faire-auth 1.0.0

package/dist/parser-CdncAl9i.cjs

@@ -0,0 +1,83 @@
+
+//#region src/client/parser.ts
+const PROTO_POLLUTION_PATTERNS = {
+	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
+	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
+	protoShort: /"__proto__"\s*:/,
+	constructorShort: /"constructor"\s*:/
+};
+const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+const SPECIAL_VALUES = {
+	true: true,
+	false: false,
+	null: null,
+	undefined: void 0,
+	nan: NaN,
+	infinity: Number.POSITIVE_INFINITY,
+	"-infinity": Number.NEGATIVE_INFINITY
+};
+const ISO_DATE_REGEX = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+const isValidDate = (date) => date instanceof Date && !Number.isNaN(date.getTime());
+const parseISODate = (value) => {
+	const match = ISO_DATE_REGEX.exec(value);
+	if (!match) return null;
+	const [, year, month, day, hour, minute, second, ms, offsetSign, offsetHour, offsetMinute] = match;
+	if (year == null || month == null || day == null || hour == null || minute == null || second == null) return null;
+	const date = new Date(Date.UTC(Number.parseInt(year, 10), Number.parseInt(month, 10) - 1, Number.parseInt(day, 10), Number.parseInt(hour, 10), Number.parseInt(minute, 10), Number.parseInt(second, 10), ms != null ? Number.parseInt(ms.padEnd(3, "0"), 10) : 0));
+	if (offsetSign != null) {
+		if (offsetHour == null || offsetMinute == null) return null;
+		const offset = (Number.parseInt(offsetHour, 10) * 60 + Number.parseInt(offsetMinute, 10)) * (offsetSign === "+" ? -1 : 1);
+		date.setUTCMinutes(date.getUTCMinutes() + offset);
+	}
+	return isValidDate(date) ? date : null;
+};
+const betterJSONParse = (value, options = {}) => {
+	const { strict = false, warnings = false, reviver, parseDates = true } = options;
+	if (typeof value !== "string") return value;
+	const trimmed = value.trim();
+	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") && !trimmed.slice(1, -1).includes("\"")) return trimmed.slice(1, -1);
+	const lowerValue = trimmed.toLowerCase();
+	if (lowerValue.length <= 9 && lowerValue in SPECIAL_VALUES) return SPECIAL_VALUES[lowerValue];
+	if (!JSON_SIGNATURE.test(trimmed)) {
+		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
+		return value;
+	}
+	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
+		const matches = pattern.test(trimmed);
+		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
+		return matches;
+	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
+	try {
+		const secureReviver = (key, value$1) => {
+			if (key === "__proto__" || key === "constructor" && value$1 != null && typeof value$1 === "object" && "prototype" in value$1) {
+				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
+				return;
+			}
+			if (parseDates && typeof value$1 === "string") {
+				const date = parseISODate(value$1);
+				if (date) return date;
+			}
+			return reviver ? reviver(key, value$1) : value$1;
+		};
+		return JSON.parse(trimmed, secureReviver);
+	} catch (error) {
+		if (strict) throw error;
+		return value;
+	}
+};
+const parseJSON = (value, options = { strict: true }) => betterJSONParse(value, options);
+var parser_default = parseJSON;
+
+//#endregion
+Object.defineProperty(exports, 'parseJSON', {
+  enumerable: true,
+  get: function () {
+    return parseJSON;
+  }
+});
+Object.defineProperty(exports, 'parser_default', {
+  enumerable: true,
+  get: function () {
+    return parser_default;
+  }
+});

package/dist/parser-CeAer-RM.mjs

@@ -0,0 +1,71 @@
+//#region src/client/parser.ts
+const PROTO_POLLUTION_PATTERNS = {
+	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
+	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
+	protoShort: /"__proto__"\s*:/,
+	constructorShort: /"constructor"\s*:/
+};
+const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+const SPECIAL_VALUES = {
+	true: true,
+	false: false,
+	null: null,
+	undefined: void 0,
+	nan: NaN,
+	infinity: Number.POSITIVE_INFINITY,
+	"-infinity": Number.NEGATIVE_INFINITY
+};
+const ISO_DATE_REGEX = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+const isValidDate = (date) => date instanceof Date && !Number.isNaN(date.getTime());
