faire-auth 1.0.3 → 1.1.0

package/dist/plugins/passkey/index.cjs

@@ -1,15 +1,551 @@
-require('../../hono-C14rpOEa.cjs');
-require('../../crypto-DpSCnrTp.cjs');
-require('../../json--tl7Grvs.cjs');
-require('../../cookies-BTl72THv.cjs');
-require('../../logged-Dv3st5qc.cjs');
-require('../../url-Ce7CVaQD.cjs');
-require('../../middleware-CWvRH4EW.cjs');
-require('../../session-Cwrj4GfV.cjs');
-require('../../state-CvSihlVT.cjs');
-require('../../request-CPNlp-DK.cjs');
-require('../../utils-44aDDP8f.cjs');
-require('../../schema-CirKflVs.cjs');
-const require_passkey = require('../../passkey-BTT-v5c-.cjs');
-
-exports.passkey = require_passkey.passkey;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../rolldown-runtime-C_Pgydhf.cjs");
+const require_session = require("../../session-CzZSMmQC.cjs");
+const require_schema = require("../../schema-b-lKhMkG.cjs");
+require("../../utils-iX0Vy_UL.cjs");
+const require_cookies = require("../../cookies-DQ52rcOy.cjs");
+let _faire_auth_core_env = require("@faire-auth/core/env");
+let _faire_auth_core_factory = require("@faire-auth/core/factory");
+let _faire_auth_core_static = require("@faire-auth/core/static");
+let _faire_auth_core_utils = require("@faire-auth/core/utils");
+let _faire_auth_core_datatypes = require("@faire-auth/core/datatypes");
+let zod = require("zod");
+zod = require_rolldown_runtime.__toESM(zod, 1);
+let _simplewebauthn_server = require("@simplewebauthn/server");
+let _faire_auth_core_crypto = require("@faire-auth/core/crypto");
+// src/plugins/passkey/index.ts
+const getRpID = (options, baseURL) => options.rpID || (baseURL ? new URL(baseURL).hostname : "localhost");
+const passkeySchema = zod.object({
+	id: zod.string(),
+	name: zod.string().optional(),
+	publicKey: zod.string(),
+	userId: zod.string(),
+	credentialID: zod.string(),
+	counter: zod.number().int().nonnegative(),
+	deviceType: zod.enum(["singleDevice", "multiDevice"]),
+	backedUp: zod.boolean(),
+	transports: zod.string().optional(),
+	createdAt: zod.date().or(zod.iso.datetime()),
+	aaguid: zod.string().optional()
+});
+const passkey = (options) => {
+	const opts = {
+		origin: null,
+		...options,
+		advanced: {
+			webAuthnChallengeCookie: "better-auth-passkey",
+			...options?.advanced
+		}
+	};
+	const expirationTime = new Date(Date.now() + 3e5);
+	const currentTime = /* @__PURE__ */ new Date();
+	const maxAgeInSeconds = Math.floor((expirationTime.getTime() - currentTime.getTime()) / 1e3);
+	const ERROR_CODES = {
+		CHALLENGE_NOT_FOUND: "Challenge not found",
+		YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+		FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+		PASSKEY_NOT_FOUND: "Passkey not found",
+		AUTHENTICATION_FAILED: "Authentication failed",
+		UNABLE_TO_CREATE_SESSION: "Unable to create session",
+		FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey"
+	};
+	return {
+		id: "passkey",
+		routes: {
+			generatePasskeyRegistrationOptions: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "generatePasskeyRegistrationOptions",
+				method: "get",
+				path: "/passkey/generate-register-options",
+				client: false,
+				description: "Generate registration options for a new passkey",
+				middleware: [require_session.freshSessionMiddleware],
+				request: (0, _faire_auth_core_factory.req)().qry(zod.object({
+					authenticatorAttachment: zod.enum(["platform", "cross-platform"]).optional().openapi({ description: `Type of authenticator to use for registration.
+                                  "platform" for device-specific authenticators,
+                                  "cross-platform" for authenticators that can be used across devices.` }),
+					name: zod.string().optional().openapi({ description: `Optional custom name for the passkey.
