@crowdedkingdoms/crowdyjs 7.1.1 → 8.0.1

package/MIGRATION.md

@@ -1,3 +1,49 @@
+# CrowdyJS v8 — Passwordless & federated sign-in (BREAKING)
+
+**Crowded Kingdoms is passwordless.** Email + password login is removed. Update
+your sign-in flow to one of:
+
+- **Magic link (email):**
+  ```ts
+  await client.auth.requestLoginLink({ email, redirectUri }); // emails a one-time link
+  // on the landing page (token from the URL):
+  const { user } = await client.auth.completeLoginLink(tokenFromUrl);
+  ```
+- **Social (federated / OIDC):**
+  ```ts
+  const providers = await client.auth.availableLoginProviders(); // e.g. ['google']
+  const { authorizeUrl, state } = await client.auth.socialLoginStart('google', callbackUrl);
+  location.assign(authorizeUrl);
+  // on the callback page:
+  await client.auth.socialLoginComplete({ provider: 'google', code, state });
+  ```
+- **Dev bypass (development only):** `await client.auth.devLogin(email)` — works only
+  when the server has `DEV_AUTH_BYPASS` enabled.
+
+**Removed:** `client.auth.login`, `register`, `confirmEmail`, `requestPasswordReset`,
+`resetPassword`, `resendConfirmationEmail`, `changePassword` (and the
+`LoginUserInput` / `RegisterUserInput` / `ResetPasswordInput` types).
+
+**New:** `requestLoginLink`, `completeLoginLink`, `socialLoginStart`,
+`socialLoginComplete`, `devLogin`, `availableLoginProviders`, `myIdentities`,
+`linkIdentity`, `unlinkIdentity`. Each sign-in still returns an identity session
+token, stored on the shared session automatically (account is created on first
+sign-in).
+
+**Portal consent + connected apps (new on `client.portal`):** `getConsent(appId)`,
+`authorizeApp(appId)`, `revokeAppAuthorization(appId)`, `myAuthorizedApps()`,
+`setAppClientSettings({ appId, redirectUris, clientType, launchUrl })`.
+`handleAuthorizeRequest` now enforces consent: untrusted apps throw
+`PortalConsentRequiredError` unless you pass `{ grantConsent: true }` (call after
+the user approves on the consent screen). Trusted/first-party apps (the Overworld,
+app 1) skip consent. Browser portal entry now requires the destination app's
+`redirect_uris` to be registered (`setAppClientSettings`).
+
+Everything else from v7 (the two-client pattern, `client.portal` minting/PKCE,
+app-scoped tokens) is unchanged.
+
+---
+
 # CrowdyJS v7 — Overworld portals & app-scoped tokens (BREAKING)
 
 v7 splits the single app-agnostic game token into two credentials and makes

package/README.md

@@ -14,6 +14,37 @@ CrowdyJS v4 targets browsers by default and uses native `fetch`, `WebSocket`, `c
 
 > **Server compatibility:** v5.2+ targets environments on release **v0.1.19 or later** (`cks-game-api >= v0.10.3`, `cks-management-api >= v0.1.70`). The destructive mutations send an `idempotencyKey` argument that older servers don't define. v6.1's `client.gameApps.deleteGrid` additionally requires release **v0.1.33+** (`cks-game-api >= v0.12.3`).
 
