@finueva/auth 0.10.1 → 0.11.0

package/README.md

@@ -2,7 +2,9 @@
 
 Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-The current published version is `0.10.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+The current published version is `0.10.1`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+
+The passkey and recent-authentication methods below describe this repository's next package candidate. Published version `0.10.1` does not include them.
 
 ## Install
 
@@ -76,21 +78,23 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                      | Browser                                     | Server                                 | Device                                 |
-| ------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
-| Create an account         | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
-| Read the current session  | `getSession()`                              | `getSession()`                         | `getSession()`                         |
-| Observe session state     | `onAuthStateChange()`                       | Not available                          | Not available                          |
-| Update a profile          | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
-| Change a password         | `changePassword()`                          | Not available                          | `changePassword()`                     |
-| Reset a password          | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
-| Verify an email           | `sendVerificationEmail()`                   | Not available                          | Not available                          |
-| List organizations        | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
-| Create an ordinary team   | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
-| Invite an ordinary member | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
-| Accept an invitation      | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
-| Request Drive access      | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
-| End the current session   | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
+| Task                          | Browser                                     | Server                                 | Device                                 |
+| ----------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
+| Create an account             | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
+| Read the current session      | `getSession()`                              | `getSession()`                         | `getSession()`                         |
+| Observe session state         | `onAuthStateChange()`                       | Not available                          | Not available                          |
+| Update a profile              | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
+| Change a password             | `changePassword()`                          | Not available                          | `changePassword()`                     |
+| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
+| Verify an email               | `sendVerificationEmail()`                   | Not available                          | Not available                          |
+| List organizations            | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
+| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
+| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
+| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
+| Enroll a passkey              | `addPasskey()`                              | Not available                          | Not available                          |
+| Perform recent authentication | Three `*RecentAuthentication*()` methods    | Not available                          | Not available                          |
+| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
+| End the current session       | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -108,6 +112,38 @@ console.log(invitation.id, invitation.expiresAt);
 
 If the response is lost, repeat the same request with the same key. The SDK does not retry automatically. The result confirms invitation creation. It does not confirm email delivery.
 
+## Perform Recent Authentication
+
+The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
+
+```ts
+await auth.signIn({ email, password });
+await auth.addPasskey();
+```
+
+The enrollment authorization expires after five minutes. It is single-use. Signup, social sign-in, session refresh, bearer use, and generic session creation do not authorize enrollment. A User without a fresh password sign-in cannot use this path.
+
+Start one reviewed platform-role action before invoking passkey authentication:
+
+```ts
+await auth.startPlatformRoleChangeRecentAuthentication({
+  targetUserId: "user_01J8R7M6N5P4Q3S2T1",
+  requestedRoles: ["administrator", "investigator"],
+  expectedRevision: 4,
+});
+
+await auth.verifyRecentAuthenticationWithPasskey();
+
+const continuation = await auth.getRecentAuthenticationStatus();
+if (continuation.status === "ready") {
+  showReviewedActionIsReady();
+}
+```
+
+The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. The tracer has no proof-consumption API. A future exact mutation must add atomic one-use consumption with its state change. No platform mutation is currently implemented.
+
+If a start result is unavailable, call `startPlatformRoleChangeRecentAuthentication()` again with the same normalized input. The client reuses the current request nonce. A different start or observed account transition removes this local retry state. Only one start request can be active. An overlapping call returns `state_conflict` before network I/O. The SDK does not retry automatically.
+
 ## Request A Drive Credential
 
 Request one short-lived credential for one workspace:

package/THIRD_PARTY_NOTICES.md

@@ -47,6 +47,32 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+## @simplewebauthn/browser 13.3.0
+
+Source: https://github.com/MasterKale/SimpleWebAuthn
+
+MIT License
+
+Copyright (c) 2020 Matthew Miller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ## ofetch 1.5.1
 
