@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.20

package/dist/client.d.ts

@@ -1,2 +1,93 @@
+import { authApi } from '@spfn/auth';
 
-export {  }
+/**
+ * @spfn/auth/client - Passkeys (WebAuthn)
+ *
+ * Four browser helpers over the two ceremonies. Each one is `options` from the
+ * server, `navigator.credentials` in the browser, `verify` back to the server —
+ * and each answers with a discriminated union instead of throwing.
+ *
+ * That is the whole point of this file. A person closing the system passkey
+ * sheet raises `NotAllowedError`, and so does a person whose authenticator has
+ * nothing to offer; neither is an application error, and code that has to tell
+ * them apart by catching and re-reading `error.name` gets it wrong once and
+ * shows a red banner to someone who simply changed their mind.
+ *
+ * Ships to browsers: no Node built-ins here, `Buffer` included. The base64url
+ * helpers come from `@simplewebauthn/browser`, which is bundled into this entry.
+ */
+
+/** The typed auth client these helpers drive. */
+type AuthApi = typeof authApi;
+/**
+ * Why a ceremony did not produce a session.
+ *
+ * - `unsupported`: this browser has no WebAuthn at all
+ * - `cancelled`: the person dismissed the prompt
+ * - `no-credential`: the authenticator had nothing for this relying party
+ * - `error`: anything else, with the original error attached
+ */
+type PasskeyFailureReason = 'unsupported' | 'cancelled' | 'no-credential' | 'error';
+type PasskeyResult<T> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    reason: PasskeyFailureReason;
+    error?: unknown;
+};
+/** Whether this browser can run a WebAuthn ceremony at all. */
+declare function isPasskeySupported(): boolean;
+/**
+ * Whether the browser can offer passkeys inside the ordinary autofill dropdown.
+ *
+ * Worth checking before rendering a sign-in form: conditional mediation is what
+ * turns a passkey into "tap the suggestion above the keyboard", and where it is
+ * missing the form needs a visible "Sign in with a passkey" button instead.
+ */
+declare function isConditionalMediationAvailable(): Promise<boolean>;
+interface EnrollPasskeyOptions {
+    /** Owner-facing name for the passkey list, e.g. the device model. */
+    label?: string;
+    /** Sent when the session proved itself longer ago than the recent-auth window. */
+    currentPassword?: string;
+}
+interface EnrollPasskeyValue {
+    passkeyId: string;
+    label: string | null;
+    createdAt: string;
+}
+/**
+ * Enroll a passkey on the device in front of the user.
+ *
+ * Requires a signed-in session. A 403 with code `RECENT_AUTH_REQUIRED` from the
+ * options call means the caller should prompt for the password and try again
+ * with `currentPassword`; that is a rejected promise, not a result here, because
+ * it is the server declining rather than the ceremony failing.
+ */
+declare function enrollPasskey(api: AuthApi, options?: EnrollPasskeyOptions): Promise<PasskeyResult<EnrollPasskeyValue>>;
+interface SignInWithPasskeyOptions {
+    /**
+     * Offer the passkey through the browser's autofill dropdown instead of a
+     * modal. Needs an `<input autocomplete="username webauthn">` on the page.
+     */
+    conditional?: boolean;
+    deviceName?: string;
+    platform?: string;
+}
+interface SignInWithPasskeyValue {
+    userId: string;
+    publicId: string;
+    email?: string;
+    phone?: string;
+    passwordChangeRequired: boolean;
+}
+/**
+ * Sign in with a passkey, no identifier asked for.
+ *
+ * The device key the session runs on is generated and stored by the Next.js
+ * proxy interceptor, exactly as on a password login — nothing here handles a
+ * private key.
