@camstack/sdk 1.1.19 → 1.1.21

package/dist/index.cjs

@@ -932,7 +932,8 @@ var System = class {
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const r = result;
 			const token = r.token;
-			if (typeof token === "string" && r.requiresTotp !== true) this.setToken(token);
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof token === "string" && !requiresSecondFactor) this.setToken(token);
 		}
 		return result;
 	}
@@ -954,6 +955,53 @@ var System = class {
 		}
 		return result;
 	}
+	/**
+	* Passkey second leg — step 1. Exchanges the login challenge token for
+	* the WebAuthn assertion options; the caller feeds `optionsJSON` to
+	* `@simplewebauthn/browser` `startAuthentication`. PUBLIC (pre-session).
+	*/
+	async loginBeginPasskey(challengeToken) {
+		return await this._trpcClient.auth.loginBeginPasskey.mutate({ challengeToken });
+	}
+	/**
+	* Passkey second leg — step 2. Submits the browser assertion; on
+	* success the server mints the real session JWT, which we set as the
+	* active token on this client.
+	*/
+	async loginVerifyPasskey(challengeToken, response) {
+		const result = await this._trpcClient.auth.loginVerifyPasskey.mutate({
+			challengeToken,
+			response
+		});
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const token = result.token;
+			if (typeof token === "string") this.setToken(token);
+		}
+		return result;
+	}
+	/**
+	* Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+	* credential assertion options (EMPTY `allowCredentials`); the caller
+	* feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+	* and the browser's own passkey picker takes over. PUBLIC (pre-session,
+	* no challenge token — the WebAuthn challenge is the whole state).
+	*/
+	async passkeyLoginBegin() {
+		return await this._trpcClient.auth.passkeyLoginBegin.mutate();
+	}
+	/**
+	* Usernameless login — step 2. Submits the browser assertion; on
+	* success the server resolves the credential's owner and mints the
+	* real session JWT, which we set as the active token on this client.
+	*/
+	async passkeyLoginFinish(response) {
+		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const token = result.token;
+			if (typeof token === "string") this.setToken(token);
+		}
+		return result;
+	}
 	async logout() {
 		await this._trpcClient.auth.logout.mutate();
 	}
@@ -975,6 +1023,18 @@ var System = class {
 	async getOwnTotpStatus() {
 		return await this._trpcClient.auth.getOwnTotpStatus.query();
 	}
+	async beginOwnPasskeyRegistration() {
+		return await this._trpcClient.auth.beginOwnPasskeyRegistration.mutate();
+	}
+	async finishOwnPasskeyRegistration(input) {
+		return await this._trpcClient.auth.finishOwnPasskeyRegistration.mutate(input);
+	}
+	async listOwnPasskeys() {
+		return await this._trpcClient.auth.listOwnPasskeys.query();
+	}
+	async removeOwnPasskey(input) {
+		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { System, createSystem, raceFastestEndpoint } from './system.js';
-export type { SystemConfig, UserInfo, SystemLiveEvent, SystemLiveEventListener } from './system.js';
+export type { SystemConfig, UserInfo, SystemLiveEvent, SystemLiveEventListener, SecondFactorKind, } from './system.js';
 export type { DeviceInfo } from '@camstack/types';
 export type { BackendAppRouter } from './backend-router.js';
 export type { BackendAppRouter as AppRouter } from './backend-router.js';

package/dist/index.js

@@ -931,7 +931,8 @@ var System = class {
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const r = result;
 			const token = r.token;
-			if (typeof token === "string" && r.requiresTotp !== true) this.setToken(token);
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof token === "string" && !requiresSecondFactor) this.setToken(token);
 		}
 		return result;
 	}
@@ -953,6 +954,53 @@ var System = class {
 		}
 		return result;
 	}
+	/**
+	* Passkey second leg — step 1. Exchanges the login challenge token for
+	* the WebAuthn assertion options; the caller feeds `optionsJSON` to
+	* `@simplewebauthn/browser` `startAuthentication`. PUBLIC (pre-session).
+	*/
+	async loginBeginPasskey(challengeToken) {
+		return await this._trpcClient.auth.loginBeginPasskey.mutate({ challengeToken });
+	}
+	/**
+	* Passkey second leg — step 2. Submits the browser assertion; on
+	* success the server mints the real session JWT, which we set as the
+	* active token on this client.
+	*/
+	async loginVerifyPasskey(challengeToken, response) {
+		const result = await this._trpcClient.auth.loginVerifyPasskey.mutate({
+			challengeToken,
+			response
+		});
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const token = result.token;
+			if (typeof token === "string") this.setToken(token);
+		}
+		return result;
+	}
+	/**
+	* Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+	* credential assertion options (EMPTY `allowCredentials`); the caller
+	* feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+	* and the browser's own passkey picker takes over. PUBLIC (pre-session,
+	* no challenge token — the WebAuthn challenge is the whole state).
+	*/
+	async passkeyLoginBegin() {
+		return await this._trpcClient.auth.passkeyLoginBegin.mutate();
+	}
+	/**
+	* Usernameless login — step 2. Submits the browser assertion; on
+	* success the server resolves the credential's owner and mints the
+	* real session JWT, which we set as the active token on this client.
+	*/
+	async passkeyLoginFinish(response) {
+		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const token = result.token;
+			if (typeof token === "string") this.setToken(token);
+		}
+		return result;
+	}
 	async logout() {
 		await this._trpcClient.auth.logout.mutate();
 	}
@@ -974,6 +1022,18 @@ var System = class {
 	async getOwnTotpStatus() {
 		return await this._trpcClient.auth.getOwnTotpStatus.query();
 	}
+	async beginOwnPasskeyRegistration() {
+		return await this._trpcClient.auth.beginOwnPasskeyRegistration.mutate();
+	}
+	async finishOwnPasskeyRegistration(input) {
+		return await this._trpcClient.auth.finishOwnPasskeyRegistration.mutate(input);
+	}
+	async listOwnPasskeys() {
+		return await this._trpcClient.auth.listOwnPasskeys.query();
+	}
+	async removeOwnPasskey(input) {
+		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/system.d.ts

