@authsome/ui-core 1.4.0 → 1.4.2

package/dist/index.js

@@ -1,11 +1,21 @@
 // src/generated/api-client.ts
 var AuthClient = class {
   baseURL;
+  publishableKey;
   fetchFn;
   constructor(config) {
     this.baseURL = config.baseURL.replace(/\/+$/, "");
+    this.publishableKey = config.publishableKey;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
   }
+  /** Set the publishable key sent on every request as X-Publishable-Key. */
+  setPublishableKey(key) {
+    this.publishableKey = key;
+  }
+  /** Get the current publishable key. */
+  getPublishableKey() {
+    return this.publishableKey;
+  }
   // ──────────────────────────────────────────────────
   // Generated methods
   // ──────────────────────────────────────────────────
@@ -33,6 +43,240 @@ var AuthClient = class {
       void 0
     );
   }
+  /**
+   * OpenID Connect Discovery
+   * GET /.well-known/openid-configuration
+   */
+  async oidcDiscovery(token) {
+    const path = "/.well-known/openid-configuration";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List SCIM Groups
+   * GET /scim/v2/Groups
+   */
+  async scimListGroups(token) {
+    const path = "/scim/v2/Groups";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create SCIM Group
+   * POST /scim/v2/Groups
+   */
+  async scimCreateGroup(body, token) {
+    const path = "/scim/v2/Groups";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get SCIM Group
+   * GET /scim/v2/Groups/{groupId}
+   */
+  async scimGetGroup(groupId, token) {
+    const path = `/scim/v2/Groups/${groupId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Replace SCIM Group
+   * PUT /scim/v2/Groups/{groupId}
+   */
+  async scimReplaceGroup(groupId, body, token) {
+    const path = `/scim/v2/Groups/${groupId}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Patch SCIM Group
+   * PATCH /scim/v2/Groups/{groupId}
+   */
+  async scimPatchGroup(groupId, body, token) {
+    const path = `/scim/v2/Groups/${groupId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete SCIM Group
+   * DELETE /scim/v2/Groups/{groupId}
+   */
+  async scimDeleteGroup(groupId, body, token) {
+    const path = `/scim/v2/Groups/${groupId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * SCIM Resource Types
+   * GET /scim/v2/ResourceTypes
+   */
+  async scimResourceTypes(token) {
+    const path = "/scim/v2/ResourceTypes";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * SCIM Schemas
+   * GET /scim/v2/Schemas
+   */
+  async scimSchemas(token) {
+    const path = "/scim/v2/Schemas";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * SCIM Service Provider Configuration
+   * GET /scim/v2/ServiceProviderConfig
+   */
+  async scimServiceProviderConfig(token) {
+    const path = "/scim/v2/ServiceProviderConfig";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List SCIM Users
+   * GET /scim/v2/Users
+   */
+  async scimListUsers(token) {
+    const path = "/scim/v2/Users";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create SCIM User
+   * POST /scim/v2/Users
+   */
+  async scimCreateUser(body, token) {
+    const path = "/scim/v2/Users";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get SCIM User
+   * GET /scim/v2/Users/{userId}
+   */
+  async scimGetUser(userId, token) {
+    const path = `/scim/v2/Users/${userId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Replace SCIM User
+   * PUT /scim/v2/Users/{userId}
+   */
+  async scimReplaceUser(userId, body, token) {
+    const path = `/scim/v2/Users/${userId}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Patch SCIM User
+   * PATCH /scim/v2/Users/{userId}
+   */
+  async scimPatchUser(userId, body, token) {
+    const path = `/scim/v2/Users/${userId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete SCIM User
+   * DELETE /scim/v2/Users/{userId}
+   */
+  async scimDeleteUser(userId, body, token) {
+    const path = `/scim/v2/Users/${userId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Create application (admin)
+   * POST /v1/admin/apps
+   */
+  async adminCreateApp(body, token) {
+    const path = "/v1/admin/apps";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete application (admin)
+   * DELETE /v1/admin/apps/{appId}
+   */
+  async adminDeleteApp(appId, body, token) {
+    const path = `/v1/admin/apps/${appId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