 Source: https://github.com/unjs/ofetch

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, N as SocialIdTokenInput, P as SocialIdTokenProvider, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { B as SocialIdTokenInput, C as OrganizationTeam, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -455,6 +455,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, M as SignInInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as SendVerificationEmailInput, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { A as PlatformRole, B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, L as RecentAuthenticationStatus, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as SendVerificationEmailInput, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SignInInput } from "./types-BqpgLkQB.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -383,6 +383,109 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/query.mjs
+const isServer$1 = () => typeof window === "undefined";
+function isAuthQueryStateEqual(a, b) {
+	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
+}
+const useAuthQuery = (initializedAtom, path, $fetch, options) => {
+	const value = atom({
+		data: null,
+		error: null,
+		isPending: true,
+		isRefetching: false,
+		refetch: (queryParams) => fn(queryParams)
+	});
+	withEquality(value, isAuthQueryStateEqual);
+	const fn = async (queryParams) => {
+		return new Promise((resolve) => {
+			const opts = typeof options === "function" ? options({
+				data: value.get().data,
+				error: value.get().error,
+				isPending: value.get().isPending
+			}) : options;
+			$fetch(path, {
+				...opts,
+				query: {
+					...opts?.query,
+					...queryParams?.query
+				},
+				async onSuccess(context) {
+					const current = value.get();
+					const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
+					value.set({
+						data: stableData,
+						error: null,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onSuccess?.(context);
+				},
+				async onError(context) {
+					const { request } = context;
+					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
+					const retryAttempt = request.retryAttempt || 0;
+					if (retryAttempts && retryAttempt < retryAttempts) return;
+					const isUnauthorized = context.error.status === 401;
+					value.set({
+						error: context.error,
+						data: isUnauthorized ? null : value.get().data,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onError?.(context);
+				},
+				async onRequest(context) {
+					const currentValue = value.get();
+					value.set({
+						isPending: currentValue.data === null,
+						data: currentValue.data,
+						error: null,
+						isRefetching: true,
+						refetch: value.value.refetch
+					});
+					await opts?.onRequest?.(context);
+				}
+			}).catch((error) => {
+				value.set({
+					error,
+					data: value.get().data,
+					isPending: false,
+					isRefetching: false,
+					refetch: value.value.refetch
+				});
+			}).finally(() => {
+				resolve(void 0);
+			});
+		});
+	};
+	initializedAtom = Array.isArray(initializedAtom) ? initializedAtom : [initializedAtom];
+	let isInitialized = false;
+	const cleanups = [];
+	for (const initAtom of initializedAtom) {
+		const unbind = initAtom.subscribe(async () => {
+			if (isServer$1()) return;
+			if (isInitialized) await fn();
+			else onMount(value, () => {
+				const timeoutId = setTimeout(async () => {
+					if (!isInitialized) {
+						isInitialized = true;
+						await fn();
+					}
+				}, 0);
+				return () => {
+					for (const u of cleanups) u();
+					clearTimeout(timeoutId);
+				};
+			});
+		});
+		cleanups.push(unbind);
+	}
+	return value;
+};
+//#endregion
 //#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
@@ -564,6 +667,15 @@ Object.freeze({
 	}
 });
 //#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/utils/error-codes.mjs
+function defineErrorCodes(codes) {
+	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
+		code: key,
+		message: value,
+		toString: () => key
+	}]));
+}
+//#endregion
 //#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
@@ -1635,7 +1747,551 @@ function createAuthClient$1(options) {
 	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.0_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_deb761a9672ce7cf69932b564bd2142d/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/version-uW-pDlTC.mjs
+const PASSKEY_ERROR_CODES = defineErrorCodes({
+	CHALLENGE_NOT_FOUND: "Challenge not found",
+	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+	FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+	PASSKEY_NOT_FOUND: "Passkey not found",
+	AUTHENTICATION_FAILED: "Authentication failed",
+	UNABLE_TO_CREATE_SESSION: "Unable to create session",
+	FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey",
+	PREVIOUSLY_REGISTERED: "Previously registered",
+	REGISTRATION_CANCELLED: "Registration cancelled",
+	AUTH_CANCELLED: "Auth cancelled",
+	UNKNOWN_ERROR: "Unknown error",
+	SESSION_REQUIRED: "Passkey registration requires an authenticated session",
+	RESOLVE_USER_REQUIRED: "Passkey registration requires either an authenticated session or a resolveUser callback when requireSession is false",
