@forteplatforms/sdk 1.0.160 → 1.0.163

package/README.md

@@ -10,27 +10,48 @@ npm install @forteplatforms/sdk
 
 ## Authentication
 
-When your code runs inside a Forte-hosted service, `FORTE_API_TOKEN` is set automatically and scoped to the service's project — no configuration needed:
+The SDK supports three auth modes depending on where it runs.
+
+### Inside a Forte-hosted service (no config)
+
+`FORTE_API_TOKEN` is set automatically and scoped to the service's project:
 
 ```typescript
 const client = new ForteClient();
 ```
 
-Outside of Forte (local development, external hosting), pass the token explicitly:
+### Client-side (browser / mobile)
+
+For calls to `client.users.*`, construct with no arguments. The browser sends the `Forte-User-Session-Token` cookie automatically after the user logs in. The SDK sets `credentials: 'include'` so the cookie reaches the API cross-origin.
 
 ```typescript
-const client = new ForteClient({ apiToken: 'your_api_token_here' });
+const client = new ForteClient();
+await client.users.renewSessionToken({ projectId });
 ```
 
-Or set it as an environment variable (Node.js only):
+Do **not** pass `apiToken` from browser code — it's a server-side secret.
 
-```bash
-export FORTE_API_TOKEN=your_api_token_here
+### Server-side BFF calling `client.users.*` (no token, per-call authorization)
+
+In a BFF that proxies user-scoped calls, omit the token and forward each user's session token as the `authorization` parameter on each call:
+
+```typescript
+const client = new ForteClient();
+await client.users.renewSessionToken({
+  projectId,
+  authorization: `Bearer ${userSessionToken}`,
+});
 ```
 
-You can generate an API token from the Forte Platforms dashboard.
+### External server-side calling `client.projects.*` (explicit token)
 
-> **Note:** The TypeScript SDK works in both Node.js and browser/React environments. In browsers, you must pass `apiToken` directly since environment variables are not available.
+```typescript
+const client = new ForteClient({ apiToken: 'your_api_token_here' });
+```
+
+Or set `FORTE_API_TOKEN` in the environment (Node.js only) and call `new ForteClient()`.
+
+You can generate an API token from the Forte Platforms dashboard.
 
 ## Quick Start
 

package/dist/generated/apis/ProjectsServerApi.d.ts

@@ -1125,6 +1125,7 @@ export declare const ListUserActionLogsActionTypeType: {
     readonly USER_HARD_DELETED: "USER_HARD_DELETED";
     readonly CONTACT_METHOD_ADDED: "CONTACT_METHOD_ADDED";
     readonly CONTACT_METHOD_REMOVED: "CONTACT_METHOD_REMOVED";
+    readonly CONTACT_METHOD_DISPLACED: "CONTACT_METHOD_DISPLACED";
     readonly CONTACT_METHOD_VERIFICATION_CODE_SENT: "CONTACT_METHOD_VERIFICATION_CODE_SENT";
     readonly CONTACT_METHOD_VERIFICATION_CODE_RE_SENT: "CONTACT_METHOD_VERIFICATION_CODE_RE_SENT";
     readonly CONTACT_METHOD_VERIFIED: "CONTACT_METHOD_VERIFIED";

package/dist/generated/apis/ProjectsServerApi.js

@@ -4569,6 +4569,7 @@ exports.ListUserActionLogsActionTypeType = {
     USER_HARD_DELETED: 'USER_HARD_DELETED',
     CONTACT_METHOD_ADDED: 'CONTACT_METHOD_ADDED',
     CONTACT_METHOD_REMOVED: 'CONTACT_METHOD_REMOVED',
+    CONTACT_METHOD_DISPLACED: 'CONTACT_METHOD_DISPLACED',
     CONTACT_METHOD_VERIFICATION_CODE_SENT: 'CONTACT_METHOD_VERIFICATION_CODE_SENT',
