@spacelr/sdk 0.7.0 → 0.8.1

package/README.md

@@ -77,6 +77,56 @@ Notes:
 - Enabling/configuring cold-tier on a collection is an **admin** operation and
   is not part of this client SDK.
 
+## Passkey authentication (WebAuthn)
+
+The SDK never touches `navigator.credentials` and does not depend on
+`@simplewebauthn` in any way (no runtime, dev, or peer dependency). It only
+performs the HTTP `begin`/`verify` round trips against the gateway. The
+browser WebAuthn ceremony itself — calling `navigator.credentials.get()` /
+`navigator.credentials.create()` — is the caller's responsibility, typically
+via the optional `@simplewebauthn/browser` package:
+
+```bash
+npm install @simplewebauthn/browser   # optional, only needed for the ceremony
+```
+
+```typescript
+import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
+
+// --- Login ---
+const opts = await spacelr.auth.beginPasskeyLogin(email);
+// The SDK vendors its own self-contained WebAuthn JSON types (see
+// libs/sdk/src/types/auth.ts) so it never depends on `@simplewebauthn`.
+// Because of that, an `as` cast is ALWAYS required here — `@simplewebauthn/browser`
+// v13's `optionsJSON` parameter uses its own DOM literal-union/named types, which
+// the vendored types don't nominally match even though they're structurally identical.
+const assertion = await startAuthentication({ optionsJSON: opts as never });
+await spacelr.auth.verifyPasskeyLogin(assertion); // tokens stored, 'authenticated' emitted
+
+// --- Register (while already signed in) ---
+const regOpts = await spacelr.auth.beginPasskeyRegistration();
+const attestation = await startRegistration({ optionsJSON: regOpts as never }); // cast required, see above
+await spacelr.auth.verifyPasskeyRegistration(attestation, 'My Laptop');
+
+// --- Manage registered credentials ---
+const creds = await spacelr.auth.listPasskeys();
+await spacelr.auth.renamePasskey(creds[0].credentialId, 'Renamed');
+await spacelr.auth.deletePasskey(creds[0].credentialId);
+```
+
+Notes:
+- `beginPasskeyLogin` / `verifyPasskeyLogin` complete the passkey login flow;
+  on success tokens are stored and the SDK emits `authenticated`, the same as
+  `auth.login()`.
+- `beginPasskeyRegistration` / `verifyPasskeyRegistration` register a new
+  passkey for the current session; they don't emit auth events (the caller is
+  already signed in).
+- `listPasskeys`, `renamePasskey`, and `deletePasskey` manage the current
+  user's registered credentials.
+- `@simplewebauthn/browser` is entirely optional and only relevant to browser
+  consumers performing the ceremony — Node/server usage of the SDK never
+  needs it.
+
 ## Requirements
 