+const parseISODate = (value) => {
+	const match = ISO_DATE_REGEX.exec(value);
+	if (!match) return null;
+	const [, year, month, day, hour, minute, second, ms, offsetSign, offsetHour, offsetMinute] = match;
+	if (year == null || month == null || day == null || hour == null || minute == null || second == null) return null;
+	const date = new Date(Date.UTC(Number.parseInt(year, 10), Number.parseInt(month, 10) - 1, Number.parseInt(day, 10), Number.parseInt(hour, 10), Number.parseInt(minute, 10), Number.parseInt(second, 10), ms != null ? Number.parseInt(ms.padEnd(3, "0"), 10) : 0));
+	if (offsetSign != null) {
+		if (offsetHour == null || offsetMinute == null) return null;
+		const offset = (Number.parseInt(offsetHour, 10) * 60 + Number.parseInt(offsetMinute, 10)) * (offsetSign === "+" ? -1 : 1);
+		date.setUTCMinutes(date.getUTCMinutes() + offset);
+	}
+	return isValidDate(date) ? date : null;
+};
+const betterJSONParse = (value, options = {}) => {
+	const { strict = false, warnings = false, reviver, parseDates = true } = options;
+	if (typeof value !== "string") return value;
+	const trimmed = value.trim();
+	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") && !trimmed.slice(1, -1).includes("\"")) return trimmed.slice(1, -1);
+	const lowerValue = trimmed.toLowerCase();
+	if (lowerValue.length <= 9 && lowerValue in SPECIAL_VALUES) return SPECIAL_VALUES[lowerValue];
+	if (!JSON_SIGNATURE.test(trimmed)) {
+		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
+		return value;
+	}
+	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
+		const matches = pattern.test(trimmed);
+		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
+		return matches;
+	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
+	try {
+		const secureReviver = (key, value$1) => {
+			if (key === "__proto__" || key === "constructor" && value$1 != null && typeof value$1 === "object" && "prototype" in value$1) {
+				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
+				return;
+			}
+			if (parseDates && typeof value$1 === "string") {
+				const date = parseISODate(value$1);
+				if (date) return date;
+			}
+			return reviver ? reviver(key, value$1) : value$1;
+		};
+		return JSON.parse(trimmed, secureReviver);
+	} catch (error) {
+		if (strict) throw error;
+		return value;
+	}
+};
+const parseJSON = (value, options = { strict: true }) => betterJSONParse(value, options);
+var parser_default = parseJSON;
+
+//#endregion
+export { parser_default as n, parseJSON as t };

package/dist/passkey-B6N20LSS.cjs

@@ -0,0 +1,512 @@
+const require_chunk = require('./chunk-oakRccI5.cjs');
+const require_cookies = require('./cookies-B5xeA6i8.cjs');
+const require_session = require('./session-De9POJTW.cjs');
+const require_schema = require('./schema-D-qjygfE.cjs');
+let __faire_auth_core_env = require("@faire-auth/core/env");
+let __faire_auth_core_factory = require("@faire-auth/core/factory");
+let __faire_auth_core_static = require("@faire-auth/core/static");
+let __faire_auth_core_utils = require("@faire-auth/core/utils");
+let __faire_auth_core_datatypes = require("@faire-auth/core/datatypes");
+let zod = require("zod");
+zod = require_chunk.__toESM(zod);
+let __simplewebauthn_server = require("@simplewebauthn/server");
+let __faire_auth_core_crypto = require("@faire-auth/core/crypto");
+
+//#region src/plugins/passkey/index.ts
+const getRpID = (options, baseURL) => options.rpID || (baseURL ? new URL(baseURL).hostname : "localhost");
+const passkeySchema = zod.object({
+	id: zod.string(),
+	name: zod.string().optional(),
+	publicKey: zod.string(),
+	userId: zod.string(),
+	credentialID: zod.string(),
+	counter: zod.number().int().nonnegative(),
+	deviceType: zod.enum(["singleDevice", "multiDevice"]),
+	backedUp: zod.boolean(),
+	transports: zod.string().optional(),
+	createdAt: zod.date().or(zod.iso.datetime()),
+	aaguid: zod.string().optional()
+});
+const passkey = (options) => {
+	const opts = {
+		origin: null,
+		...options,
+		advanced: {
+			webAuthnChallengeCookie: "better-auth-passkey",
+			...options?.advanced
+		}
+	};
+	const expirationTime = new Date(Date.now() + 1e3 * 60 * 5);
+	const currentTime = /* @__PURE__ */ new Date();