   /**
    * Get per-app client config overrides
    * GET /v1/admin/apps/{appId}/client-config
@@ -163,12 +407,530 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * List OAuth2 clients
+   * GET /v1/admin/oauth/clients
+   */
+  async listOAuth2Clients(token) {
+    const path = "/v1/admin/oauth/clients";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create OAuth2 client
+   * POST /v1/admin/oauth/clients
+   */
+  async createOAuth2Client(body, token) {
+    const path = "/v1/admin/oauth/clients";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete OAuth2 client
+   * DELETE /v1/admin/oauth/clients/{clientId}
+   */
+  async deleteOAuth2Client(clientId, body, token) {
+    const path = `/v1/admin/oauth/clients/${clientId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
   /**
    * List organizations (admin)
    * GET /v1/admin/orgs
    */
-  async adminListOrgs(token) {
+  async adminListOrgs() {
     const path = "/v1/admin/orgs";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
+  }
+  /**
+   * Grant platform-owner role (admin)
+   * POST /v1/admin/platform/owners
+   */
+  async adminGrantPlatformOwner(body, token) {
+    const path = "/v1/admin/platform/owners";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Revoke platform-owner role (admin)
+   * DELETE /v1/admin/platform/owners/{userID}
+   */
+  async adminRevokePlatformOwner(userID, body, token) {
+    const path = `/v1/admin/platform/owners/${userID}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List service accounts (admin)
+   * GET /v1/admin/service-accounts
+   */
+  async adminListServiceAccounts(token) {
+    const path = "/v1/admin/service-accounts";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create service account (admin)
+   * POST /v1/admin/service-accounts
+   */
+  async adminCreateServiceAccount(body, token) {
+    const path = "/v1/admin/service-accounts";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get service account (admin)
+   * GET /v1/admin/service-accounts/{serviceAccountId}
+   */
+  async adminGetServiceAccount(serviceAccountId, token) {
+    const path = `/v1/admin/service-accounts/${serviceAccountId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Delete service account (admin)
+   * DELETE /v1/admin/service-accounts/{serviceAccountId}
+   */
+  async adminDeleteServiceAccount(serviceAccountId, body, token) {
+    const path = `/v1/admin/service-accounts/${serviceAccountId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Create service account API key (admin)
+   * POST /v1/admin/service-accounts/{serviceAccountId}/api-keys
+   */
+  async adminCreateServiceAccountAPIKey(serviceAccountId, body, token) {
+    const path = `/v1/admin/service-accounts/${serviceAccountId}/api-keys`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List all setting definitions
+   * GET /v1/admin/settings/definitions
+   */
+  async listSettingsDefinitions(token) {
+    const path = "/v1/admin/settings/definitions";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List definitions for a namespace
+   * GET /v1/admin/settings/definitions/{namespace}
+   */
+  async listNamespaceSettingsDefinitions(namespace, token) {
+    const path = `/v1/admin/settings/definitions/${namespace}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Enforce a setting value at a scope
+   * PUT /v1/admin/settings/enforce/{key}
+   */
+  async enforceSetting(key, body, token) {
+    const path = `/v1/admin/settings/enforce/${key}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Remove enforcement from a setting
+   * DELETE /v1/admin/settings/enforce/{key}
+   */
+  async unenforceSetting(key, body, token) {
+    const path = `/v1/admin/settings/enforce/${key}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Resolve all settings at a scope
+   * GET /v1/admin/settings/resolve
+   */
+  async resolveSettings(token) {
+    const path = "/v1/admin/settings/resolve";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Resolve one setting with cascade details
+   * GET /v1/admin/settings/resolve/{key}
+   */
+  async resolveSetting(key, token) {
+    const path = `/v1/admin/settings/resolve/${key}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Set a setting value at a scope
+   * PUT /v1/admin/settings/values/{key}