 - Node.js >= 18

package/dist/index.d.mts

@@ -146,6 +146,120 @@ interface TwoFactorVerifyParams {
     token: string;
     code: string;
 }
+/**
+ * Vendored WebAuthn JSON interfaces.
+ *
+ * These are SDK-owned structural interfaces (no `@simplewebauthn` import and
+ * no new dependency in `libs/sdk/package.json`), faithful to the W3C WebAuthn
+ * JSON serialization — the same shape as `@simplewebauthn/browser`'s
+ * `PublicKeyCredentialRequestOptionsJSON` / `AuthenticationResponseJSON` /
+ * `PublicKeyCredentialCreationOptionsJSON` / `RegistrationResponseJSON`.
+ * A browser caller passes these values into `@simplewebauthn/browser`'s
+ * `startAuthentication({ optionsJSON })` / `startRegistration({ optionsJSON })`.
+ * Because these are structurally-equivalent SDK-owned types rather than
+ * `@simplewebauthn`'s own types, an `as` cast at that call boundary is ALWAYS
+ * required — not only when the installed `@simplewebauthn` version differs.
+ * `@simplewebauthn/browser` v13's `optionsJSON` parameter is typed with DOM
+ * literal-union/named types (e.g. `PublicKeyCredentialRequestOptionsJSON`),
+ * which these vendored interfaces do not nominally match even when
+ * structurally identical, so TypeScript will not accept them without a cast.
+ */
+/** A public key credential descriptor in its JSON wire form. */
+interface PasskeyCredentialDescriptorJSON {
+    id: string;
+    type: string;
+    transports?: string[];
+}
+/** WebAuthn assertion (`navigator.credentials.get`) request options, JSON form. */
+interface PasskeyAuthenticationOptionsJSON {
+    challenge: string;
+    rpId?: string;
+    timeout?: number;
+    userVerification?: string;
+    allowCredentials?: PasskeyCredentialDescriptorJSON[];
+    extensions?: Record<string, unknown>;
+}
+/** WebAuthn assertion (`navigator.credentials.get`) response, JSON form. */
+interface PasskeyAuthenticationResponseJSON {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string;
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
+}
+/** WebAuthn attestation (`navigator.credentials.create`) request options, JSON form. */
+interface PasskeyRegistrationOptionsJSON {
+    challenge: string;
+    rp: {
+        id?: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    pubKeyCredParams: Array<{
+        type: string;
+        alg: number;
+    }>;
+    timeout?: number;
+    excludeCredentials?: PasskeyCredentialDescriptorJSON[];
+    authenticatorSelection?: Record<string, unknown>;
+    attestation?: string;
+    extensions?: Record<string, unknown>;
+}
+/** WebAuthn attestation (`navigator.credentials.create`) response, JSON form. */
+interface PasskeyRegistrationResponseJSON {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        transports?: string[];
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
+}
+/**
+ * Response returned by the passkey login flow.
+ *
+ * This is intentionally a SEPARATE type from `LoginResponse`, not an alias:
+ * the gateway's passkey mapper drops `user.sub`/`user.username`, returning
+ * only `{ id, email, roles }`, so `LoginResponse` (which requires `user.sub`)
+ * would not structurally match.
+ */
+interface PasskeyLoginResponse {
+    user: {
+        id: string;
+        email: string;
+        roles: string[];
+    };
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+/** Result of verifying a passkey registration attestation. */
+interface PasskeyRegistrationResult {
+    verified: boolean;
+}
+/** A registered passkey credential, as returned by the credential-list endpoint. */
+interface PasskeyCredential {
+    credentialId: string;
+    label?: string;
+    deviceType?: string;
+    backedUp?: boolean;
+    transports?: string[];
+    createdAt: string;
+    lastUsedAt?: string;
+}
 
 interface TokenStorage {
     getTokens(): Promise<StoredTokens | null>;
@@ -292,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */
@@ -703,6 +825,45 @@ declare class AuthModule {
      * Call this after catching SpacelrTwoFactorRequiredError from login().
      */
     verifyTwoFactor(params: TwoFactorVerifyParams): Promise<LoginResponse>;
+    /**
+     * Fetch WebAuthn assertion options to start a passkey login.
+     * Pass `email` to scope the challenge to a known user's registered
+     * credentials; omit it for a discoverable-credential (usernameless) flow.
+     */
+    beginPasskeyLogin(email?: string): Promise<PasskeyAuthenticationOptionsJSON>;
+    /**
+     * Verify a WebAuthn assertion produced by `navigator.credentials.get()`
+     * against the options returned by `beginPasskeyLogin()`, completing login.
+     */
+    verifyPasskeyLogin(response: PasskeyAuthenticationResponseJSON): Promise<PasskeyLoginResponse>;
+    /**
+     * Fetch WebAuthn attestation options to register a new passkey for the
+     * currently authenticated user.
+     */
+    beginPasskeyRegistration(): Promise<PasskeyRegistrationOptionsJSON>;
+    /**
+     * Verify a WebAuthn attestation produced by `navigator.credentials.create()`
+     * against the options returned by `beginPasskeyRegistration()`, saving the
+     * new credential under the current user. This does not issue tokens or
+     * change auth state — the caller is already authenticated.
+     */
+    verifyPasskeyRegistration(response: PasskeyRegistrationResponseJSON, label?: string): Promise<PasskeyRegistrationResult>;
+    /**
+     * List the WebAuthn passkey credentials registered for the current user.
+     */
+    listPasskeys(): Promise<PasskeyCredential[]>;
+    /**
+     * Rename a registered passkey credential (e.g. "My Laptop").
+     */
+    renamePasskey(credentialId: string, label: string): Promise<{
+        renamed: true;
+    }>;
+    /**
+     * Delete a registered passkey credential.
+     */
+    deletePasskey(credentialId: string): Promise<{
+        deleted: true;
+    }>;
     private storeTokensFromLogin;
     private storeTokensFromRegister;
 }
@@ -1582,4 +1743,4 @@ interface SpacelrClient {
 }
 declare function createClient(config: SpacelrClientConfig): SpacelrClient;
 