+	const maxAgeInSeconds = Math.floor((expirationTime.getTime() - currentTime.getTime()) / 1e3);
+	const ERROR_CODES = {
+		CHALLENGE_NOT_FOUND: "Challenge not found",
+		YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+		FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+		PASSKEY_NOT_FOUND: "Passkey not found",
+		AUTHENTICATION_FAILED: "Authentication failed",
+		UNABLE_TO_CREATE_SESSION: "Unable to create session",
+		FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey"
+	};
+	return {
+		id: "passkey",
+		routes: {
+			generatePasskeyRegistrationOptions: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "generatePasskeyRegistrationOptions",
+				method: "get",
+				path: "/passkey/generate-register-options",
+				client: false,
+				description: "Generate registration options for a new passkey",
+				middleware: [require_session.freshSessionMiddleware],
+				request: (0, __faire_auth_core_factory.req)().qry(zod.object({
+					authenticatorAttachment: zod.enum(["platform", "cross-platform"]).optional().openapi({ description: `Type of authenticator to use for registration.
+                                  "platform" for device-specific authenticators,
+                                  "cross-platform" for authenticators that can be used across devices.` }),
+					name: zod.string().optional().openapi({ description: `Optional custom name for the passkey.
+                                  This can help identify the passkey when managing multiple credentials.` })
+				})).bld(),
+				responses: (0, __faire_auth_core_factory.res)(zod.object({
+					challenge: zod.base64url(),
+					timeout: zod.number().optional(),
+					rp: zod.object({
+						name: zod.string(),
+						id: zod.string().optional()
+					}),
+					user: zod.object({
+						id: zod.string(),
+						name: zod.string(),
+						displayName: zod.string()
+					}),
+					pubKeyCredParams: zod.array(zod.object({
+						type: zod.string(),
+						alg: zod.number()
+					})),
+					excludeCredentials: zod.array(zod.object({
+						id: zod.string(),
+						type: zod.string(),
+						transports: zod.array(zod.enum([
+							"ble",
+							"cable",
+							"hybrid",
+							"internal",
+							"nfc",
+							"smart-card",
+							"usb"
+						])).optional()
+					})).optional(),
+					authenticatorSelection: zod.object({
+						authenticatorAttachment: zod.string(),
+						requireResidentKey: zod.boolean(),
+						userVerification: zod.string()
+					}).partial().optional(),
+					attestation: zod.string(),
+					extensions: zod.record(zod.string(), zod.any())
+				}).transform(__faire_auth_core_utils.toSuccess)).err(401).bld()
+			}), (authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const { name, authenticatorAttachment } = ctx.req.valid("query");
+				const userPasskeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const userID = new TextEncoder().encode((0, __faire_auth_core_crypto.generateRandomString)(32, "a-z", "0-9"));
+				let options$1;
+				options$1 = await (0, __simplewebauthn_server.generateRegistrationOptions)({
+					rpName: opts.rpName || ctx.get("context").appName,
+					rpID: getRpID(opts, authOptions.baseURL),
+					userID,
+					userName: name ?? session.user.email ?? session.user.id,
+					userDisplayName: session.user.email ?? session.user.id,
+					attestationType: "none",
+					excludeCredentials: userPasskeys.map((passkey$1) => ({
+						id: passkey$1.credentialID,
+						transports: passkey$1.transports?.split(",")
+					})),
+					authenticatorSelection: {
+						residentKey: "preferred",
+						userVerification: "preferred",
+						...opts.authenticatorSelection ?? {},
+						...authenticatorAttachment && { authenticatorAttachment }
+					}
+				});
+				const id = (0, __faire_auth_core_crypto.generateId)(32);
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await (0, require_cookies.cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.get("context").internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify({
+						expectedChallenge: options$1.challenge,
+						userData: { id: session.user.id }
+					}),
+					expiresAt: expirationTime
+				});
