@crowdedkingdoms/crowdyjs 7.1.1 → 8.0.0

package/MIGRATION.md

@@ -1,3 +1,49 @@
+# CrowdyJS v8 — Passwordless & federated sign-in (BREAKING)
+
+**Crowded Kingdoms is passwordless.** Email + password login is removed. Update
+your sign-in flow to one of:
+
+- **Magic link (email):**
+  ```ts
+  await client.auth.requestLoginLink({ email, redirectUri }); // emails a one-time link
+  // on the landing page (token from the URL):
+  const { user } = await client.auth.completeLoginLink(tokenFromUrl);
+  ```
+- **Social (federated / OIDC):**
+  ```ts
+  const providers = await client.auth.availableLoginProviders(); // e.g. ['google']
+  const { authorizeUrl, state } = await client.auth.socialLoginStart('google', callbackUrl);
+  location.assign(authorizeUrl);
+  // on the callback page:
+  await client.auth.socialLoginComplete({ provider: 'google', code, state });
+  ```
+- **Dev bypass (development only):** `await client.auth.devLogin(email)` — works only
+  when the server has `DEV_AUTH_BYPASS` enabled.
+
+**Removed:** `client.auth.login`, `register`, `confirmEmail`, `requestPasswordReset`,
+`resetPassword`, `resendConfirmationEmail`, `changePassword` (and the
+`LoginUserInput` / `RegisterUserInput` / `ResetPasswordInput` types).
+
+**New:** `requestLoginLink`, `completeLoginLink`, `socialLoginStart`,
+`socialLoginComplete`, `devLogin`, `availableLoginProviders`, `myIdentities`,
+`linkIdentity`, `unlinkIdentity`. Each sign-in still returns an identity session
+token, stored on the shared session automatically (account is created on first
+sign-in).
+
+**Portal consent + connected apps (new on `client.portal`):** `getConsent(appId)`,
+`authorizeApp(appId)`, `revokeAppAuthorization(appId)`, `myAuthorizedApps()`,
+`setAppClientSettings({ appId, redirectUris, clientType, launchUrl })`.
+`handleAuthorizeRequest` now enforces consent: untrusted apps throw
+`PortalConsentRequiredError` unless you pass `{ grantConsent: true }` (call after
+the user approves on the consent screen). Trusted/first-party apps (the Overworld,
+app 1) skip consent. Browser portal entry now requires the destination app's
+`redirect_uris` to be registered (`setAppClientSettings`).
+
+Everything else from v7 (the two-client pattern, `client.portal` minting/PKCE,
+app-scoped tokens) is unchanged.
+
+---
+
 # CrowdyJS v7 — Overworld portals & app-scoped tokens (BREAKING)
 
 v7 splits the single app-agnostic game token into two credentials and makes

package/dist/domains/auth.d.ts

@@ -1,163 +1,100 @@
 import type { GraphQLClient } from '../client.js';
 import type { AuthState } from '../auth-state.js';
-import { type LoginMutation, type LoginUserInput, type RegisterMutation, type RegisterUserInput, type ResetPasswordInput } from '../generated/graphql.js';
 /**
- * Authentication and account-lifecycle flows — exposed as `client.auth`.
+ * Authentication and account lifecycle — exposed as `client.auth`.
  *
- * Targets the **management-api**: every call routes to `managementUrl` (falling
- * back to the game-api endpoint only in legacy single-endpoint mode). The
- * management API owns the `game_tokens` table that backs every login / register
- * / password / email-confirmation flow; the `token` it returns is a
- * `game_tokens` row that game-api validates against the same shared Postgres.
+ * Crowded Kingdoms is **passwordless**. There is no email+password login: a user
+ * authenticates with an emailed magic link, a federated social provider (OIDC),
+ * or — in development only — the dev bypass. Every path returns an identity
+ * SESSION token (management-plane), which is stored on the shared session state
+ * automatically. Gameplay tokens are minted separately via `client.portal`.
  *
- * {@link login} and {@link register} mint that session token **and** store it on
- * the shared session state automatically, so every later call on *either*
- * endpoint (auth, users, apps, actors, chunks, udp, ...) is authenticated
- * without you threading the token through by hand. Use {@link setToken} to
- * rehydrate a saved token and {@link getToken} to read the current one. `BigInt`
- * ids on the returned user (e.g. `userId`, `orgId`) are decimal strings.