+## Standalone builds and schema refresh
+
+CrowdyJS is a standalone public package. A clean external clone must be able to
+run `npm install && npm run build` without sibling CKS API repos checked out.
+For that reason the build uses committed schema artifacts in this repo:
+
+- `schema.gql` — merged Management API + Game API SDL.
+- `src/generated/graphql.ts` — generated TypeScript operation types.
+
+Schema refresh is explicit:
+
+```bash
+# Refresh from the published production SDLs.
+npm run schema:sync:prod
+npm run codegen
+
+# Or, inside the CKS wrapper repo, refresh from local API checkouts.
+npm run schema:sync:local
+npm run codegen
+
+# Or use exact file/URL sources.
+npm run schema:sync:paths -- \
+  --management ../cks-management-api/schema.gql \
+  --game ../cks-game-api/schema.gql
+npm run codegen
+```
+
+Commit `schema.gql` and `src/generated/graphql.ts` together whenever the public
+GraphQL surface changes. Do not make `npm run build` depend on local API repos or
+network access; use `npm run check:schema` in CI/release work to detect drift.
+
 ## Quick start
 
 ```ts
@@ -26,7 +57,7 @@ const client = createCrowdyClient({
   // Game API (world data + UDP proxy)
   httpUrl: 'https://game.example.com',
   wsUrl: 'wss://game.example.com',
-  // Management API (login, register, profile)
+  // Management API (passwordless sign-in, profile)
   managementUrl: 'https://management.example.com',
   tokenStore: new BrowserLocalStorageTokenStore(),
   realtime: {
@@ -35,19 +66,23 @@ const client = createCrowdyClient({
   },
 });
 
-// Restore a previous session if there is one, otherwise log in.
+// Restore a previous session if there is one, otherwise sign in (passwordless).
 await client.session.restore();
 if (!client.session.getToken()) {
-  await client.auth.login({ email: 'player@example.com', password: 'secret' });
+  // Magic link: email a one-time link, then complete with the token from it.
+  await client.auth.requestLoginLink({ email: 'player@example.com', redirectUri });
+  await client.auth.completeLoginLink(tokenFromLink);
+  // Or social/OIDC: socialLoginStart('google', redirectUri) -> socialLoginComplete({ provider, code, state })
+  // Or dev/test only (server has DEV_AUTH_BYPASS): client.auth.devLogin('player@example.com')
 }
 
-// `client.auth.login()` returns an identity SESSION token (Management API only).
-// Identity reads run on it:
+// Passwordless sign-in returns an identity SESSION token (Management API only);
+// the account is created on first sign-in. Identity reads run on it:
 const me = await client.users.me();
 console.log(me.email);
 ```
 
-**Gameplay needs an app-scoped token, not the login token.** Mint one per app and
+**Gameplay needs an app-scoped token, not the session token.** Mint one per app and
 drive the Game API world/UDP surface (including `gameClientBootstrap`) from a
 per-game client — see [Overworld portals & app-scoped tokens (v7)](#overworld-portals--app-scoped-tokens-v7).
 
@@ -59,12 +94,12 @@ If `managementUrl` is omitted, the SDK falls back to `httpUrl` for backwards-com
 
 | Sub-client | What it does |
 |---|---|
-| `client.auth` | Register, log in, log out, password reset, email confirmation. |
+| `client.auth` | Passwordless sign-in (magic link, social/OIDC, dev bypass), log out, and linked identities (`myIdentities`, `linkIdentity`/`unlinkIdentity`). |
 | `client.users` | `me`, `updateGamertag`, profile reads. |
 | `client.session` | Token store, `restore()`, `getToken()`, manual `setToken()`. |
 | `client.serverStatus` | `gameClientBootstrap(appId)` — per-app version info, UDP status, spatial limits. |
 | `client.chunks`, `client.voxels`, `client.actors`, `client.avatars`, `client.state` | World data reads + writes. |
-| `client.host` | Game-host election + actor liveness `heartbeat`. |
+| `client.host` | Game-host election (`get`, `amIHost`) + actor liveness `heartbeat`. `amIHost` is UI convenience only — authoritative host gating uses `gameModelInvoke`'s `is_host` policy. |
 | `client.teleport` | Teleport requests. |
 | `client.channels`, `client.teams` | Messaging channels and app-scoped player teams (membership + roles). |
 | `client.gameModel` | Abstract game model: containers, properties, functions (incl. model-driven `notify_*` effects), sessions, and **automations / NPCs** (`upsertAutomation`, `runAutomation`, `automationRuns`, `automationStats`, …). |
@@ -97,7 +132,7 @@ Auth, user reads, and the studio-admin / operator surfaces target `managementUrl
 