+   */
+  async setSetting(key, body, token) {
+    const path = `/v1/admin/settings/values/${key}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete a setting override at a scope
+   * DELETE /v1/admin/settings/values/{key}
+   */
+  async deleteSetting(key, body, token) {
+    const path = `/v1/admin/settings/values/${key}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List social providers (admin)
+   * GET /v1/admin/social/providers
+   */
+  async socialAdminListProviders(app_id, token) {
+    const params = new URLSearchParams();
+    if (app_id !== void 0) params.set("app_id", String(app_id));
+    const qs = params.toString();
+    const path = "/v1/admin/social/providers" + (qs ? `?${qs}` : "");
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List supported social providers
+   * GET /v1/admin/social/providers/catalog
+   */
+  async socialAdminCatalog(token) {
+    const path = "/v1/admin/social/providers/catalog";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Configure a social provider (admin)
+   * PUT /v1/admin/social/providers/{provider}
+   */
+  async socialAdminUpsertProvider(provider, body, app_id, token) {
+    const params = new URLSearchParams();
+    if (app_id !== void 0) params.set("app_id", String(app_id));
+    const qs = params.toString();
+    const path = `/v1/admin/social/providers/${provider}` + (qs ? `?${qs}` : "");
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete a social provider (admin)
+   * DELETE /v1/admin/social/providers/{provider}
+   */
+  async socialAdminDeleteProvider(provider, app_id, token) {
+    const params = new URLSearchParams();
+    if (app_id !== void 0) params.set("app_id", String(app_id));
+    const qs = params.toString();
+    const path = `/v1/admin/social/providers/${provider}` + (qs ? `?${qs}` : "");
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List SSO connections for an app (admin)
+   * GET /v1/admin/sso/connections
+   */
+  async ssoAdminListConnections(app_id, token) {
+    const params = new URLSearchParams();
+    if (app_id !== void 0) params.set("app_id", String(app_id));
+    const qs = params.toString();
+    const path = "/v1/admin/sso/connections" + (qs ? `?${qs}` : "");
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create SSO connection (admin)
+   * POST /v1/admin/sso/connections
+   */
+  async ssoAdminCreateConnection(body, token) {
+    const path = "/v1/admin/sso/connections";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get SSO connection (admin)
+   * GET /v1/admin/sso/connections/{connectionId}
+   */
+  async ssoAdminGetConnection(connectionId, token) {
+    const path = `/v1/admin/sso/connections/${connectionId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Update SSO connection (admin)
+   * PUT /v1/admin/sso/connections/{connectionId}
+   */
+  async ssoAdminUpdateConnection(connectionId, body, token) {
+    const path = `/v1/admin/sso/connections/${connectionId}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete SSO connection (admin)
+   * DELETE /v1/admin/sso/connections/{connectionId}
+   */
+  async ssoAdminDeleteConnection(connectionId, token) {
+    const path = `/v1/admin/sso/connections/${connectionId}`;
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Get stats (admin)
+   * GET /v1/admin/stats
+   */
+  async adminGetStats(token) {
+    const path = "/v1/admin/stats";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * List users (admin)
+   * GET /v1/admin/users
+   */
+  async adminListUsers(token) {
+    const path = "/v1/admin/users";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create user (admin)
+   * POST /v1/admin/users/create
+   */
+  async adminCreateUser(body, token) {
+    const path = "/v1/admin/users/create";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get user (admin)
+   * GET /v1/admin/users/{userId}
+   */
+  async adminGetUser(userId, token) {
+    const path = `/v1/admin/users/${userId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Update user (admin)
+   * PATCH /v1/admin/users/{userId}
+   */
+  async adminUpdateUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete user (admin)
+   * DELETE /v1/admin/users/{userId}
+   */
+  async adminDeleteUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Ban user (admin)