+ * Targets the **management-api** (`managementUrl`).
  *
- * **Public — no session required:** {@link login}, {@link register},
- * {@link confirmEmail}, {@link requestPasswordReset}, {@link resetPassword}, and
- * {@link resendConfirmationEmail}. **Require a valid session:** {@link logout},
- * {@link logoutAllDevices}, and {@link changePassword}, which otherwise throw
- * {@link CrowdyGraphQLError} with `UNAUTHENTICATED` when the bearer token is
- * missing, expired, or revoked.
+ * **Public (no session):** {@link requestLoginLink}, {@link completeLoginLink},
+ * {@link socialLoginStart}, {@link socialLoginComplete}, {@link devLogin},
+ * {@link availableLoginProviders}. **Require a session:** {@link logout},
+ * {@link logoutAllDevices}, {@link myIdentities}, {@link linkIdentity},
+ * {@link unlinkIdentity}.
  */
+export interface AuthUser {
+    userId: string;
+    email?: string | null;
+    gamertag?: string | null;
+}
+export interface AuthResponse {
+    /** Identity session token; stored on the session state automatically. */
+    token: string;
+    gameTokenId: string;
+    user: AuthUser;
+}
+export interface UserIdentity {
+    identityId: string;
+    provider: string;
+    subject: string;
+    email: string | null;
+    emailVerified: boolean;
+    createdAt: string;
+    lastLoginAt: string | null;
+}
 export declare class AuthAPI {
     private readonly graphql;
     private readonly session;
     constructor(graphql: GraphQLClient, session: AuthState);
+    /** The federated sign-in providers currently enabled (e.g. `['google']`). */
+    availableLoginProviders(): Promise<string[]>;
     /**
-     * Authenticate with email + password and start a new session. **Public** — no
-     * existing session required.
-     *
-     * On success the returned `token` is minted **and** stored on the shared
-     * session state, so subsequent calls on any sub-client (management-api or
-     * game-api) carry it automatically — no need to call {@link setToken}.
-     *
-     * @param input - Credentials ({@link LoginUserInput}): `email` and `password`
-     *   (min 8 characters).
-     * @returns An {@link AuthResponse}: the opaque session `token` (sent as
-     *   `Authorization: Bearer <token>`), `gameTokenId` (the session row id, a
-     *   string), and the authenticated `user`.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` on invalid credentials, or
-     *   `BAD_USER_INPUT` on malformed input.
-     * @example
-     * ```ts
-     * const { user } = await client.auth.login({ email, password });
-     * // the session token is now stored; later calls are authenticated for you
-     * await client.users.me();
-     * ```
+     * Passwordless: email the address a one-time magic sign-in link (creating the
+     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
+     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
+     * token to pass straight to {@link completeLoginLink} without an inbox.
      */
-    login(input: LoginUserInput): Promise<LoginMutation['login']>;
+    requestLoginLink(input: {
+        email: string;
+        redirectUri?: string;
+    }): Promise<{
+        sent: boolean;
+        devToken: string | null;
+    }>;
+    /** Complete a magic-link sign-in; stores the session token on success. */
+    completeLoginLink(token: string): Promise<AuthResponse>;
     /**
-     * Create a new (initially unconfirmed) account, send a confirmation email, and
-     * return a session for immediate login. **Public** — no existing session
-     * required. Same token-persistence behaviour as {@link login}: the new `token`
-     * is stored on the shared session state automatically.
-     *
-     * @param input - New-account details ({@link RegisterUserInput}): `email`
-     *   (where the confirmation email is sent), `password` (min 8 characters), and
-     *   an optional initial `gamertag` (min 3 characters; can also be set later via
-     *   `client.users.updateGamertag`).
-     * @returns An {@link AuthResponse} (session `token`, `gameTokenId`, and the new
-     *   `user`).
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the email already exists or
-     *   the input is invalid.
+     * Begin a federated (social) sign-in. Returns an `authorizeUrl` to redirect the
+     * user to and an opaque `state` to round-trip back to {@link socialLoginComplete}.
      */
-    register(input: RegisterUserInput): Promise<RegisterMutation['register']>;
+    socialLoginStart(provider: string, redirectUri: string): Promise<{
+        authorizeUrl: string;
+        state: string;
+    }>;
+    /** Complete a federated sign-in from the provider callback; stores the token. */
+    socialLoginComplete(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<AuthResponse>;
     /**
-     * Single-device logout: revoke the `game_tokens` row that authenticated this
-     * request; other devices/tokens are unaffected. After a successful server-side
-     * revoke the in-memory token is cleared from the shared session state so the
-     * other sub-clients stop using it. Requires a valid session.