-export { type ApiResponse, type AuthLostReason, type AuthState, type AuthStateListener, type AuthorizationUrlParams, BrowserTokenStorage, CodeChallengeMethod, type ConnectionState, CursorInvalidError, type CursorStorage, type DatabaseChangeEvent, type DownloadUrlResponse, type ExchangeCodeParams, type FileInfo, type FileListResponse, FileVisibility, ForbiddenError, type FunctionInvokeOptions, type FunctionInvokeResult, type GapReason, GrantType, type InitMultipartUploadParams, type InitMultipartUploadResponse, type JWK, type JWKSResponse, type ListFilesParams, type LoginParams, type LoginResponse, MemoryTokenStorage, NotFoundError, type OpenIDConfiguration, type PKCEChallenge, type PartEtag, type PushSubscriptionInfo, type QuotaInfo, type RegisterParams, type RegisterResponse, type Schedule, type ScheduleInvokeOptions, type ScheduleListOptions, type ScheduleStatus, type SearchOptions, ServerConfigError, type ShareFileParams, SharePermission, SpacelrAuthError, type SpacelrClient, type SpacelrClientConfig, SpacelrEmailVerificationRequiredError, SpacelrError, SpacelrNetworkError, SpacelrSearchFilterRequiredError, SpacelrTimeoutError, SpacelrTwoFactorRequiredError, type StoredTokens, type StreamGapInfo, type StreamSubscription, type SubscribeEventsHandlers, type SubscribeHandlers, type SubscribeWithSnapshotOptions, type TimelineAndFilter, TimelineError, type TimelineFieldFilter, type TimelineFilter, type TimelineLeafFilter, TimelineModule, type TimelineOrderBy, type TimelineQueryOptions, type TimelineQueryResponse, type TimelineScalar, type TimelineSourceStats, TimeoutError, type TokenResponse, type TokenStorage, type TwoFactorResponse, type TwoFactorVerifyParams, type UnshareFileParams, type UploadFileParams, type UploadLargeFileParams, type UploadProgress, type UserInfo, type UserProfile, ValidationError, type VapidKeyResponse, createClient, generatePKCEChallenge, localStorageCursorStorage, memoryCursorStorage };
+export { type ApiResponse, type AuthLostReason, type AuthState, type AuthStateListener, type AuthorizationUrlParams, BrowserTokenStorage, CodeChallengeMethod, type ConnectionState, CursorInvalidError, type CursorStorage, type DatabaseChangeEvent, type DownloadUrlResponse, type ExchangeCodeParams, type FileInfo, type FileListResponse, FileVisibility, ForbiddenError, type FunctionInvokeOptions, type FunctionInvokeResult, type GapReason, GrantType, type InitMultipartUploadParams, type InitMultipartUploadResponse, type JWK, type JWKSResponse, type ListFilesParams, type LoginParams, type LoginResponse, MemoryTokenStorage, NotFoundError, type OpenIDConfiguration, type PKCEChallenge, type PartEtag, type PasskeyAuthenticationOptionsJSON, type PasskeyAuthenticationResponseJSON, type PasskeyCredential, type PasskeyCredentialDescriptorJSON, type PasskeyLoginResponse, type PasskeyRegistrationOptionsJSON, type PasskeyRegistrationResponseJSON, type PasskeyRegistrationResult, type PushSubscriptionInfo, type QuotaInfo, type RegisterParams, type RegisterResponse, type Schedule, type ScheduleInvokeOptions, type ScheduleListOptions, type ScheduleStatus, type SearchOptions, ServerConfigError, type ShareFileParams, SharePermission, SpacelrAuthError, type SpacelrClient, type SpacelrClientConfig, SpacelrEmailVerificationRequiredError, SpacelrError, SpacelrNetworkError, SpacelrSearchFilterRequiredError, SpacelrTimeoutError, SpacelrTwoFactorRequiredError, type StoredTokens, type StreamGapInfo, type StreamSubscription, type SubscribeEventsHandlers, type SubscribeHandlers, type SubscribeWithSnapshotOptions, type TimelineAndFilter, TimelineError, type TimelineFieldFilter, type TimelineFilter, type TimelineLeafFilter, TimelineModule, type TimelineOrderBy, type TimelineQueryOptions, type TimelineQueryResponse, type TimelineScalar, type TimelineSourceStats, TimeoutError, type TokenResponse, type TokenStorage, type TwoFactorResponse, type TwoFactorVerifyParams, type UnshareFileParams, type UploadFileParams, type UploadLargeFileParams, type UploadProgress, type UserInfo, type UserProfile, ValidationError, type VapidKeyResponse, createClient, generatePKCEChallenge, localStorageCursorStorage, memoryCursorStorage };