+ */
+declare function signInWithPasskey(api: AuthApi, options?: SignInWithPasskeyOptions): Promise<PasskeyResult<SignInWithPasskeyValue>>;
+
+export { type AuthApi, type EnrollPasskeyOptions, type EnrollPasskeyValue, type PasskeyFailureReason, type PasskeyResult, type SignInWithPasskeyOptions, type SignInWithPasskeyValue, enrollPasskey, isConditionalMediationAvailable, isPasskeySupported, signInWithPasskey };

package/dist/client.js

@@ -1 +1,59 @@
+// src/client/passkeys.ts
+import {
+  browserSupportsWebAuthn,
+  browserSupportsWebAuthnAutofill,
+  startAuthentication,
+  startRegistration
+} from "@simplewebauthn/browser";
+function isPasskeySupported() {
+  return browserSupportsWebAuthn();
+}
+async function isConditionalMediationAvailable() {
+  return await browserSupportsWebAuthnAutofill();
+}
+function failureReason(error, whenNotAllowed) {
+  return error?.name === "NotAllowedError" ? whenNotAllowed : "error";
+}
+async function enrollPasskey(api, options = {}) {
+  if (!isPasskeySupported()) {
+    return { ok: false, reason: "unsupported" };
+  }
+  const optionsJSON = await api.passkeyRegisterOptions.call({
+    body: { currentPassword: options.currentPassword }
+  });
+  let response;
+  try {
+    response = await startRegistration({ optionsJSON });
+  } catch (error) {
+    return { ok: false, reason: failureReason(error, "cancelled"), error };
+  }
+  const enrolled = await api.passkeyRegisterVerify.call({
+    body: { response, label: options.label }
+  });
+  return { ok: true, ...enrolled };
+}
+async function signInWithPasskey(api, options = {}) {
+  if (!isPasskeySupported()) {
+    return { ok: false, reason: "unsupported" };
+  }
+  const optionsJSON = await api.passkeyLoginOptions.call({
+    body: {}
+  });
+  let response;
+  try {
+    response = await startAuthentication({ optionsJSON, useBrowserAutofill: options.conditional === true });
+  } catch (error) {
+    return { ok: false, reason: failureReason(error, "no-credential"), error };
+  }
+  const session = await api.passkeyLoginVerify.call({
+    body: { response }
+  });
+  return { ok: true, ...session };
+}
+export {
+  enrollPasskey,
+  isConditionalMediationAvailable,
+  isPasskeySupported,
+  signInWithPasskey
+};
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":["../src/client/passkeys.ts"],"sourcesContent":["/**\n * @spfn/auth/client - Passkeys (WebAuthn)\n *\n * Four browser helpers over the two ceremonies. Each one is `options` from the\n * server, `navigator.credentials` in the browser, `verify` back to the server —\n * and each answers with a discriminated union instead of throwing.\n *\n * That is the whole point of this file. A person closing the system passkey\n * sheet raises `NotAllowedError`, and so does a person whose authenticator has\n * nothing to offer; neither is an application error, and code that has to tell\n * them apart by catching and re-reading `error.name` gets it wrong once and\n * shows a red banner to someone who simply changed their mind.\n *\n * Ships to browsers: no Node built-ins here, `Buffer` included. The base64url\n * helpers come from `@simplewebauthn/browser`, which is bundled into this entry.\n */\n\nimport {\n    browserSupportsWebAuthn,\n    browserSupportsWebAuthnAutofill,\n    startAuthentication,\n    startRegistration,\n    type AuthenticationResponseJSON,\n    type PublicKeyCredentialCreationOptionsJSON,\n    type PublicKeyCredentialRequestOptionsJSON,\n    type RegistrationResponseJSON,\n} from '@simplewebauthn/browser';\n\nimport type { authApi } from '@spfn/auth';\n\n/** The typed auth client these helpers drive. */\nexport type AuthApi = typeof authApi;\n\n/**\n * Why a ceremony did not produce a session.