@camstack/sdk 1.1.21 → 1.1.22

package/dist/index.cjs

@@ -993,12 +993,19 @@ var System = class {
 	* Usernameless login — step 2. Submits the browser assertion; on
 	* success the server resolves the credential's owner and mints the
 	* real session JWT, which we set as the active token on this client.
+	*
+	* Second-factor aware (mirrors `login`): when the account still has a
+	* second factor to satisfy (TOTP — 2FA applies uniformly after any
+	* primary method), the server returns a short-lived CHALLENGE token +
+	* `secondFactors`. That token is NOT persisted as the active session
+	* — the caller completes the remaining factor via `loginVerifyTotp`.
 	*/
 	async passkeyLoginFinish(response) {
 		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
 		if (typeof result === "object" && result !== null && "token" in result) {
-			const token = result.token;
-			if (typeof token === "string") this.setToken(token);
+			const r = result;
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof r.token === "string" && !requiresSecondFactor) this.setToken(r.token);
 		}
 		return result;
 	}
@@ -1035,6 +1042,17 @@ var System = class {
 	async removeOwnPasskey(input) {
 		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
 	}
+	/**
+	* Own passkey second-factor preference (opt-in, default OFF).
+	* Enrolling a passkey only enables passkey-first sign-in; this flag
+	* additionally demands the passkey after every password login.
+	*/
+	async getOwnPasskeySecondFactorPreference() {
+		return await this._trpcClient.auth.getOwnPasskeySecondFactorPreference.query();
+	}
+	async setOwnPasskeySecondFactorPreference(input) {
+		return await this._trpcClient.auth.setOwnPasskeySecondFactorPreference.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/index.js

@@ -992,12 +992,19 @@ var System = class {
 	* Usernameless login — step 2. Submits the browser assertion; on
 	* success the server resolves the credential's owner and mints the
 	* real session JWT, which we set as the active token on this client.
+	*
+	* Second-factor aware (mirrors `login`): when the account still has a
+	* second factor to satisfy (TOTP — 2FA applies uniformly after any
+	* primary method), the server returns a short-lived CHALLENGE token +
+	* `secondFactors`. That token is NOT persisted as the active session
+	* — the caller completes the remaining factor via `loginVerifyTotp`.
 	*/
 	async passkeyLoginFinish(response) {
 		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
 		if (typeof result === "object" && result !== null && "token" in result) {
-			const token = result.token;
-			if (typeof token === "string") this.setToken(token);
+			const r = result;
+			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
+			if (typeof r.token === "string" && !requiresSecondFactor) this.setToken(r.token);
 		}
 		return result;
 	}
@@ -1034,6 +1041,17 @@ var System = class {
 	async removeOwnPasskey(input) {
 		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
 	}
+	/**
+	* Own passkey second-factor preference (opt-in, default OFF).
+	* Enrolling a passkey only enables passkey-first sign-in; this flag
+	* additionally demands the passkey after every password login.
+	*/
+	async getOwnPasskeySecondFactorPreference() {
+		return await this._trpcClient.auth.getOwnPasskeySecondFactorPreference.query();
+	}
+	async setOwnPasskeySecondFactorPreference(input) {
+		return await this._trpcClient.auth.setOwnPasskeySecondFactorPreference.mutate(input);
+	}
 	/** Update the auth token (e.g. after login or token refresh). */
 	setToken(token) {
 		this.token = token;

package/dist/system.d.ts

@@ -233,9 +233,17 @@ export declare class System {
      * Usernameless login — step 2. Submits the browser assertion; on
      * success the server resolves the credential's owner and mints the
      * real session JWT, which we set as the active token on this client.
+     *
+     * Second-factor aware (mirrors `login`): when the account still has a
+     * second factor to satisfy (TOTP — 2FA applies uniformly after any
+     * primary method), the server returns a short-lived CHALLENGE token +
+     * `secondFactors`. That token is NOT persisted as the active session
+     * — the caller completes the remaining factor via `loginVerifyTotp`.
      */
     passkeyLoginFinish(response: Record<string, unknown>): Promise<{
         token: string;
+        requiresTotp?: boolean;
+        secondFactors?: readonly SecondFactorKind[];
     }>;
     logout(): Promise<void>;
     getMe(): Promise<UserInfo>;
@@ -277,6 +285,19 @@ export declare class System {
     }): Promise<{
         success: true;
     }>;
+    /**
+     * Own passkey second-factor preference (opt-in, default OFF).
+     * Enrolling a passkey only enables passkey-first sign-in; this flag
+     * additionally demands the passkey after every password login.
+     */
+    getOwnPasskeySecondFactorPreference(): Promise<{
+        enabled: boolean;
+    }>;
+    setOwnPasskeySecondFactorPreference(input: {
+        enabled: boolean;
+    }): Promise<{
+        success: true;
+    }>;
     /** Update the auth token (e.g. after login or token refresh). */
     setToken(token: string): void;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/sdk",
-  "version": "1.1.21",
+  "version": "1.1.22",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",