@camstack/types 1.1.37 → 1.1.39

package/dist/capabilities/user-passkeys.cap.d.ts

@@ -40,6 +40,15 @@ import { type InferProvider } from './capability-definition.js';
  *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
  *      - `removePasskey({userId, credentialId})` — revoke one credential.
  *
+ *   4. Second-factor preference (opt-in, default OFF):
+ *      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+ *      demanded as a second factor after a password login ONLY when the
+ *      user explicitly opts in via `setSecondFactorPreference`.
+ *      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+ *        row ⇒ `enabled: false`).
+ *      - `setSecondFactorPreference({userId, enabled})` — persisted by
+ *        the providing addon beside its credentials.
+ *
  * Challenges are short-lived (5 min, in-memory). The cap is internal —
  * the admin-ui composes the begin/finish round-trip and never exposes
  * the cap to non-admins.
@@ -107,6 +116,17 @@ export declare const userPasskeysCapability: {
         }, z.core.$strip>, z.ZodObject<{
             success: z.ZodLiteral<true>;
         }, z.core.$strip>, "mutation">;
+        readonly getSecondFactorPreference: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly setSecondFactorPreference: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
     };
 };
 export type IUserPasskeysProvider = InferProvider<typeof userPasskeysCapability>;

package/dist/generated/addon-api.d.ts

@@ -714,6 +714,44 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        exchangeSession: import("@trpc/server").TRPCMutationProcedure<{
+            input: Record<string, never> | undefined;
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        createHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                code: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        redeemHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                code: string;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
         me: import("@trpc/server").TRPCQueryProcedure<{
             input: void;
             output: {
@@ -810,6 +848,22 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
         createShareToken: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 scope: {
@@ -14196,6 +14250,27 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getSecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+            };
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setSecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
     }>>;
     vacuumControl: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -15542,6 +15617,44 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        exchangeSession: import("@trpc/server").TRPCMutationProcedure<{
+            input: Record<string, never> | undefined;
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
+        createHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: void;
+            output: {
+                code: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        redeemHandoffCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                code: string;
+            };
+            output: {
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                requiresTotp?: boolean | undefined;
+                secondFactors?: ("totp" | "passkey")[] | undefined;
+            };
+            meta: object;
+        }>;
         me: import("@trpc/server").TRPCQueryProcedure<{
             input: void;
             output: {
@@ -15638,6 +15751,22 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
         createShareToken: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 scope: {
@@ -29024,6 +29153,27 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getSecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+            };
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setSecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
     }>>;
     vacuumControl: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 732 method paths across 112 capabilities.
+ * Coverage: 734 method paths across 112 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/index.js

@@ -19175,6 +19175,15 @@ getTurnServers: require_sleep.method(zod.z.void(), zod.z.array(TurnServerSchema)
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -19248,6 +19257,15 @@ response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.object({ enabled: zod.z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: require_sleep.method(zod.z.object({
+			userId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -27948,6 +27966,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27960,6 +27984,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/index.mjs

@@ -19174,6 +19174,15 @@ getTurnServers: method(z.void(), z.array(TurnServerSchema).readonly()) }
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -19247,6 +19256,15 @@ response: z.record(z.string(), z.unknown()) }), z.object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(z.object({ userId: z.string() }), z.object({ enabled: z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(z.object({
+			userId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -27947,6 +27965,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27959,6 +27983,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.1.37",
+  "version": "1.1.39",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",