@@ -11,9 +11,16 @@
  * — a future phase will narrow the surface further.
  */
 import { createWSClient, type TRPCClient } from '@trpc/client';
-import type { DeviceProxy, DeviceInfo, DeviceQueryFilters, DeviceLifecycleListener, SystemProxy } from '@camstack/types';
+import type { DeviceProxy, DeviceInfo, DeviceQueryFilters, DeviceLifecycleListener, SystemProxy, PasskeySummary } from '@camstack/types';
 import type { BackendAppRouter } from './backend-router.js';
 import type { BackendConnectionState } from './types.js';
+/**
+ * Second-factor kinds reported by `auth.login`. Kept in the SDK (not
+ * imported from a cap) because it's a login-flow contract, not a cap
+ * surface. `totp` → the `user-management` TOTP surface; `passkey` → any
+ * `user-passkeys` cap provider.
+ */
+export type SecondFactorKind = 'totp' | 'passkey';
 /**
  * Canonical user-info shape returned by `getMe()`. Mirrors the server's
  * `auth.me` output — kept narrow so SDK consumers don't need the full
@@ -184,6 +191,7 @@ export declare class System {
     login(username: string, password: string): Promise<{
         token: string;
         requiresTotp?: boolean;
+        secondFactors?: readonly SecondFactorKind[];
     }>;
     /**
      * Second leg of the 2FA login. The caller passes the challenge
@@ -195,6 +203,40 @@ export declare class System {
     loginVerifyTotp(challengeToken: string, code: string): Promise<{
         token: string;
     }>;
+    /**
+     * Passkey second leg — step 1. Exchanges the login challenge token for
+     * the WebAuthn assertion options; the caller feeds `optionsJSON` to
+     * `@simplewebauthn/browser` `startAuthentication`. PUBLIC (pre-session).
+     */
+    loginBeginPasskey(challengeToken: string): Promise<{
+        optionsJSON: Record<string, unknown>;
+    }>;
+    /**
+     * Passkey second leg — step 2. Submits the browser assertion; on
+     * success the server mints the real session JWT, which we set as the
+     * active token on this client.
+     */
+    loginVerifyPasskey(challengeToken: string, response: Record<string, unknown>): Promise<{
+        token: string;
+    }>;
+    /**
+     * Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+     * credential assertion options (EMPTY `allowCredentials`); the caller
+     * feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+     * and the browser's own passkey picker takes over. PUBLIC (pre-session,
+     * no challenge token — the WebAuthn challenge is the whole state).
+     */
+    passkeyLoginBegin(): Promise<{
+        optionsJSON: Record<string, unknown>;
+    }>;
+    /**
+     * Usernameless login — step 2. Submits the browser assertion; on
+     * success the server resolves the credential's owner and mints the
+     * real session JWT, which we set as the active token on this client.
+     */
+    passkeyLoginFinish(response: Record<string, unknown>): Promise<{
+        token: string;
+    }>;
     logout(): Promise<void>;
     getMe(): Promise<UserInfo>;
     changeOwnPassword(input: {
@@ -219,6 +261,22 @@ export declare class System {
         enabled: boolean;
         confirmedAt: number | null;
     }>;
+    beginOwnPasskeyRegistration(): Promise<{
+        optionsJSON: Record<string, unknown>;
+    }>;
+    finishOwnPasskeyRegistration(input: {
+        response: Record<string, unknown>;
+        label: string;
+    }): Promise<{
+        success: true;
+        credentialId: string;
+    }>;
+    listOwnPasskeys(): Promise<readonly PasskeySummary[]>;
+    removeOwnPasskey(input: {
+        credentialId: string;
+    }): Promise<{
+        success: true;
+    }>;
     /** Update the auth token (e.g. after login or token refresh). */
     setToken(token: string): void;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/sdk",
-  "version": "1.1.19",
+  "version": "1.1.21",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",