     CONTACT_METHOD_VERIFICATION_CODE_RE_SENT: 'CONTACT_METHOD_VERIFICATION_CODE_RE_SENT',
     CONTACT_METHOD_VERIFIED: 'CONTACT_METHOD_VERIFIED',

package/dist/generated/models/UserActionLogObject.d.ts

@@ -64,6 +64,7 @@ export declare const UserActionLogObjectActionTypeType: {
     readonly USER_HARD_DELETED: "USER_HARD_DELETED";
     readonly CONTACT_METHOD_ADDED: "CONTACT_METHOD_ADDED";
     readonly CONTACT_METHOD_REMOVED: "CONTACT_METHOD_REMOVED";
+    readonly CONTACT_METHOD_DISPLACED: "CONTACT_METHOD_DISPLACED";
     readonly CONTACT_METHOD_VERIFICATION_CODE_SENT: "CONTACT_METHOD_VERIFICATION_CODE_SENT";
     readonly CONTACT_METHOD_VERIFICATION_CODE_RE_SENT: "CONTACT_METHOD_VERIFICATION_CODE_RE_SENT";
     readonly CONTACT_METHOD_VERIFIED: "CONTACT_METHOD_VERIFIED";

package/dist/generated/models/UserActionLogObject.js

@@ -29,6 +29,7 @@ exports.UserActionLogObjectActionTypeType = {
     USER_HARD_DELETED: 'USER_HARD_DELETED',
     CONTACT_METHOD_ADDED: 'CONTACT_METHOD_ADDED',
     CONTACT_METHOD_REMOVED: 'CONTACT_METHOD_REMOVED',
+    CONTACT_METHOD_DISPLACED: 'CONTACT_METHOD_DISPLACED',
     CONTACT_METHOD_VERIFICATION_CODE_SENT: 'CONTACT_METHOD_VERIFICATION_CODE_SENT',
     CONTACT_METHOD_VERIFICATION_CODE_RE_SENT: 'CONTACT_METHOD_VERIFICATION_CODE_RE_SENT',
     CONTACT_METHOD_VERIFIED: 'CONTACT_METHOD_VERIFIED',

package/dist/index.js

@@ -23,14 +23,20 @@ var ForteClient = /** @class */ (function () {
     function ForteClient(options) {
         if (options === void 0) { options = {}; }
         var _a, _b, _c;
-        // Falls back to FORTE_API_TOKEN env var in Node.js; safe in browsers where process is undefined
+        // Falls back to FORTE_API_TOKEN env var in Node.js; safe in browsers where process is undefined.
+        // No token is OK: in browsers the Forte-User-Session-Token cookie authenticates users.*;
+        // in BFFs the caller passes `authorization` per-call to users.*.
         var token = (_a = options.apiToken) !== null && _a !== void 0 ? _a : (typeof process !== 'undefined' ? (_b = process.env) === null || _b === void 0 ? void 0 : _b.FORTE_API_TOKEN : undefined);
-        if (!token) {
-            throw new Error('API token is required. Pass apiToken in the constructor options, or set the FORTE_API_TOKEN environment variable (Node.js only).');
+        var headers = {};
+        if (token) {
+            headers.Authorization = "Bearer ".concat(token);
         }
         var config = new runtime_1.Configuration({
             basePath: (_c = options.baseUrl) !== null && _c !== void 0 ? _c : 'https://api.forteplatforms.com',
-            headers: { Authorization: "Bearer ".concat(token) },
+            headers: headers,
+            // Always include credentials so browsers send the Forte-User-Session-Token cookie
+            // cross-origin. No-op for Node.js fetch.
+            credentials: 'include',
         });
         this.projects = new ProjectsServerApi_1.ProjectsServerApi(config);
         this.users = new UsersServerApi_1.UsersServerApi(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forteplatforms/sdk",
-  "version": "1.0.160",
+  "version": "1.0.163",
   "description": "Official TypeScript SDK for Forte Platforms",
   "author": "Forte Platforms <support@forteplatforms.com>",
   "repository": {