+	RESOLVED_USER_INVALID: "Resolved user is invalid"
+});
+const PACKAGE_VERSION = "1.6.22";
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js
+function bufferToBase64URLString(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let str = "";
+	for (const charCode of bytes) str += String.fromCharCode(charCode);
+	return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js
+function base64URLStringToBuffer(base64URLString) {
+	const base64 = base64URLString.replace(/-/g, "+").replace(/_/g, "/");
+	const padLength = (4 - base64.length % 4) % 4;
+	const padded = base64.padEnd(base64.length + padLength, "=");
+	const binary = atob(padded);
+	const buffer = new ArrayBuffer(binary.length);
+	const bytes = new Uint8Array(buffer);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return buffer;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js
+function browserSupportsWebAuthn() {
+	return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== void 0 && typeof globalThis.PublicKeyCredential === "function");
+}
+const _browserSupportsWebAuthnInternals = { stubThis: (value) => value };
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js
+function toPublicKeyCredentialDescriptor(descriptor) {
+	const { id } = descriptor;
+	return {
+		...descriptor,
+		id: base64URLStringToBuffer(id),
+		transports: descriptor.transports
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js
+function isValidDomain(hostname) {
+	return hostname === "localhost" || /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js
+var WebAuthnError = class extends Error {
+	constructor({ message, code, cause, name }) {
+		super(message, { cause });
+		Object.defineProperty(this, "code", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+		this.name = name ?? cause.name;
+		this.code = code;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js
+function identifyRegistrationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Registration ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "ConstraintError") {
+		if (publicKey.authenticatorSelection?.requireResidentKey === true) return new WebAuthnError({
+			message: "Discoverable credentials were required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
+			cause: error
+		});
+		else if (options.mediation === "conditional" && publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required during automatic registration but it could not be performed",
+			code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
+			cause: error
+		});
+		else if (publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
+			cause: error
+		});
+	} else if (error.name === "InvalidStateError") return new WebAuthnError({
+		message: "The authenticator was previously registered",
+		code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
+		cause: error
+	});
+	else if (error.name === "NotAllowedError") return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "NotSupportedError") {
+		if (publicKey.pubKeyCredParams.filter((param) => param.type === "public-key").length === 0) return new WebAuthnError({
+			message: "No entry in pubKeyCredParams was of type \"public-key\"",
+			code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
+			cause: error
+		});
+		return new WebAuthnError({
+			message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
+			code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
+			cause: error
+		});
+	} else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rp.id !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rp.id}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "TypeError") {
+		if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) return new WebAuthnError({
+			message: "User ID was not between 1 and 64 characters",
+			code: "ERROR_INVALID_USER_ID_LENGTH",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new credential",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js
+var BaseWebAuthnAbortService = class {
+	constructor() {
+		Object.defineProperty(this, "controller", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+	}
+	createNewAbortSignal() {
+		if (this.controller) {
+			const abortError = new Error("Cancelling existing WebAuthn API call for new one");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+		}
+		const newController = new AbortController();
+		this.controller = newController;
+		return newController.signal;
+	}
+	cancelCeremony() {
+		if (this.controller) {
+			const abortError = new Error("Manually cancelling existing WebAuthn API call");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+			this.controller = void 0;
+		}
+	}
+};
+const WebAuthnAbortService = new BaseWebAuthnAbortService();
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js
+const attachments = ["cross-platform", "platform"];
+function toAuthenticatorAttachment(attachment) {
+	if (!attachment) return;
+	if (attachments.indexOf(attachment) < 0) return;
+	return attachment;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js
+async function startRegistration(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useAutoRegister = false } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		user: {
