@crowdedkingdoms/crowdyjs 14.2.0-test.1 → 15.0.0-dev.1

package/MIGRATION.md

@@ -1,3 +1,55 @@
+# CrowdyJS v15 — the dev auth bypass is gone (breaking)
+
+`client.auth.devLogin()` is **removed**, and so is the `devToken` field on
+`requestLoginLink`. Neither is deprecated or disabled — the server-side feature
+they called is deleted from every tier, so a wrapper for it could only produce a
+GraphQL validation error.
+
+**Why it went.** `devLogin` returned an identity session for any email address
+with no proof of ownership whatsoever. It was gated on a server flag the control
+plane derived as `tier !== 'prod'`, so it was live on dev and test, and if the
+address happened to belong to a super admin then so did the session. `devToken`
+was the same hole in a smaller shape: it put the emailed one-time magic-link
+token in the response body, readable by any unauthenticated caller who knew an
+address.
+
+**What replaces them: `login` and `register`, which are new here and are not new
+to the server.** Email + password has been first-class in the API throughout;
+only this SDK claimed the product was passwordless, and that gap is what pushed
+automated clients onto the bypass in the first place.
+
+```diff
+-await client.auth.devLogin('player@example.com');
++await client.auth.login({ email: 'player@example.com', password });
++// or, for an address that has never been seen:
++await client.auth.register({ email: 'player@example.com', password });
+```
+
+```diff
+ const link = await client.auth.requestLoginLink({ email });
+-if (link.devToken) await client.auth.completeLoginLink(link.devToken);
++// The token arrives only by email now. An automated caller should register an
++// account it holds the password to instead of reading one out of the response.
+```
+
+**Also new:** `client.auth.checkAuthMethod(email)` for email-first adaptive
+login, and two error predicates, because these two conditions are **not**
+distinguishable by GraphQL error code:
+
+- `isAlreadyRegisteredError(e)` — `register` refused because the address already
+  has an account. The server raises a `ConflictException` and it arrives as
+  `INTERNAL_SERVER_ERROR`, so a caller keying on `CONFLICT` matches nothing.
+- `isPasswordUnconfirmedError(e)` — `login` refused because the password is real
+  but unconfirmed on an account with another verified sign-in method. The remedy
+  is the emailed link, not a different password.
+
+**One behaviour worth knowing before you write a retry loop:** `register` returns
+a session only for an address it is **creating**. An address that already has an
+account gets the password attached *pending email confirmation* and no token.
+Registering and signing in are therefore not interchangeable.
+
+---
+
 # CrowdyJS v14 — one endpoint (breaking)
 
 v13 made the two GraphQL origins optional-but-supported. v14 removes the second
@@ -489,11 +541,12 @@ your sign-in flow to one of:
   await client.auth.socialLoginComplete({ provider: 'google', code, state });
   ```
 - **Dev bypass (development only):** `await client.auth.devLogin(email)` — works only
-  when the server has `DEV_AUTH_BYPASS` enabled.
+  when the server has `DEV_AUTH_BYPASS` enabled. **Removed in 15.0.0 — see below.**
 
 **Removed:** `client.auth.login`, `register`, `confirmEmail`, `requestPasswordReset`,
 `resetPassword`, `resendConfirmationEmail`, `changePassword` (and the
 `LoginUserInput` / `RegisterUserInput` / `ResetPasswordInput` types).
+**`login` and `register` came back in 15.0.0**; the rest did not.
 
 **New:** `requestLoginLink`, `completeLoginLink`, `socialLoginStart`,
 `socialLoginComplete`, `devLogin`, `availableLoginProviders`, `myIdentities`,

package/README.md

@@ -49,18 +49,20 @@ const client = createCrowdyClient({
   },
 });
 
-// Restore a previous session if there is one, otherwise sign in (passwordless).
+// Restore a previous session if there is one, otherwise sign in.
 await client.session.restore();
 if (!client.session.getToken()) {
-  // Magic link: email a one-time link, then complete with the token from it.
+  // Email + password:
+  await client.auth.login({ email: 'player@example.com', password });
+  // ...or create the account: client.auth.register({ email, password })
+  // Or magic link: email a one-time link, then complete with the token from it.
   await client.auth.requestLoginLink({ email: 'player@example.com', redirectUri });
   await client.auth.completeLoginLink(tokenFromLink);
   // Or social/OIDC: socialLoginStart('google', redirectUri) -> socialLoginComplete({ provider, code, state })
-  // Or dev/test only (server has DEV_AUTH_BYPASS): client.auth.devLogin('player@example.com')
 }
 
-// Passwordless sign-in returns an identity SESSION token (rejected for gameplay);
-// the account is created on first sign-in. Identity reads run on it:
+// Every sign-in returns an identity SESSION token (rejected for gameplay).
