@fytkit/sdk 4.0.0 → 4.2.0

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `@fytkit/sdk` are documented in this file.
 Format: [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/).
 Versioning: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).
 
+## 4.2.0
+
+To be published by hand with sdk-publish.yml (the manifest records 4.2.0). Create the tag and GitHub release `@fytkit/sdk@4.2.0` when it is published.
+
+### Features
+
+* `nutritionFollows`: the meal plan the trainee follows, one at a time. `list()` resolves to the active follow with its plan (`{ id, planId, status, startDate, startedAt, stoppedAt, plan: { id, title, description, accessLevel, canAccess, status, durationWeeks, headerImageUrl } }`), or to `[]`. `start({ planId, startDate? })` follows one of the studio's published plans from `startDate` ("YYYY-MM-DD", day 1 of week 1 in the trainee's calendar; their local today when omitted) and stops the trainee's current follow of another plan in the same write, naming it in `stoppedFollowId`; following the plan already followed changes nothing and returns that follow. `stop({ id })` stops a follow. A premium plan without `premium_nutrition` rejects as `nutrition.get` does (`payment_required` or `forbidden`); a draft, another studio's or an unknown plan, and another trainee's follow, reject with `not_found`; stopping a follow already stopped rejects with `conflict`. Writes are refused while a fytkit admin is signed in as the trainee. Additive ([#594](https://github.com/cbarlow1993/fytkit-web/issues/594))
+* `auth.signInWithIdToken({ provider, idToken, nonce, name? })`: Sign in with Apple or Google in Fytkit Coach. Signs in, signs up, or joins this studio with the provider's ID token, and resolves like `signIn`: `{ kind: "signed_in", session, memberCreated }` (the session is cached and `signed_in` emitted; `memberCreated` is true when this call made the person a member of this studio, for onboarding) or `{ kind: "two_factor_required", challenge }`, completed with the existing `verify*` methods. `nonce` is the raw nonce the app generated (pass its SHA-256 hex to Apple, the raw nonce to Google); `name` is the name Apple gives the app on the first authorisation only. A credential call: a 401 never refreshes or signs out. Studio-owned (custom) apps are refused. New types `IdTokenProvider` and `IdTokenSignInResult` ([#544](https://github.com/cbarlow1993/fytkit-web/issues/544))
+* `FytkitErrorCode` gains `social_sign_in_unavailable` and `social_email_has_password`, `social_email_has_other_provider`, `two_factor_join_unsupported` (on `forbidden`, 403) and `invalid_id_token`, `social_email_unverified` (on `server`, 400), the refusals of `signInWithIdToken`; `first_party_account` is sent by it too ([#544](https://github.com/cbarlow1993/fytkit-web/issues/544))
+* `auth.closeAccount` accepts a fresh Apple or Google ID token instead of a password, so a member whose account has no password (it signs in with Apple or Google only) can close it in the app: `closeAccount({ confirmEmail, identityToken: { provider, idToken, nonce, authorizationCode? } })`. Run the provider's sign-in again with a new nonce; the token must be at most 10 minutes old and belong to the Apple or Google account the member signs in with. An account with a password still confirms with `closeAccount({ confirmEmail, password })`. The input is the new exported union `CloseAccountInput`, so sending both proofs, or neither, does not compile; the existing password call is unchanged. New type `IdTokenReauthentication`. On success the session is cleared as before ([#544](https://github.com/cbarlow1993/fytkit-web/issues/544))
+* `auth.signInWithIdToken` takes an optional `authorizationCode` (Apple only; a validation error with Google): Apple's authorization code from the same sign-in, which the server exchanges for a refresh token so the app's Apple tokens can be revoked when the account is closed. `closeAccount`'s `identityToken.authorizationCode` does the same for a member whose code was never sent. A failed exchange never fails sign-in. Additive ([#544](https://github.com/cbarlow1993/fytkit-web/issues/544))