+			...optionsJSON.user,
+			id: base64URLStringToBuffer(optionsJSON.user.id)
+		},
+		excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor)
+	};
+	const createOptions = {};
+	if (useAutoRegister) createOptions.mediation = "conditional";
+	createOptions.publicKey = publicKey;
+	createOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.create(createOptions);
+	} catch (err) {
+		throw identifyRegistrationError({
+			error: err,
+			options: createOptions
+		});
+	}
+	if (!credential) throw new Error("Registration was not completed");
+	const { id, rawId, response, type } = credential;
+	let transports = void 0;
+	if (typeof response.getTransports === "function") transports = response.getTransports();
+	let responsePublicKeyAlgorithm = void 0;
+	if (typeof response.getPublicKeyAlgorithm === "function") try {
+		responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKeyAlgorithm()", error);
+	}
+	let responsePublicKey = void 0;
+	if (typeof response.getPublicKey === "function") try {
+		const _publicKey = response.getPublicKey();
+		if (_publicKey !== null) responsePublicKey = bufferToBase64URLString(_publicKey);
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKey()", error);
+	}
+	let responseAuthenticatorData;
+	if (typeof response.getAuthenticatorData === "function") try {
+		responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());
+	} catch (error) {
+		warnOnBrokenImplementation("getAuthenticatorData()", error);
+	}
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			attestationObject: bufferToBase64URLString(response.attestationObject),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			transports,
+			publicKeyAlgorithm: responsePublicKeyAlgorithm,
+			publicKey: responsePublicKey,
+			authenticatorData: responseAuthenticatorData
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+function warnOnBrokenImplementation(methodName, cause) {
+	console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\n`, cause);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js
+function browserSupportsWebAuthnAutofill() {
+	if (!browserSupportsWebAuthn()) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	const globalPublicKeyCredential = globalThis.PublicKeyCredential;
+	if (globalPublicKeyCredential?.isConditionalMediationAvailable === void 0) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());
+}
+const _browserSupportsWebAuthnAutofillInternals = { stubThis: (value) => value };
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js
+function identifyAuthenticationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Authentication ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "NotAllowedError") return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rpId !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rpId}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js
+async function startAuthentication(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	let allowCredentials;
+	if (optionsJSON.allowCredentials?.length !== 0) allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		allowCredentials
+	};
+	const getOptions = {};
+	if (useBrowserAutofill) {
+		if (!await browserSupportsWebAuthnAutofill()) throw Error("Browser does not support WebAuthn autofill");
+		if (document.querySelectorAll("input[autocomplete$='webauthn']").length < 1 && verifyBrowserAutofillInput) throw Error("No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected");
+		getOptions.mediation = "conditional";
+		publicKey.allowCredentials = [];
+	}
+	getOptions.publicKey = publicKey;
+	getOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.get(getOptions);
+	} catch (err) {
+		throw identifyAuthenticationError({
+			error: err,
+			options: getOptions
+		});
+	}
+	if (!credential) throw new Error("Authentication was not completed");
+	const { id, rawId, response, type } = credential;
+	let userHandle = void 0;
+	if (response.userHandle) userHandle = bufferToBase64URLString(response.userHandle);
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			authenticatorData: bufferToBase64URLString(response.authenticatorData),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			signature: bufferToBase64URLString(response.signature),
+			userHandle
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/client.mjs
+const getPasskeyActions = ($fetch, { $listPasskeys, $store }) => {
+	const signInPasskey = async (opts, options) => {
+		const response = await $fetch("/passkey/generate-authenticate-options", {
+			method: "GET",
+			throw: false
+		});
+		if (!response.data) return response;
+		const mergedExtensions = response.data.extensions || opts?.extensions ? {
+			...response.data.extensions || {},
+			...opts?.extensions || {}
+		} : void 0;
+		let res;
+		try {
+			res = await startAuthentication({
+				optionsJSON: {
+					...response.data,
+					extensions: mergedExtensions
+				},
+				useBrowserAutofill: opts?.autoFill
+			});
+		} catch (err) {
+			return {
+				data: null,
+				error: {
