@auth-craft/client 0.1.0

package/README.md

@@ -0,0 +1,315 @@
+# @auth-craft/client
+
+Typed, contract-driven frontend client for Auth Craft.
+
+Every method is generated from `@auth-craft/api-contract` — the **same** endpoint
+declarations the backend routes validate against. So the client's paths, request
+bodies, query params, path params **and response types cannot drift** from the
+server: if a route changes and the contract is updated, your call sites re-type
+at build time. Tokens are isolated in a Web Worker (via `@auth-craft/transport`,
+absorbed from FetchGuard), protecting them from XSS.
+
+> Migrating from the old `@auth-craft/frontend-sdk`? Jump to
+> [Migration](#migration-from-auth-craftfrontend-sdk).
+
+---
+
+## Install
+
+```bash
+npm install @auth-craft/client
+```
+
+### Bundler note (Vite)
+
+The transport runs a Web Worker. With Vite, exclude it from pre-bundling:
+
+```ts
+// vite.config.ts
+export default defineConfig({
+  optimizeDeps: { exclude: ['@auth-craft/transport'] }
+})
+```
+
+If you bundle the SDK to plain JS (e.g. consuming from `dist/`), pass a
+`workerFactory` so the worker URL resolves in your app (see [Config](#config)).
+
+---
+
+## Quick start
+
+```ts
+import { createAuthCraftClient } from '@auth-craft/client'
+
+const client = createAuthCraftClient({
+  baseUrl: 'https://auth.example.com',
+  strategy: 'cookie-auth',          // or 'body-auth'
+  allowedDomains: ['auth.example.com']
+})
+
+// One-time init — boots the Worker and restores any existing session.
+await client.init()
+
+// Log in. Returns a discriminated result: tokens | challenge | mfa.
+const r = await client.auth.authenticate({
+  body: { identityType: 'email', identityValue: 'user@example.com', credentialType: 'password', credentialValue: 'secret' }
+})
+
+if (r.ok) {
+  // session established → call authenticated endpoints
+  const me = await client.auth.me()
+}
+```
+
+---
+
+## The call shape
+
+Every generated method takes **one argument object** with up to three keys —
+always the same shape, so you never have to remember a per-method signature:
+
+```ts
+client.<group>.<method>({
+  params?: { ...pathParams },   // required only when the path has :params
+  body?:   { ...requestBody },  // present only when the endpoint has a body
+  query?:  { ...queryParams }   // present only when the endpoint has a query
+})
+```
+
+- `params` is **required** when the path contains a segment like `:tenantId`.
+- `body` is typed from the contract's request schema (missing/extra fields are a
+  compile error).
+- `query` is always optional.
+
+Every method returns `Promise<Result<T>>` from
+[`ts-micro-result`](https://www.npmjs.com/package/ts-micro-result):
+
+```ts
+const r = await client.auth.me()
+if (r.ok) {
+  console.log(r.data.displayName)   // typed from the contract response schema
+} else {
+  console.error(r.errors[0].code)   // backend error codes, forwarded as-is
+}
+```
+
+---
+
+## Config
+
+```ts
+interface AuthCraftClientConfig {
+  /** Base URL of the Auth Craft backend (no trailing slash needed). */
+  baseUrl: string
+  /** Refresh-token delivery: 'cookie-auth' (httpOnly cookie) or 'body-auth'. */
+  strategy: 'cookie-auth' | 'body-auth'
+  /** Hosts the Worker may attach tokens to (anti-exfiltration allow-list). */
+  allowedDomains: string[]
+  /** Refresh this many ms before access-token expiry (proactive). */
+  refreshEarlyMs?: number
+  /** Headers added to every request (e.g. an edge-gate secret). */
+  defaultHeaders?: Record<string, string>
+  /** Custom Worker factory — required when consuming the SDK as compiled JS. */
+  workerFactory?: () => Worker
+  /**
+   * Auth scope → sent as the `X-Auth-Context` header on every request.
+   * 'system' = admin, 'tenant' = tenant-scoped, omit/'customer' = default.
+   */
+  context?: 'customer' | 'tenant' | 'system'
+}
+```
+
+---
+
+## Method groups
+
+`client.<group>.<method>(...)`. Authenticated unless marked **public**.
