@w6w/sdk 0.5.0 → 0.9.8

package/dist/src/console/otp.d.ts

@@ -0,0 +1,127 @@
+/**
+ * `client.console.otp.*` — email one-time-code sign-in, a third standalone
+ * login option beside password and passkey (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **All three methods are PUBLIC — the login screen has no token.** Mirrors
+ * `console.passkeys`'s login pair exactly: each passes `requireAuth: false`,
+ * without which a tokenless client (the normal case at `/login`, before any
+ * session exists) would hit `requireToken`'s `ConfigError` before `fetch` is
+ * ever called. Wire pins are T2.1.1's contract §Wire pins, above its
+ * `requireTenantAdmin`-guarded `/tenant/login-flags` pair (see
+ * `./tenant-login-flags.ts`).
+ *
+ * **`OtpVerifyResponse` is a type ALIAS of `PasskeyAuthenticationVerifyResponse`,
+ * not a second declaration of the same four fields.** The server's
+ * `POST /auth/otp/verify` answers a byte-identical body to
+ * `id/passkey-login.ts`'s own verify route (T2.1.1's wire pin: "byte-shape
+ * identical to `id/user-login.ts`'s and `id/passkey-login.ts`'s"), and the
+ * passkey names (`PasskeyUser`, `PasskeyAuthenticationVerifyResponse`) are
+ * published and cannot be renamed — a third copy of the same shape would be a
+ * third thing to drift out of sync with the other two.
+ *
+ * @module
+ */
+import { type HttpResponse, type RequestOptions } from "../http.ts";
+import type { PasskeyAuthenticationVerifyResponse } from "./passkeys.ts";
+/**
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
+ * else. Structural rather than a concrete client type, so the namespace stays
+ * independently constructible in a test and this module never imports the
+ * client back — mirrors `PasskeysHost` in `./passkeys.ts`.
+ */
+export interface OtpHost {
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/**
+ * Which sign-in methods this tenant currently offers — `GET
+ * /auth/login-providers` (T2.1.1's wire pin). Read by `/login` to decide what
+ * to render; see `packages/studio/src/lib/login-providers.ts`'s
+ * `providerVisibility`, the one place that decision is made.
+ */
+export interface LoginProviders {
+    password: boolean;
+    passkey: boolean;
+    otp: boolean;
+}
+/**
+ * The user identity `verifyCode` mints a session for — the SAME shape
+ * `PasskeyAuthenticationVerifyResponse` already declares (see this module's
+ * header). A type alias, not a reuse of `console.auth`'s `LoginResponse`:
+ * that type's `user` does not carry `role`/`tenant`/`emailVerified`.
+ */
+export type OtpVerifyResponse = PasskeyAuthenticationVerifyResponse;
+/**
+ * The `console.otp` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * const client = new W6WClient({ baseUrl: "https://api.example.com" }); // no token — see below
+ * const { providers } = { providers: await client.console.otp.loginProviders() };
+ * if (providers.otp) {
+ *   await client.console.otp.requestCode({ email: "alice@example.com" });
+ *   const { token } = await client.console.otp.verifyCode({
+ *     email: "alice@example.com",
+ *     code: "123456",
+ *   });
+ * }
+ * ```
+ */
+export declare class OtpApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: OtpHost);
+    /**
+     * Which sign-in methods this tenant currently offers.
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). The `/login` screen calls this before any session
+     * exists, so a tokenless client must be able to reach it.
+     *
+     * @returns `{ password, passkey, otp }`, unwrapped from the `providers` envelope.
+     */
+    loginProviders(): Promise<LoginProviders>;
+    /**
+     * Request a one-time sign-in code by email.
+     *
+     * PUBLIC — sends no bearer (`requireAuth: false`). Answers `202 {ok: true}`
+     * ALWAYS, whether or not a user exists with that email (T2.1.1's wire pin)
+     * — this method discards that body and resolves `void`, since there is
+     * nothing informative in it for the caller to act on.
+     *
+     * @param input - The email to send the code to.
+     * @throws {ApiError} `403 otp_disabled` when the tenant's `otp_enabled` is
+     *   false; `400 invalid_body` for a non-object/non-string body.
