@camstack/types 1.1.36 → 1.1.38

package/dist/capabilities/user-passkeys.cap.d.ts

@@ -23,6 +23,19 @@ import { type InferProvider } from './capability-definition.js';
  *      b. `finishAuthentication({userId, response})` → server verifies
  *         the assertion, bumps the credential counter, returns ok.
  *
+ *   2b. Usernameless (discoverable-credential) authentication — the
+ *       passkey IS the primary factor, no password leg:
+ *       a. `beginDiscoverableAuthentication({})` → assertion options with
+ *          EMPTY `allowCredentials` (the browser offers every resident
+ *          passkey it holds for this RP) + `userVerification: 'required'`
+ *          (the passkey replaces both factors, so UV is mandatory).
+ *          The challenge is stored server-side, NOT bound to any user.
+ *       b. `finishDiscoverableAuthentication({response})` → the provider
+ *          resolves the credential by the response's credential id,
+ *          verifies the assertion against the stored challenge + that
+ *          credential's public key/counter, and returns the OWNING
+ *          `userId` — the caller (core auth router) mints the session.
+ *
  *   3. Management:
  *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
  *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -70,6 +83,15 @@ export declare const userPasskeysCapability: {
         }, z.core.$strip>, z.ZodObject<{
             verified: z.ZodBoolean;
         }, z.core.$strip>, "mutation">;
+        readonly beginDiscoverableAuthentication: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            optionsJSON: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>, "mutation">;
+        readonly finishDiscoverableAuthentication: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>, z.ZodObject<{
+            verified: z.ZodBoolean;
+            userId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>, "mutation">;
         readonly listPasskeys: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             userId: z.ZodString;
         }, z.core.$strip>, z.ZodArray<z.ZodObject<{