\n *\n * - `unsupported`: this browser has no WebAuthn at all\n * - `cancelled`: the person dismissed the prompt\n * - `no-credential`: the authenticator had nothing for this relying party\n * - `error`: anything else, with the original error attached\n */\nexport type PasskeyFailureReason = 'unsupported' | 'cancelled' | 'no-credential' | 'error';\n\nexport type PasskeyResult<T> =\n    | ({ ok: true } & T)\n    | { ok: false; reason: PasskeyFailureReason; error?: unknown };\n\n/** Whether this browser can run a WebAuthn ceremony at all. */\nexport function isPasskeySupported(): boolean\n{\n    return browserSupportsWebAuthn();\n}\n\n/**\n * Whether the browser can offer passkeys inside the ordinary autofill dropdown.\n *\n * Worth checking before rendering a sign-in form: conditional mediation is what\n * turns a passkey into \"tap the suggestion above the keyboard\", and where it is\n * missing the form needs a visible \"Sign in with a passkey\" button instead.\n */\nexport async function isConditionalMediationAvailable(): Promise<boolean>\n{\n    return await browserSupportsWebAuthnAutofill();\n}\n\n/**\n * The reason a ceremony failure should be reported as.\n *\n * `NotAllowedError` is the browser's answer both to \"the person said no\" and to\n * \"nothing here matched\", and the specification deliberately does not\n * distinguish them — telling a caller which applied would say whether a\n * credential for this site exists on the device. So it is `cancelled` in both\n * cases on registration, and `no-credential` on a sign-in that offered no\n * credentials to choose from, which is the reading a UI wants.\n */\nfunction failureReason(error: unknown, whenNotAllowed: PasskeyFailureReason): PasskeyFailureReason\n{\n    return (error as { name?: string } | null)?.name === 'NotAllowedError' ? whenNotAllowed : 'error';\n}\n\nexport interface EnrollPasskeyOptions\n{\n    /** Owner-facing name for the passkey list, e.g. the device model. */\n    label?: string;\n    /** Sent when the session proved itself longer ago than the recent-auth window. */\n    currentPassword?: string;\n}\n\nexport interface EnrollPasskeyValue\n{\n    passkeyId: string;\n    label: string | null;\n    createdAt: string;\n}\n\n/**\n * Enroll a passkey on the device in front of the user.\n *\n * Requires a signed-in session. A 403 with code `RECENT_AUTH_REQUIRED` from the\n * options call means the caller should prompt for the password and try again\n * with `currentPassword`; that is a rejected promise, not a result here, because\n * it is the server declining rather than the ceremony failing.\n */\nexport async function enrollPasskey(\n    api: AuthApi,\n    options: EnrollPasskeyOptions = {},\n): Promise<PasskeyResult<EnrollPasskeyValue>>\n{\n    if (!isPasskeySupported())\n    {\n        return { ok: false, reason: 'unsupported' };\n    }\n\n    const optionsJSON = await api.passkeyRegisterOptions.call({\n        body: { currentPassword: options.currentPassword },\n    }) as PublicKeyCredentialCreationOptionsJSON;\n\n    let response: RegistrationResponseJSON;\n\n    try\n    {\n        response = await startRegistration({ optionsJSON });\n    }\n    catch (error)\n    {\n        return { ok: false, reason: failureReason(error, 'cancelled'), error };\n    }\n\n    const enrolled = await api.passkeyRegisterVerify.call({\n        body: { response, label: options.label },\n    }) as EnrollPasskeyValue;\n\n    return { ok: true, ...enrolled };\n}\n\nexport interface SignInWithPasskeyOptions\n{\n    /**\n     * Offer the passkey through the browser's autofill dropdown instead of a\n     * modal. Needs an `<input autocomplete=\"username webauthn\">` on the page.