+     */
+    requestCode(input: {
+        email: string;
+    }): Promise<void>;
+    /**
+     * Verify a one-time code and mint a session — a standalone alternative to
+     * a password, not a second factor, exactly like `console.passkeys`'s
+     * `authenticationVerify` (HITL-5 there).
+     *
+     * PUBLIC — sends no bearer (`requireAuth: false`).
+     *
+     * @param input - The email the code was requested for, and the code itself.
+     * @returns The token, the caller's identity, and the token's lifetime.
+     * @throws {ApiError} `401 otp_rejected` for every failure mode (T2.1.1's
+     *   wire pin) — an unknown email, an expired code, a wrong code and a
+     *   spent code are all indistinguishable to the caller.
+     */
+    verifyCode(input: {
+        email: string;
+        code: string;
+    }): Promise<OtpVerifyResponse>;
+}
+//# sourceMappingURL=otp.d.ts.map

package/dist/src/console/otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.d.ts","sourceRoot":"","sources":["../../../src/console/otp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,MAAM;;IAGjB;;OAEG;gBACS,IAAI,EAAE,OAAO;IAIzB;;;;;;;;OAQG;IACG,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC;IAS/C;;;;;;;;;;;OAWG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CASrF"}

package/dist/src/console/otp.js

@@ -0,0 +1,118 @@
+/**
+ * `client.console.otp.*` — email one-time-code sign-in, a third standalone
+ * login option beside password and passkey (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **All three methods are PUBLIC — the login screen has no token.** Mirrors
+ * `console.passkeys`'s login pair exactly: each passes `requireAuth: false`,
+ * without which a tokenless client (the normal case at `/login`, before any
+ * session exists) would hit `requireToken`'s `ConfigError` before `fetch` is
+ * ever called. Wire pins are T2.1.1's contract §Wire pins, above its
+ * `requireTenantAdmin`-guarded `/tenant/login-flags` pair (see
+ * `./tenant-login-flags.ts`).
+ *
+ * **`OtpVerifyResponse` is a type ALIAS of `PasskeyAuthenticationVerifyResponse`,
+ * not a second declaration of the same four fields.** The server's
+ * `POST /auth/otp/verify` answers a byte-identical body to
+ * `id/passkey-login.ts`'s own verify route (T2.1.1's wire pin: "byte-shape
+ * identical to `id/user-login.ts`'s and `id/passkey-login.ts`'s"), and the
+ * passkey names (`PasskeyUser`, `PasskeyAuthenticationVerifyResponse`) are
+ * published and cannot be renamed — a third copy of the same shape would be a
+ * third thing to drift out of sync with the other two.
+ *
+ * @module
+ */
+import {} from "../http.js";
+import { unwrap } from "../types.js";
+/**
+ * The `console.otp` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * const client = new W6WClient({ baseUrl: "https://api.example.com" }); // no token — see below
+ * const { providers } = { providers: await client.console.otp.loginProviders() };
+ * if (providers.otp) {
+ *   await client.console.otp.requestCode({ email: "alice@example.com" });
+ *   const { token } = await client.console.otp.verifyCode({
+ *     email: "alice@example.com",
+ *     code: "123456",
+ *   });
+ * }
+ * ```
+ */
+export class OtpApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * Which sign-in methods this tenant currently offers.
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). The `/login` screen calls this before any session
+     * exists, so a tokenless client must be able to reach it.
+     *
+     * @returns `{ password, passkey, otp }`, unwrapped from the `providers` envelope.
+     */
+    async loginProviders() {
+        const res = await this.#host.request({
+            method: "GET",
+            path: "/auth/login-providers",
+            requireAuth: false,
+        });
+        return unwrap(res, "providers");
+    }
+    /**
+     * Request a one-time sign-in code by email.
+     *
+     * PUBLIC — sends no bearer (`requireAuth: false`). Answers `202 {ok: true}`
+     * ALWAYS, whether or not a user exists with that email (T2.1.1's wire pin)
+     * — this method discards that body and resolves `void`, since there is
+     * nothing informative in it for the caller to act on.