+                                  This can help identify the passkey when managing multiple credentials.` })
+				})).bld(),
+				responses: (0, _faire_auth_core_factory.res)(zod.object({
+					challenge: zod.base64url(),
+					timeout: zod.number().optional(),
+					rp: zod.object({
+						name: zod.string(),
+						id: zod.string().optional()
+					}),
+					user: zod.object({
+						id: zod.string(),
+						name: zod.string(),
+						displayName: zod.string()
+					}),
+					pubKeyCredParams: zod.array(zod.object({
+						type: zod.string(),
+						alg: zod.number()
+					})),
+					excludeCredentials: zod.array(zod.object({
+						id: zod.string(),
+						type: zod.string(),
+						transports: zod.array(zod.enum([
+							"ble",
+							"cable",
+							"hybrid",
+							"internal",
+							"nfc",
+							"smart-card",
+							"usb"
+						])).optional()
+					})).optional(),
+					authenticatorSelection: zod.object({
+						authenticatorAttachment: zod.string(),
+						requireResidentKey: zod.boolean(),
+						userVerification: zod.string()
+					}).partial().optional(),
+					attestation: zod.string(),
+					extensions: zod.record(zod.string(), zod.any())
+				}).transform(_faire_auth_core_utils.toSuccess)).err(401).bld()
+			}), (authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const { name, authenticatorAttachment } = ctx.req.valid("query");
+				const userPasskeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const userID = new TextEncoder().encode((0, _faire_auth_core_crypto.generateRandomString)(32, "a-z", "0-9"));
+				let options;
+				options = await (0, _simplewebauthn_server.generateRegistrationOptions)({
+					rpName: opts.rpName || ctx.get("context").appName,
+					rpID: getRpID(opts, authOptions.baseURL),
+					userID,
+					userName: name ?? session.user.email ?? session.user.id,
+					userDisplayName: session.user.email ?? session.user.id,
+					attestationType: "none",
+					excludeCredentials: userPasskeys.map((passkey) => ({
+						id: passkey.credentialID,
+						transports: passkey.transports?.split(",")
+					})),
+					authenticatorSelection: {
+						residentKey: "preferred",
+						userVerification: "preferred",
+						...opts.authenticatorSelection ?? {},
+						...authenticatorAttachment && { authenticatorAttachment }
+					}
+				});
+				const id = (0, _faire_auth_core_crypto.generateId)(32);
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await (0, require_cookies.cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.get("context").internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify({
+						expectedChallenge: options.challenge,
+						userData: { id: session.user.id }
+					}),
+					expiresAt: expirationTime
+				});
+				return ctx.render(options, 200);
+			}),
+			generatePasskeyAuthenticationOptions: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "generatePasskeyAuthenticationOptions",
+				method: "post",
+				path: "/passkey/generate-authenticate-options",
+				description: "Generate authentication options for a passkey",
+				request: (0, _faire_auth_core_factory.req)().bdy(zod.object({ email: _faire_auth_core_factory.emailSchema.openapi({ description: "The email address of the user" }).optional() })).bld(),
+				responses: (0, _faire_auth_core_factory.res)(zod.object({
+					challenge: zod.base64url(),
+					timeout: zod.number().optional(),
+					rpId: zod.string().optional(),
+					allowCredentials: zod.array(zod.object({
+						id: zod.string(),
+						type: zod.string(),
+						transports: zod.array(zod.enum([
+							"ble",
+							"cable",
+							"hybrid",
+							"internal",
+							"nfc",
+							"smart-card",
+							"usb"
+						])).optional()
+					})).optional(),
+					userVerification: zod.enum([
+						"discouraged",
+						"preferred",
+						"required"
+					]).optional(),
+					extensions: zod.record(zod.string(), zod.any()).optional()
+				}).transform(_faire_auth_core_utils.toSuccess)).bld()
+			}), (authOptions) => async (ctx) => {
+				const session = await require_session.getSessionFromCtx(ctx);
+				let userPasskeys = [];
+				if (!(session instanceof Response)) userPasskeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const options = await (0, _simplewebauthn_server.generateAuthenticationOptions)({
+					rpID: getRpID(opts, authOptions.baseURL),
+					userVerification: "preferred",
+					...userPasskeys.length > 0 && { allowCredentials: userPasskeys.map((passkey) => ({
+						id: passkey.credentialID,
+						transports: passkey.transports?.split(",")
+					})) }
+				});
+				const data = {
+					expectedChallenge: options.challenge,
+					userData: { id: "user" in session ? session.user.id : "" }
+				};
+				const id = (0, _faire_auth_core_crypto.generateId)(32);