+   * POST /v1/admin/users/{userId}/ban
+   */
+  async adminBanUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}/ban`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Unban user (admin)
+   * POST /v1/admin/users/{userId}/unban
+   */
+  async adminUnbanUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}/unban`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List coupons
+   * GET /v1/billing/coupons
+   */
+  async listCoupons(token) {
+    const path = "/v1/billing/coupons";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create coupon
+   * POST /v1/billing/coupons
+   */
+  async createCoupon(body, token) {
+    const path = "/v1/billing/coupons";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete coupon
+   * DELETE /v1/billing/coupons/{couponId}
+   */
+  async deleteCoupon(couponId, body, token) {
+    const path = `/v1/billing/coupons/${couponId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Check feature entitlement
+   * GET /v1/billing/entitlements/{featureKey}
+   */
+  async checkEntitlement(featureKey, token) {
+    const path = `/v1/billing/entitlements/${featureKey}`;
     return this.request(
       "GET",
       path,
@@ -177,11 +939,11 @@ var AuthClient = class {
     );
   }
   /**
-   * List all setting definitions
-   * GET /v1/admin/settings/definitions
+   * List invoices
+   * GET /v1/billing/invoices
    */
-  async listSettingsDefinitions(token) {
-    const path = "/v1/admin/settings/definitions";
+  async listInvoices(token) {
+    const path = "/v1/billing/invoices";
     return this.request(
       "GET",
       path,
@@ -190,11 +952,11 @@ var AuthClient = class {
     );
   }
   /**
-   * List definitions for a namespace
-   * GET /v1/admin/settings/definitions/{namespace}
+   * Get invoice
+   * GET /v1/billing/invoices/{invoiceId}
    */
-  async listNamespaceSettingsDefinitions(namespace, token) {
-    const path = `/v1/admin/settings/definitions/${namespace}`;
+  async getInvoice(invoiceId, token) {
+    const path = `/v1/billing/invoices/${invoiceId}`;
     return this.request(
       "GET",
       path,
@@ -203,37 +965,37 @@ var AuthClient = class {
     );
   }
   /**
-   * Enforce a setting value at a scope
-   * PUT /v1/admin/settings/enforce/{key}
+   * Mark invoice as paid
+   * POST /v1/billing/invoices/{invoiceId}/pay
    */
-  async enforceSetting(key, body, token) {
-    const path = `/v1/admin/settings/enforce/${key}`;
+  async markInvoicePaid(invoiceId, body, token) {
+    const path = `/v1/billing/invoices/${invoiceId}/pay`;
     return this.request(
-      "PUT",
+      "POST",
       path,
       body,
       token
     );
   }
   /**
-   * Remove enforcement from a setting
-   * DELETE /v1/admin/settings/enforce/{key}
+   * Void an invoice
+   * POST /v1/billing/invoices/{invoiceId}/void
    */
-  async unenforceSetting(key, body, token) {
-    const path = `/v1/admin/settings/enforce/${key}`;
+  async voidInvoice(invoiceId, body, token) {
+    const path = `/v1/billing/invoices/${invoiceId}/void`;
     return this.request(
-      "DELETE",
+      "POST",
       path,
       body,
       token
     );
   }
   /**
-   * Resolve all settings at a scope
-   * GET /v1/admin/settings/resolve
+   * List billing plans
+   * GET /v1/billing/plans
    */
-  async resolveSettings(token) {
-    const path = "/v1/admin/settings/resolve";
+  async listBillingPlans(token) {
+    const path = "/v1/billing/plans";
     return this.request(
       "GET",
       path,
@@ -242,11 +1004,24 @@ var AuthClient = class {
     );
   }
   /**
-   * Resolve one setting with cascade details
-   * GET /v1/admin/settings/resolve/{key}
+   * Create billing plan
+   * POST /v1/billing/plans
    */
-  async resolveSetting(key, token) {
-    const path = `/v1/admin/settings/resolve/${key}`;
+  async createBillingPlan(body, token) {
+    const path = "/v1/billing/plans";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get billing plan
+   * GET /v1/billing/plans/{planId}
+   */
+  async getBillingPlan(planId, token) {
+    const path = `/v1/billing/plans/${planId}`;
     return this.request(
       "GET",
       path,
@@ -255,37 +1030,37 @@ var AuthClient = class {
     );
   }
   /**
-   * Set a setting value at a scope
-   * PUT /v1/admin/settings/values/{key}
+   * Activate a billing plan