+
+### `auth`
+| Method | HTTP | Notes |
+|---|---|---|
+| `authenticate({ body })` | POST /auth/authenticate | **public**, login — returns tokens / challenge / mfa |
+| `register({ body })` | POST /auth/register | **public** — returns `{ userId, verification? }` (does NOT log in) |
+| `completeChallenge({ body })` | POST /auth/complete-challenge | **public**, login — finishes a 2-step credential challenge |
+| `completeMfaChallenge({ body })` | POST /auth/complete-mfa-challenge | **public**, login — finishes MFA |
+| `issueMfaChallenge({ body })` | POST /auth/issue-mfa-challenge | **public** — send an MFA code (SMS/email) |
+| `me()` | GET /auth/me | current user profile |
+| `selectTenant({ body })` | POST /auth/select-tenant | switch tenant context (re-issues tokens) |
+| `logout()` | POST /auth/logout | clears the session |
+
+> `refresh` is handled **automatically** by the transport (proactive, before
+> expiry). You don't call it.
+
+### `password`
+`changePassword({ body })` · `forgotPassword({ body })` *(public)* · `resetPassword({ body })` *(public)*
+
+### `verification`
+`verifyCode({ body })` *(public)* · `resendVerification({ body })` *(public)*
+
+### `session`
+`listSessions({ query? })` · `deleteSession({ body })` · `revokeToken({ body })`
+
+### `mfa`
+`setupAuthenticator({ body })` · `verifyAuthenticator({ body })` · `listAuthenticators({ query? })` · `removeAuthenticator({ body })` · `updateMfaSettings({ body })`
+
+> MFA verify: the code goes **inside `data`**, e.g.
+> `verifyAuthenticator({ body: { method: 'totp', data: { code: '123456' } } })`.
+
+### `oauth`
+`oauthState()` *(public)* · `oauthCallback({ body })` *(public, login)* · `linkProvider({ body })` · `unlinkProvider({ body })` · `getProviders()`
+
+### `users`
+`updateProfile({ body })`
+
+### `tenant`
+All scoped under `/tenants/:tenantId/...` — **`params.tenantId` is required**:
+
+`getTenantProfile({ params })` · `updateTenantProfile({ params, body })` · `createInvite({ params, body })` · `listInvites({ params, query? })` · `acceptInvite({ params, body })` · `declineInvite({ params, body })` · `revokeInvite({ params, body })` · `listMembers({ params, query? })` · `updateMember({ params, body })` · `removeMember({ params, body })`
+
+```ts
+await client.tenant.listMembers({ params: { tenantId: 'org-123' } })
+await client.tenant.createInvite({
+  params: { tenantId: 'org-123' },
+  body: { inviteeEmail: 'new@example.com', roles: ['member'], authPerms: ['tenant.member.view'] }
+})
+```
+
+---
+
+## Login: handling challenge & MFA
+
+A login call (`authenticate`, `completeChallenge`, `oauthCallback`) resolves to a
+**discriminated union** — tokens, a credential challenge, or an MFA requirement.
+Use the exported type guards to branch:
+
+```ts
+import { isAuthTokens, isChallengeRequired, isMfaRequired } from '@auth-craft/api-contract'
+
+const r = await client.auth.authenticate({
+  body: { identityType: 'email', identityValue: 'user@example.com', credentialType: 'otp' }
+})
+if (!r.ok) { /* real error */ return }
+
+if (isChallengeRequired(r.data)) {
+  // e.g. emailed OTP — collect the code, then:
+  const done = await client.auth.completeChallenge({
+    body: { challengeId: r.data.challenge.data.challengeId as string, code: userCode }
+  })
+} else if (isMfaRequired(r.data)) {
+  // collect MFA code for one of r.data.mfa.methods, then:
+  const done = await client.auth.completeMfaChallenge({
+    body: { challengeId: r.data.mfa.challengeId, method: r.data.mfa.methods[0], code: userCode }
+  })
+} else if (isAuthTokens(r.data)) {
+  // session established
+}
+```
+
+---
+
+## Scopes (customer / tenant / system)
+
+Set `context` so the backend reads the right refresh-token cookie / scope:
+
+```ts
+const adminClient = createAuthCraftClient({ /* ... */, context: 'system' })
+```
+
+This stamps `X-Auth-Context: system` on every request. (In a deployment with the
+Cloudflare BFF gateway, the gateway is the source of truth for scope; the header
+is the local-dev convention.)