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await (0, require_cookies.cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.get("context").internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify(data),
+					expiresAt: expirationTime
+				});
+				return ctx.render(options, 200);
+			}),
+			verifyPasskeyRegistration: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "verifyPasskeyRegistration",
+				method: "post",
+				path: "/passkey/verify-registration",
+				description: "Verify registration of a new passkey",
+				middleware: [require_session.freshSessionMiddleware],
+				request: (0, _faire_auth_core_factory.req)().bdy(zod.object({
+					response: zod.any(),
+					name: zod.string().openapi({ description: "Name of the passkey" }).optional()
+				})).bld(),
+				responses: (0, _faire_auth_core_factory.res)(passkeySchema.transform(_faire_auth_core_utils.toSuccess)).err(400).err(401).err(500, "Failed to verify registration").bld()
+			}), (authOptions) => async (ctx) => {
+				const origin = options?.origin ?? ctx.req.header("origin") ?? "";
+				if (!origin) return ctx.render({ success: _faire_auth_core_static.False }, 400);
+				const session = ctx.get("session");
+				const { response } = ctx.req.valid("json");
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await (0, require_cookies.cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
+				if (!challengeId) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
+				if (!data) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+				}, 400);
+				const { expectedChallenge, userData } = JSON.parse(data.value);
+				if (userData.id !== session.user.id) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
+				}, 401);
+				try {
+					const { verified, registrationInfo } = await (0, _simplewebauthn_server.verifyRegistrationResponse)({
+						response,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, authOptions.baseURL),
+						requireUserVerification: false
+					});
+					if (!verified || !registrationInfo) return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+					}, 400);
+					const { aaguid, credentialDeviceType, credentialBackedUp, credential } = registrationInfo;
+					const pubKey = _faire_auth_core_datatypes.base64.encode(credential.publicKey);
+					const newPasskey = {
+						name: ctx.body.name,
+						userId: userData.id,
+						credentialID: credential.id,
+						publicKey: pubKey,
+						counter: credential.counter,
+						deviceType: credentialDeviceType,
+						transports: response.response.transports.join(","),
+						backedUp: credentialBackedUp,
+						createdAt: /* @__PURE__ */ new Date(),
+						aaguid
+					};
+					const newPasskeyRes = await ctx.get("context").adapter.create({
+						model: "passkey",
+						data: newPasskey
+					});
+					return ctx.render(newPasskeyRes, 200);
+				} catch (e) {
+					_faire_auth_core_env.logger.error(String(e));
+					return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
+					}, 500);
+				}
+			}),
+			verifyPasskeyAuthentication: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "verifyPasskeyAuthentication",
+				method: "post",
+				path: "/passkey/verify-authentication",
+				description: "Verify authentication of a passkey",
+				$Infer: { body: {} },
+				request: (0, _faire_auth_core_factory.req)().bdy(zod.object({ response: zod.record(zod.string(), zod.any()) })).bld(),
+				responses: (0, _faire_auth_core_factory.res)(_faire_auth_core_static.SCHEMAS[_faire_auth_core_static.Definitions.SESSION_RESPONSE].default).err(400, "Origin missing, challenge not found, or auth failed").err(401, "Passkey not found or auth failed").err(500, "User not found or unable to create session").bld()
+			}), (authOptions) => async (ctx) => {
+				const origin = options?.origin ?? ctx.req.header("origin") ?? "";
+				if (!origin) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: "Origin missing"
+				}, 400);
+				const { response } = ctx.req.valid("json");
+				const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await (0, require_cookies.cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
+				if (!challengeId) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
+				if (!data) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.CHALLENGE_NOT_FOUND
+				}, 400);
+				const { expectedChallenge } = JSON.parse(data.value);
+				const passkey = await ctx.get("context").adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "credentialID",
+						value: response["id"]
+					}]
+				});
+				if (!passkey) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.PASSKEY_NOT_FOUND
+				}, 401);
+				try {
+					const verification = await (0, _simplewebauthn_server.verifyAuthenticationResponse)({
+						response,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, authOptions.baseURL),
+						credential: {
+							id: passkey.credentialID,
+							publicKey: _faire_auth_core_datatypes.base64.decode(passkey.publicKey),