+				return ctx.render(options$1, 200);
+			}),
+			generatePasskeyAuthenticationOptions: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "generatePasskeyAuthenticationOptions",
+				method: "post",
+				path: "/passkey/generate-authenticate-options",
+				description: "Generate authentication options for a passkey",
+				request: (0, __faire_auth_core_factory.req)().bdy(zod.object({ email: __faire_auth_core_factory.emailSchema.openapi({ description: "The email address of the user" }).optional() })).bld(),
+				responses: (0, __faire_auth_core_factory.res)(zod.object({
+					challenge: zod.base64url(),
+					timeout: zod.number().optional(),
+					rpId: zod.string().optional(),
+					allowCredentials: zod.array(zod.object({
+						id: zod.string(),
+						type: zod.string(),
+						transports: zod.array(zod.enum([
+							"ble",
+							"cable",
+							"hybrid",
+							"internal",
+							"nfc",
+							"smart-card",
+							"usb"
+						])).optional()
+					})).optional(),
+					userVerification: zod.enum([
+						"discouraged",
+						"preferred",
+						"required"
+					]).optional(),
+					extensions: zod.record(zod.string(), zod.any()).optional()
+				}).transform(__faire_auth_core_utils.toSuccess)).bld()
+			}), (authOptions) => async (ctx) => {
+				const session = await require_session.getSessionFromCtx(ctx);
+				let userPasskeys = [];
+				if (!(session instanceof Response)) userPasskeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const options$1 = await (0, __simplewebauthn_server.generateAuthenticationOptions)({
+					rpID: getRpID(opts, authOptions.baseURL),
+					userVerification: "preferred",
+					...userPasskeys.length > 0 && { allowCredentials: userPasskeys.map((passkey$1) => ({
+						id: passkey$1.credentialID,
+						transports: passkey$1.transports?.split(",")
+					})) }
+				});
+				const data = {
+					expectedChallenge: options$1.challenge,
+					userData: { id: "user" in session ? session.user.id : "" }
+				};
+				const id = (0, __faire_auth_core_crypto.generateId)(32);
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await (0, require_cookies.cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.get("context").internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify(data),
+					expiresAt: expirationTime
+				});
+				return ctx.render(options$1, 200);
+			}),
+			verifyPasskeyRegistration: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "verifyPasskeyRegistration",
+				method: "post",
+				path: "/passkey/verify-registration",
+				description: "Verify registration of a new passkey",
+				middleware: [require_session.freshSessionMiddleware],
+				request: (0, __faire_auth_core_factory.req)().bdy(zod.object({
+					response: zod.any(),
+					name: zod.string().openapi({ description: "Name of the passkey" }).optional()
+				})).bld(),
+				responses: (0, __faire_auth_core_factory.res)(passkeySchema.transform(__faire_auth_core_utils.toSuccess)).err(400).err(401).err(500, "Failed to verify registration").bld()
+			}), (authOptions) => async (ctx) => {
+				const origin = options?.origin ?? ctx.req.header("origin") ?? "";
+				if (!origin) return ctx.render({ success: __faire_auth_core_static.False }, 400);
+				const session = ctx.get("session");
+				const { response } = ctx.req.valid("json");
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await (0, require_cookies.cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
+				if (!challengeId) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
+				if (!data) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+				}, 400);
+				const { expectedChallenge, userData } = JSON.parse(data.value);
+				if (userData.id !== session.user.id) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
+				}, 401);
+				try {
+					const { verified, registrationInfo } = await (0, __simplewebauthn_server.verifyRegistrationResponse)({
+						response,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, authOptions.baseURL),
+						requireUserVerification: false
+					});
+					if (!verified || !registrationInfo) return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+					}, 400);