+
+---
+
+## Lifecycle
+
+```ts
+await client.init()   // boot Worker; idempotent enough to call once at startup
+client.destroy()      // terminate the Worker and clear in-memory state
+```
+
+---
+
+## Why it can't drift
+
+| Concern | Guaranteed by |
+|---|---|
+| Path / path params | shared `contract.path`; a CI test diffs every contract path against the live route registry |
+| HTTP method | same registry diff (method + path) |
+| Request body / query | `InferInput` of the contract schema — wrong/missing fields are a compile error |
+| Response shape | `InferOutput` of the contract response schema; a CI test fails if a data endpoint lacks one |
+| Method coverage | methods are **generated** from the contract group (`buildClient` iterates its keys) — a new endpoint appears automatically; there is no hand-maintained list to fall behind |
+| Server reads the same shape | the backend route's `ctx.body`/`query`/`params` are typed from the **same** contract schema; renaming a field breaks the client call site *and* the route handler in one `tsc` run |
+| Per-method transform bugs | there are none — the envelope→`Result<T>` step lives once in the transport |
+
+---
+
+## Migration from `@auth-craft/frontend-sdk`
+
+The old `@auth-craft/frontend-sdk` was hand-written (per-method paths/types), which
+let request/response shapes drift from the server. It is **removed**. This client
+replaces it. The package name and factory change, and every call uses the uniform
+`{ body / params / query }` shape.
+
+### Setup
+
+```ts
+// OLD
+import { createAuthCraft } from '@auth-craft/frontend-sdk'
+const client = createAuthCraft({ baseUrl, strategy, allowedDomains })
+await client.init()
+
+// NEW
+import { createAuthCraftClient } from '@auth-craft/client'
+const client = createAuthCraftClient({ baseUrl, strategy, allowedDomains })
+await client.init()
+```
+
+### Call-site changes (the important part)
+
+| Old | New |
+|---|---|
+| `client.auth.authenticate(req)` | `client.auth.authenticate({ body: req })` |
+| `client.auth.me()` | `client.auth.me()` *(unchanged)* |
+| `client.password.change(req)` | `client.password.changePassword({ body: req })` |
+| `client.password.forgot(req)` | `client.password.forgotPassword({ body: req })` |
+| `client.password.reset(req)` | `client.password.resetPassword({ body: req })` |
+| `client.verification.verify(req)` | `client.verification.verifyCode({ body: req })` |
+| `client.verification.resend(req)` | `client.verification.resendVerification({ body: req })` |
+| `client.session.list(includeRevoked)` | `client.session.listSessions({ query: { includeRevoked: 'true' } })` |
+| `client.session.delete(req)` | `client.session.deleteSession({ body: req })` |
+| `client.session.revoke(req)` | `client.session.revokeToken({ body: req })` |
+| `client.mfa.setup(req)` | `client.mfa.setupAuthenticator({ body: req })` |
+| `client.mfa.verify({ method, code })` | `client.mfa.verifyAuthenticator({ body: { method, data: { code } } })` ⚠️ code in `data` |
+| `client.mfa.list(opts)` | `client.mfa.listAuthenticators({ query: opts })` |
+| `client.mfa.delete({ method, id })` | `client.mfa.removeAuthenticator({ body: { method, authenticatorId } })` ⚠️ `authenticatorId` |
+| `client.mfa.updateSettings(req)` | `client.mfa.updateMfaSettings({ body: req })` |
+| `client.oauth.callback(req)` | `client.oauth.oauthCallback({ body: req })` |
+| `client.oauth.link(req)` | `client.oauth.linkProvider({ body: req })` ⚠️ no `accessToken` field |
+| `client.oauth.unlink(req)` | `client.oauth.unlinkProvider({ body: req })` |
+| `client.oauth.listProviders()` | `client.oauth.getProviders()` |
+| *(none)* | `client.oauth.oauthState()` — **new**, required for the CSRF redirect flow |
+| `client.user.updateProfile(req)` | `client.users.updateProfile({ body: req })` |
+| `client.tenant.createInvite(req)` | `client.tenant.createInvite({ params: { tenantId }, body })` ⚠️ tenantId in path |
+| `client.tenant.listMembers()` | `client.tenant.listMembers({ params: { tenantId } })` ⚠️ tenantId in path |
+| `client.tenant.getProfile()` | `client.tenant.getTenantProfile({ params: { tenantId } })` |
+| `client.tenant.checkPendingInvites(req)` | **removed** — no public route (internal only) |
+
+### Behaviour changes you must be aware of
+
+- **Tenant routes are path-scoped.** Every tenant method now requires
+  `params.tenantId`. The old client called `/tenant/...` (no id) and 404'd.
