					value.set({
+						error: context.error,
+						data: isUnauthorized ? null : value.get().data,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onError?.(context);
+				},
+				async onRequest(context) {
+					const currentValue = value.get();
+					value.set({
+						isPending: currentValue.data === null,
+						data: currentValue.data,
+						error: null,
+						isRefetching: true,
+						refetch: value.value.refetch
+					});
+					await opts?.onRequest?.(context);
+				}
+			}).catch((error) => {
+				value.set({
+					error,
+					data: value.get().data,
+					isPending: false,
+					isRefetching: false,
+					refetch: value.value.refetch
+				});
+			}).finally(() => {
+				resolve(void 0);
+			});
+		});
+	};
+	initializedAtom = Array.isArray(initializedAtom) ? initializedAtom : [initializedAtom];
+	let isInitialized = false;
+	const cleanups = [];
+	for (const initAtom of initializedAtom) {
+		const unbind = initAtom.subscribe(async () => {
+			if (isServer$1()) return;
+			if (isInitialized) await fn();
+			else onMount(value, () => {
+				const timeoutId = setTimeout(async () => {
+					if (!isInitialized) {
+						isInitialized = true;
+						await fn();
+					}
+				}, 0);
+				return () => {
+					for (const u of cleanups) u();
+					clearTimeout(timeoutId);
+				};
+			});
+		});
+		cleanups.push(unbind);
+	}
+	return value;
+};
+//#endregion
 //#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
@@ -564,6 +667,15 @@ Object.freeze({
 	}
 });
 //#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/utils/error-codes.mjs
+function defineErrorCodes(codes) {
+	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
+		code: key,
+		message: value,
+		toString: () => key
+	}]));
+}
+//#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
@@ -1635,7 +1747,551 @@ function createAuthClient$1(options) {
 	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.0_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_deb761a9672ce7cf69932b564bd2142d/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/version-uW-pDlTC.mjs
+const PASSKEY_ERROR_CODES = defineErrorCodes({
+	CHALLENGE_NOT_FOUND: "Challenge not found",
+	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+	FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+	PASSKEY_NOT_FOUND: "Passkey not found",
+	AUTHENTICATION_FAILED: "Authentication failed",
+	UNABLE_TO_CREATE_SESSION: "Unable to create session",
+	FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey",
+	PREVIOUSLY_REGISTERED: "Previously registered",
+	REGISTRATION_CANCELLED: "Registration cancelled",
+	AUTH_CANCELLED: "Auth cancelled",
+	UNKNOWN_ERROR: "Unknown error",
+	SESSION_REQUIRED: "Passkey registration requires an authenticated session",
+	RESOLVE_USER_REQUIRED: "Passkey registration requires either an authenticated session or a resolveUser callback when requireSession is false",
+	RESOLVED_USER_INVALID: "Resolved user is invalid"
+});
+const PACKAGE_VERSION = "1.6.22";
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js
+function bufferToBase64URLString(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let str = "";
+	for (const charCode of bytes) str += String.fromCharCode(charCode);
+	return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js
+function base64URLStringToBuffer(base64URLString) {
+	const base64 = base64URLString.replace(/-/g, "+").replace(/_/g, "/");
+	const padLength = (4 - base64.length % 4) % 4;
+	const padded = base64.padEnd(base64.length + padLength, "=");
+	const binary = atob(padded);
+	const buffer = new ArrayBuffer(binary.length);
+	const bytes = new Uint8Array(buffer);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return buffer;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js
+function browserSupportsWebAuthn() {
+	return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== void 0 && typeof globalThis.PublicKeyCredential === "function");
+}
+const _browserSupportsWebAuthnInternals = { stubThis: (value) => value };
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js
+function toPublicKeyCredentialDescriptor(descriptor) {
+	const { id } = descriptor;
+	return {
+		...descriptor,
+		id: base64URLStringToBuffer(id),
+		transports: descriptor.transports
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js
+function isValidDomain(hostname) {
+	return hostname === "localhost" || /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js
+var WebAuthnError = class extends Error {
+	constructor({ message, code, cause, name }) {
+		super(message, { cause });
+		Object.defineProperty(this, "code", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+		this.name = name ?? cause.name;
+		this.code = code;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js