+     *
+     * @param input - The email to send the code to.
+     * @throws {ApiError} `403 otp_disabled` when the tenant's `otp_enabled` is
+     *   false; `400 invalid_body` for a non-object/non-string body.
+     */
+    async requestCode(input) {
+        await this.#host.request({
+            method: "POST",
+            path: "/auth/otp/request",
+            body: input,
+            requireAuth: false,
+        });
+    }
+    /**
+     * Verify a one-time code and mint a session — a standalone alternative to
+     * a password, not a second factor, exactly like `console.passkeys`'s
+     * `authenticationVerify` (HITL-5 there).
+     *
+     * PUBLIC — sends no bearer (`requireAuth: false`).
+     *
+     * @param input - The email the code was requested for, and the code itself.
+     * @returns The token, the caller's identity, and the token's lifetime.
+     * @throws {ApiError} `401 otp_rejected` for every failure mode (T2.1.1's
+     *   wire pin) — an unknown email, an expired code, a wrong code and a
+     *   spent code are all indistinguishable to the caller.
+     */
+    async verifyCode(input) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/auth/otp/verify",
+            body: input,
+            requireAuth: false,
+        });
+        return res.body;
+    }
+}
+//# sourceMappingURL=otp.js.map

package/dist/src/console/otp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.js","sourceRoot":"","sources":["../../../src/console/otp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAA0C,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAkCrC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,MAAM;IACR,KAAK,CAAU;IAExB;;OAEG;IACH,YAAY,IAAa;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CAAC,KAAsC;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF"}

package/dist/src/console/passkeys.d.ts

@@ -0,0 +1,246 @@
+/**
+ * `client.console.passkeys.*` — WebAuthn passkey management and login for
+ * self-serve Studio users (T1.1.5).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`
+ * and HITL-1 in this task's contract. `@w6w/sdk`'s instance-state mechanism
+ * pin still applies here exactly as it does to every other namespace
+ * (`docs/implementation.md` §MECHANISM PIN — instance state, never globals):
+ * this class holds no state of its own beyond the injected host, so two
+ * clients in one process never share a credential.
+ *
+ * **Who this is for (HITL-3).** Passkeys belong to self-serve Studio users
+ * only; a partner-tenant user's IdP owns its identity. No eligibility logic
+ * lives here — the server enforces it (`PasskeyNotEligibleError`), and this
+ * module is a plain transport shim over whatever it decides.
+ *
+ * **Two routes, four methods, split by who is authenticated.** The management
+ * quartet (`registrationOptions`, `registrationVerify`, `list`, `revoke`) is
+ * GUARDED, mirroring `packages/server/packages/api/data/passkeys.ts`'s own
+ * doc comment ("Registered BELOW the auth guard"). The login pair
+ * (`authenticationOptions`, `authenticationVerify`) is PUBLIC, mirroring
+ * `packages/server/packages/api/id/passkey-login.ts`'s own doc comment ("BOTH
+ * routes are PUBLIC and UNAUTHENTICATED by construction") — discoverable
+ * credentials, no identifier in the request body (P1). Each of those two
+ * methods passes `requireAuth: false`, the same mechanism
+ * `console.auth.login`/`signup`/`checkAccountSlug` rely on: without it a
+ * tokenless client (the normal case at the login screen, before any session
+ * exists) would hit `requireToken`'s `ConfigError` before `fetch` is ever
+ * called.
+ *
+ * **`authenticationVerify` mints a session, the same way `login` does
+ * (HITL-5).** A verified passkey assertion is a standalone alternative to a
+ * password, not a second factor — so its response is token-bearing, exactly
+ * like `console.auth.login`'s. It is a SEPARATE type from `LoginResponse`
+ * (`./auth.ts`), not a reuse: the server route is byte-shape-identical to
+ * `user-login.ts`'s login body (`id/passkey-login.ts`'s own doc comment) which
+ * carries `role`, `tenant` and `emailVerified` on `user` — fields
+ * `console.auth`'s `LoginResponse.user` does not declare.