+- **MFA codes go in `data`**, and the field is `authenticatorId` (not `id`).
+- **OAuth never accepts `accessToken`** — the backend rejects it (token
+  substitution). Use `code` or `credential`. For the redirect/code flow, call
+  `oauth.oauthState()` first and forward the returned `state` to the provider.
+- **Permissions are string arrays** (`roles`, `authPerms`), not numeric masks.
+- **Login returns a union** — branch with `isAuthTokens` / `isChallengeRequired`
+  / `isMfaRequired` (see [above](#login-handling-challenge--mfa)). The old client
+  returned ad-hoc shapes per path.
+- **`refresh` is automatic** — remove any manual refresh calls.
+
+### Errors
+
+Both old and new return `Result<T>` from `ts-micro-result`, so `if (r.ok) { r.data } else { r.errors }`
+is unchanged. The new client forwards the backend's error codes verbatim.

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @auth-craft/client — contract-driven typed client.
+ *
+ * Wires the absorbed transport (FetchGuard) to the shared api-contract, so the
+ * client's methods are generated from — and type-checked against — the same
+ * endpoint declarations the backend routes use. No hand-written per-method
+ * paths/types: a route change in the contract re-types the call sites here.
+ *
+ * Module groups mirror the route groups: auth, password, verification, session,
+ * mfa, oauth, users, tenant. Tenant methods take `{ params: { tenantId }, ... }`
+ * because the routes are scoped under /tenants/:tenantId/...
+ */
+import { authContract, mfaContract, oauthContract, passwordContract, sessionContract, tenantsContract, usersContract, verificationContract } from '@auth-craft/api-contract';
+import { type ContractClient } from './proxy';
+export interface AuthCraftClientConfig {
+    baseUrl: string;
+    strategy: 'cookie-auth' | 'body-auth';
+    allowedDomains: string[];
+    refreshEarlyMs?: number;
+    defaultHeaders?: Record<string, string>;
+    workerFactory?: () => Worker;
+    /** Auth context scope → X-Auth-Context header. */
+    context?: 'customer' | 'tenant' | 'system';
+}
+export declare class AuthCraftClient {
+    private fg;
+    private readonly config;
+    auth: ContractClient<typeof authContract>;
+    password: ContractClient<typeof passwordContract>;
+    verification: ContractClient<typeof verificationContract>;
+    session: ContractClient<typeof sessionContract>;
+    mfa: ContractClient<typeof mfaContract>;
+    oauth: ContractClient<typeof oauthContract>;
+    users: ContractClient<typeof usersContract>;
+    tenant: ContractClient<typeof tenantsContract>;
+    constructor(config: AuthCraftClientConfig);
+    init(): Promise<void>;
+    private wireGroups;
+    buildUrl(path: string): string;
+    destroy(): void;
+}
+export declare function createAuthCraftClient(config: AuthCraftClientConfig): AuthCraftClient;
+export { buildClient } from './proxy';
+export type { ContractClient, EndpointMethod, AuthResult } from './proxy';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,YAAY,EACZ,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAE1D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,aAAa,GAAG,WAAW,CAAA;IACrC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAA;IAC5B,kDAAkD;IAClD,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAC3C;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAAgC;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAE9C,IAAI,EAAG,cAAc,CAAC,OAAO,YAAY,CAAC,CAAA;IAC1C,QAAQ,EAAG,cAAc,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAClD,YAAY,EAAG,cAAc,CAAC,OAAO,oBAAoB,CAAC,CAAA;IAC1D,OAAO,EAAG,cAAc,CAAC,OAAO,eAAe,CAAC,CAAA;IAChD,GAAG,EAAG,cAAc,CAAC,OAAO,WAAW,CAAC,CAAA;IACxC,KAAK,EAAG,cAAc,CAAC,OAAO,aAAa,CAAC,CAAA;IAC5C,KAAK,EAAG,cAAc,CAAC,OAAO,aAAa,CAAC,CAAA;IAC5C,MAAM,EAAG,cAAc,CAAC,OAAO,eAAe,CAAC,CAAA;gBAEnC,MAAM,EAAE,qBAAqB;IAInC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB3B,OAAO,CAAC,UAAU;IAYlB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAK9B,OAAO,IAAI,IAAI;CAIhB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAEpF;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA"}

package/dist/index.js

@@ -0,0 +1,74 @@
+/**
+ * @auth-craft/client — contract-driven typed client.