-     *
-     * @returns `true` if a token was revoked, or `false` if the request carried no
-     *   game token.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
+     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
+     * Returns a session for `email` without email/social verification; stores it.
+     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
      */
+    devLogin(email: string): Promise<AuthResponse>;
+    /** The signed-in user's linked sign-in identities. Requires a session. */
+    myIdentities(): Promise<UserIdentity[]>;
+    /** Link an additional federated identity (from a social callback). */
+    linkIdentity(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<UserIdentity>;
+    /** Unlink a federated identity (cannot remove the last sign-in method). */
+    unlinkIdentity(identityId: string): Promise<boolean>;
+    /** Single-device logout; clears the in-memory token on success. */
     logout(): Promise<boolean>;
-    /**
-     * Revoke **every** active session for the authenticated user (deletes all
-     * their `game_tokens` rows and records revocations). Requires a valid session;
-     * use {@link logout} to end only the current one.
-     *
-     * Note: unlike {@link logout}, this does not clear the SDK's in-memory token —
-     * call {@link setToken}`(null)` afterwards if you also want to drop it locally.
-     *
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
-     */
+    /** Revoke every active session for the user. Requires a session. */
     logoutAllDevices(): Promise<boolean>;
-    /**
-     * Confirm a user's email address using the token from the confirmation email.
-     * **Public** — the token itself authorizes the call.
-     *
-     * @param token - The confirmation token from the emailed link.
-     * @returns `true` on success, or `false` if the token is invalid or expired.
-     * @throws {CrowdyGraphQLError} on transport/validation failures (invalid or
-     *   expired tokens resolve to `false` rather than throwing).
-     */
-    confirmEmail(token: string): Promise<boolean>;
-    /**
-     * Start the password-reset flow by emailing a reset link to the address.
-     * **Public**. Always returns `true` regardless of whether the email exists or
-     * is confirmed, to prevent account enumeration.
-     *
-     * @param email - Email address to send the password-reset link to.
-     * @returns `true` (always, even when no such account exists).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    requestPasswordReset(email: string): Promise<boolean>;
-    /**
-     * Complete a password reset using the reset token and a new password.
-     * **Public** — the reset token authorizes the call. Existing sessions are
-     * **not** revoked.
-     *
-     * @param input - {@link ResetPasswordInput}: the `token` from the emailed reset
-     *   link and the `newPassword` to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the token is invalid or
-     *   expired.
-     */
-    resetPassword(input: ResetPasswordInput): Promise<boolean>;
-    /**
-     * Re-send the email-confirmation link. **Public**. Always returns `true`
-     * regardless of whether the account exists or is already confirmed (prevents
-     * enumeration); the email is only actually sent for existing unconfirmed
-     * accounts.
-     *
-     * @param email - Email address of the account to re-send confirmation to.
-     * @returns `true` (always).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    resendConfirmationEmail(email: string): Promise<boolean>;
-    /**
-     * Change the authenticated user's password after verifying the current one.
-     * Requires a valid session. Existing sessions are **not** revoked.
-     *
-     * @param currentPassword - The user's current password, for verification.
-     * @param newPassword - The new password to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a valid session, or
-     *   `BAD_USER_INPUT` if the current password is wrong.
-     */
-    changePassword(currentPassword: string, newPassword: string): Promise<boolean>;
-    /**
-     * Imperatively replace the in-memory bearer token on the shared session state
-     * (e.g. to rehydrate a token persisted to disk). Affects every sub-client.
-     * Local only — performs no network call. Pass `null` to clear it.
-     *
-     * @param token - The bearer token to use, or `null` to clear the session.
-     */
+    /** Imperatively set the in-memory bearer token (e.g. rehydrate). */
     setToken(token: string | null): void;
-    /**
-     * Read the current in-memory bearer token from the shared session state. Local
-     * only — performs no network call.
-     *
-     * @returns The current bearer token, or `null` if none is set.