 ## Game-loop lifecycle
 
-1. Authenticate on the identity client with `client.auth.login()` (or `client.session.restore()`) — this yields the **session token**.
+1. Sign in (passwordless) on the identity client with `client.auth` — `requestLoginLink`/`completeLoginLink` (magic link), `socialLoginStart`/`socialLoginComplete` (social/OIDC), or `devLogin` (dev/test only) — or `client.session.restore()`. This yields the **session token** (Management API only).
 2. Mint an **app-scoped token** for the app (`identity.portal.mintAppToken(appId)`, or the PKCE portal flow across origins) and build a per-game client holding it (`game.setToken(token)`). The gameplay steps below run on that **game** client.
 3. Subscribe to UDP proxy notifications with `game.udp.subscribe(handlers, appId)` — `appId` is **required** (the SDK opens the realtime socket on demand and scopes it to that app).
 4. Join a chunk by sending an initial actor update.
@@ -269,10 +304,10 @@ The key parameter is optional and trailing, so it's safe to omit. Requires a ser
 
 ## Overworld portals & app-scoped tokens (v7)
 
-As of v7 gameplay requires an **app-scoped token**, not the login token. Login
-returns an **identity session token** (Management API only — account, studio
-admin, and minting); each game is entered with a short-lived token confined to
-that one app, so a game stack never receives the player's full session.
+As of v7 gameplay requires an **app-scoped token**, not the session token.
+Passwordless sign-in returns an **identity session token** (Management API only —
+account, studio admin, and minting); each game is entered with a short-lived token
+confined to that one app, so a game stack never receives the player's full session.
 