+ *
+ * Wires the absorbed transport (FetchGuard) to the shared api-contract, so the
+ * client's methods are generated from — and type-checked against — the same
+ * endpoint declarations the backend routes use. No hand-written per-method
+ * paths/types: a route change in the contract re-types the call sites here.
+ *
+ * Module groups mirror the route groups: auth, password, verification, session,
+ * mfa, oauth, users, tenant. Tenant methods take `{ params: { tenantId }, ... }`
+ * because the routes are scoped under /tenants/:tenantId/...
+ */
+import { authContract, mfaContract, oauthContract, passwordContract, sessionContract, tenantsContract, usersContract, verificationContract } from '@auth-craft/api-contract';
+import { createClient } from '@auth-craft/transport';
+import { buildClient } from './proxy';
+export class AuthCraftClient {
+    fg = null;
+    config;
+    auth;
+    password;
+    verification;
+    session;
+    mfa;
+    oauth;
+    users;
+    tenant;
+    constructor(config) {
+        this.config = config;
+    }
+    async init() {
+        const headers = this.config.context && this.config.context !== 'customer'
+            ? { ...this.config.defaultHeaders, 'X-Auth-Context': this.config.context }
+            : this.config.defaultHeaders;
+        this.fg = createClient({
+            provider: {
+                type: this.config.strategy,
+                refreshUrl: this.buildUrl('/auth/refresh'),
+                loginUrl: this.buildUrl('/auth/authenticate'),
+                logoutUrl: this.buildUrl('/auth/logout'),
+                ...(headers ? { headers } : {})
+            },
+            allowedDomains: this.config.allowedDomains,
+            ...(this.config.refreshEarlyMs !== undefined ? { refreshEarlyMs: this.config.refreshEarlyMs } : {}),
+            ...(headers ? { defaultHeaders: headers } : {}),
+            ...(this.config.workerFactory ? { workerFactory: this.config.workerFactory } : {})
+        });
+        await this.fg.whenReady();
+        this.wireGroups(this.fg);
+    }
+    wireGroups(fg) {
+        const url = (p) => this.buildUrl(p);
+        this.auth = buildClient(fg, authContract, url);
+        this.password = buildClient(fg, passwordContract, url);
+        this.verification = buildClient(fg, verificationContract, url);
+        this.session = buildClient(fg, sessionContract, url);
+        this.mfa = buildClient(fg, mfaContract, url);
+        this.oauth = buildClient(fg, oauthContract, url);
+        this.users = buildClient(fg, usersContract, url);
+        this.tenant = buildClient(fg, tenantsContract, url);
+    }
+    buildUrl(path) {
+        const p = path.startsWith('/') ? path : `/${path}`;
+        return `${this.config.baseUrl}${p}`;
+    }
+    destroy() {
+        this.fg?.destroy();
+        this.fg = null;
+    }
+}
+export function createAuthCraftClient(config) {
+    return new AuthCraftClient(config);
+}
+export { buildClient } from './proxy';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,YAAY,EACZ,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,YAAY,EAAyB,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAuB,MAAM,SAAS,CAAA;AAa1D,MAAM,OAAO,eAAe;IAClB,EAAE,GAA4B,IAAI,CAAA;IACzB,MAAM,CAAuB;IAE9C,IAAI,CAAsC;IAC1C,QAAQ,CAA0C;IAClD,YAAY,CAA8C;IAC1D,OAAO,CAAyC;IAChD,GAAG,CAAqC;IACxC,KAAK,CAAuC;IAC5C,KAAK,CAAuC;IAC5C,MAAM,CAAyC;IAE/C,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU;YACvD,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;QAEhC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC;YACrB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC;YACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IAEO,UAAU,CAAC,EAAoB;QACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;QACtD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,EAAE,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC9D,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IACrD,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;QAClD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAA;IACrC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAA;QAClB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAA;IAChB,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA"}

package/dist/proxy.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Contract-driven typed proxy.