+					code: err instanceof WebAuthnError ? err.code : "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+		try {
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-authentication", {
+				body: { response: responseBody },
+				...opts?.fetchOptions,
+				...options,
+				method: "POST",
+				throw: false
+			});
+			$listPasskeys.set(Math.random());
+			$store.notify("$sessionSignal");
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (err) {
+			console.error(`[Better Auth] Error verifying passkey`, err);
+			return {
+				data: null,
+				error: {
+					code: "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+	};
+	const registerPasskey = async (opts, fetchOpts) => {
+		const options = await $fetch("/passkey/generate-register-options", {
+			method: "GET",
+			query: {
+				...opts?.authenticatorAttachment && { authenticatorAttachment: opts.authenticatorAttachment },
+				...opts?.name && { name: opts.name },
+				...opts?.context && { context: opts.context }
+			},
+			throw: false
+		});
+		if (!options.data) return options;
+		try {
+			const mergedExtensions = options.data.extensions || opts?.extensions ? {
+				...options.data.extensions || {},
+				...opts?.extensions || {}
+			} : void 0;
+			const res = await startRegistration({
+				optionsJSON: {
+					...options.data,
+					extensions: mergedExtensions
+				},
+				useAutoRegister: opts?.useAutoRegister
+			});
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-registration", {
+				...opts?.fetchOptions,
+				...fetchOpts,
+				body: {
+					response: responseBody,
+					name: opts?.name
+				},
+				method: "POST",
+				throw: false
+			});
+			if (!verified.data) return verified;
+			$listPasskeys.set(Math.random());
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (e) {
+			if (e instanceof WebAuthnError) {
+				if (e.code === "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.PREVIOUSLY_REGISTERED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				if (e.code === "ERROR_CEREMONY_ABORTED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.REGISTRATION_CANCELLED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				return {
+					data: null,
+					error: {
+						code: e.code,
+						message: e.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+			}
+			return {
+				data: null,
+				error: {
+					code: "UNKNOWN_ERROR",
+					message: e instanceof Error ? e.message : PASSKEY_ERROR_CODES.UNKNOWN_ERROR.message,
+					status: 500,
+					statusText: "INTERNAL_SERVER_ERROR"
+				}
+			};
+		}
+	};
+	return {
+		signIn: { passkey: signInPasskey },
+		passkey: { addPasskey: registerPasskey },
+		$Infer: {}
+	};
+};
+const passkeyClient = () => {
+	const $listPasskeys = atom();
+	return {
+		id: "passkey",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		getActions: ($fetch, $store) => getPasskeyActions($fetch, {
+			$listPasskeys,
+			$store
+		}),
+		getAtoms($fetch) {
+			return {
+				listPasskeys: useAuthQuery($listPasskeys, "/passkey/list-user-passkeys", $fetch, { method: "GET" }),
+				$listPasskeys
+			};
+		},
+		pathMethods: {
+			"/passkey/register": "POST",
+			"/passkey/authenticate": "POST"
+		},
+		atomListeners: [{
+			matcher(path) {
+				return path === "/passkey/verify-registration" || path === "/passkey/delete-passkey" || path === "/passkey/update-passkey" || path === "/sign-out";
+			},
+			signal: "$listPasskeys"
+		}, {
+			matcher: (path) => path === "/passkey/verify-authentication",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: PASSKEY_ERROR_CODES
+	};
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_dfcdb59639d9fe73412dad0223379a88/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -1895,6 +2551,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {
@@ -2639,6 +3298,90 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
+	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
+	if (!Array.isArray(value.requestedRoles) || value.requestedRoles.length < 1 || value.requestedRoles.length > 2 || value.requestedRoles.some((role) => role !== "administrator" && role !== "investigator") || new Set(value.requestedRoles).size !== value.requestedRoles.length) throw new TypeError("requestedRoles is invalid");
+	for (const field of ["expectedTargetRevision", "expectedGlobalRevision"]) if (!Number.isSafeInteger(value[field]) || value[field] < 0 || value[field] >= Number.MAX_SAFE_INTEGER) throw new TypeError(`${field} is invalid`);
+	if (!(typeof value.reasonCategory === "string" && [
+		"initial_bootstrap",
+		"personnel_change",
+		"privilege_review",
+		"quorum_recovery",
+		"security_response"
+	].includes(value.reasonCategory))) throw new TypeError("reasonCategory is invalid");
+	for (const field of ["changeReference", "idempotencyKey"]) if (typeof value[field] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value[field])) throw new TypeError(`${field} is invalid`);
+	return {
+		action: "platform_role_change",
+		targetUserId: value.targetUserId,
+		requestedRoles: [...value.requestedRoles].sort(),
+		expectedTargetRevision: value.expectedTargetRevision,
+		expectedGlobalRevision: value.expectedGlobalRevision,
+		reasonCategory: value.reasonCategory,