 Use two clients: an Overworld/identity client (session token) and a per-game
 client (app token), sharing only the Management URL.
@@ -280,7 +315,9 @@ client (app token), sharing only the Management URL.
 ```ts
 // Overworld/identity client
 const overworld = createCrowdyClient({ managementUrl, tokenStore: new BrowserLocalStorageTokenStore('crowdyjs:session') });
-await overworld.auth.login({ email, password });
+// Passwordless sign-in (magic link, social/OIDC, or dev bypass) yields the session token.
+await overworld.auth.requestLoginLink({ email, redirectUri });
+await overworld.auth.completeLoginLink(tokenFromLink);
 
 // Native / same-origin: mint directly, then build a game client.
 const t = await overworld.portal.mintAppToken(appId);

package/dist/client.d.ts

@@ -9,6 +9,7 @@
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 import type { SessionStore } from './session.js';
 import type { CrowdyLogger } from './logger.js';
+import type { LbCookieStore } from './lb-cookie-store.js';
 /**
  * Configuration for {@link GraphQLClient}, the low-level HTTP transport. You
  * normally don't build this yourself — `CrowdyClient` constructs the transport
@@ -38,6 +39,12 @@ export interface GraphQLClientConfig {
      * that discards all output.
      */
     logger?: CrowdyLogger;
+    /**
+     * Optional sticky-LB cookie jar for game-api requests. When set, the
+     * client forwards `cks_ga` on HTTP and ingests `Set-Cookie` from responses
+     * so mutations stay pinned to the same upstream as the WS subscription.
+     */
+    lbCookieStore?: LbCookieStore;
 }
 /**
  * Low-level HTTP transport for GraphQL operations against the game or
@@ -65,6 +72,7 @@ export declare class GraphQLClient {
     private readonly timeout;
     private readonly session;
     private readonly logger;
+    private readonly lbCookieStore?;
     /**
      * @param config - Endpoint, timeout, and logger options; see
      *   {@link GraphQLClientConfig}.

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC;;;;;;OAMG;gBACS,MAAM,EAAE,mBAAmB,YAAK,EAAE,OAAO,EAAE,YAAY;IAUnE;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,OAAO,CAAC,OAAO,EAAE,UAAU,EAC/B,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,EAChD,SAAS,CAAC,EAAE,UAAU,EACtB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,KAAK,CAAC,CAAC,GAAG,GAAG,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACvC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,CAAC,CAAC;CA+Cd;AAED;;;GAGG;AACH,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAgB;IAE/C;;;;;;OAMG;gBACS,MAAM,EAAE,mBAAmB,YAAK,EAAE,OAAO,EAAE,YAAY;IAWnE;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,OAAO,CAAC,OAAO,EAAE,UAAU,EAC/B,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,EAChD,SAAS,CAAC,EAAE,UAAU,EACtB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,KAAK,CAAC,CAAC,GAAG,GAAG,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACvC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,CAAC,CAAC;CAmDd;AAED;;;GAGG;AACH,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/client.js

@@ -46,6 +46,7 @@ export class GraphQLClient {
         this.timeout = config.timeout || 60000;
         this.session = session;
         this.logger = config.logger ?? silentLogger;
+        this.lbCookieStore = config.lbCookieStore;
     }
     /**
      * The resolved GraphQL endpoint URL this client POSTs to.
@@ -105,6 +106,7 @@ export class GraphQLClient {
         const timeoutId = setTimeout(() => controller.abort(), this.timeout);
         const token = this.session.getToken();
         const signal = options.signal ?? controller.signal;
+        const lbCookie = this.lbCookieStore?.headerValue();
         try {
             const requestBody = { query, variables };
             const response = await fetch(this.graphqlEndpoint, {
@@ -112,11 +114,14 @@ export class GraphQLClient {
                 headers: {
                     'Content-Type': 'application/json',
                     ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                    ...(lbCookie ? { Cookie: lbCookie } : {}),
                 },
                 body: JSON.stringify(requestBody),
+                credentials: this.lbCookieStore ? 'include' : 'same-origin',
                 signal,
             });
             clearTimeout(timeoutId);
+            this.lbCookieStore?.ingestSetCookie(response.headers);
             if (!response.ok) {
                 const errorText = await response.text();
                 throw new CrowdyHttpError(response.status, errorText);

package/dist/crowdy-client.d.ts

@@ -22,6 +22,7 @@
  */
 import { AuthState } from './auth-state.js';
 import { GraphQLClient } from './client.js';
+import { LbCookieStore } from './lb-cookie-store.js';
 import { SubscriptionManager } from './subscriptions.js';
 import type { CrowdyLogger } from './logger.js';
 import type { TokenStore } from './session.js';
@@ -101,6 +102,12 @@ export interface CrowdyClientConfig {
         /** Default timeout for `...AndWait` round-trips that await a matching echo. */
         waitTimeoutMs?: number;