+ *
+ * Given a transport (the absorbed FetchGuard client) and a map of contract
+ * endpoints, this builds a typed method per endpoint. The `kind` discriminator
+ * decides how each one is dispatched:
+ *
+ *   data   → transport.callJson(method, url, body)   (auto-bound, typed Result<T>)
+ *   login  → transport.login(body, url)              (Worker session bootstrap)
+ *   logout → transport.logout(body)
+ *   exchange → transport.exchangeToken(url, { payload })
+ *
+ * Types flow straight from the contract: the input is inferred from the body
+ * schema, the output from the response schema (or AuthResult for login/logout).
+ * A route change to the contract therefore re-types every call site at build.
+ */
+import type { Endpoint, PathParams } from '@auth-craft/api-contract';
+import { type FetchGuardClient } from '@auth-craft/transport';
+import { type Result } from 'ts-micro-result';
+import type { InferInput, InferOutput } from 'valibot';
+export interface AuthResult {
+    authenticated: boolean;
+    user?: unknown;
+    expiresAt?: number | null;
+}
+/** Whether an endpoint has any `:param` segments. */
+type HasParams<P extends string> = PathParams<P> extends never ? false : true;
+/** The `params` argument, required only when the path has params. */
+type ParamsArg<P extends string> = HasParams<P> extends true ? {
+    params: Record<PathParams<P>, string | number>;
+} : {
+    params?: undefined;
+};
+/** Body argument, present only when the endpoint declares a body schema. */
+type BodyArg<E> = E extends {
+    body: infer S;
+} ? {
+    body: InferInput<S extends import('valibot').GenericSchema ? S : never>;
+} : {
+    body?: undefined;
+};
+/** Query argument, present only when the endpoint declares a query schema. */
+type QueryArg<E> = E extends {
+    query: infer S;
+} ? {
+    query?: InferInput<S extends import('valibot').GenericSchema ? S : never>;
+} : {
+    query?: undefined;
+};
+/** The single call argument object for a generated method. */
+type CallArg<E extends Endpoint> = ParamsArg<E['path']> & BodyArg<E> & QueryArg<E>;
+/** The resolved return type of a generated method. */
+type CallReturn<E extends Endpoint> = E extends {
+    kind: 'data';
+} ? E extends {
+    response: infer R;
+} ? Result<InferOutput<R extends import('valibot').GenericSchema ? R : never>> : Result<unknown> : E extends {
+    kind: 'login';
+} ? E extends {
+    response: infer R;
+} ? Result<InferOutput<R extends import('valibot').GenericSchema ? R : never>> : Result<AuthResult> : Result<AuthResult>;
+/** Does this arg shape need any argument at all? */
+type NeedsArg<E extends Endpoint> = HasParams<E['path']> extends true ? true : E extends {
+    body: unknown;
+} ? true : false;
+export type EndpointMethod<E extends Endpoint> = NeedsArg<E> extends true ? (arg: CallArg<E>) => Promise<CallReturn<E>> : (arg?: CallArg<E>) => Promise<CallReturn<E>>;
+export type ContractClient<C extends Record<string, Endpoint>> = {
+    [K in keyof C]: EndpointMethod<C[K]>;
+};
+/**
+ * Build a typed client object from a contract group.
