@robosystems/core 0.8.0 → 0.8.1

package/auth-core/client.d.ts

@@ -87,11 +87,17 @@ export declare class RoboSystemsAuthClient {
     /** Passwordless login: assertion → session. */
     completePasskeyLogin(assertion: Record<string, unknown>): Promise<AuthResponse>;
     /**
-     * Begin enrollment. Authenticated settings flow omits `mfaToken`; the
-     * forced-enrollment lane passes the token from an
-     * `mfa_enrollment_required` login.
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
      */
-    getPasskeyRegistrationOptions(mfaToken?: string): Promise<Record<string, unknown>>;
+    getPasskeyRegistrationOptions(proof?: {
+        mfaToken?: string;
+        password?: string;
+        assertion?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
     /**
      * Finish enrollment. First passkey returns recovery codes (once); in the
      * forced-enrollment lane the result carries the completed login and the

package/auth-core/client.js

@@ -570,14 +570,22 @@ export class RoboSystemsAuthClient {
         return this.finalizeAuthResponse(response.data);
     }
     /**
-     * Begin enrollment. Authenticated settings flow omits `mfaToken`; the
-     * forced-enrollment lane passes the token from an
-     * `mfa_enrollment_required` login.
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
      */
-    async getPasskeyRegistrationOptions(mfaToken) {
+    async getPasskeyRegistrationOptions(proof) {
         const response = await getPasskeyRegistrationOptions({
             client: this.client,
-            body: { mfa_token: mfaToken },
+            // The proof fields land in client 1.11's generated request model;
+            // until the regen they ride as extra JSON properties, hence the cast.
+            body: {
+                mfa_token: proof === null || proof === void 0 ? void 0 : proof.mfaToken,
+                password: proof === null || proof === void 0 ? void 0 : proof.password,
+                assertion: proof === null || proof === void 0 ? void 0 : proof.assertion,
+            },
         });
         return response.data.options;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,