+		changeReference: value.changeReference,
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizePlatformBootstrapRoleChangeInput(value) {
+	const request = normalizePlatformRoleChangeRecentAuthenticationInput(value);
+	if (request.reasonCategory !== "initial_bootstrap" || !request.requestedRoles.includes("administrator")) throw new TypeError("platform first approval input is invalid");
+	return request;
+}
+function normalizePlatformRoleApproval(value) {
+	exact(value, [
+		"status",
+		"targetUserId",
+		"targetRevision",
+		"globalRevision",
+		"roles"
+	]);
+	if (value.status !== "awaiting_second_approval" && value.status !== "applied" || !isId(value.targetUserId)) throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.targetRevision) || value.targetRevision < 0) throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.globalRevision) || value.globalRevision < 0) throw authorityUnavailable();
+	if (!Array.isArray(value.roles) || value.status === "awaiting_second_approval" && value.roles.length !== 0 || value.status === "applied" && !(value.roles.length === 1 && value.roles[0] === "administrator" || value.roles.length === 2 && value.roles[0] === "administrator" && value.roles[1] === "investigator")) throw authorityUnavailable();
+	if (value.status === "applied") return {
+		status: "applied",
+		targetUserId: value.targetUserId,
+		targetRevision: value.targetRevision,
+		globalRevision: value.globalRevision,
+		roles: value.roles
+	};
+	return {
+		status: "awaiting_second_approval",
+		targetUserId: value.targetUserId,
+		targetRevision: value.targetRevision,
+		globalRevision: value.globalRevision,
+		roles: []
+	};
+}
+function normalizeRecentAuthenticationStatus(value) {
+	exact(value, ["status"]);
+	if (value.status !== "pending" && value.status !== "ready") throw authorityUnavailable();
+	return { status: value.status };
+}
+function fromRecentAuthenticationError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+function fromPlatformAdministrationError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 400 && code === "BAD_REQUEST") return new AuthError("invalid_request", 400);
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && code === "FORBIDDEN") return new AuthError("access_denied", 403);
+	if (status === 404 && code === "NOT_FOUND") return new AuthError("platform_target_unavailable", 404);
+	if (status === 409 && code === "CONFLICT") return new AuthError("state_conflict", 409);
+	if (status === 409 && code === "QUORUM_UNAVAILABLE") return new AuthError("platform_quorum_unavailable", 409);
+	if (status === 413 && code === "REQUEST_TOO_LONG") return new AuthError("invalid_request", 413);
+	if (status === 415 && code === "UNSUPPORTED_MEDIA_TYPE") return new AuthError("invalid_request", 415);
+	if (status === 422 && code === "RECOVERY_REQUIRED") return new AuthError("platform_recovery_required", 422);
+	if (status === 429 && code === "RATE_LIMITED") return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 503 && code === "SERVICE_UNAVAILABLE") return authorityUnavailable();
+	return authorityUnavailable();
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -3580,6 +4323,8 @@ function byteLength(value) {
 //#endregion
 //#region src/client.ts
 const REFRESH_WINDOW_MS = 120 * 1e3;
+const RECENT_AUTHENTICATION_BROWSER_HEADER = "x-finueva-recent-auth-browser";
+const RECENT_AUTHENTICATION_REQUEST_HEADER = "x-finueva-recent-auth-request";
 function createAuthClient(options) {
 	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
 	const appOrigin = normalizeOrigin(options.appOrigin, "appOrigin");
@@ -3596,7 +4341,8 @@ function createAuthClient(options) {
 			credentials: "include",
 			retry: 0,
 			timeout: timeoutMs
-		}
+		},
+		plugins: [passkeyClient()]
 	});
 	const persistence = createSessionPersistence(options.persistence, authOrigin, now, timeoutMs);
 	const authStateListeners = new Set();
@@ -3608,6 +4354,9 @@ function createAuthClient(options) {
 	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
 	let authorityGeneration = 0;
+	let recentAuthenticationBrowserToken;
+	let recentAuthenticationStartAttempt;
+	let recentAuthenticationStartRequest;
 	let sessionReadEpoch = 0;
 	let activeAccountMutationGeneration;
 	let invitationAbort;
@@ -3621,6 +4370,10 @@ function createAuthClient(options) {
 	let signalRefreshPending = false;
 	let signalRefreshScheduled = false;
 	let signalRefreshRequest;
+	function advanceAuthorityGeneration() {
+		recentAuthenticationStartAttempt = void 0;
+		return ++authorityGeneration;
+	}
 	function setAuthState(state) {
 		authState = state;
 		for (const listener of authStateListeners) try {
@@ -3726,7 +4479,9 @@ function createAuthClient(options) {
 	}
 	function updateSession(session) {
 		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
+		const changedSession = !session || sessionId !== void 0 && (session.id !== sessionId || session.user.id !== sessionUserId);
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
 		sessionId = session?.id;
 		sessionUserId = session?.user.id;
 		return session;
@@ -3755,10 +4510,10 @@ function createAuthClient(options) {
 	}
 	function signOut() {