     };
+    /**
+     * Optional sticky-LB cookie jar shared with the game-api HTTP client. Node
+     * runtimes must forward `cks_ga` on the WebSocket upgrade; browsers send it
+     * automatically once HTTP has stored the cookie via `credentials: 'include'`.
+     */
+    lbCookieStore?: LbCookieStore;
 }
 export declare class CrowdyClient {
     /** Shared token state for both game-api and management-api requests. */

package/dist/crowdy-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IAEjC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAGnC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,qBAAa,YAAY;IACvB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IAGnC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IAoF3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC,gEAAgE;IAChE,KAAK,IAAI,IAAI;CAId;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}
+{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IAEjC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAGnC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,YAAY;IACvB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IAGnC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IAuF3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC,gEAAgE;IAChE,KAAK,IAAI,IAAI;CAId;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}

package/dist/crowdy-client.js

@@ -22,6 +22,7 @@
  */
 import { AuthState } from './auth-state.js';
 import { GraphQLClient } from './client.js';
+import { LbCookieStore } from './lb-cookie-store.js';
 import { SubscriptionManager } from './subscriptions.js';
 import { WorldClient } from './world.js';
 import { AuthAPI } from './domains/auth.js';
@@ -55,16 +56,19 @@ import { GameModelAPI } from './domains/gameModel.js';
 export class CrowdyClient {
     constructor(config = {}) {
         this.session = new AuthState(config.tokenStore);
+        const lbCookieStore = config.lbCookieStore ?? new LbCookieStore();
         this.graphql = new GraphQLClient({
             httpUrl: config.httpUrl,
             graphqlEndpoint: config.graphqlEndpoint ?? toGraphqlEndpoint(config.httpUrl, 'graphql'),
             timeout: config.timeout,
             logger: config.logger,
+            lbCookieStore,
         }, this.session);
         this.realtime = new SubscriptionManager({
             wsUrl: config.wsUrl,
             wsEndpoint: config.wsEndpoint ?? toGraphqlEndpoint(config.wsUrl, 'graphql'),
             logger: config.logger,
+            lbCookieStore,
             ...config.realtime,
         }, this.session);
         const managementGraphqlEndpoint = config.managementGraphqlEndpoint ??

package/dist/domains/auth.d.ts

@@ -1,163 +1,100 @@
 import type { GraphQLClient } from '../client.js';
 import type { AuthState } from '../auth-state.js';
-import { type LoginMutation, type LoginUserInput, type RegisterMutation, type RegisterUserInput, type ResetPasswordInput } from '../generated/graphql.js';
 /**
- * Authentication and account-lifecycle flows — exposed as `client.auth`.
+ * Authentication and account lifecycle — exposed as `client.auth`.
  *
- * Targets the **management-api**: every call routes to `managementUrl` (falling
- * back to the game-api endpoint only in legacy single-endpoint mode). The
- * management API owns the `game_tokens` table that backs every login / register
- * / password / email-confirmation flow; the `token` it returns is a
- * `game_tokens` row that game-api validates against the same shared Postgres.
+ * Crowded Kingdoms is **passwordless**. There is no email+password login: a user
+ * authenticates with an emailed magic link, a federated social provider (OIDC),
+ * or — in development only — the dev bypass. Every path returns an identity
+ * SESSION token (management-plane), which is stored on the shared session state
+ * automatically. Gameplay tokens are minted separately via `client.portal`.
  *
- * {@link login} and {@link register} mint that session token **and** store it on
- * the shared session state automatically, so every later call on *either*
- * endpoint (auth, users, apps, actors, chunks, udp, ...) is authenticated
- * without you threading the token through by hand. Use {@link setToken} to
- * rehydrate a saved token and {@link getToken} to read the current one. `BigInt`
- * ids on the returned user (e.g. `userId`, `orgId`) are decimal strings.
+ * Targets the **management-api** (`managementUrl`).
  *
- * **Public — no session required:** {@link login}, {@link register},
- * {@link confirmEmail}, {@link requestPasswordReset}, {@link resetPassword}, and
- * {@link resendConfirmationEmail}. **Require a valid session:** {@link logout},
- * {@link logoutAllDevices}, and {@link changePassword}, which otherwise throw
- * {@link CrowdyGraphQLError} with `UNAUTHENTICATED` when the bearer token is
- * missing, expired, or revoked.
+ * **Public (no session):** {@link requestLoginLink}, {@link completeLoginLink},
+ * {@link socialLoginStart}, {@link socialLoginComplete}, {@link devLogin},
+ * {@link availableLoginProviders}. **Require a session:** {@link logout},