+// Identity reads run on it:
 const me = await client.users.me();
 console.log(me.email);
 ```
@@ -725,8 +727,8 @@ endpoint; `client.graphql` reaches every surface.)
 the environment is not configured, so they are safe to leave in `npm test`.
 
 ```bash
-CROWDY_HTTP_URL='https://ck.<tier>.cp.cks-env.com' \
-CROWDY_WS_URL='wss://ck.<tier>.cp.cks-env.com/graphql' \
+CROWDY_HTTP_URL='https://ck.<tier>.v7.cks-env.com' \
+CROWDY_WS_URL='wss://ck.<tier>.v7.cks-env.com/graphql' \
 CROWDY_OWNER_EMAIL='owner@example.com' \
 CROWDY_TEST_APP_ID='78221653114368' \
   npm run test:e2e

package/dist/domains/auth.d.ts

@@ -3,17 +3,24 @@ import type { AuthState } from '../auth-state.js';
 /**
  * Authentication and account lifecycle — exposed as `client.auth`.
  *
- * Crowded Kingdoms is **passwordless**. There is no email+password login: a user
- * authenticates with an emailed magic link, a federated social provider (OIDC),
- * or — in development only — the dev bypass. Every path returns an identity
- * SESSION token (management-plane), which is stored on the shared session state
- * automatically. Gameplay tokens are minted separately via `client.portal`.
+ * Four ways to sign in: email + password ({@link register} / {@link login}), an
+ * emailed magic link, or a federated social provider (OIDC). Every path returns
+ * an identity SESSION token (management-plane), which is stored on the shared
+ * session state automatically. Gameplay tokens are minted separately via
+ * `client.portal`.
+ *
+ * This comment used to say Crowded Kingdoms was passwordless and that there was
+ * no email+password login. That was never true of the server: `login` and
+ * `register` have been first-class in the API throughout, and the C++ load
+ * tester has used them all along. Only this SDK pretended otherwise, and the
+ * gap sent integrators to the dev bypass — which no longer exists on any tier.
  *
  * Part of the management surface.
  *
- * **Public (no session):** {@link requestLoginLink}, {@link completeLoginLink},
- * {@link socialLoginStart}, {@link socialLoginComplete}, {@link devLogin},
- * {@link availableLoginProviders}. **Require a session:** {@link logout},
+ * **Public (no session):** {@link register}, {@link login},
+ * {@link requestLoginLink}, {@link completeLoginLink}, {@link socialLoginStart},
+ * {@link socialLoginComplete}, {@link availableLoginProviders},
+ * {@link checkAuthMethod}. **Require a session:** {@link logout},
  * {@link logoutAllDevices}, {@link myIdentities}, {@link linkIdentity},
  * {@link unlinkIdentity}.
  */
@@ -37,6 +44,23 @@ export interface UserIdentity {
     createdAt: string;
     lastLoginAt: string | null;
 }
+/**
+ * `register` refused because the address already has an account.
+ *
+ * Matched on WORDING rather than on an error code, which looks fragile and is
+ * the only thing that works: the server raises a Nest `ConflictException` and it
+ * arrives over GraphQL as `INTERNAL_SERVER_ERROR` — verified against a live
+ * tier — so a caller keying on `CONFLICT` matches nothing and treats a routine
+ * "this account exists" as a server fault.
+ */
+export declare function isAlreadyRegisteredError(error: unknown): boolean;
+/**
+ * `login` refused because the password is real but not yet confirmed, on an
+ * account that has another verified sign-in method. The remedy is the emailed
+ * confirmation link, not a different password — so this must not be reported to
+ * the user as "wrong password".
+ */
+export declare function isPasswordUnconfirmedError(error: unknown): boolean;
 export declare class AuthAPI {
     private readonly graphql;
     private readonly session;
@@ -45,16 +69,17 @@ export declare class AuthAPI {
     availableLoginProviders(): Promise<string[]>;
     /**
      * Passwordless: email the address a one-time magic sign-in link (creating the
-     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
-     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
-     * token to pass straight to {@link completeLoginLink} without an inbox.