 		if (signOutRequest) return signOutRequest;
-		if (activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
+		if (activeAccountMutationGeneration !== void 0 || recentAuthenticationStartRequest) return Promise.reject(new AuthError("state_conflict", 409));
 		const pendingInvitation = invitationRequest;
 		invitationAbort?.abort();
-		const generation = ++authorityGeneration;
+		const generation = advanceAuthorityGeneration();
 		sessionReadEpoch += 1;
 		clearCredential();
 		sessionId = void 0;
@@ -3803,10 +4558,10 @@ function createAuthClient(options) {
 		return request;
 	}
 	async function runAccountMutation(operation) {
-		if (signOutRequest || activeAccountMutationGeneration !== void 0) throw new AuthError("state_conflict", 409);
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
 		const pendingInvitation = invitationRequest;
 		invitationAbort?.abort();
-		const generation = ++authorityGeneration;
+		const generation = advanceAuthorityGeneration();
 		sessionReadEpoch += 1;
 		activeAccountMutationGeneration = generation;
 		clearCredential();
@@ -3873,8 +4628,101 @@ function createAuthClient(options) {
 			throw error;
 		}
 	}
+	function assertRecentAuthenticationOrigin() {
+		if (appOrigin !== authOrigin) throw new TypeError("recent authentication requires the exact Auth Origin");
+	}
 	return {
 		_type: "browser",
+		async startPlatformRoleChangeRecentAuthentication(input) {
+			assertRecentAuthenticationOrigin();
+			const body = normalizePlatformRoleChangeRecentAuthenticationInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			recentAuthenticationBrowserToken ??= createOpaqueToken();
+			const normalizedInput = JSON.stringify(body);
+			const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
+				input: normalizedInput,
+				requestToken: createOpaqueToken(),
+				sessionId,
+				userId: sessionUserId
+			};
+			recentAuthenticationStartAttempt = attempt;
+			const request = (async () => {
+				try {
+					const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
+						fetch: fetchImpl,
+						timeoutMs,
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
+							[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
+						},
+						body,
+						mapError: fromRecentAuthenticationError
+					});
+					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+					const status = normalizeRecentAuthenticationStatus(value);
+					if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
+					return status;
+				} catch (error) {
+					if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
+					throw error;
+				}
+			})();
+			recentAuthenticationStartRequest = request;
+			try {
+				return await request;
+			} finally {
+				if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
+			}
+		},
+		async approveBootstrapPlatformRoleChange(input) {
+			assertRecentAuthenticationOrigin();
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const body = normalizePlatformBootstrapRoleChangeInput(input);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/platform/role-approvals"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromPlatformAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizePlatformRoleApproval(value);
+		},
+		async verifyRecentAuthenticationWithPasskey() {
+			assertRecentAuthenticationOrigin();
+			if (!(await runAccountMutation(async () => {
+				const verification = await betterAuth.signIn.passkey({ autoFill: false });
+				if (verification.error) throw fromRecentAuthenticationError(void 0, verification.error.status);
+			})).session) throw new AuthError("authentication_required", 401);
+		},
+		async addPasskey() {
+			assertRecentAuthenticationOrigin();
+			if (!(await runAccountMutation(async () => {
+				const registration = await betterAuth.passkey.addPasskey({ context: createOpaqueToken() });
+				if (registration.error) throw fromAccountAuthorityError(registration.error, registration.error.status);
+			})).session) throw new AuthError("authentication_required", 401);
+		},
+		async getRecentAuthenticationStatus() {
+			assertRecentAuthenticationOrigin();
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication/status"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {},
+				mapError: fromRecentAuthenticationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeRecentAuthenticationStatus(value);
+		},
 		acceptInvitation(input) {
 			let invitation;
 			try {
@@ -3882,8 +4730,8 @@ function createAuthClient(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
-			const generation = ++authorityGeneration;
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest || recentAuthenticationStartRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			const generation = advanceAuthorityGeneration();
 			const controller = new AbortController();
 			clearCredential();
 			const request = (async () => {
@@ -4138,5 +4986,12 @@ function createAuthClient(options) {
 		}
 	};
 }
+function createOpaqueToken() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return globalThis.btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
 //#endregion
 export { AuthError, createAuthClient };