+function identifyRegistrationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Registration ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "ConstraintError") {
+		if (publicKey.authenticatorSelection?.requireResidentKey === true) return new WebAuthnError({
+			message: "Discoverable credentials were required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
+			cause: error
+		});
+		else if (options.mediation === "conditional" && publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required during automatic registration but it could not be performed",
+			code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
+			cause: error
+		});
+		else if (publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
+			cause: error
+		});
+	} else if (error.name === "InvalidStateError") return new WebAuthnError({
+		message: "The authenticator was previously registered",
+		code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
+		cause: error
+	});
+	else if (error.name === "NotAllowedError") return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "NotSupportedError") {
+		if (publicKey.pubKeyCredParams.filter((param) => param.type === "public-key").length === 0) return new WebAuthnError({
+			message: "No entry in pubKeyCredParams was of type \"public-key\"",
+			code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
+			cause: error
+		});
+		return new WebAuthnError({
+			message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
+			code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
+			cause: error
+		});
+	} else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rp.id !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rp.id}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "TypeError") {
+		if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) return new WebAuthnError({
+			message: "User ID was not between 1 and 64 characters",
+			code: "ERROR_INVALID_USER_ID_LENGTH",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new credential",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js
+var BaseWebAuthnAbortService = class {
+	constructor() {
+		Object.defineProperty(this, "controller", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+	}
+	createNewAbortSignal() {
+		if (this.controller) {
+			const abortError = new Error("Cancelling existing WebAuthn API call for new one");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+		}
+		const newController = new AbortController();
+		this.controller = newController;
+		return newController.signal;
+	}
+	cancelCeremony() {
+		if (this.controller) {
+			const abortError = new Error("Manually cancelling existing WebAuthn API call");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+			this.controller = void 0;
+		}
+	}
+};
+const WebAuthnAbortService = new BaseWebAuthnAbortService();
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js
+const attachments = ["cross-platform", "platform"];
+function toAuthenticatorAttachment(attachment) {
+	if (!attachment) return;
+	if (attachments.indexOf(attachment) < 0) return;
+	return attachment;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js
+async function startRegistration(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useAutoRegister = false } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		user: {
+			...optionsJSON.user,
+			id: base64URLStringToBuffer(optionsJSON.user.id)
+		},
+		excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor)
+	};
+	const createOptions = {};
+	if (useAutoRegister) createOptions.mediation = "conditional";
+	createOptions.publicKey = publicKey;
+	createOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.create(createOptions);
+	} catch (err) {
+		throw identifyRegistrationError({
+			error: err,
+			options: createOptions
+		});
+	}
+	if (!credential) throw new Error("Registration was not completed");
+	const { id, rawId, response, type } = credential;
+	let transports = void 0;
+	if (typeof response.getTransports === "function") transports = response.getTransports();
+	let responsePublicKeyAlgorithm = void 0;
+	if (typeof response.getPublicKeyAlgorithm === "function") try {
+		responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKeyAlgorithm()", error);
+	}
+	let responsePublicKey = void 0;
+	if (typeof response.getPublicKey === "function") try {
+		const _publicKey = response.getPublicKey();
+		if (_publicKey !== null) responsePublicKey = bufferToBase64URLString(_publicKey);
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKey()", error);
+	}
+	let responseAuthenticatorData;
+	if (typeof response.getAuthenticatorData === "function") try {
+		responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());
+	} catch (error) {
+		warnOnBrokenImplementation("getAuthenticatorData()", error);