package/dist/index.d.ts

@@ -146,6 +146,120 @@ interface TwoFactorVerifyParams {
     token: string;
     code: string;
 }
+/**
+ * Vendored WebAuthn JSON interfaces.
+ *
+ * These are SDK-owned structural interfaces (no `@simplewebauthn` import and
+ * no new dependency in `libs/sdk/package.json`), faithful to the W3C WebAuthn
+ * JSON serialization — the same shape as `@simplewebauthn/browser`'s
+ * `PublicKeyCredentialRequestOptionsJSON` / `AuthenticationResponseJSON` /
+ * `PublicKeyCredentialCreationOptionsJSON` / `RegistrationResponseJSON`.
+ * A browser caller passes these values into `@simplewebauthn/browser`'s
+ * `startAuthentication({ optionsJSON })` / `startRegistration({ optionsJSON })`.
+ * Because these are structurally-equivalent SDK-owned types rather than
+ * `@simplewebauthn`'s own types, an `as` cast at that call boundary is ALWAYS
+ * required — not only when the installed `@simplewebauthn` version differs.
+ * `@simplewebauthn/browser` v13's `optionsJSON` parameter is typed with DOM
+ * literal-union/named types (e.g. `PublicKeyCredentialRequestOptionsJSON`),
+ * which these vendored interfaces do not nominally match even when
+ * structurally identical, so TypeScript will not accept them without a cast.
+ */
+/** A public key credential descriptor in its JSON wire form. */
+interface PasskeyCredentialDescriptorJSON {
+    id: string;
+    type: string;
+    transports?: string[];
+}
+/** WebAuthn assertion (`navigator.credentials.get`) request options, JSON form. */
+interface PasskeyAuthenticationOptionsJSON {
+    challenge: string;
+    rpId?: string;
+    timeout?: number;
+    userVerification?: string;
+    allowCredentials?: PasskeyCredentialDescriptorJSON[];
+    extensions?: Record<string, unknown>;
+}
+/** WebAuthn assertion (`navigator.credentials.get`) response, JSON form. */
+interface PasskeyAuthenticationResponseJSON {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string;
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
+}
+/** WebAuthn attestation (`navigator.credentials.create`) request options, JSON form. */
+interface PasskeyRegistrationOptionsJSON {
+    challenge: string;
+    rp: {
+        id?: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    pubKeyCredParams: Array<{
+        type: string;
+        alg: number;
+    }>;
+    timeout?: number;
+    excludeCredentials?: PasskeyCredentialDescriptorJSON[];
+    authenticatorSelection?: Record<string, unknown>;
+    attestation?: string;
+    extensions?: Record<string, unknown>;
+}
+/** WebAuthn attestation (`navigator.credentials.create`) response, JSON form. */
+interface PasskeyRegistrationResponseJSON {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        transports?: string[];
+    };
+    clientExtensionResults?: Record<string, unknown>;
+    authenticatorAttachment?: string;
+}
+/**
+ * Response returned by the passkey login flow.
+ *
+ * This is intentionally a SEPARATE type from `LoginResponse`, not an alias:
+ * the gateway's passkey mapper drops `user.sub`/`user.username`, returning
+ * only `{ id, email, roles }`, so `LoginResponse` (which requires `user.sub`)
+ * would not structurally match.
+ */
+interface PasskeyLoginResponse {
+    user: {
+        id: string;
+        email: string;
+        roles: string[];
+    };
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+/** Result of verifying a passkey registration attestation. */
+interface PasskeyRegistrationResult {
+    verified: boolean;
+}
+/** A registered passkey credential, as returned by the credential-list endpoint. */
+interface PasskeyCredential {
+    credentialId: string;
+    label?: string;
+    deviceType?: string;
+    backedUp?: boolean;
+    transports?: string[];
+    createdAt: string;
+    lastUsedAt?: string;
+}
 