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;

package/dist/server.js

@@ -192,6 +192,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {

package/dist/{types-Byw9JQwL.d.ts → types-BqpgLkQB.d.ts}

@@ -1,6 +1,6 @@
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
-type AuthErrorStatus = 400 | 401 | 403 | 409 | 422 | 429 | 503;
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorStatus = 400 | 401 | 403 | 404 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;
@@ -193,6 +193,38 @@ interface DriveCredentialInput {
   workspace: WorkspaceSelection;
   forceRefresh?: boolean;
 }
+type PlatformRole = "administrator" | "investigator";
+interface PlatformRoleChangeRecentAuthenticationInput {
+  targetUserId: string;
+  requestedRoles: PlatformRole[];
+  expectedTargetRevision: number;
+  expectedGlobalRevision: number;
+  reasonCategory: "initial_bootstrap" | "personnel_change" | "privilege_review" | "quorum_recovery" | "security_response";
+  changeReference: string;
+  idempotencyKey: string;
+}
+interface PlatformBootstrapRoleChangeInput extends Omit<PlatformRoleChangeRecentAuthenticationInput, "reasonCategory" | "requestedRoles"> {
+  requestedRoles: ["administrator"] | ["administrator", "investigator"] | ["investigator", "administrator"];
+  reasonCategory: "initial_bootstrap";
+}
+interface PlatformRoleFirstApproval {
+  status: "awaiting_second_approval";
+  targetUserId: string;
+  targetRevision: number;
+  globalRevision: number;
+  roles: [];
+}
+interface PlatformRoleApplied {
+  status: "applied";
+  targetUserId: string;
+  targetRevision: number;
+  globalRevision: number;
+  roles: PlatformRole[];
+}
+type PlatformRoleApproval = PlatformRoleFirstApproval | PlatformRoleApplied;
+interface RecentAuthenticationStatus {
+  status: "pending" | "ready";
+}
 interface AuthClientOptions {
   authOrigin: string;
   appOrigin: string;
@@ -203,6 +235,11 @@ interface AuthClientOptions {
 }
 interface FinuevaAuthClient {
   readonly _type: "browser";
+  startPlatformRoleChangeRecentAuthentication(input: PlatformRoleChangeRecentAuthenticationInput): Promise<RecentAuthenticationStatus>;
+  approveBootstrapPlatformRoleChange(input: PlatformBootstrapRoleChangeInput): Promise<PlatformRoleApproval>;
+  addPasskey(): Promise<void>;
+  verifyRecentAuthenticationWithPasskey(): Promise<void>;
+  getRecentAuthenticationStatus(): Promise<RecentAuthenticationStatus>;
   acceptInvitation(input: AcceptInvitationInput): Promise<InvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
@@ -232,4 +269,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { ReceivedOrganizationInvitationPage as A, AuthErrorCode as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, UpdateOrganizationDisplayInput as F, UpdateOrganizationTeamDisplayInput as I, UpdateProfileInput as L, SignInInput as M, SocialIdTokenInput as N, PersonalWorkspaceSelection as O, SocialIdTokenProvider as P, WorkspaceSelection as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, AuthErrorStatus as V, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, SendVerificationEmailInput as j, ReceivedOrganizationInvitation as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, AuthError as z };
+export { PlatformRole as A, SocialIdTokenInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, ReceivedOrganizationInvitation as F, WorkspaceSelection as G, UpdateOrganizationDisplayInput as H, ReceivedOrganizationInvitationPage as I, AuthErrorStatus as J, AuthError as K, RecentAuthenticationStatus as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, SendVerificationEmailInput as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationTeamDisplayInput as U, SocialIdTokenProvider as V, UpdateProfileInput as W, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthErrorCode as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SignInInput as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -49,7 +49,9 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@chiballc/utils": "2.5.0",
+    "@better-auth/core": "1.6.22",
+    "@better-auth/passkey": "1.6.22",
+    "@chiballc/utils": "2.5.1",
     "@types/node": "24.13.3",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.10",