+ */
+export declare function buildClient<C extends Record<string, Endpoint>>(transport: FetchGuardClient, contract: C, buildUrl: (path: string) => string): ContractClient<C>;
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAGtD,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,qDAAqD;AACrD,KAAK,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,IAAI,CAAA;AAE7E,qEAAqE;AACrE,KAAK,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,GACxD;IAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;CAAE,GAClD;IAAE,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAE1B,4EAA4E;AAC5E,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,UAAU,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;CAAE,GAC3E;IAAE,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAExB,8EAA8E;AAC9E,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C;IAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;CAAE,GAC7E;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAEzB,8DAA8D;AAC9D,KAAK,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;AAElF,sDAAsD;AACtD,KAAK,UAAU,CAAC,CAAC,SAAS,QAAQ,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5D,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAC1E,MAAM,CAAC,OAAO,CAAC,GACjB,CAAC,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAEzB,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAC1E,MAAM,CAAC,UAAU,CAAC,GACpB,MAAM,CAAC,UAAU,CAAC,CAAA;AAExB,oDAAoD;AACpD,KAAK,QAAQ,CAAC,CAAC,SAAS,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,GACjE,IAAI,GACJ,CAAC,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACzB,IAAI,GACJ,KAAK,CAAA;AAEX,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,GACrE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC3C,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AAEhD,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI;KAC9D,CAAC,IAAI,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACrC,CAAA;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5D,SAAS,EAAE,gBAAgB,EAC3B,QAAQ,EAAE,CAAC,EACX,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GACjC,cAAc,CAAC,CAAC,CAAC,CAgCnB"}

package/dist/proxy.js

@@ -0,0 +1,95 @@
+/**
+ * Contract-driven typed proxy.
+ *
+ * Given a transport (the absorbed FetchGuard client) and a map of contract
+ * endpoints, this builds a typed method per endpoint. The `kind` discriminator
+ * decides how each one is dispatched:
+ *
+ *   data   → transport.callJson(method, url, body)   (auto-bound, typed Result<T>)
+ *   login  → transport.login(body, url)              (Worker session bootstrap)
+ *   logout → transport.logout(body)
+ *   exchange → transport.exchangeToken(url, { payload })
+ *
+ * Types flow straight from the contract: the input is inferred from the body
+ * schema, the output from the response schema (or AuthResult for login/logout).
+ * A route change to the contract therefore re-types every call site at build.
+ */
+import { fillPath } from '@auth-craft/api-contract';
+import { deserializeResult } from '@auth-craft/transport';
+import { err, ok } from 'ts-micro-result';
+/**
+ * Build a typed client object from a contract group.
+ */
+export function buildClient(transport, contract, buildUrl) {
+    const out = {};
+    for (const key of Object.keys(contract)) {
+        const ep = contract[key];
+        out[key] = async (arg) => {
+            const path = fillPath(ep.path, arg?.params);
+            const url = buildUrl(path) + buildQueryString(arg?.query);
+            const body = arg?.body;
+            const requiresAuth = ep.public !== true;
+            switch (ep.kind) {
+                case 'data':
+                    return transport.callJson(ep.method, url, body, { requiresAuth });
+                case 'login':
+                    return dispatchLogin(transport, body, url);
+                case 'logout':
+                    return transport.logout(body);
+                case 'exchange':
+                    return transport.exchangeToken(url, {
+                        ...(body !== undefined ? { payload: body } : {})
+                    });
+                default:
+                    return err({ code: 'UNKNOWN_KIND', message: `Unknown endpoint kind for '${key}'.` });
+            }
+        };
+    }
+    return out;
+}
+/**
+ * Dispatch a login-kind endpoint and normalize the outcome.
+ *
+ * FetchGuard's login() resolves the AuthResult when a session is established. A
+ * 2-step login (credential challenge / MFA required) comes back as a non-error
+ * HTTP body that FetchGuard surfaces via `meta.params.body`. We deserialize that
+ * envelope so the caller gets the discriminated login result (tokens | challenge
+ * | mfa) instead of an opaque "not authenticated" — matching the old SDK's
+ * behaviour, but in ONE place instead of per method.
+ */
+async function dispatchLogin(transport, body, url) {
+    const result = await transport.login(body, url);
+    // Session established → return the tokens/auth-state shape.
+    if (result.ok && result.data.authenticated) {
+        return ok({
+            accessToken: '',
+            expiresAt: result.data.expiresAt ?? 0
+        });
+    }
+    // Not authenticated: the backend body may carry a challenge / MFA requirement
+    // (a legitimate 2-step step), or a real error. Deserialize and forward it.
+    if (!result.ok) {
+        const params = result.meta?.params;
+        if (params?.body) {
+            const parsed = deserializeResult(params.body);
+            // Forward whatever the backend said — challenge/mfa (ok) or error (err).
+            return parsed;
+        }
+        return err(result.errors);
+    }
+    // ok but not authenticated and no body to interpret — surface a generic error.