+	}
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			attestationObject: bufferToBase64URLString(response.attestationObject),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			transports,
+			publicKeyAlgorithm: responsePublicKeyAlgorithm,
+			publicKey: responsePublicKey,
+			authenticatorData: responseAuthenticatorData
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+function warnOnBrokenImplementation(methodName, cause) {
+	console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\n`, cause);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js
+function browserSupportsWebAuthnAutofill() {
+	if (!browserSupportsWebAuthn()) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	const globalPublicKeyCredential = globalThis.PublicKeyCredential;
+	if (globalPublicKeyCredential?.isConditionalMediationAvailable === void 0) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());
+}
+const _browserSupportsWebAuthnAutofillInternals = { stubThis: (value) => value };
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js
+function identifyAuthenticationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Authentication ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "NotAllowedError") return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rpId !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rpId}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js
+async function startAuthentication(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	let allowCredentials;
+	if (optionsJSON.allowCredentials?.length !== 0) allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		allowCredentials
+	};
+	const getOptions = {};
+	if (useBrowserAutofill) {
+		if (!await browserSupportsWebAuthnAutofill()) throw Error("Browser does not support WebAuthn autofill");
+		if (document.querySelectorAll("input[autocomplete$='webauthn']").length < 1 && verifyBrowserAutofillInput) throw Error("No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected");
+		getOptions.mediation = "conditional";
+		publicKey.allowCredentials = [];
+	}
+	getOptions.publicKey = publicKey;
+	getOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.get(getOptions);
+	} catch (err) {
+		throw identifyAuthenticationError({
+			error: err,
+			options: getOptions
+		});
+	}
+	if (!credential) throw new Error("Authentication was not completed");
+	const { id, rawId, response, type } = credential;
+	let userHandle = void 0;
+	if (response.userHandle) userHandle = bufferToBase64URLString(response.userHandle);
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			authenticatorData: bufferToBase64URLString(response.authenticatorData),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			signature: bufferToBase64URLString(response.signature),
+			userHandle
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/client.mjs
+const getPasskeyActions = ($fetch, { $listPasskeys, $store }) => {
+	const signInPasskey = async (opts, options) => {
+		const response = await $fetch("/passkey/generate-authenticate-options", {
+			method: "GET",
+			throw: false
+		});
+		if (!response.data) return response;
+		const mergedExtensions = response.data.extensions || opts?.extensions ? {
+			...response.data.extensions || {},
+			...opts?.extensions || {}
+		} : void 0;
+		let res;
+		try {
+			res = await startAuthentication({
+				optionsJSON: {
+					...response.data,
+					extensions: mergedExtensions
+				},
+				useBrowserAutofill: opts?.autoFill
+			});
+		} catch (err) {
+			return {
+				data: null,
+				error: {
+					code: err instanceof WebAuthnError ? err.code : "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+		try {
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-authentication", {
+				body: { response: responseBody },
+				...opts?.fetchOptions,
+				...options,
+				method: "POST",
+				throw: false
+			});
+			$listPasskeys.set(Math.random());
+			$store.notify("$sessionSignal");
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (err) {
+			console.error(`[Better Auth] Error verifying passkey`, err);
+			return {
+				data: null,
+				error: {
+					code: "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+	};
+	const registerPasskey = async (opts, fetchOpts) => {
+		const options = await $fetch("/passkey/generate-register-options", {
+			method: "GET",
+			query: {
+				...opts?.authenticatorAttachment && { authenticatorAttachment: opts.authenticatorAttachment },
+				...opts?.name && { name: opts.name },
+				...opts?.context && { context: opts.context }
+			},
+			throw: false
+		});
+		if (!options.data) return options;
+		try {
+			const mergedExtensions = options.data.extensions || opts?.extensions ? {
+				...options.data.extensions || {},