 interface TokenStorage {
     getTokens(): Promise<StoredTokens | null>;
@@ -292,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */
@@ -703,6 +825,45 @@ declare class AuthModule {
      * Call this after catching SpacelrTwoFactorRequiredError from login().
      */
     verifyTwoFactor(params: TwoFactorVerifyParams): Promise<LoginResponse>;
+    /**
+     * Fetch WebAuthn assertion options to start a passkey login.
+     * Pass `email` to scope the challenge to a known user's registered
+     * credentials; omit it for a discoverable-credential (usernameless) flow.
+     */
+    beginPasskeyLogin(email?: string): Promise<PasskeyAuthenticationOptionsJSON>;
+    /**
+     * Verify a WebAuthn assertion produced by `navigator.credentials.get()`
+     * against the options returned by `beginPasskeyLogin()`, completing login.
+     */
+    verifyPasskeyLogin(response: PasskeyAuthenticationResponseJSON): Promise<PasskeyLoginResponse>;
+    /**
+     * Fetch WebAuthn attestation options to register a new passkey for the
+     * currently authenticated user.
+     */
+    beginPasskeyRegistration(): Promise<PasskeyRegistrationOptionsJSON>;
+    /**
+     * Verify a WebAuthn attestation produced by `navigator.credentials.create()`
+     * against the options returned by `beginPasskeyRegistration()`, saving the
+     * new credential under the current user. This does not issue tokens or
+     * change auth state — the caller is already authenticated.
+     */
+    verifyPasskeyRegistration(response: PasskeyRegistrationResponseJSON, label?: string): Promise<PasskeyRegistrationResult>;
+    /**
+     * List the WebAuthn passkey credentials registered for the current user.
+     */
+    listPasskeys(): Promise<PasskeyCredential[]>;
+    /**
+     * Rename a registered passkey credential (e.g. "My Laptop").
+     */
+    renamePasskey(credentialId: string, label: string): Promise<{
+        renamed: true;
+    }>;
+    /**
+     * Delete a registered passkey credential.
+     */
+    deletePasskey(credentialId: string): Promise<{
+        deleted: true;
+    }>;
     private storeTokensFromLogin;
     private storeTokensFromRegister;
 }
@@ -1582,4 +1743,4 @@ interface SpacelrClient {
 }
 declare function createClient(config: SpacelrClientConfig): SpacelrClient;
 