+   * POST /v1/billing/plans/{planId}/activate
    */
-  async setSetting(key, body, token) {
-    const path = `/v1/admin/settings/values/${key}`;
+  async activateBillingPlan(planId, body, token) {
+    const path = `/v1/billing/plans/${planId}/activate`;
     return this.request(
-      "PUT",
+      "POST",
       path,
       body,
       token
     );
   }
   /**
-   * Delete a setting override at a scope
-   * DELETE /v1/admin/settings/values/{key}
+   * Archive a billing plan
+   * POST /v1/billing/plans/{planId}/archive
    */
-  async deleteSetting(key, body, token) {
-    const path = `/v1/admin/settings/values/${key}`;
+  async archiveBillingPlan(planId, body, token) {
+    const path = `/v1/billing/plans/${planId}/archive`;
     return this.request(
-      "DELETE",
+      "POST",
       path,
       body,
       token
     );
   }
   /**
-   * Get stats (admin)
-   * GET /v1/admin/stats
+   * List subscriptions
+   * GET /v1/billing/subscriptions
    */
-  async adminGetStats(token) {
-    const path = "/v1/admin/stats";
+  async listSubscriptions(token) {
+    const path = "/v1/billing/subscriptions";
     return this.request(
       "GET",
       path,
@@ -294,24 +1069,24 @@ var AuthClient = class {
     );
   }
   /**
-   * List users (admin)
-   * GET /v1/admin/users
+   * Create subscription
+   * POST /v1/billing/subscriptions
    */
-  async adminListUsers(token) {
-    const path = "/v1/admin/users";
+  async createSubscription(body, token) {
+    const path = "/v1/billing/subscriptions";
     return this.request(
-      "GET",
+      "POST",
       path,
-      void 0,
+      body,
       token
     );
   }
   /**
-   * Get user (admin)
-   * GET /v1/admin/users/{userId}
+   * Get active subscription
+   * GET /v1/billing/subscriptions/active
    */
-  async adminGetUser(userId, token) {
-    const path = `/v1/admin/users/${userId}`;
+  async getActiveSubscription(token) {
+    const path = "/v1/billing/subscriptions/active";
     return this.request(
       "GET",
       path,
@@ -320,24 +1095,24 @@ var AuthClient = class {
     );
   }
   /**
-   * Delete user (admin)
-   * DELETE /v1/admin/users/{userId}
+   * Cancel subscription
+   * POST /v1/billing/subscriptions/{subId}/cancel
    */
-  async adminDeleteUser(userId, body, token) {
-    const path = `/v1/admin/users/${userId}`;
+  async cancelSubscription(subId, body, token) {
+    const path = `/v1/billing/subscriptions/${subId}/cancel`;
     return this.request(
-      "DELETE",
+      "POST",
       path,
       body,
       token
     );
   }
   /**
-   * Ban user (admin)
-   * POST /v1/admin/users/{userId}/ban
+   * Change subscription plan
+   * POST /v1/billing/subscriptions/{subId}/change-plan
    */
-  async adminBanUser(userId, body, token) {
-    const path = `/v1/admin/users/${userId}/ban`;
+  async changeSubscriptionPlan(subId, body, token) {
+    const path = `/v1/billing/subscriptions/${subId}/change-plan`;
     return this.request(
       "POST",
       path,
@@ -346,11 +1121,24 @@ var AuthClient = class {
     );
   }
   /**
-   * Unban user (admin)
-   * POST /v1/admin/users/{userId}/unban
+   * Pause subscription
+   * POST /v1/billing/subscriptions/{subId}/pause
    */
-  async adminUnbanUser(userId, body, token) {
-    const path = `/v1/admin/users/${userId}/unban`;
+  async pauseSubscription(subId, body, token) {
+    const path = `/v1/billing/subscriptions/${subId}/pause`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Resume subscription
+   * POST /v1/billing/subscriptions/{subId}/resume
+   */
+  async resumeSubscription(subId, body, token) {
+    const path = `/v1/billing/subscriptions/${subId}/resume`;
     return this.request(
       "POST",
       path,
@@ -358,6 +1146,19 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Get usage summary
+   * GET /v1/billing/usage
+   */
+  async getUsageSummary(token) {
+    const path = "/v1/billing/usage";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * Change password
    * POST /v1/change-password
@@ -384,6 +1185,42 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * List consents
+   * GET /v1/consent
+   */
+  async listConsents() {
+    const path = "/v1/consent";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
+  }
+  /**
+   * Grant consent
+   * POST /v1/consent/grant