+					const { aaguid, credentialDeviceType, credentialBackedUp, credential } = registrationInfo;
+					const pubKey = __faire_auth_core_datatypes.base64.encode(credential.publicKey);
+					const newPasskey = {
+						name: ctx.body.name,
+						userId: userData.id,
+						credentialID: credential.id,
+						publicKey: pubKey,
+						counter: credential.counter,
+						deviceType: credentialDeviceType,
+						transports: response.response.transports.join(","),
+						backedUp: credentialBackedUp,
+						createdAt: /* @__PURE__ */ new Date(),
+						aaguid
+					};
+					const newPasskeyRes = await ctx.get("context").adapter.create({
+						model: "passkey",
+						data: newPasskey
+					});
+					return ctx.render(newPasskeyRes, 200);
+				} catch (e) {
+					__faire_auth_core_env.logger.error(String(e));
+					return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+					}, 500);
+				}
+			}),
+			verifyPasskeyAuthentication: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "verifyPasskeyAuthentication",
+				method: "post",
+				path: "/passkey/verify-authentication",
+				description: "Verify authentication of a passkey",
+				$Infer: { body: {} },
+				request: (0, __faire_auth_core_factory.req)().bdy(zod.object({ response: zod.record(zod.string(), zod.any()) })).bld(),
+				responses: (0, __faire_auth_core_factory.res)(__faire_auth_core_static.SCHEMAS[__faire_auth_core_static.Definitions.SESSION_RESPONSE].default).err(400, "Origin missing, challenge not found, or auth failed").err(401, "Passkey not found or auth failed").err(500, "User not found or unable to create session").bld()
+			}), (authOptions) => async (ctx) => {
+				const origin = options?.origin ?? ctx.req.header("origin") ?? "";
+				if (!origin) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: "Origin missing"
+				}, 400);
+				const { response } = ctx.req.valid("json");
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await (0, require_cookies.cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
+				if (!challengeId) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
+				if (!data) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const { expectedChallenge } = JSON.parse(data.value);
+				const passkey$1 = await ctx.get("context").adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "credentialID",
+						value: response["id"]
+					}]
+				});
+				if (!passkey$1) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.PASSKEY_NOT_FOUND
+				}, 401);
+				try {
+					const verification = await (0, __simplewebauthn_server.verifyAuthenticationResponse)({
+						response,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, authOptions.baseURL),
+						credential: {
+							id: passkey$1.credentialID,
+							publicKey: __faire_auth_core_datatypes.base64.decode(passkey$1.publicKey),
+							counter: passkey$1.counter,
+							transports: passkey$1.transports?.split(",")
+						},
+						requireUserVerification: false
+					});
+					const { verified } = verification;
+					if (!verified) return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: ERROR_CODES.AUTHENTICATION_FAILED
+					}, 401);
+					await ctx.get("context").adapter.update({
+						model: "passkey",
+						where: [{
+							field: "id",
+							value: passkey$1.id
+						}],
+						update: { counter: verification.authenticationInfo.newCounter }
+					});
+					const s = await ctx.get("context").internalAdapter.createSession(passkey$1.userId);
+					if (!s) return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: ERROR_CODES.UNABLE_TO_CREATE_SESSION
+					}, 500);
+					const user = await ctx.get("context").internalAdapter.findUserById(passkey$1.userId);
+					if (!user) return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: "User not found"
+					}, 500);
+					await require_cookies.setSessionCookie(ctx, authOptions, {
+						session: s,
+						user
+					});
+					return ctx.render(s, 200);
+				} catch (e) {
+					ctx.get("context").logger.error("Failed to verify authentication", e);
+					return ctx.render({
+						success: __faire_auth_core_static.False,
+						message: ERROR_CODES.AUTHENTICATION_FAILED
+					}, 400);
+				}