-     */
+    /** Read the current in-memory bearer token. */
     getToken(): string | null;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/domains/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAUL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAQnE;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CACZ,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAQxC;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D;;;;;;;;;;OAUG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOhE;;;;;;;;;OASG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO9D;;;;;;;;;OASG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAQnB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+DD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;OAKG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKvD,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQpD,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}

package/dist/domains/auth.js

@@ -1,207 +1,110 @@
-import { ChangePasswordDocument, ConfirmEmailDocument, LoginDocument, LogoutAllDevicesDocument, LogoutDocument, RegisterDocument, RequestPasswordResetDocument, ResendConfirmationEmailDocument, ResetPasswordDocument, } from '../generated/graphql.js';
-/**
- * Authentication and account-lifecycle flows — exposed as `client.auth`.
- *
- * Targets the **management-api**: every call routes to `managementUrl` (falling
- * back to the game-api endpoint only in legacy single-endpoint mode). The
- * management API owns the `game_tokens` table that backs every login / register
- * / password / email-confirmation flow; the `token` it returns is a
- * `game_tokens` row that game-api validates against the same shared Postgres.
- *
- * {@link login} and {@link register} mint that session token **and** store it on
- * the shared session state automatically, so every later call on *either*
- * endpoint (auth, users, apps, actors, chunks, udp, ...) is authenticated
- * without you threading the token through by hand. Use {@link setToken} to
- * rehydrate a saved token and {@link getToken} to read the current one. `BigInt`
- * ids on the returned user (e.g. `userId`, `orgId`) are decimal strings.
- *
- * **Public — no session required:** {@link login}, {@link register},
- * {@link confirmEmail}, {@link requestPasswordReset}, {@link resetPassword}, and
- * {@link resendConfirmationEmail}. **Require a valid session:** {@link logout},
- * {@link logoutAllDevices}, and {@link changePassword}, which otherwise throw
- * {@link CrowdyGraphQLError} with `UNAUTHENTICATED` when the bearer token is
- * missing, expired, or revoked.
- */
+import { parse } from 'graphql';
+import { LogoutAllDevicesDocument, LogoutDocument } from '../generated/graphql.js';
+const AUTH_RESPONSE_FIELDS = 'token gameTokenId user { userId email gamertag }';
+const IDENTITY_FIELDS = 'identityId provider subject email emailVerified createdAt lastLoginAt';
+const RequestLoginLinkDocument = parse(`mutation RequestLoginLink($input: RequestLoginLinkInput!) { requestLoginLink(input: $input) { sent devToken } }`);
+const CompleteLoginLinkDocument = parse(`mutation CompleteLoginLink($input: CompleteLoginLinkInput!) { completeLoginLink(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const SocialLoginStartDocument = parse(`mutation SocialLoginStart($input: SocialLoginStartInput!) { socialLoginStart(input: $input) { authorizeUrl state } }`);
+const SocialLoginCompleteDocument = parse(`mutation SocialLoginComplete($input: SocialLoginCompleteInput!) { socialLoginComplete(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const DevLoginDocument = parse(`mutation DevLogin($input: DevLoginInput!) { devLogin(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const AvailableLoginProvidersDocument = parse(`query AvailableLoginProviders { availableLoginProviders }`);
+const MyIdentitiesDocument = parse(`query MyIdentities { myIdentities { ${IDENTITY_FIELDS} } }`);
+const LinkIdentityDocument = parse(`mutation LinkIdentity($input: LinkIdentityInput!) { linkIdentity(input: $input) { ${IDENTITY_FIELDS} } }`);
+const UnlinkIdentityDocument = parse(`mutation UnlinkIdentity($identityId: String!) { unlinkIdentity(identityId: $identityId) }`);
 export class AuthAPI {
     constructor(graphql, session) {
         this.graphql = graphql;
         this.session = session;
     }
-    /**
-     * Authenticate with email + password and start a new session. **Public** — no
-     * existing session required.
-     *
-     * On success the returned `token` is minted **and** stored on the shared
-     * session state, so subsequent calls on any sub-client (management-api or
-     * game-api) carry it automatically — no need to call {@link setToken}.
-     *
-     * @param input - Credentials ({@link LoginUserInput}): `email` and `password`
-     *   (min 8 characters).
-     * @returns An {@link AuthResponse}: the opaque session `token` (sent as
-     *   `Authorization: Bearer <token>`), `gameTokenId` (the session row id, a
-     *   string), and the authenticated `user`.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` on invalid credentials, or
-     *   `BAD_USER_INPUT` on malformed input.