package/dist/generated/addon-api.d.ts

@@ -518,23 +518,14 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 category?: string | undefined;
                 limit?: number | undefined;
             } | undefined;
-            output: readonly import("@camstack/system").SystemEvent[];
+            output: readonly import("@camstack/types").SystemEvent[];
             meta: object;
         }>;
         onEvent: import("@trpc/server").TRPCSubscriptionProcedure<{
             input: {
                 category?: string | undefined;
             };
-            output: AsyncIterable<{
-                id: string;
-                timestamp: Date;
-                source: {
-                    type: string;
-                    id: string | number;
-                };
-                category: string;
-                data: Record<string, unknown>;
-            }, any, any>;
+            output: AsyncIterable<import("@camstack/types").SystemEvent, any, any>;
             meta: object;
         }>;
         onDeviceEvent: import("@trpc/server").TRPCSubscriptionProcedure<{
@@ -700,6 +691,67 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        passkeyLoginBegin: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                optionsJSON: Record<string, unknown>;
+            };
+            meta: object;
+        }>;
+        passkeyLoginFinish: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                response: Record<string, unknown>;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        exchangeSession: import("@trpc/server").TRPCMutationProcedure<{
+            input: Record<string, never> | undefined;
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        createHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                code: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        redeemHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                code: string;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
         me: import("@trpc/server").TRPCQueryProcedure<{
             input: void;
             output: {
@@ -796,6 +848,47 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        createShareToken: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                scope: {
+                    kind: "grid-view";
+                    deviceIds: number[];
+                };
+                ttlSec?: number | "never" | undefined;
+            };
+            output: {
+                id: string;
+                token: string;
+                expiresAt: number | null;
+            };
+            meta: object;
+        }>;
+        revokeShareToken: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                id: string;
+            };
+            output: {
+                success: boolean;
+            };
+            meta: object;
+        }>;
+        listShareTokens: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                id: string;
+                userId: string;
+                tokenPrefix: string;
+                scope: {
+                    kind: "grid-view";
+                    deviceIds: number[];
+                };
+                createdAt: number;
+                expiresAt: number | null;
+                neverExpires: boolean;
+                lastUsedAt?: number | undefined;
+            }[];
+            meta: object;
+        }>;
         logout: import("@trpc/server").TRPCMutationProcedure<{
             input: void;
             output: {
@@ -14096,6 +14189,26 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        beginDiscoverableAuthentication: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            };
+            output: {
+                optionsJSON: Record<string, unknown>;
+            };
+            meta: object;
+        }>;
+        finishDiscoverableAuthentication: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                response: Record<string, unknown>;
+            };
+            output: {
+                verified: boolean;
+                userId: string | null;
+            };
+            meta: object;
+        }>;
         listPasskeys: import("@trpc/server").TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;
@@ -14299,14 +14412,18 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             input: {
                 nodeId?: string | undefined;
             } | undefined;
-            output: any;
+            output: {
+                staticDir: string;
+            };
             meta: object;
         }>;
         getVersion: import("@trpc/server").TRPCQueryProcedure<{
             input: {
                 nodeId?: string | undefined;
             } | undefined;
-            output: any;
+            output: {
+                version: string;
+            };
             meta: object;
         }>;
     }>>;
@@ -15267,23 +15384,14 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 category?: string | undefined;
                 limit?: number | undefined;
             } | undefined;
-            output: readonly import("@camstack/system").SystemEvent[];
+            output: readonly import("@camstack/types").SystemEvent[];
             meta: object;
         }>;
         onEvent: import("@trpc/server").TRPCSubscriptionProcedure<{
             input: {
                 category?: string | undefined;
             };
-            output: AsyncIterable<{
-                id: string;
-                timestamp: Date;
-                source: {
-                    type: string;
-                    id: string | number;
-                };
-                category: string;
-                data: Record<string, unknown>;
-            }, any, any>;
+            output: AsyncIterable<import("@camstack/types").SystemEvent, any, any>;
             meta: object;
         }>;
         onDeviceEvent: import("@trpc/server").TRPCSubscriptionProcedure<{
@@ -15449,6 +15557,67 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        passkeyLoginBegin: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                optionsJSON: Record<string, unknown>;
+            };
+            meta: object;
+        }>;
+        passkeyLoginFinish: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                response: Record<string, unknown>;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        exchangeSession: import("@trpc/server").TRPCMutationProcedure<{
+            input: Record<string, never> | undefined;
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        createHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                code: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        redeemHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                code: string;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
         me: import("@trpc/server").TRPCQueryProcedure<{
             input: void;
             output: {
@@ -15545,6 +15714,47 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        createShareToken: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                scope: {
+                    kind: "grid-view";
+                    deviceIds: number[];
+                };
+                ttlSec?: number | "never" | undefined;
+            };
+            output: {
+                id: string;
+                token: string;
+                expiresAt: number | null;
+            };
+            meta: object;
+        }>;
+        revokeShareToken: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                id: string;
+            };
+            output: {
+                success: boolean;
+            };
+            meta: object;
+        }>;
+        listShareTokens: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                id: string;
+                userId: string;
+                tokenPrefix: string;
+                scope: {
+                    kind: "grid-view";
+                    deviceIds: number[];
+                };
+                createdAt: number;
+                expiresAt: number | null;
+                neverExpires: boolean;
+                lastUsedAt?: number | undefined;
+            }[];
+            meta: object;
+        }>;
         logout: import("@trpc/server").TRPCMutationProcedure<{
             input: void;
             output: {
@@ -28845,6 +29055,26 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        beginDiscoverableAuthentication: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            };
+            output: {
+                optionsJSON: Record<string, unknown>;
+            };
+            meta: object;
+        }>;
+        finishDiscoverableAuthentication: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                response: Record<string, unknown>;
+            };
+            output: {
+                verified: boolean;
+                userId: string | null;
+            };
+            meta: object;
+        }>;
         listPasskeys: import("@trpc/server").TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;
@@ -29048,14 +29278,18 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             input: {
                 nodeId?: string | undefined;
             } | undefined;
-            output: any;
+            output: {
+                staticDir: string;
+            };
             meta: object;
         }>;
         getVersion: import("@trpc/server").TRPCQueryProcedure<{
             input: {
                 nodeId?: string | undefined;
             } | undefined;
-            output: any;
+            output: {
+                version: string;
+            };
             meta: object;
         }>;
     }>>;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 730 method paths across 112 capabilities.
+ * Coverage: 732 method paths across 112 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/index.js

@@ -19158,6 +19158,19 @@ getTurnServers: require_sleep.method(zod.z.void(), zod.z.array(TurnServerSchema)
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -19214,6 +19227,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: require_sleep.method(zod.z.object({}), zod.z.object({ optionsJSON: zod.z.record(zod.z.string(), zod.z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: require_sleep.method(zod.z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
+			verified: zod.z.boolean(),
+			userId: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: require_sleep.method(zod.z.object({
 			userId: zod.z.string(),
@@ -27892,6 +27918,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27904,6 +27936,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/dist/index.mjs

@@ -19157,6 +19157,19 @@ getTurnServers: method(z.void(), z.array(TurnServerSchema).readonly()) }
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -19213,6 +19226,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(z.object({}), z.object({ optionsJSON: z.record(z.string(), z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: z.record(z.string(), z.unknown()) }), z.object({
+			verified: z.boolean(),
+			userId: z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(z.object({ userId: z.string() }), z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(z.object({
 			userId: z.string(),
@@ -27891,6 +27917,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27903,6 +27935,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.1.36",
+  "version": "1.1.38",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",