@camstack/sdk 1.1.20 → 1.1.22

package/dist/index.cjs

@@ -979,6 +979,36 @@ var System = class {
 		}
 		return result;
 	}
+	/**
+	* Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+	* credential assertion options (EMPTY `allowCredentials`); the caller
+	* feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+	* and the browser's own passkey picker takes over. PUBLIC (pre-session,
+	* no challenge token — the WebAuthn challenge is the whole state).
+	*/
+	async passkeyLoginBegin() {
+		return await this._trpcClient.auth.passkeyLoginBegin.mutate();
+	}
+	/**
+	* Usernameless login — step 2. Submits the browser assertion; on
+	* success the server resolves the credential's owner and mints the
+	* real session JWT, which we set as the active token on this client.
+	*
+	* Second-factor aware (mirrors `login`): when the account still has a
+	* second factor to satisfy (TOTP — 2FA applies uniformly after any
+	* primary method), the server returns a short-lived CHALLENGE token +
+	* `secondFactors`. That token is NOT persisted as the active session
+	* — the caller completes the remaining factor via `loginVerifyTotp`.
+	*/
+	async passkeyLoginFinish(response) {
+		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const r = result;
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof r.token === "string" && !requiresSecondFactor) this.setToken(r.token);
+		}
+		return result;
+	}
 	async logout() {
 		await this._trpcClient.auth.logout.mutate();
 	}
@@ -1012,6 +1042,17 @@ var System = class {
 	async removeOwnPasskey(input) {
 		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
 	}
+	/**
+	* Own passkey second-factor preference (opt-in, default OFF).
+	* Enrolling a passkey only enables passkey-first sign-in; this flag
+	* additionally demands the passkey after every password login.
+	*/
+	async getOwnPasskeySecondFactorPreference() {
+		return await this._trpcClient.auth.getOwnPasskeySecondFactorPreference.query();
+	}
+	async setOwnPasskeySecondFactorPreference(input) {
+		return await this._trpcClient.auth.setOwnPasskeySecondFactorPreference.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/index.js

@@ -978,6 +978,36 @@ var System = class {
 		}
 		return result;
 	}
+	/**
+	* Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+	* credential assertion options (EMPTY `allowCredentials`); the caller
+	* feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+	* and the browser's own passkey picker takes over. PUBLIC (pre-session,
+	* no challenge token — the WebAuthn challenge is the whole state).
+	*/
+	async passkeyLoginBegin() {
+		return await this._trpcClient.auth.passkeyLoginBegin.mutate();
+	}
+	/**
+	* Usernameless login — step 2. Submits the browser assertion; on
+	* success the server resolves the credential's owner and mints the
+	* real session JWT, which we set as the active token on this client.
+	*
+	* Second-factor aware (mirrors `login`): when the account still has a
+	* second factor to satisfy (TOTP — 2FA applies uniformly after any
+	* primary method), the server returns a short-lived CHALLENGE token +
+	* `secondFactors`. That token is NOT persisted as the active session
+	* — the caller completes the remaining factor via `loginVerifyTotp`.
+	*/
+	async passkeyLoginFinish(response) {
+		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
+		if (typeof result === "object" && result !== null && "token" in result) {
+			const r = result;
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof r.token === "string" && !requiresSecondFactor) this.setToken(r.token);
+		}
+		return result;
+	}
 	async logout() {
 		await this._trpcClient.auth.logout.mutate();
 	}
@@ -1011,6 +1041,17 @@ var System = class {
 	async removeOwnPasskey(input) {
 		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
 	}
+	/**
+	* Own passkey second-factor preference (opt-in, default OFF).
+	* Enrolling a passkey only enables passkey-first sign-in; this flag
+	* additionally demands the passkey after every password login.
+	*/
+	async getOwnPasskeySecondFactorPreference() {
+		return await this._trpcClient.auth.getOwnPasskeySecondFactorPreference.query();
+	}
+	async setOwnPasskeySecondFactorPreference(input) {
+		return await this._trpcClient.auth.setOwnPasskeySecondFactorPreference.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/system.d.ts

@@ -219,6 +219,32 @@ export declare class System {
     loginVerifyPasskey(challengeToken: string, response: Record<string, unknown>): Promise<{
         token: string;
     }>;
+    /**
+     * Usernameless (passkey-FIRST) login — step 1. Fetches discoverable-
+     * credential assertion options (EMPTY `allowCredentials`); the caller
+     * feeds `optionsJSON` to `@simplewebauthn/browser` `startAuthentication`
+     * and the browser's own passkey picker takes over. PUBLIC (pre-session,
+     * no challenge token — the WebAuthn challenge is the whole state).
+     */
+    passkeyLoginBegin(): Promise<{
+        optionsJSON: Record<string, unknown>;
+    }>;
+    /**
+     * Usernameless login — step 2. Submits the browser assertion; on
+     * success the server resolves the credential's owner and mints the
+     * real session JWT, which we set as the active token on this client.
+     *
+     * Second-factor aware (mirrors `login`): when the account still has a
+     * second factor to satisfy (TOTP — 2FA applies uniformly after any
+     * primary method), the server returns a short-lived CHALLENGE token +
+     * `secondFactors`. That token is NOT persisted as the active session
+     * — the caller completes the remaining factor via `loginVerifyTotp`.
+     */
+    passkeyLoginFinish(response: Record<string, unknown>): Promise<{
+        token: string;
+        requiresTotp?: boolean;
+        secondFactors?: readonly SecondFactorKind[];
+    }>;
     logout(): Promise<void>;
     getMe(): Promise<UserInfo>;
     changeOwnPassword(input: {
@@ -259,6 +285,19 @@ export declare class System {
     }): Promise<{
         success: true;
     }>;
+    /**
+     * Own passkey second-factor preference (opt-in, default OFF).
+     * Enrolling a passkey only enables passkey-first sign-in; this flag
+     * additionally demands the passkey after every password login.
+     */
+    getOwnPasskeySecondFactorPreference(): Promise<{
+        enabled: boolean;
+    }>;
+    setOwnPasskeySecondFactorPreference(input: {
+        enabled: boolean;
+    }): Promise<{
+        success: true;
+    }>;
     /** Update the auth token (e.g. after login or token refresh). */
     setToken(token: string): void;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/sdk",
-  "version": "1.1.20",
+  "version": "1.1.22",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",