+							counter: passkey.counter,
+							transports: passkey.transports?.split(",")
+						},
+						requireUserVerification: false
+					});
+					const { verified } = verification;
+					if (!verified) return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: ERROR_CODES.AUTHENTICATION_FAILED
+					}, 401);
+					await ctx.get("context").adapter.update({
+						model: "passkey",
+						where: [{
+							field: "id",
+							value: passkey.id
+						}],
+						update: { counter: verification.authenticationInfo.newCounter }
+					});
+					const s = await ctx.get("context").internalAdapter.createSession(passkey.userId);
+					if (!s) return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: ERROR_CODES.UNABLE_TO_CREATE_SESSION
+					}, 500);
+					const user = await ctx.get("context").internalAdapter.findUserById(passkey.userId);
+					if (!user) return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: "User not found"
+					}, 500);
+					await require_cookies.setSessionCookie(ctx, authOptions, {
+						session: s,
+						user
+					});
+					return ctx.render(s, 200);
+				} catch (e) {
+					ctx.get("context").logger.error("Failed to verify authentication", e);
+					return ctx.render({
+						success: _faire_auth_core_static.False,
+						message: ERROR_CODES.AUTHENTICATION_FAILED
+					}, 400);
+				}
+			}),
+			/**
+			* ### Endpoint
+			*
+			* GET `/passkey/list-user-passkeys`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.listPasskeys`
+			*
+			* **client:**
+			* `authClient.passkey.listUserPasskeys`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-list-user-passkeys)
+			*/
+			listPasskeys: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "listPasskeys",
+				method: "get",
+				path: "/passkey/list-user-passkeys",
+				description: "List all passkeys for the authenticated user",
+				middleware: [require_session.sessionMiddleware()],
+				responses: (0, _faire_auth_core_factory.res)(zod.array(passkeySchema).openapi({ description: "Array of passkey objects associated with the user" }).transform(_faire_auth_core_utils.toSuccess)).err(401).bld()
+			}), (_authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const passkeys = await ctx.get("context").adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				return ctx.render(passkeys, 200);
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/passkey/delete-passkey`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.deletePasskey`
+			*
+			* **client:**
+			* `authClient.passkey.deletePasskey`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-delete-passkey)
+			*/
+			deletePasskey: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "deletePasskey",
+				method: "post",
+				path: "/passkey/delete-passkey",
+				description: "Delete a specific passkey",
+				middleware: [require_session.sessionMiddleware()],
+				request: (0, _faire_auth_core_factory.req)().bdy(zod.object({ id: zod.string().openapi({ description: "The ID of the passkey to delete. Eg: \"some-passkey-id\"" }) })).bld(),
+				responses: (0, _faire_auth_core_factory.res)(_faire_auth_core_static.SCHEMAS[_faire_auth_core_static.Definitions.SUCCESS].default, "Passkey deleted successfully").err(401).bld()
+			}), (_authOptions) => async (ctx) => {
+				await ctx.get("context").adapter.delete({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: ctx.req.valid("json").id
+					}]
+				});
+				return ctx.render({ success: _faire_auth_core_static.True }, 200);
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/passkey/update-passkey`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.updatePasskey`
+			*
+			* **client:**
+			* `authClient.passkey.updatePasskey`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-update-passkey)
+			*/
+			updatePasskey: require_session.createEndpoint((0, _faire_auth_core_factory.createRoute)({
+				operationId: "updatePasskey",
+				method: "post",
+				path: "/passkey/update-passkey",
+				description: "Update a specific passkey's name",
+				middleware: [require_session.sessionMiddleware()],
+				request: (0, _faire_auth_core_factory.req)().bdy(zod.object({
+					id: zod.string().openapi({ description: `The ID of the passkey which will be updated. Eg: \"passkey-id\"` }),
+					name: zod.string().openapi({ description: `The new name which the passkey will be updated to. Eg: \"my-new-passkey-name\"` })
+				})).bld(),
+				responses: (0, _faire_auth_core_factory.res)(passkeySchema.transform(_faire_auth_core_utils.toSuccess)).err(401, "Invalid session or not allowed to register").err(404, "Passkey not found").err(500, "Failed to update passkey").bld()
+			}), (_authOptions) => async (ctx) => {
+				const session = ctx.get("session");
+				const { id, name } = ctx.req.valid("json");
+				const passkey = await ctx.get("context").adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: id