\n     */\n    conditional?: boolean;\n    deviceName?: string;\n    platform?: string;\n}\n\nexport interface SignInWithPasskeyValue\n{\n    userId: string;\n    publicId: string;\n    email?: string;\n    phone?: string;\n    passwordChangeRequired: boolean;\n}\n\n/**\n * Sign in with a passkey, no identifier asked for.\n *\n * The device key the session runs on is generated and stored by the Next.js\n * proxy interceptor, exactly as on a password login — nothing here handles a\n * private key.\n */\nexport async function signInWithPasskey(\n    api: AuthApi,\n    options: SignInWithPasskeyOptions = {},\n): Promise<PasskeyResult<SignInWithPasskeyValue>>\n{\n    if (!isPasskeySupported())\n    {\n        return { ok: false, reason: 'unsupported' };\n    }\n\n    const optionsJSON = await api.passkeyLoginOptions.call({\n        body: {},\n    }) as PublicKeyCredentialRequestOptionsJSON;\n\n    let response: AuthenticationResponseJSON;\n\n    try\n    {\n        response = await startAuthentication({ optionsJSON, useBrowserAutofill: options.conditional === true });\n    }\n    catch (error)\n    {\n        return { ok: false, reason: failureReason(error, 'no-credential'), error };\n    }\n\n    const session = await api.passkeyLoginVerify.call({\n        body: { response },\n    }) as SignInWithPasskeyValue;\n\n    return { ok: true, ...session };\n}\n"],"mappings":";AAiBA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKG;AAsBA,SAAS,qBAChB;AACI,SAAO,wBAAwB;AACnC;AASA,eAAsB,kCACtB;AACI,SAAO,MAAM,gCAAgC;AACjD;AAYA,SAAS,cAAc,OAAgB,gBACvC;AACI,SAAQ,OAAoC,SAAS,oBAAoB,iBAAiB;AAC9F;AAyBA,eAAsB,cAClB,KACA,UAAgC,CAAC,GAErC;AACI,MAAI,CAAC,mBAAmB,GACxB;AACI,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc;AAAA,EAC9C;AAEA,QAAM,cAAc,MAAM,IAAI,uBAAuB,KAAK;AAAA,IACtD,MAAM,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,EACrD,CAAC;AAED,MAAI;AAEJ,MACA;AACI,eAAW,MAAM,kBAAkB,EAAE,YAAY,CAAC;AAAA,EACtD,SACO,OACP;AACI,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,OAAO,WAAW,GAAG,MAAM;AAAA,EACzE;AAEA,QAAM,WAAW,MAAM,IAAI,sBAAsB,KAAK;AAAA,IAClD,MAAM,EAAE,UAAU,OAAO,QAAQ,MAAM;AAAA,EAC3C,CAAC;AAED,SAAO,EAAE,IAAI,MAAM,GAAG,SAAS;AACnC;AA6BA,eAAsB,kBAClB,KACA,UAAoC,CAAC,GAEzC;AACI,MAAI,CAAC,mBAAmB,GACxB;AACI,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc;AAAA,EAC9C;AAEA,QAAM,cAAc,MAAM,IAAI,oBAAoB,KAAK;AAAA,IACnD,MAAM,CAAC;AAAA,EACX,CAAC;AAED,MAAI;AAEJ,MACA;AACI,eAAW,MAAM,oBAAoB,EAAE,aAAa,oBAAoB,QAAQ,gBAAgB,KAAK,CAAC;AAAA,EAC1G,SACO,OACP;AACI,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,OAAO,eAAe,GAAG,MAAM;AAAA,EAC7E;AAEA,QAAM,UAAU,MAAM,IAAI,mBAAmB,KAAK;AAAA,IAC9C,MAAM,EAAE,SAAS;AAAA,EACrB,CAAC;AAED,SAAO,EAAE,IAAI,MAAM,GAAG,QAAQ;AAClC;","names":[]}

package/dist/config.d.ts

@@ -80,6 +80,16 @@ declare const authEnvSchema: {
     } & {
         key: "SPFN_AUTH_COOKIE_SECURE";
     };
+    SPFN_AUTH_CSRF: {
+        description: string;
+        required: boolean;
+        nextjs: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_CSRF";
+    };
     SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
         key: string;
         description: string;
@@ -195,6 +205,138 @@ declare const authEnvSchema: {
     } & {
         key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
     };
+    SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_CONFIRM_PATH";
+    };
+    SPFN_AUTH_PASSWORD_RESET_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_PASSWORD_RESET_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_PASSWORD_RESET_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_CONFIRM_PATH";
+    };
+    SPFN_AUTH_LINK_MAIL_DELIVERY: {
+        description: string;
+        default?: "auto" | "inline" | "queued" | undefined;
+        examples?: ("auto" | "inline" | "queued")[] | undefined;