+ *
+ * **WebAuthn ceremony payloads (`options`/`response`) are opaque JSON, typed
+ * as `Record<string, unknown>`, never as `@simplewebauthn/*` types.** This
+ * package has no dependency on `@simplewebauthn` (browser or server) and
+ * adding one only to type two pass-through fields would be a new dependency
+ * for zero behavioural gain — `inputs.touch` for this task explicitly
+ * excludes `package.json`. A caller passes the browser's own
+ * `PublicKeyCredentialCreationOptionsJSON`/`...RequestOptionsJSON` (from
+ * `options`) into `navigator.credentials.create()`/`.get()` (or a helper such
+ * as `@simplewebauthn/browser`'s `startRegistration`/`startAuthentication`)
+ * and forwards what comes back as `response` — this module never inspects
+ * either shape, only relays it.
+ *
+ * @module
+ */
+import { type HttpResponse, type RequestOptions } from "../http.ts";
+/**
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
+ * else. Structural rather than a concrete client type, so the namespace stays
+ * independently constructible in a test and this module never imports the
+ * client back — mirrors `TokensHost` in `./tokens.ts`.
+ */
+export interface PasskeysHost {
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/**
+ * A stored passkey, as the server exposes it. **Never the public key or the
+ * counter** — `packages/server/packages/api/data/passkeys.ts`'s own
+ * `WirePasskey`/`toWirePasskey()` state the identical invariant server-side.
+ */
+export interface Passkey {
+    /** Server-issued id. */
+    id: string;
+    /** Caller-chosen label (empty string when none was given at registration). */
+    label: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+    /** ISO-8601 timestamp of the credential's last successful authentication, or `null`. */
+    lastUsedAt: string | null;
+    /** WebAuthn transport hints reported at registration (e.g. `"internal"`, `"hybrid"`). */
+    transports: string[];
+}
+/**
+ * A fresh WebAuthn ceremony challenge — the shared result shape of
+ * `POST /me/passkeys/options` (`data/passkeys.ts:118-130`) and
+ * `POST /auth/passkey/options` (`id/passkey-login.ts:63-71`). Flat, no
+ * envelope key.
+ */
+export interface PasskeyCeremonyOptions {
+    /**
+     * WebAuthn ceremony options, opaque JSON forwarded verbatim to
+     * `navigator.credentials.create()`/`.get()` (or a browser WebAuthn helper).
+     * This package never inspects its shape — see this module's header.
+     */
+    options: Record<string, unknown>;
+    /** Single-use challenge token. Echo it back on the paired verify call. */
+    challengeToken: string;
+}
+/** The body `registrationVerify` sends (`POST /me/passkeys`, `data/passkeys.ts:132-164`). */
+export interface RegistrationVerifyInput {
+    /** The token returned by the paired `registrationOptions()` call. */
+    challengeToken: string;
+    /**
+     * The browser's `RegistrationResponseJSON`, opaque JSON — see this
+     * module's header.
+     */
+    response: Record<string, unknown>;
+    /** Caller-chosen label for the new passkey. */
+    label?: string;
+}
+/** The body `authenticationVerify` sends (`POST /auth/passkey/verify`, `id/passkey-login.ts:73-110`). */
+export interface AuthenticationVerifyInput {
+    /** The token returned by the paired `authenticationOptions()` call. */
+    challengeToken: string;
+    /**
+     * The browser's `AuthenticationResponseJSON`, opaque JSON — see this
+     * module's header.
+     */
+    response: Record<string, unknown>;
+}
+/**
+ * The user identity `authenticationVerify` mints a session for, as
+ * `id/passkey-login.ts` returns it — BYTE-SHAPE IDENTICAL to
+ * `console.auth`'s `LoginResponse.user`'s sibling in `user-login.ts`, but
+ * carrying more fields (`role`, `tenant`, `emailVerified`), which is why this
+ * is a separate type rather than a reuse of `./auth.ts`'s `User`.
+ */
+export interface PasskeyUser {
+    /** The user's email, or its `userId` when no email is on file. */
+    username: string;
+    /** Always `"user"` for a passkey login (`id/passkey-login.ts:100`). */
+    role: string;
+    /** The tenant the session is minted in. */
+    tenant: string;
+    emailVerified: boolean;
+}
+/**
+ * `POST /auth/passkey/verify` → 200 (`id/passkey-login.ts:96-105`). Mints a
+ * session exactly like `console.auth.login` does (HITL-5) — a verified
+ * passkey assertion is a standalone alternative to a password, not a second
+ * factor.