+					}]
+				});
+				if (!passkey) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.PASSKEY_NOT_FOUND
+				}, 404);
+				if (passkey.userId !== session.user.id) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
+				}, 401);
+				const updatedPasskey = await ctx.get("context").adapter.update({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: id
+					}],
+					update: { name }
+				});
+				if (!updatedPasskey) return ctx.render({
+					success: _faire_auth_core_static.False,
+					message: ERROR_CODES.FAILED_TO_UPDATE_PASSKEY
+				}, 500);
+				return ctx.render(updatedPasskey, 200);
+			})
+		},
+		schema: require_schema.mergeSchema(schema, options?.schema),
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+const schema = { passkey: { fields: {
+	name: {
+		type: "string",
+		required: false
+	},
+	publicKey: {
+		type: "string",
+		required: true
+	},
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id"
+		},
+		required: true
+	},
+	credentialID: {
+		type: "string",
+		required: true
+	},
+	counter: {
+		type: "number",
+		required: true
+	},
+	deviceType: {
+		type: "string",
+		required: true
+	},
+	backedUp: {
+		type: "boolean",
+		required: true
+	},
+	transports: {
+		type: "string",
+		required: false
+	},
+	createdAt: {
+		type: "date",
+		required: false
+	},
+	aaguid: {
+		type: "string",
+		required: false
+	}
+} } };
+exports.passkey = passkey;

package/dist/plugins/passkey/index.d.cts

@@ -1,4 +1,123 @@
-import "../../index-CsWF3f7U.cjs";
-import "../../hono-DOM31WQz.cjs";
-import { n as PasskeyOptions, r as passkey, t as Passkey } from "../../index-By364WbF.cjs";
-export { Passkey, PasskeyOptions, passkey };
+import { in as AuthEndpoint, xt as InferOptionSchema } from "../../shared.cjs";
+import { CredentialDeviceType } from "@simplewebauthn/server";
+export interface PasskeyOptions {
+  /**
+   * A unique identifier for your website. 'localhost' is okay for
+   * local dev
+   *
+   * @default "localhost"
+   */
+  rpID?: string;
+  /**
+   * Human-readable title for your website
+   *
+   * @default "Better Auth"
+   */
+  rpName?: string;
+  /**
+   * The URL at which registrations and authentications should occur.
+   * `http://localhost` and `http://localhost:PORT` are also valid.
+   * Do NOT include any trailing /
+   *
+   * if this isn't provided. The client itself will
+   * pass this value.
+   */
+  origin?: string | null;
+  /**
+   * Allow customization of the authenticatorSelection options
+   * during passkey registration.
+   */
+  authenticatorSelection?: AuthenticatorSelectionCriteria;
+  /**
+   * Advanced options
+   */
+  advanced?: {
+    webAuthnChallengeCookie?: string;
+  };
+  /**
+   * Schema for the passkey model
+   */
+  schema?: InferOptionSchema<typeof schema>;
+}
+export type Passkey = {
+  id: string;
+  name?: string;
+  publicKey: string;
+  userId: string;
+  credentialID: string;
+  counter: number;
+  deviceType: CredentialDeviceType;
+  backedUp: boolean;
+  transports?: string;
+  createdAt: Date;
+  aaguid?: string;
+};
+export declare const passkey: (options?: PasskeyOptions) => {
+  id: string;
+  routes: {
+    generatePasskeyRegistrationOptions: AuthEndpoint<any>;
+    generatePasskeyAuthenticationOptions: AuthEndpoint<any>;
+    verifyPasskeyRegistration: AuthEndpoint<any>;
+    verifyPasskeyAuthentication: AuthEndpoint<any>;
+    /**
+     * ### Endpoint
+     *
+     * GET `/passkey/list-user-passkeys`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.listPasskeys`
+     *
+     * **client:**
+     * `authClient.passkey.listUserPasskeys`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-list-user-passkeys)
+     */
+    listPasskeys: AuthEndpoint<any>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/passkey/delete-passkey`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.deletePasskey`
+     *
+     * **client:**
+     * `authClient.passkey.deletePasskey`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-delete-passkey)
+     */
+    deletePasskey: AuthEndpoint<any>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/passkey/update-passkey`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.updatePasskey`
+     *
+     * **client:**
+     * `authClient.passkey.updatePasskey`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/passkey#api-method-passkey-update-passkey)
+     */
+    updatePasskey: AuthEndpoint<any>;
+  };
+  schema: FaireAuthPluginDBSchema;
+  $ERROR_CODES: {
+    CHALLENGE_NOT_FOUND: string;
+    YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: string;
+    FAILED_TO_VERIFY_REGISTRATION: string;
+    PASSKEY_NOT_FOUND: string;
+    AUTHENTICATION_FAILED: string;
+    UNABLE_TO_CREATE_SESSION: string;
+    FAILED_TO_UPDATE_PASSKEY: string;
+  };
+};
+declare const schema: FaireAuthPluginDBSchema;
+export {};