+        minLength?: number | undefined;
+        required?: boolean | undefined;
+        fallbackKeys?: string[] | undefined;
+        sensitive?: boolean | undefined;
+        generate?: "hex32" | "hex64" | "uuid" | "base64url32" | undefined;
+        nextjs?: boolean | undefined;
+        type: "enum";
+        validator: (val: string) => "auto" | "inline" | "queued";
+    } & {
+        key: "SPFN_AUTH_LINK_MAIL_DELIVERY";
+    };
+    SPFN_AUTH_PASSKEY_RP_ID: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RP_ID";
+    };
+    SPFN_AUTH_PASSKEY_RP_NAME: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RP_NAME";
+    };
+    SPFN_AUTH_PASSKEY_ORIGINS: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_ORIGINS";
+    };
+    SPFN_AUTH_PASSKEY_USER_VERIFICATION: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_USER_VERIFICATION";
+    };
+    SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS";
+    };
+    SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;
@@ -382,6 +524,15 @@ declare const authEnvSchema: {
     } & {
         key: "SPFN_AUTH_GITHUB_REDIRECT_URI";
     };
+    SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK";
+    };
     SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS: {
         description: string;
         required: boolean;
@@ -494,6 +645,16 @@ declare const env: _spfn_core_env.InferEnvType<{
     } & {
         key: "SPFN_AUTH_COOKIE_SECURE";
     };
+    SPFN_AUTH_CSRF: {
+        description: string;
+        required: boolean;
+        nextjs: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_CSRF";
+    };
     SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
         key: string;
         description: string;
@@ -609,6 +770,138 @@ declare const env: _spfn_core_env.InferEnvType<{
     } & {
         key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
     };
+    SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_CONFIRM_PATH";
+    };
+    SPFN_AUTH_PASSWORD_RESET_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_PASSWORD_RESET_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_PASSWORD_RESET_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSWORD_RESET_CONFIRM_PATH";
+    };
+    SPFN_AUTH_LINK_MAIL_DELIVERY: {
+        description: string;
+        default?: "auto" | "inline" | "queued" | undefined;
+        examples?: ("auto" | "inline" | "queued")[] | undefined;
+        minLength?: number | undefined;
+        required?: boolean | undefined;
+        fallbackKeys?: string[] | undefined;
+        sensitive?: boolean | undefined;
+        generate?: "hex32" | "hex64" | "uuid" | "base64url32" | undefined;
+        nextjs?: boolean | undefined;
+        type: "enum";
+        validator: (val: string) => "auto" | "inline" | "queued";
+    } & {
+        key: "SPFN_AUTH_LINK_MAIL_DELIVERY";
+    };
+    SPFN_AUTH_PASSKEY_RP_ID: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RP_ID";
+    };
+    SPFN_AUTH_PASSKEY_RP_NAME: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RP_NAME";
+    };
+    SPFN_AUTH_PASSKEY_ORIGINS: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_ORIGINS";
+    };
+    SPFN_AUTH_PASSKEY_USER_VERIFICATION: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_USER_VERIFICATION";
+    };
+    SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS";
+    };
+    SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;
@@ -796,6 +1089,15 @@ declare const env: _spfn_core_env.InferEnvType<{
     } & {
         key: "SPFN_AUTH_GITHUB_REDIRECT_URI";
     };
+    SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK";
+    };
     SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS: {
         description: string;
         required: boolean;