+ */
+export interface PasskeyAuthenticationVerifyResponse {
+    token: string;
+    user: PasskeyUser;
+    expiresIn: number;
+}
+/**
+ * The `console.passkeys` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * // Registration (authenticated).
+ * const { options, challengeToken } = await client.console.passkeys.registrationOptions();
+ * const response = await startRegistration({ optionsJSON: options }); // e.g. @simplewebauthn/browser
+ * const passkey = await client.console.passkeys.registrationVerify({ challengeToken, response });
+ *
+ * // Login (public — works on a tokenless client).
+ * const opts = await client.console.passkeys.authenticationOptions();
+ * const assertion = await startAuthentication({ optionsJSON: opts.options });
+ * const { token } = await client.console.passkeys.authenticationVerify({
+ *   challengeToken: opts.challengeToken,
+ *   response: assertion,
+ * });
+ * ```
+ */
+export declare class PasskeysApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: PasskeysHost);
+    /**
+     * A fresh registration challenge, scoped to the caller's own identity.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`, `403 passkey_not_eligible`.
+     */
+    registrationOptions(): Promise<PasskeyCeremonyOptions>;
+    /**
+     * Verify a registration ceremony and store the credential.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The challenge token from `registrationOptions()`, the browser's ceremony
+     *   response, and an optional caller-chosen label.
+     * @returns The stored passkey's metadata, unwrapped from the `passkey` envelope.
+     * @throws {ApiError} `400 passkey_registration_failed`, `403 passkey_not_eligible`,
+     *   `409 passkey_already_registered`.
+     */
+    registrationVerify(input: RegistrationVerifyInput): Promise<Passkey>;
+    /**
+     * A fresh authentication challenge. No identifier is sent or accepted —
+     * discoverable credentials only (P1): the owner is resolved server-side
+     * from the assertion itself, never from anything this call sends.
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Without it, the login screen (the normal case:
+     * no session exists yet) could never call this method at all — a tokenless
+     * client would hit `requireToken`'s `ConfigError` before `fetch` is ever
+     * called.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`.
+     */
+    authenticationOptions(): Promise<PasskeyCeremonyOptions>;
+    /**
+     * Verify an authentication (login) ceremony and mint a session — the same
+     * way `console.auth.login` does (HITL-5).
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Every failure mode past a malformed body is the
+     * same `401 passkey_rejected` (P9): unknown credential, revoked credential,
+     * wrong kind, bad signature, counter regression, and a spent/invalid
+     * challenge are indistinguishable to the caller.
+     *
+     * @param input - The challenge token from `authenticationOptions()` and the browser's ceremony
+     *   response.
+     * @returns The token, the caller's identity, and the token's lifetime.
+     * @throws {ApiError} `401 passkey_rejected` on any verification failure.
+     */
+    authenticationVerify(input: AuthenticationVerifyInput): Promise<PasskeyAuthenticationVerifyResponse>;
+    /**
+     * List the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's passkeys, unwrapped from the `passkeys` envelope. Never the empty array
+     *   collapsed to `undefined` — an empty account gets `[]`.
+     */
+    list(): Promise<Passkey[]>;
+    /**
+     * Revoke (delete) one of the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The passkey id.
+     * @returns Nothing: the server answers `204` with no body.
+     * @throws {ApiError} `404 passkey_not_found`.
+     */
+    revoke(id: string): Promise<void>;
+}
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/src/console/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../src/console/passkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yGAAyG;AACzG,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAW;;IAGtB;;OAEG;gBACS,IAAI,EAAE,YAAY;IAI9B;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAS5D;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1E;;;;;;;;;;;;;OAaG;IACG,qBAAqB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAU9D;;;;;;;;;;;;;;OAcG;IACG,oBAAoB,CACxB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mCAAmC,CAAC;IAU/C;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAKhC;;;;;;;;OAQG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}