-export { type ApiResponse, type AuthLostReason, type AuthState, type AuthStateListener, type AuthorizationUrlParams, BrowserTokenStorage, CodeChallengeMethod, type ConnectionState, CursorInvalidError, type CursorStorage, type DatabaseChangeEvent, type DownloadUrlResponse, type ExchangeCodeParams, type FileInfo, type FileListResponse, FileVisibility, ForbiddenError, type FunctionInvokeOptions, type FunctionInvokeResult, type GapReason, GrantType, type InitMultipartUploadParams, type InitMultipartUploadResponse, type JWK, type JWKSResponse, type ListFilesParams, type LoginParams, type LoginResponse, MemoryTokenStorage, NotFoundError, type OpenIDConfiguration, type PKCEChallenge, type PartEtag, type PushSubscriptionInfo, type QuotaInfo, type RegisterParams, type RegisterResponse, type Schedule, type ScheduleInvokeOptions, type ScheduleListOptions, type ScheduleStatus, type SearchOptions, ServerConfigError, type ShareFileParams, SharePermission, SpacelrAuthError, type SpacelrClient, type SpacelrClientConfig, SpacelrEmailVerificationRequiredError, SpacelrError, SpacelrNetworkError, SpacelrSearchFilterRequiredError, SpacelrTimeoutError, SpacelrTwoFactorRequiredError, type StoredTokens, type StreamGapInfo, type StreamSubscription, type SubscribeEventsHandlers, type SubscribeHandlers, type SubscribeWithSnapshotOptions, type TimelineAndFilter, TimelineError, type TimelineFieldFilter, type TimelineFilter, type TimelineLeafFilter, TimelineModule, type TimelineOrderBy, type TimelineQueryOptions, type TimelineQueryResponse, type TimelineScalar, type TimelineSourceStats, TimeoutError, type TokenResponse, type TokenStorage, type TwoFactorResponse, type TwoFactorVerifyParams, type UnshareFileParams, type UploadFileParams, type UploadLargeFileParams, type UploadProgress, type UserInfo, type UserProfile, ValidationError, type VapidKeyResponse, createClient, generatePKCEChallenge, localStorageCursorStorage, memoryCursorStorage };
+export { type ApiResponse, type AuthLostReason, type AuthState, type AuthStateListener, type AuthorizationUrlParams, BrowserTokenStorage, CodeChallengeMethod, type ConnectionState, CursorInvalidError, type CursorStorage, type DatabaseChangeEvent, type DownloadUrlResponse, type ExchangeCodeParams, type FileInfo, type FileListResponse, FileVisibility, ForbiddenError, type FunctionInvokeOptions, type FunctionInvokeResult, type GapReason, GrantType, type InitMultipartUploadParams, type InitMultipartUploadResponse, type JWK, type JWKSResponse, type ListFilesParams, type LoginParams, type LoginResponse, MemoryTokenStorage, NotFoundError, type OpenIDConfiguration, type PKCEChallenge, type PartEtag, type PasskeyAuthenticationOptionsJSON, type PasskeyAuthenticationResponseJSON, type PasskeyCredential, type PasskeyCredentialDescriptorJSON, type PasskeyLoginResponse, type PasskeyRegistrationOptionsJSON, type PasskeyRegistrationResponseJSON, type PasskeyRegistrationResult, type PushSubscriptionInfo, type QuotaInfo, type RegisterParams, type RegisterResponse, type Schedule, type ScheduleInvokeOptions, type ScheduleListOptions, type ScheduleStatus, type SearchOptions, ServerConfigError, type ShareFileParams, SharePermission, SpacelrAuthError, type SpacelrClient, type SpacelrClientConfig, SpacelrEmailVerificationRequiredError, SpacelrError, SpacelrNetworkError, SpacelrSearchFilterRequiredError, SpacelrTimeoutError, SpacelrTwoFactorRequiredError, type StoredTokens, type StreamGapInfo, type StreamSubscription, type SubscribeEventsHandlers, type SubscribeHandlers, type SubscribeWithSnapshotOptions, type TimelineAndFilter, TimelineError, type TimelineFieldFilter, type TimelineFilter, type TimelineLeafFilter, TimelineModule, type TimelineOrderBy, type TimelineQueryOptions, type TimelineQueryResponse, type TimelineScalar, type TimelineSourceStats, TimeoutError, type TokenResponse, type TokenStorage, type TwoFactorResponse, type TwoFactorVerifyParams, type UnshareFileParams, type UploadFileParams, type UploadLargeFileParams, type UploadProgress, type UserInfo, type UserProfile, ValidationError, type VapidKeyResponse, createClient, generatePKCEChallenge, localStorageCursorStorage, memoryCursorStorage };