+				...opts?.extensions || {}
+			} : void 0;
+			const res = await startRegistration({
+				optionsJSON: {
+					...options.data,
+					extensions: mergedExtensions
+				},
+				useAutoRegister: opts?.useAutoRegister
+			});
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-registration", {
+				...opts?.fetchOptions,
+				...fetchOpts,
+				body: {
+					response: responseBody,
+					name: opts?.name
+				},
+				method: "POST",
+				throw: false
+			});
+			if (!verified.data) return verified;
+			$listPasskeys.set(Math.random());
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (e) {
+			if (e instanceof WebAuthnError) {
+				if (e.code === "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.PREVIOUSLY_REGISTERED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				if (e.code === "ERROR_CEREMONY_ABORTED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.REGISTRATION_CANCELLED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				return {
+					data: null,
+					error: {
+						code: e.code,
+						message: e.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+			}
+			return {
+				data: null,
+				error: {
+					code: "UNKNOWN_ERROR",
+					message: e instanceof Error ? e.message : PASSKEY_ERROR_CODES.UNKNOWN_ERROR.message,
+					status: 500,
+					statusText: "INTERNAL_SERVER_ERROR"
+				}
+			};
+		}
+	};
+	return {
+		signIn: { passkey: signInPasskey },
+		passkey: { addPasskey: registerPasskey },
+		$Infer: {}
+	};
+};
+const passkeyClient = () => {
+	const $listPasskeys = atom();
+	return {
+		id: "passkey",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		getActions: ($fetch, $store) => getPasskeyActions($fetch, {
+			$listPasskeys,
+			$store
+		}),
+		getAtoms($fetch) {
+			return {
+				listPasskeys: useAuthQuery($listPasskeys, "/passkey/list-user-passkeys", $fetch, { method: "GET" }),
+				$listPasskeys
+			};
+		},
+		pathMethods: {
+			"/passkey/register": "POST",
+			"/passkey/authenticate": "POST"
+		},
+		atomListeners: [{
+			matcher(path) {
+				return path === "/passkey/verify-registration" || path === "/passkey/delete-passkey" || path === "/passkey/update-passkey" || path === "/sign-out";
+			},
+			signal: "$listPasskeys"
+		}, {
+			matcher: (path) => path === "/passkey/verify-authentication",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: PASSKEY_ERROR_CODES
+	};
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_dfcdb59639d9fe73412dad0223379a88/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -1895,6 +2551,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {
@@ -2639,6 +3298,90 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
+	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
+	if (!Array.isArray(value.requestedRoles) || value.requestedRoles.length < 1 || value.requestedRoles.length > 2 || value.requestedRoles.some((role) => role !== "administrator" && role !== "investigator") || new Set(value.requestedRoles).size !== value.requestedRoles.length) throw new TypeError("requestedRoles is invalid");
+	for (const field of ["expectedTargetRevision", "expectedGlobalRevision"]) if (!Number.isSafeInteger(value[field]) || value[field] < 0 || value[field] >= Number.MAX_SAFE_INTEGER) throw new TypeError(`${field} is invalid`);
+	if (!(typeof value.reasonCategory === "string" && [
+		"initial_bootstrap",
+		"personnel_change",
+		"privilege_review",
+		"quorum_recovery",
+		"security_response"
+	].includes(value.reasonCategory))) throw new TypeError("reasonCategory is invalid");
+	for (const field of ["changeReference", "idempotencyKey"]) if (typeof value[field] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value[field])) throw new TypeError(`${field} is invalid`);
+	return {
+		action: "platform_role_change",
+		targetUserId: value.targetUserId,
+		requestedRoles: [...value.requestedRoles].sort(),
+		expectedTargetRevision: value.expectedTargetRevision,
+		expectedGlobalRevision: value.expectedGlobalRevision,
+		reasonCategory: value.reasonCategory,
+		changeReference: value.changeReference,
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizePlatformBootstrapRoleChangeInput(value) {
+	const request = normalizePlatformRoleChangeRecentAuthenticationInput(value);
+	if (request.reasonCategory !== "initial_bootstrap" || !request.requestedRoles.includes("administrator")) throw new TypeError("platform first approval input is invalid");
+	return request;
+}
+function normalizePlatformRoleApproval(value) {
+	exact(value, [
+		"status",
+		"targetUserId",
+		"targetRevision",
+		"globalRevision",
+		"roles"
+	]);
+	if (value.status !== "awaiting_second_approval" && value.status !== "applied" || !isId(value.targetUserId)) throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.targetRevision) || value.targetRevision < 0) throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.globalRevision) || value.globalRevision < 0) throw authorityUnavailable();