+     * account on first sign-in). Always resolves `sent: true` (no enumeration).
+     *
+     * The token arrives only by email. There is no longer a `devToken` shortcut —
+     * automated callers that need a session without an inbox should
+     * {@link register} an account they own the password to.
      */
     requestLoginLink(input: {
         email: string;
         redirectUri?: string;
     }): Promise<{
         sent: boolean;
-        devToken: string | null;
     }>;
     /** Complete a magic-link sign-in; stores the session token on success. */
     completeLoginLink(token: string): Promise<AuthResponse>;
@@ -73,11 +98,39 @@ export declare class AuthAPI {
         state: string;
     }): Promise<AuthResponse>;
     /**
-     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
-     * Returns a session for `email` without email/social verification; stores it.
-     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
+     * Sign in with email + password; stores the session token on success.
+     *
+     * Throws when the credentials are wrong, and — separately — when the account
+     * has another verified sign-in method and the password has not yet been
+     * confirmed by email. {@link isPasswordUnconfirmedError} tells those apart,
+     * because they need different things from the user.
      */
-    devLogin(email: string): Promise<AuthResponse>;
+    login(input: {
+        email: string;
+        password: string;
+    }): Promise<AuthResponse>;
+    /**
+     * Create an email + password account; stores the session token on success.
+     *
+     * **A brand-new address gets a session immediately.** An address that already
+     * has an account does NOT: the password is attached pending email
+     * confirmation and the server throws instead of returning a token, so the
+     * caller cannot treat "registered" and "signed in" as one outcome. Use
+     * {@link isAlreadyRegisteredError} to detect it and fall back to
+     * {@link login} or {@link requestLoginLink}.
+     */
+    register(input: {
+        email: string;
+        password: string;
+        gamertag?: string;
+    }): Promise<AuthResponse>;
+    /**
+     * Email-first adaptive login: does this address have password sign-in enabled?
+     * Public, and deliberately does not reveal whether the address is registered.
+     */
+    checkAuthMethod(email: string): Promise<{
+        hasPassword: boolean;
+    }>;
     /** The signed-in user's linked sign-in identities. Requires a session. */
     myIdentities(): Promise<UserIdentity[]>;
     /** Link an additional federated identity (from a social callback). */

package/dist/domains/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+DD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;OAKG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKvD,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQpD,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGlE;AAsFD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;;;OAOG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK9B,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ9E;;;;;;;;;OASG;IACG,QAAQ,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,YAAY,CAAC;IAQzB;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAOvE,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}

package/dist/domains/auth.js

@@ -1,12 +1,46 @@
 import { parse } from 'graphql';
 import { LogoutAllDevicesDocument, LogoutDocument } from '../generated/graphql.js';
+/**
+ * `register` refused because the address already has an account.
+ *
+ * Matched on WORDING rather than on an error code, which looks fragile and is
+ * the only thing that works: the server raises a Nest `ConflictException` and it
+ * arrives over GraphQL as `INTERNAL_SERVER_ERROR` — verified against a live
+ * tier — so a caller keying on `CONFLICT` matches nothing and treats a routine
+ * "this account exists" as a server fault.
+ */
+export function isAlreadyRegisteredError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /account with this email already exists/i.test(message);
+}
+/**
+ * `login` refused because the password is real but not yet confirmed, on an
+ * account that has another verified sign-in method. The remedy is the emailed
+ * confirmation link, not a different password — so this must not be reported to
+ * the user as "wrong password".
+ */
+export function isPasswordUnconfirmedError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /confirm your email to enable password sign-in/i.test(message);
+}
 const AUTH_RESPONSE_FIELDS = 'token gameTokenId user { userId email gamertag }';
 const IDENTITY_FIELDS = 'identityId provider subject email emailVerified createdAt lastLoginAt';
-const RequestLoginLinkDocument = parse(`mutation RequestLoginLink($input: RequestLoginLinkInput!) { requestLoginLink(input: $input) { sent devToken } }`);
+// `devToken` is NOT selected. The field returned the magic-link token in
+// plaintext whenever the server had the dev bypass on, which made an emailed
+// one-time secret readable by any unauthenticated caller. It is gone from the
+// server; selecting it here would make every requestLoginLink call fail
+// validation against a current API.