+ * {@link logoutAllDevices}, {@link myIdentities}, {@link linkIdentity},
+ * {@link unlinkIdentity}.
  */
+export interface AuthUser {
+    userId: string;
+    email?: string | null;
+    gamertag?: string | null;
+}
+export interface AuthResponse {
+    /** Identity session token; stored on the session state automatically. */
+    token: string;
+    gameTokenId: string;
+    user: AuthUser;
+}
+export interface UserIdentity {
+    identityId: string;
+    provider: string;
+    subject: string;
+    email: string | null;
+    emailVerified: boolean;
+    createdAt: string;
+    lastLoginAt: string | null;
+}
 export declare class AuthAPI {
     private readonly graphql;
     private readonly session;
     constructor(graphql: GraphQLClient, session: AuthState);
+    /** The federated sign-in providers currently enabled (e.g. `['google']`). */
+    availableLoginProviders(): Promise<string[]>;
     /**
-     * Authenticate with email + password and start a new session. **Public** — no
-     * existing session required.
-     *
-     * On success the returned `token` is minted **and** stored on the shared
-     * session state, so subsequent calls on any sub-client (management-api or
-     * game-api) carry it automatically — no need to call {@link setToken}.
-     *
-     * @param input - Credentials ({@link LoginUserInput}): `email` and `password`
-     *   (min 8 characters).
-     * @returns An {@link AuthResponse}: the opaque session `token` (sent as
-     *   `Authorization: Bearer <token>`), `gameTokenId` (the session row id, a
-     *   string), and the authenticated `user`.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` on invalid credentials, or
-     *   `BAD_USER_INPUT` on malformed input.
-     * @example
-     * ```ts
-     * const { user } = await client.auth.login({ email, password });
-     * // the session token is now stored; later calls are authenticated for you
-     * await client.users.me();
-     * ```
+     * Passwordless: email the address a one-time magic sign-in link (creating the
+     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
+     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
+     * token to pass straight to {@link completeLoginLink} without an inbox.
      */
-    login(input: LoginUserInput): Promise<LoginMutation['login']>;
+    requestLoginLink(input: {
+        email: string;
+        redirectUri?: string;
+    }): Promise<{
+        sent: boolean;
+        devToken: string | null;
+    }>;
+    /** Complete a magic-link sign-in; stores the session token on success. */
+    completeLoginLink(token: string): Promise<AuthResponse>;
     /**
-     * Create a new (initially unconfirmed) account, send a confirmation email, and
-     * return a session for immediate login. **Public** — no existing session
-     * required. Same token-persistence behaviour as {@link login}: the new `token`
-     * is stored on the shared session state automatically.
-     *
-     * @param input - New-account details ({@link RegisterUserInput}): `email`
-     *   (where the confirmation email is sent), `password` (min 8 characters), and
-     *   an optional initial `gamertag` (min 3 characters; can also be set later via
-     *   `client.users.updateGamertag`).
-     * @returns An {@link AuthResponse} (session `token`, `gameTokenId`, and the new
-     *   `user`).
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the email already exists or
-     *   the input is invalid.
+     * Begin a federated (social) sign-in. Returns an `authorizeUrl` to redirect the
+     * user to and an opaque `state` to round-trip back to {@link socialLoginComplete}.
      */
-    register(input: RegisterUserInput): Promise<RegisterMutation['register']>;
+    socialLoginStart(provider: string, redirectUri: string): Promise<{
+        authorizeUrl: string;
+        state: string;
+    }>;
+    /** Complete a federated sign-in from the provider callback; stores the token. */
+    socialLoginComplete(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<AuthResponse>;
     /**
-     * Single-device logout: revoke the `game_tokens` row that authenticated this
-     * request; other devices/tokens are unaffected. After a successful server-side
-     * revoke the in-memory token is cleared from the shared session state so the
-     * other sub-clients stop using it. Requires a valid session.
-     *
-     * @returns `true` if a token was revoked, or `false` if the request carried no
-     *   game token.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
+     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
+     * Returns a session for `email` without email/social verification; stores it.
+     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
      */
+    devLogin(email: string): Promise<AuthResponse>;
+    /** The signed-in user's linked sign-in identities. Requires a session. */
+    myIdentities(): Promise<UserIdentity[]>;
+    /** Link an additional federated identity (from a social callback). */
+    linkIdentity(input: {