+	if (!Array.isArray(value.roles) || value.status === "awaiting_second_approval" && value.roles.length !== 0 || value.status === "applied" && !(value.roles.length === 1 && value.roles[0] === "administrator" || value.roles.length === 2 && value.roles[0] === "administrator" && value.roles[1] === "investigator")) throw authorityUnavailable();
+	if (value.status === "applied") return {
+		status: "applied",
+		targetUserId: value.targetUserId,
+		targetRevision: value.targetRevision,
+		globalRevision: value.globalRevision,
+		roles: value.roles
+	};
+	return {
+		status: "awaiting_second_approval",
+		targetUserId: value.targetUserId,
+		targetRevision: value.targetRevision,
+		globalRevision: value.globalRevision,
+		roles: []
+	};
+}
+function normalizeRecentAuthenticationStatus(value) {
+	exact(value, ["status"]);
+	if (value.status !== "pending" && value.status !== "ready") throw authorityUnavailable();
+	return { status: value.status };
+}
+function fromRecentAuthenticationError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+function fromPlatformAdministrationError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 400 && code === "BAD_REQUEST") return new AuthError("invalid_request", 400);
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && code === "FORBIDDEN") return new AuthError("access_denied", 403);
+	if (status === 404 && code === "NOT_FOUND") return new AuthError("platform_target_unavailable", 404);
+	if (status === 409 && code === "CONFLICT") return new AuthError("state_conflict", 409);
+	if (status === 409 && code === "QUORUM_UNAVAILABLE") return new AuthError("platform_quorum_unavailable", 409);
+	if (status === 413 && code === "REQUEST_TOO_LONG") return new AuthError("invalid_request", 413);
+	if (status === 415 && code === "UNSUPPORTED_MEDIA_TYPE") return new AuthError("invalid_request", 415);
+	if (status === 422 && code === "RECOVERY_REQUIRED") return new AuthError("platform_recovery_required", 422);
+	if (status === 429 && code === "RATE_LIMITED") return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 503 && code === "SERVICE_UNAVAILABLE") return authorityUnavailable();
+	return authorityUnavailable();
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -3580,6 +4323,8 @@ function byteLength(value) {
 //#endregion
 //#region src/client.ts
 const REFRESH_WINDOW_MS = 120 * 1e3;
+const RECENT_AUTHENTICATION_BROWSER_HEADER = "x-finueva-recent-auth-browser";
+const RECENT_AUTHENTICATION_REQUEST_HEADER = "x-finueva-recent-auth-request";
 function createAuthClient(options) {
 	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
 	const appOrigin = normalizeOrigin(options.appOrigin, "appOrigin");
@@ -3596,7 +4341,8 @@ function createAuthClient(options) {
 			credentials: "include",
 			retry: 0,
 			timeout: timeoutMs
-		}
+		},
+		plugins: [passkeyClient()]
 	});
 	const persistence = createSessionPersistence(options.persistence, authOrigin, now, timeoutMs);
 	const authStateListeners = new Set();
@@ -3608,6 +4354,9 @@ function createAuthClient(options) {
 	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
 	let authorityGeneration = 0;
+	let recentAuthenticationBrowserToken;
+	let recentAuthenticationStartAttempt;
+	let recentAuthenticationStartRequest;
 	let sessionReadEpoch = 0;
 	let activeAccountMutationGeneration;
 	let invitationAbort;
@@ -3621,6 +4370,10 @@ function createAuthClient(options) {
 	let signalRefreshPending = false;
 	let signalRefreshScheduled = false;
 	let signalRefreshRequest;
+	function advanceAuthorityGeneration() {
+		recentAuthenticationStartAttempt = void 0;
+		return ++authorityGeneration;
+	}
 	function setAuthState(state) {
 		authState = state;
 		for (const listener of authStateListeners) try {
@@ -3726,7 +4479,9 @@ function createAuthClient(options) {
 	}
 	function updateSession(session) {
 		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
+		const changedSession = !session || sessionId !== void 0 && (session.id !== sessionId || session.user.id !== sessionUserId);
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
 		sessionId = session?.id;
 		sessionUserId = session?.user.id;
 		return session;
@@ -3755,10 +4510,10 @@ function createAuthClient(options) {
 	}
 	function signOut() {
 		if (signOutRequest) return signOutRequest;
-		if (activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
+		if (activeAccountMutationGeneration !== void 0 || recentAuthenticationStartRequest) return Promise.reject(new AuthError("state_conflict", 409));
 		const pendingInvitation = invitationRequest;
 		invitationAbort?.abort();
-		const generation = ++authorityGeneration;