-     * @example
-     * ```ts
-     * const { user } = await client.auth.login({ email, password });
-     * // the session token is now stored; later calls are authenticated for you
-     * await client.users.me();
-     * ```
-     */
-    async login(input) {
-        const data = await this.graphql.request(LoginDocument, { input });
-        if (data.login?.token) {
-            this.session.setToken(data.login.token);
-        }
-        return data.login;
-    }
-    /**
-     * Create a new (initially unconfirmed) account, send a confirmation email, and
-     * return a session for immediate login. **Public** — no existing session
-     * required. Same token-persistence behaviour as {@link login}: the new `token`
-     * is stored on the shared session state automatically.
-     *
-     * @param input - New-account details ({@link RegisterUserInput}): `email`
-     *   (where the confirmation email is sent), `password` (min 8 characters), and
-     *   an optional initial `gamertag` (min 3 characters; can also be set later via
-     *   `client.users.updateGamertag`).
-     * @returns An {@link AuthResponse} (session `token`, `gameTokenId`, and the new
-     *   `user`).
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the email already exists or
-     *   the input is invalid.
-     */
-    async register(input) {
-        const data = await this.graphql.request(RegisterDocument, { input });
-        if (data.register?.token) {
-            this.session.setToken(data.register.token);
-        }
-        return data.register;
+    /** The federated sign-in providers currently enabled (e.g. `['google']`). */
+    async availableLoginProviders() {
+        const data = await this.graphql.request(AvailableLoginProvidersDocument);
+        return data.availableLoginProviders;
     }
     /**
-     * Single-device logout: revoke the `game_tokens` row that authenticated this
-     * request; other devices/tokens are unaffected. After a successful server-side
-     * revoke the in-memory token is cleared from the shared session state so the
-     * other sub-clients stop using it. Requires a valid session.
-     *
-     * @returns `true` if a token was revoked, or `false` if the request carried no
-     *   game token.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
+     * Passwordless: email the address a one-time magic sign-in link (creating the
+     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
+     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
+     * token to pass straight to {@link completeLoginLink} without an inbox.
      */
-    async logout() {
-        const data = await this.graphql.request(LogoutDocument);
-        this.session.setToken(null);
-        return data.logout;
+    async requestLoginLink(input) {
+        const data = await this.graphql.request(RequestLoginLinkDocument, { input });
+        return data.requestLoginLink;
     }
-    /**
-     * Revoke **every** active session for the authenticated user (deletes all
-     * their `game_tokens` rows and records revocations). Requires a valid session;
-     * use {@link logout} to end only the current one.
-     *
-     * Note: unlike {@link logout}, this does not clear the SDK's in-memory token —
-     * call {@link setToken}`(null)` afterwards if you also want to drop it locally.
-     *
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
-     */
-    async logoutAllDevices() {
-        const data = await this.graphql.request(LogoutAllDevicesDocument);
-        return data.logoutAllDevices;
-    }
-    /**
-     * Confirm a user's email address using the token from the confirmation email.
-     * **Public** — the token itself authorizes the call.
-     *
-     * @param token - The confirmation token from the emailed link.
-     * @returns `true` on success, or `false` if the token is invalid or expired.
-     * @throws {CrowdyGraphQLError} on transport/validation failures (invalid or
-     *   expired tokens resolve to `false` rather than throwing).
-     */
-    async confirmEmail(token) {
-        const data = await this.graphql.request(ConfirmEmailDocument, { token });
-        return data.confirmEmail;
+    /** Complete a magic-link sign-in; stores the session token on success. */
+    async completeLoginLink(token) {
+        const data = await this.graphql.request(CompleteLoginLinkDocument, {
+            input: { token },
+        });
+        if (data.completeLoginLink?.token)
+            this.session.setToken(data.completeLoginLink.token);
+        return data.completeLoginLink;
     }
     /**
-     * Start the password-reset flow by emailing a reset link to the address.
-     * **Public**. Always returns `true` regardless of whether the email exists or
-     * is confirmed, to prevent account enumeration.
-     *
-     * @param email - Email address to send the password-reset link to.
-     * @returns `true` (always, even when no such account exists).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
+     * Begin a federated (social) sign-in. Returns an `authorizeUrl` to redirect the
+     * user to and an opaque `state` to round-trip back to {@link socialLoginComplete}.