+   */
+  async grantConsent(body) {
+    const path = "/v1/consent/grant";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Revoke consent
+   * POST /v1/consent/revoke
+   */
+  async revokeConsent(body) {
+    const path = "/v1/consent/revoke";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
   /**
    * List devices
    * GET /v1/devices
@@ -577,6 +1414,18 @@ var AuthClient = class {
       void 0
     );
   }
+  /**
+   * Introspect token
+   * POST /v1/introspect
+   */
+  async introspectToken(body) {
+    const path = "/v1/introspect";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
   /**
    * List API keys
    * GET /v1/keys
@@ -718,6 +1567,19 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Switch active organization
+   * POST /v1/me/switch-org
+   */
+  async switchOrg(body, token) {
+    const path = "/v1/me/switch-org";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
   /**
    * MFA challenge
    * POST /v1/mfa/challenge
@@ -819,6 +1681,80 @@ var AuthClient = class {
       body
     );
   }
+  /**
+   * OAuth2 Authorization
+   * GET /v1/oauth/authorize
+   */
+  async oauth2Authorize() {
+    const path = "/v1/oauth/authorize";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
+  }
+  /**
+   * Device Authorization
+   * POST /v1/oauth/device/authorize
+   */
+  async oauth2DeviceAuthorize(body) {
+    const path = "/v1/oauth/device/authorize";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Complete device authorization
+   * POST /v1/oauth/device/complete
+   */
+  async oauth2DeviceComplete(body) {
+    const path = "/v1/oauth/device/complete";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Revoke token
+   * POST /v1/oauth/revoke
+   */
+  async oauth2Revoke(body, token) {
+    const path = "/v1/oauth/revoke";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * OAuth2 Token
+   * POST /v1/oauth/token
+   */
+  async oauth2Token(body) {
+    const path = "/v1/oauth/token";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * OIDC UserInfo
+   * GET /v1/oauth/userinfo
+   */
+  async oauth2UserInfo(token) {
+    const path = "/v1/oauth/userinfo";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * List organizations
    * GET /v1/orgs
@@ -1068,10 +2004,10 @@ var AuthClient = class {
   }
   /**
    * List passkeys
-   * GET /v1/passkeys/
+   * GET /v1/passkeys
    */
   async listPasskeys(token) {
-    const path = "/v1/passkeys/";
+    const path = "/v1/passkeys";
     return this.request(
       "GET",
       path,
@@ -1142,6 +2078,30 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Start phone authentication
+   * POST /v1/phone/start
+   */
+  async phoneAuthStart(body) {
+    const path = "/v1/phone/start";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Verify phone OTP
+   * POST /v1/phone/verify
+   */
+  async phoneAuthVerify(body) {
+    const path = "/v1/phone/verify";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
   /**
    * Refresh tokens
    * POST /v1/refresh
@@ -1444,6 +2404,18 @@ var AuthClient = class {
       body
     );
   }
+  /**
+   * Resend email verification
+   * POST /v1/verify-email/resend
+   */
+  async resendEmailVerification(body) {
+    const path = "/v1/verify-email/resend";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
   /**
    * List webhooks
    * GET /v1/webhooks
@@ -1520,6 +2492,9 @@ var AuthClient = class {
     if (token) {
       headers["Authorization"] = `Bearer ${token}`;
     }
+    if (this.publishableKey) {
+      headers["X-Publishable-Key"] = this.publishableKey;
+    }
     const response = await this.fetchFn(`${this.baseURL}${path}`, {
       method,
       headers,
@@ -1533,7 +2508,10 @@ var AuthClient = class {
       }
       throw new AuthClientError(
         apiError?.error ?? `Request failed with status ${response.status}`,
-        apiError?.code ?? response.status
+        apiError?.code ?? response.status,
+        apiError?.type,
+        apiError
+        // full decoded body so callers can read extras like mfa_ticket / available_methods
       );
     }
     if (response.status === 204) {
@@ -1544,10 +2522,23 @@ var AuthClient = class {
 };
 var AuthClientError = class extends Error {
   code;
-  constructor(message, code) {
+  // Stable string error code from the backend envelope (e.g.