+		const generation = advanceAuthorityGeneration();
 		sessionReadEpoch += 1;
 		clearCredential();
 		sessionId = void 0;
@@ -3803,10 +4558,10 @@ function createAuthClient(options) {
 		return request;
 	}
 	async function runAccountMutation(operation) {
-		if (signOutRequest || activeAccountMutationGeneration !== void 0) throw new AuthError("state_conflict", 409);
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
 		const pendingInvitation = invitationRequest;
 		invitationAbort?.abort();
-		const generation = ++authorityGeneration;
+		const generation = advanceAuthorityGeneration();
 		sessionReadEpoch += 1;
 		activeAccountMutationGeneration = generation;
 		clearCredential();
@@ -3873,8 +4628,101 @@ function createAuthClient(options) {
 			throw error;
 		}
 	}
+	function assertRecentAuthenticationOrigin() {
+		if (appOrigin !== authOrigin) throw new TypeError("recent authentication requires the exact Auth Origin");
+	}
 	return {
 		_type: "browser",
+		async startPlatformRoleChangeRecentAuthentication(input) {
+			assertRecentAuthenticationOrigin();
+			const body = normalizePlatformRoleChangeRecentAuthenticationInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			recentAuthenticationBrowserToken ??= createOpaqueToken();
+			const normalizedInput = JSON.stringify(body);
+			const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
+				input: normalizedInput,
+				requestToken: createOpaqueToken(),
+				sessionId,
+				userId: sessionUserId
+			};
+			recentAuthenticationStartAttempt = attempt;
+			const request = (async () => {
+				try {
+					const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
+						fetch: fetchImpl,
+						timeoutMs,
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
+							[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
+						},
+						body,
+						mapError: fromRecentAuthenticationError
+					});
+					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+					const status = normalizeRecentAuthenticationStatus(value);
+					if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
+					return status;
+				} catch (error) {
+					if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
+					throw error;
+				}
+			})();
+			recentAuthenticationStartRequest = request;
+			try {
+				return await request;
+			} finally {
+				if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
+			}
+		},
+		async approveBootstrapPlatformRoleChange(input) {
+			assertRecentAuthenticationOrigin();
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const body = normalizePlatformBootstrapRoleChangeInput(input);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/platform/role-approvals"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromPlatformAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizePlatformRoleApproval(value);
+		},
+		async verifyRecentAuthenticationWithPasskey() {
+			assertRecentAuthenticationOrigin();
+			if (!(await runAccountMutation(async () => {
+				const verification = await betterAuth.signIn.passkey({ autoFill: false });
+				if (verification.error) throw fromRecentAuthenticationError(void 0, verification.error.status);
+			})).session) throw new AuthError("authentication_required", 401);
+		},
+		async addPasskey() {
+			assertRecentAuthenticationOrigin();
+			if (!(await runAccountMutation(async () => {
+				const registration = await betterAuth.passkey.addPasskey({ context: createOpaqueToken() });
+				if (registration.error) throw fromAccountAuthorityError(registration.error, registration.error.status);
+			})).session) throw new AuthError("authentication_required", 401);
+		},
+		async getRecentAuthenticationStatus() {
+			assertRecentAuthenticationOrigin();
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication/status"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {},
+				mapError: fromRecentAuthenticationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeRecentAuthenticationStatus(value);
+		},
 		acceptInvitation(input) {
 			let invitation;
 			try {
@@ -3882,8 +4730,8 @@ function createAuthClient(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
-			const generation = ++authorityGeneration;
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest || recentAuthenticationStartRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			const generation = advanceAuthorityGeneration();
 			const controller = new AbortController();
 			clearCredential();
 			const request = (async () => {
@@ -4138,5 +4986,12 @@ function createAuthClient(options) {
 		}
 	};
 }
+function createOpaqueToken() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return globalThis.btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
 //#endregion
 export { AuthError, createAuthClient };