      */
-    async requestPasswordReset(email) {
-        const data = await this.graphql.request(RequestPasswordResetDocument, {
-            email,
+    async socialLoginStart(provider, redirectUri) {
+        const data = await this.graphql.request(SocialLoginStartDocument, {
+            input: { provider, redirectUri },
         });
-        return data.requestPasswordReset;
+        return data.socialLoginStart;
     }
-    /**
-     * Complete a password reset using the reset token and a new password.
-     * **Public** — the reset token authorizes the call. Existing sessions are
-     * **not** revoked.
-     *
-     * @param input - {@link ResetPasswordInput}: the `token` from the emailed reset
-     *   link and the `newPassword` to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the token is invalid or
-     *   expired.
-     */
-    async resetPassword(input) {
-        const data = await this.graphql.request(ResetPasswordDocument, {
+    /** Complete a federated sign-in from the provider callback; stores the token. */
+    async socialLoginComplete(input) {
+        const data = await this.graphql.request(SocialLoginCompleteDocument, {
             input,
         });
-        return data.resetPassword;
+        if (data.socialLoginComplete?.token)
+            this.session.setToken(data.socialLoginComplete.token);
+        return data.socialLoginComplete;
     }
     /**
-     * Re-send the email-confirmation link. **Public**. Always returns `true`
-     * regardless of whether the account exists or is already confirmed (prevents
-     * enumeration); the email is only actually sent for existing unconfirmed
-     * accounts.
-     *
-     * @param email - Email address of the account to re-send confirmation to.
-     * @returns `true` (always).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
+     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
+     * Returns a session for `email` without email/social verification; stores it.
+     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
      */
-    async resendConfirmationEmail(email) {
-        const data = await this.graphql.request(ResendConfirmationEmailDocument, {
-            email,
+    async devLogin(email) {
+        const data = await this.graphql.request(DevLoginDocument, {
+            input: { email },
         });
-        return data.resendConfirmationEmail;
+        if (data.devLogin?.token)
+            this.session.setToken(data.devLogin.token);
+        return data.devLogin;
     }
-    /**
-     * Change the authenticated user's password after verifying the current one.
-     * Requires a valid session. Existing sessions are **not** revoked.
-     *
-     * @param currentPassword - The user's current password, for verification.
-     * @param newPassword - The new password to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a valid session, or
-     *   `BAD_USER_INPUT` if the current password is wrong.
-     */
-    async changePassword(currentPassword, newPassword) {
-        const data = await this.graphql.request(ChangePasswordDocument, {
-            currentPassword,
-            newPassword,
+    /** The signed-in user's linked sign-in identities. Requires a session. */
+    async myIdentities() {
+        const data = await this.graphql.request(MyIdentitiesDocument);
+        return data.myIdentities;
+    }
+    /** Link an additional federated identity (from a social callback). */
+    async linkIdentity(input) {
+        const data = await this.graphql.request(LinkIdentityDocument, { input });
+        return data.linkIdentity;
+    }
+    /** Unlink a federated identity (cannot remove the last sign-in method). */
+    async unlinkIdentity(identityId) {
+        const data = await this.graphql.request(UnlinkIdentityDocument, {
+            identityId,
         });
-        return data.changePassword;
+        return data.unlinkIdentity;
     }
-    /**
-     * Imperatively replace the in-memory bearer token on the shared session state
-     * (e.g. to rehydrate a token persisted to disk). Affects every sub-client.
-     * Local only — performs no network call. Pass `null` to clear it.
-     *
-     * @param token - The bearer token to use, or `null` to clear the session.
-     */
+    /** Single-device logout; clears the in-memory token on success. */
+    async logout() {
+        const data = await this.graphql.request(LogoutDocument);
+        this.session.setToken(null);
+        return data.logout;
+    }
+    /** Revoke every active session for the user. Requires a session. */
+    async logoutAllDevices() {
+        const data = await this.graphql.request(LogoutAllDevicesDocument);
+        return data.logoutAllDevices;
+    }
+    /** Imperatively set the in-memory bearer token (e.g. rehydrate). */
     setToken(token) {
         this.session.setToken(token);
     }
-    /**
-     * Read the current in-memory bearer token from the shared session state. Local
-     * only — performs no network call.
-     *
-     * @returns The current bearer token, or `null` if none is set.
-     */
+    /** Read the current in-memory bearer token. */
     getToken() {
         return this.session.getToken();
     }