+  // "email_not_verified", "captcha_required", "mfa_required"). Lets
+  // the UI branch on specific failure modes instead of pattern-
+  // matching on the human-readable message.
+  type;
+  // Full decoded JSON body when the response body was JSON. Lets
+  // callers read tagged extras the envelope carries beyond
+  // {error, code, type} — e.g. mfa_ticket and available_methods on
+  // a 403 with type:"mfa_required". Undefined when the body wasn't
+  // JSON.
+  details;
+  constructor(message, code, type, details) {
     super(message);
     this.name = "AuthClientError";
     this.code = code;
+    this.type = type;
+    this.details = details;
   }
 };
 
@@ -1644,13 +2635,20 @@ var AuthClient2 = class extends AuthClient {
    *
    * The config describes which auth methods are enabled so SDK
    * components can auto-configure without manual props.
+   *
+   * Reads `baseURL` and `fetchFn` directly off the generated parent
+   * class — earlier generator templates kept a `this.config` ref but
+   * the current embedded template stores fields individually, so the
+   * old `(this as any).config.baseURL` shape produced `undefined` and
+   * the URL constructor threw.
    */
   async fetchClientConfig(publishableKey) {
-    const url = new URL("/v1/client-config", this.config.baseURL);
+    const baseURL = this.baseURL;
+    const fetchFn = this.fetchFn ?? globalThis.fetch;
+    const url = new URL("/v1/client-config", baseURL);
     if (publishableKey) {
       url.searchParams.set("key", publishableKey);
     }
-    const fetchFn = this.config.fetch ?? globalThis.fetch;
     const res = await fetchFn(url.toString(), {
       method: "GET",
       headers: { "Content-Type": "application/json" }
@@ -1775,6 +2773,26 @@ var AuthManager = class {
       };
       await this.handleAuthResponse(res.user, session);
     } catch (err) {
+      if (err instanceof AuthClientError && err.type === "mfa_required" && err.details) {
+        const ticket = typeof err.details["mfa_ticket"] === "string" ? err.details["mfa_ticket"] : "";
+        const methods = Array.isArray(err.details["available_methods"]) ? err.details["available_methods"] : [];
+        if (ticket) {
+          this.setState({
+            status: "mfa_required",
+            email: credentials.email ?? "",
+            mfaTicket: ticket,
+            availableMethods: methods
+          });
+          return;
+        }
+      }
+      if (err instanceof AuthClientError && err.type === "email_not_verified") {
+        this.setState({
+          status: "email_not_verified",
+          email: credentials.email ?? ""
+        });
+        throw err;
+      }
       this.handleError(err);
       throw err;
     }
@@ -1782,18 +2800,35 @@ var AuthManager = class {
   /** Sign up with email & password. */
   async signUp(data) {
     try {
-      const res = await this.client.signUp(data);
-      const session = {
-        session_token: res.session_token,
-        refresh_token: res.refresh_token,
-        expires_at: new Date(Date.now() + 36e5).toISOString()
-      };
-      await this.handleAuthResponse(res.user, session);
+      await this.client.signUp(data);
+      this.setState({
+        status: "verification_pending",
+        email: data.email
+      });
     } catch (err) {
       this.handleError(err);
       throw err;
     }
   }
+  /**
+   * Resend the verification email for an unverified account.
+   *
+   * Always resolves; the backend returns 200 regardless of whether the
+   * email is registered, unregistered, or already verified — that's the
+   * enumeration-resistance contract. UI callers should disable the
+   * button + show a generic "if your email is registered, we sent a new
+   * link" confirmation rather than branching on the response.