+    return err({ code: 'LOGIN_FAILED', message: 'Authentication did not establish a session' });
+}
+/** Serialize a query object to a `?a=1&b=2` string (skips undefined). */
+function buildQueryString(query) {
+    if (!query)
+        return '';
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) {
+        if (v !== undefined && v !== null)
+            params.set(k, String(v));
+    }
+    const qs = params.toString();
+    return qs ? `?${qs}` : '';
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAyB,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,iBAAiB,CAAA;AA0DtD;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAA2B,EAC3B,QAAW,EACX,QAAkC;IAElC,MAAM,GAAG,GAAG,EAGX,CAAA;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAa,CAAA;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzD,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAA;YACtB,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI,CAAA;YAEvC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,MAAM;oBACT,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;gBACnE,KAAK,OAAO;oBACV,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC5C,KAAK,QAAQ;oBACX,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAA;gBAC3D,KAAK,UAAU;oBACb,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE;wBAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5E,CAA6B,CAAA;gBAChC;oBACE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,GAAG,IAAI,EAAE,CAAC,CAAA;YACxF,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAED,OAAO,GAAwB,CAAA;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,SAA2B,EAC3B,IAAa,EACb,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAE/C,4DAA4D;IAC5D,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC;YACR,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAuC,CAAA;QACnE,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,iBAAiB,CAAU,MAAM,CAAC,IAAI,CAAC,CAAA;YACtD,yEAAyE;YACzE,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,+EAA+E;IAC/E,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,KAA+B;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3B,CAAC"}

package/dist/types.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.test-d.d.ts.map

package/dist/types.test-d.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.test-d.d.ts","sourceRoot":"","sources":["../src/types.test-d.ts"],"names":[],"mappings":""}

package/dist/types.test-d.js

@@ -0,0 +1,26 @@
+/**
+ * Type-level POC: the generated client methods are typed FROM the contract.
+ * Correct calls compile; wrong calls must fail (verified by @ts-expect-error).
+ * This is the mechanical guarantee — a contract change re-types these call sites.
+ *
+ * This file is type-checked (tsc --noEmit), not executed.
+ */
+import { authContract } from '@auth-craft/api-contract';
+// ✓ me: no body, no params → callable with no argument
+void client.me();
+// ✓ authenticate: body inferred from the contract schema
+void client.authenticate({
+    body: { identityType: 'email', identityValue: 'a@b.com', credentialType: 'password', credentialValue: 'x' }
+});
+// ✓ selectTenant: body { tenantId }
+void client.selectTenant({ body: { tenantId: 't1' } });
+// ✗ authenticate missing required fields → MUST error
+// @ts-expect-error identityValue + credentialType are required
+void client.authenticate({ body: { identityType: 'email' } });
+// ✗ selectTenant wrong field name → MUST error
+// @ts-expect-error 'tenant' is not a valid field
+void client.selectTenant({ body: { tenant: 't1' } });
+// ✗ me takes no body → MUST error
+// @ts-expect-error me accepts no argument with body
+void client.me({ body: { x: 1 } });
+//# sourceMappingURL=types.test-d.js.map

package/dist/types.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.test-d.js","sourceRoot":"","sources":["../src/types.test-d.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAKvD,uDAAuD;AACvD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAA;AAEhB,yDAAyD;AACzD,KAAK,MAAM,CAAC,YAAY,CAAC;IACvB,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE;CAC5G,CAAC,CAAA;AAEF,oCAAoC;AACpC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AAEtD,sDAAsD;AACtD,+DAA+D;AAC/D,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;AAE7D,+CAA+C;AAC/C,iDAAiD;AACjD,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AAEpD,kCAAkC;AAClC,oDAAoD;AACpD,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@auth-craft/client",
+  "version": "0.1.0",
+  "description": "Contract-driven typed frontend client for Auth Craft. Methods are generated from @auth-craft/api-contract over the @auth-craft/transport (Web-Worker token isolation), so routes and client cannot drift.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "README.md"],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@auth-craft/api-contract": "workspace:*",
+    "@auth-craft/transport": "workspace:*",
+    "ts-micro-result": "^3.3.0",
+    "valibot": "^1.4.1"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  },
+  "license": "MIT"
+}