+const RequestLoginLinkDocument = parse(`mutation RequestLoginLink($input: RequestLoginLinkInput!) { requestLoginLink(input: $input) { sent } }`);
 const CompleteLoginLinkDocument = parse(`mutation CompleteLoginLink($input: CompleteLoginLinkInput!) { completeLoginLink(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
 const SocialLoginStartDocument = parse(`mutation SocialLoginStart($input: SocialLoginStartInput!) { socialLoginStart(input: $input) { authorizeUrl state } }`);
 const SocialLoginCompleteDocument = parse(`mutation SocialLoginComplete($input: SocialLoginCompleteInput!) { socialLoginComplete(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
-const DevLoginDocument = parse(`mutation DevLogin($input: DevLoginInput!) { devLogin(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+// `login` and `register` take a NON-STANDARD argument name -- `loginUserInput`
+// and `registerUserInput` rather than `input`. That is the server's spelling and
+// it is not negotiable from here; getting it wrong produces a validation error
+// naming a field the caller never wrote.
+const LoginDocument = parse(`mutation Login($loginUserInput: LoginUserInput!) { login(loginUserInput: $loginUserInput) { ${AUTH_RESPONSE_FIELDS} } }`);
+const RegisterDocument = parse(`mutation Register($registerUserInput: RegisterUserInput!) { register(registerUserInput: $registerUserInput) { ${AUTH_RESPONSE_FIELDS} } }`);
+const CheckAuthMethodDocument = parse(`query CheckAuthMethod($input: CheckAuthMethodInput!) { checkAuthMethod(input: $input) { hasPassword } }`);
 const AvailableLoginProvidersDocument = parse(`query AvailableLoginProviders { availableLoginProviders }`);
 const MyIdentitiesDocument = parse(`query MyIdentities { myIdentities { ${IDENTITY_FIELDS} } }`);
 const LinkIdentityDocument = parse(`mutation LinkIdentity($input: LinkIdentityInput!) { linkIdentity(input: $input) { ${IDENTITY_FIELDS} } }`);
@@ -23,9 +57,11 @@ export class AuthAPI {
     }
     /**
      * Passwordless: email the address a one-time magic sign-in link (creating the
-     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
-     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
-     * token to pass straight to {@link completeLoginLink} without an inbox.
+     * account on first sign-in). Always resolves `sent: true` (no enumeration).
+     *
+     * The token arrives only by email. There is no longer a `devToken` shortcut —
+     * automated callers that need a session without an inbox should
+     * {@link register} an account they own the password to.
      */
     async requestLoginLink(input) {
         const data = await this.graphql.request(RequestLoginLinkDocument, { input });
@@ -60,17 +96,48 @@ export class AuthAPI {
         return data.socialLoginComplete;
     }
     /**
-     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
-     * Returns a session for `email` without email/social verification; stores it.
-     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
+     * Sign in with email + password; stores the session token on success.
+     *
+     * Throws when the credentials are wrong, and — separately — when the account
+     * has another verified sign-in method and the password has not yet been
+     * confirmed by email. {@link isPasswordUnconfirmedError} tells those apart,
+     * because they need different things from the user.
+     */
+    async login(input) {
+        const data = await this.graphql.request(LoginDocument, {
+            loginUserInput: input,
+        });
+        if (data.login?.token)
+            this.session.setToken(data.login.token);
+        return data.login;
+    }
+    /**
+     * Create an email + password account; stores the session token on success.
+     *
+     * **A brand-new address gets a session immediately.** An address that already
+     * has an account does NOT: the password is attached pending email
+     * confirmation and the server throws instead of returning a token, so the
+     * caller cannot treat "registered" and "signed in" as one outcome. Use
+     * {@link isAlreadyRegisteredError} to detect it and fall back to
+     * {@link login} or {@link requestLoginLink}.
+     */
+    async register(input) {
+        const data = await this.graphql.request(RegisterDocument, {
+            registerUserInput: input,
+        });
+        if (data.register?.token)
+            this.session.setToken(data.register.token);
+        return data.register;
+    }
+    /**
+     * Email-first adaptive login: does this address have password sign-in enabled?
+     * Public, and deliberately does not reveal whether the address is registered.
      */
-    async devLogin(email) {
-        const data = await this.graphql.request(DevLoginDocument, {
+    async checkAuthMethod(email) {
+        const data = await this.graphql.request(CheckAuthMethodDocument, {
             input: { email },
         });
-        if (data.devLogin?.token)
-            this.session.setToken(data.devLogin.token);
-        return data.devLogin;
+        return data.checkAuthMethod;
     }
     /** The signed-in user's linked sign-in identities. Requires a session. */
     async myIdentities() {