+   */
+  async resendVerification(email) {
+    if (!email) return;
+    try {
+      await this.client.resendEmailVerification({ email });
+    } catch (err) {
+      this.onError?.({
+        error: err instanceof Error ? err.message : "resend failed"
+      });
+    }
+  }
   /** Sign out and clear the session. */
   async signOut() {
     const token = this.getSessionToken();
@@ -1807,21 +2842,48 @@ var AuthManager = class {
     await this.clearSession();
     this.setState({ status: "unauthenticated" });
   }
-  /** Submit an MFA challenge code. */
-  async submitMFACode(enrollmentId, code) {
-    this.setState({ status: "loading" });
+  /**
+   * Submit the MFA challenge code against the ticket from the
+   * mfa_required state. On success: real session minted, state →
+   * "authenticated". On bad code: state stays "mfa_required" so
+   * the form can show the error inline; the ticket remains valid
+   * for the 5-minute server-side TTL.
+   *
+   * Throws if called outside the mfa_required state — the caller
+   * has nowhere to send the code.
+   */
+  async submitMFAChallenge(code) {
+    const state = this.state;
+    if (state.status !== "mfa_required") {
+      throw new Error("auth: submitMFAChallenge called outside the mfa_required state");
+    }
     try {
-      const res = await this.client.mfaChallenge({ enrollment_id: enrollmentId, code });
+      const res = await this.client.challengeMFA({
+        mfa_ticket: state.mfaTicket,
+        code
+      });
       const session = {
         session_token: res.session_token,
         refresh_token: res.refresh_token,
-        expires_at: new Date(Date.now() + 36e5).toISOString()
+        expires_at: res.expires_at ?? new Date(Date.now() + 36e5).toISOString()
       };
       await this.handleAuthResponse(res.user, session);
     } catch (err) {
-      this.handleError(err);
+      this.onError?.({
+        error: err instanceof Error ? err.message : "challenge failed"
+      });
+      throw err;
     }
   }
+  /**
+   * @deprecated Use submitMFAChallenge(code). The old enrollment-id
+   * + partial-session shape was removed in the MFA consolidation;
+   * this thin shim only exists so older callers don't break their
+   * build, but the enrollmentId argument is now ignored.
+   */
+  async submitMFACode(_enrollmentId, code) {
+    return this.submitMFAChallenge(code);
+  }
   /** Submit an MFA recovery code. */
   async submitRecoveryCode(code) {
     this.setState({ status: "loading" });
@@ -1866,16 +2928,26 @@ var AuthManager = class {
     if (state.status !== "authenticated") return;
     await this.refreshSession(state.session.refresh_token);
   }
-  /** Get the current session token (if authenticated). */
+  /**
+   * Get the current session token (if authenticated). Returns null
+   * during the MFA challenge — there is no real session yet, only a
+   * ticket the challenge handler validates internally.
+   */
   getSessionToken() {
     if (this.state.status === "authenticated") {
       return this.state.session.session_token;
     }
-    if (this.state.status === "mfa_required") {
-      return this.state.session.session_token;
-    }
     return null;
   }
+  /**
+   * Get the active MFA ticket (only set during the mfa_required
+   * state). Form components driving the challenge UI read this to
+   * confirm they have a partial-auth credential before letting the
+   * user submit a code.
+   */
+  getMFATicket() {
+    return this.state.status === "mfa_required" ? this.state.mfaTicket : null;
+  }
   /** Get the current user (if authenticated). */
   getUser() {
     if (this.state.status === "authenticated") {
@@ -2000,22 +3072,9 @@ var AuthManager = class {
   handleError(err) {
     const message = err instanceof AuthClientError ? err.message : "An unexpected error occurred";
     const code = err instanceof AuthClientError ? err.code : void 0;
-    if (code === 403 && message.toLowerCase().includes("mfa")) {
-      const token = this.getSessionToken();
-      if (token) {
-        this.setState({
-          status: "mfa_required",
-          session: {
-            session_token: token,
-            refresh_token: "",
-            expires_at: new Date(Date.now() + 3e5).toISOString()
-          }
-        });
-        return;
-      }
-    }
+    const type = err instanceof AuthClientError ? err.type : void 0;
     this.setState({ status: "error", error: message });
-    this.onError?.({ error: message, code });
+    this.onError?.({ error: message, code, type });
   }
 };