+			}),
+			listPasskeys: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "listPasskeys",
+				method: "get",
+				path: "/passkey/list-user-passkeys",
+				description: "List all passkeys for the authenticated user",
+				middleware: [require_session.sessionMiddleware()],
+				responses: (0, __faire_auth_core_factory.res)(zod.array(passkeySchema).openapi({ description: "Array of passkey objects associated with the user" }).transform(__faire_auth_core_utils.toSuccess)).err(401).bld()
+			}), (_authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const passkeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				return ctx.render(passkeys, 200);
+			}),
+			deletePasskey: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "deletePasskey",
+				method: "post",
+				path: "/passkey/delete-passkey",
+				description: "Delete a specific passkey",
+				middleware: [require_session.sessionMiddleware()],
+				request: (0, __faire_auth_core_factory.req)().bdy(zod.object({ id: zod.string().openapi({ description: "The ID of the passkey to delete. Eg: \"some-passkey-id\"" }) })).bld(),
+				responses: (0, __faire_auth_core_factory.res)(__faire_auth_core_static.SCHEMAS[__faire_auth_core_static.Definitions.SUCCESS].default, "Passkey deleted successfully").err(401).bld()
+			}), (_authOptions) => async (ctx) => {
+				await ctx.get("context").adapter.delete({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: ctx.req.valid("json").id
+					}]
+				});
+				return ctx.render({ success: __faire_auth_core_static.True }, 200);
+			}),
+			updatePasskey: require_session.createEndpoint((0, __faire_auth_core_factory.createRoute)({
+				operationId: "updatePasskey",
+				method: "post",
+				path: "/passkey/update-passkey",
+				description: "Update a specific passkey's name",
+				middleware: [require_session.sessionMiddleware()],
+				request: (0, __faire_auth_core_factory.req)().bdy(zod.object({
+					id: zod.string().openapi({ description: `The ID of the passkey which will be updated. Eg: \"passkey-id\"` }),
+					name: zod.string().openapi({ description: `The new name which the passkey will be updated to. Eg: \"my-new-passkey-name\"` })
+				})).bld(),
+				responses: (0, __faire_auth_core_factory.res)(passkeySchema.transform(__faire_auth_core_utils.toSuccess)).err(401, "Invalid session or not allowed to register").err(404, "Passkey not found").err(500, "Failed to update passkey").bld()
+			}), (_authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const { id, name } = ctx.req.valid("json");
+				const passkey$1 = await ctx.get("context").adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: id
+					}]
+				});
+				if (!passkey$1) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.PASSKEY_NOT_FOUND
+				}, 404);
+				if (passkey$1.userId !== session.user.id) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
+				}, 401);
+				const updatedPasskey = await ctx.get("context").adapter.update({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: id
+					}],
+					update: { name }
+				});
+				if (!updatedPasskey) return ctx.render({
+					success: __faire_auth_core_static.False,
+					message: ERROR_CODES.FAILED_TO_UPDATE_PASSKEY
+				}, 500);
+				return ctx.render(updatedPasskey, 200);
+			})
+		},
+		schema: require_schema.mergeSchema(schema, options?.schema),
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+const schema = { passkey: { fields: {
+	name: {
+		type: "string",
+		required: false
+	},
+	publicKey: {
+		type: "string",
+		required: true
+	},
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id"
+		},
+		required: true
+	},
+	credentialID: {
+		type: "string",
+		required: true
+	},
+	counter: {
+		type: "number",
+		required: true
+	},
+	deviceType: {
+		type: "string",
+		required: true
+	},
+	backedUp: {
+		type: "boolean",
+		required: true
+	},
+	transports: {
+		type: "string",
+		required: false
+	},
+	createdAt: {
+		type: "date",
+		required: false
+	},
+	aaguid: {
+		type: "string",
+		required: false
+	}
+} } };
+
+//#endregion
+Object.defineProperty(exports, 'passkey', {
+  enumerable: true,
+  get: function () {
+    return passkey;
+  }
+});