package/dist/index.js

@@ -158,7 +158,7 @@ var HttpClient = class {
       });
       const responseBody = await this.parseResponse(response);
       if (!response.ok) {
-        if (options.authenticated && response.status === 401) {
+        if (options.authenticated && response.status === 401 && !options.skipAuthRefresh) {
           if (await this.recoverFromAuthFailure(isRetry)) {
             return this.requestWithRetry(options, true);
           }
@@ -1438,7 +1438,11 @@ var AuthModule = class {
       await this.http.request({
         method: "POST",
         path: "/auth/logout",
-        authenticated: true
+        authenticated: true,
+        // A 401 here means the session is already gone — do not trigger the
+        // refresh/auth-lost recovery, or an auth-lost handler that calls
+        // logout would recurse into an endless 401 loop.
+        skipAuthRefresh: true
       });
     } catch {
     }
@@ -1590,6 +1594,88 @@ var AuthModule = class {
     await this.storeTokensFromLogin(response);
     return response;
   }
+  /**
+   * Fetch WebAuthn assertion options to start a passkey login.
+   * Pass `email` to scope the challenge to a known user's registered
+   * credentials; omit it for a discoverable-credential (usernameless) flow.
+   */
+  async beginPasskeyLogin(email) {
+    return this.http.request({
+      method: "POST",
+      path: "/auth/passkey/login/options",
+      body: email ? { email } : {}
+    });
+  }
+  /**
+   * Verify a WebAuthn assertion produced by `navigator.credentials.get()`
+   * against the options returned by `beginPasskeyLogin()`, completing login.
+   */
+  async verifyPasskeyLogin(response) {
+    const result = await this.http.request({
+      method: "POST",
+      path: "/auth/passkey/login/verify",
+      body: { response }
+    });
+    await this.storeTokensFromLogin(result);
+    return result;
+  }
+  /**
+   * Fetch WebAuthn attestation options to register a new passkey for the
+   * currently authenticated user.
+   */
+  async beginPasskeyRegistration() {
+    return this.http.request({
+      method: "POST",
+      path: "/auth/passkey/register/options",
+      authenticated: true,
+      body: {}
+    });
+  }
+  /**
+   * Verify a WebAuthn attestation produced by `navigator.credentials.create()`
+   * against the options returned by `beginPasskeyRegistration()`, saving the
+   * new credential under the current user. This does not issue tokens or
+   * change auth state — the caller is already authenticated.
+   */
+  async verifyPasskeyRegistration(response, label) {
+    return this.http.request({
+      method: "POST",
+      path: "/auth/passkey/register/verify",
+      authenticated: true,
+      body: { response, label }
+    });
+  }
+  /**
+   * List the WebAuthn passkey credentials registered for the current user.
+   */
+  async listPasskeys() {
+    return this.http.request({
+      method: "GET",
+      path: "/auth/passkey/credentials",
+      authenticated: true
+    });
+  }
+  /**
+   * Rename a registered passkey credential (e.g. "My Laptop").
+   */
+  async renamePasskey(credentialId, label) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,
+      authenticated: true,
+      body: { label }
+    });
+  }
+  /**
+   * Delete a registered passkey credential.
+   */
+  async deletePasskey(credentialId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,
+      authenticated: true
+    });
+  }
   async storeTokensFromLogin(response) {
     const expiresAt = response.expires_in ? Math.floor(Date.now() / 1e3) + response.expires_in : void 0;
     await this.tokenManager.setTokens({