+        provider: string;
+        code: string;
+        state: string;
+    }): Promise<UserIdentity>;
+    /** Unlink a federated identity (cannot remove the last sign-in method). */
+    unlinkIdentity(identityId: string): Promise<boolean>;
+    /** Single-device logout; clears the in-memory token on success. */
     logout(): Promise<boolean>;
-    /**
-     * Revoke **every** active session for the authenticated user (deletes all
-     * their `game_tokens` rows and records revocations). Requires a valid session;
-     * use {@link logout} to end only the current one.
-     *
-     * Note: unlike {@link logout}, this does not clear the SDK's in-memory token —
-     * call {@link setToken}`(null)` afterwards if you also want to drop it locally.
-     *
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
-     */
+    /** Revoke every active session for the user. Requires a session. */
     logoutAllDevices(): Promise<boolean>;
-    /**
-     * Confirm a user's email address using the token from the confirmation email.
-     * **Public** — the token itself authorizes the call.
-     *
-     * @param token - The confirmation token from the emailed link.
-     * @returns `true` on success, or `false` if the token is invalid or expired.
-     * @throws {CrowdyGraphQLError} on transport/validation failures (invalid or
-     *   expired tokens resolve to `false` rather than throwing).
-     */
-    confirmEmail(token: string): Promise<boolean>;
-    /**
-     * Start the password-reset flow by emailing a reset link to the address.
-     * **Public**. Always returns `true` regardless of whether the email exists or
-     * is confirmed, to prevent account enumeration.
-     *
-     * @param email - Email address to send the password-reset link to.
-     * @returns `true` (always, even when no such account exists).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    requestPasswordReset(email: string): Promise<boolean>;
-    /**
-     * Complete a password reset using the reset token and a new password.
-     * **Public** — the reset token authorizes the call. Existing sessions are
-     * **not** revoked.
-     *
-     * @param input - {@link ResetPasswordInput}: the `token` from the emailed reset
-     *   link and the `newPassword` to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the token is invalid or
-     *   expired.
-     */
-    resetPassword(input: ResetPasswordInput): Promise<boolean>;
-    /**
-     * Re-send the email-confirmation link. **Public**. Always returns `true`
-     * regardless of whether the account exists or is already confirmed (prevents
-     * enumeration); the email is only actually sent for existing unconfirmed
-     * accounts.
-     *
-     * @param email - Email address of the account to re-send confirmation to.
-     * @returns `true` (always).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
-     */
-    resendConfirmationEmail(email: string): Promise<boolean>;
-    /**
-     * Change the authenticated user's password after verifying the current one.
-     * Requires a valid session. Existing sessions are **not** revoked.
-     *
-     * @param currentPassword - The user's current password, for verification.
-     * @param newPassword - The new password to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a valid session, or
-     *   `BAD_USER_INPUT` if the current password is wrong.
-     */
-    changePassword(currentPassword: string, newPassword: string): Promise<boolean>;
-    /**
-     * Imperatively replace the in-memory bearer token on the shared session state
-     * (e.g. to rehydrate a token persisted to disk). Affects every sub-client.
-     * Local only — performs no network call. Pass `null` to clear it.
-     *
-     * @param token - The bearer token to use, or `null` to clear the session.
-     */
+    /** Imperatively set the in-memory bearer token (e.g. rehydrate). */
     setToken(token: string | null): void;
-    /**
-     * Read the current in-memory bearer token from the shared session state. Local
-     * only — performs no network call.
-     *
-     * @returns The current bearer token, or `null` if none is set.
-     */
+    /** Read the current in-memory bearer token. */
     getToken(): string | null;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/domains/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAUL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAQnE;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CACZ,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAQxC;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D;;;;;;;;;;OAUG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOhE;;;;;;;;;OASG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO9D;;;;;;;;;OASG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAQnB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+DD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;OAKG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKvD,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQpD,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}