+* `FytkitErrorCode` gains `password_not_set` (on `server`, 400: `closeAccount` was sent a password but the account has none; send `identityToken`), `password_required` (on `server`, 400: `closeAccount` was sent `identityToken` but the account has a password) and `reauth_identity_mismatch` (on `forbidden`, 403: the ID token is for another Apple or Google account than the member's). `invalid_id_token` and `social_sign_in_unavailable` can now come from `closeAccount` too. Every `closeAccount` refusal keeps the session ([#544](https://github.com/cbarlow1993/fytkit-web/issues/544))
+
+### Changed (server)
+
+* `nutrition.list` and `recipes.list` now return premium plans and recipes the caller cannot open, with `canAccess: false`, where before they left them out. The gate is unchanged on `nutrition.get` and `recipes.get` (`payment_required`). This is a server change, so every SDK version sees it ([#597](https://github.com/cbarlow1993/fytkit-web/issues/597))
+
+## 4.1.0
+
+To be published by hand with sdk-publish.yml (the manifest records 4.1.0). Create the tag and GitHub release `@fytkit/sdk@4.1.0` when it is published.
+
+### Features
+
+* `subscribeToMessages` takes an optional `onCoachTyping`, for a "Sam is writing…" line: who on the trainee's coaching team is writing to them right now, as `{ kind: "typing", names }` (staff display names, as the conversation shows them) or `{ kind: "idle" }`. Heard only while the status is `live`; a name drops out by itself `COACH_TYPING_EXPIRY_MS` (8 seconds) after its last sign, so a lost stop never leaves it showing, and the state goes `idle` when the channel is lost. Additive. New type `CoachTypingState` and constant `COACH_TYPING_EXPIRY_MS` (W16)
+* `programs.get` and `programs.getSession` carry `durationMinutes` on each session's workout: the trainer's planned time for the workout, null when unset. Additive (W13)
+* `auth.getSecurityStatus()` adds `passwordChangedAt` (when the password was last set or changed, ISO 8601; null when the account has no password) and `backupCodesRemaining` (unused backup codes left; null when two-factor is off, 0 when every code is used), and `SecurityStatus` gains both fields. Additive (W20)
+* `profile.get` and `profile.update` carry `lengthUnit` (`"in"` or `"cm"`), the member's unit for body measurements, beside `weightUnit`; `profile.update` takes it optionally. Additive (W19)
+* `bodyMeasurements.record` takes an optional `clientRequestId` (a UUID) for offline replay, as `bodyMetrics.record` does: a replay with the same key returns the stored measurements instead of recording them twice. Calls without a key are unchanged (W21)
+
+### Bug Fixes
+
+* `auth.disableTwoFactor` now signs out every other device, and the server rotates the caller's session; the SDK swaps its stored token transparently, so the caller stays signed in ([#494](https://github.com/cbarlow1993/fytkit-web/pull/494))
+
 ## 4.0.0
 
 To be published by hand (release-please, which runs on GitHub Actions, does not cut this release; the manifest records 4.0.0 so the next automated release bumps from it). Create the tag and GitHub release `@fytkit/sdk@4.0.0` when it is published, or release-please proposes 4.0.0 again.

package/README.md

@@ -161,6 +161,13 @@ await fytkit.auth.changePassword({ currentPassword, newPassword, revokeOtherSess
 // nothing changes until the trainee opens it.
 await fytkit.auth.changeEmail({ newEmail });
 
+// Resend the sign-up verification email to the trainee's own address (there
+// is no email input). Resolves to { status: "sent" } or, when the address is
+// already verified and nothing is sent, { status: "already_verified" }.
+// Throttled per account (one a minute, five an hour): over the limit it
+// rejects with { kind: "rate_limited", retryAfter } (milliseconds).
+const { status } = await fytkit.auth.resendVerification();
+
 // Devices signed in through this app (plus the calling one); the trainee's
 // sessions elsewhere are never listed. revokeId is an opaque id (never the
 // bearer token).
@@ -181,7 +188,7 @@ session is gone. A wrong password on `signIn` (for example, signing in again
 after `reauth_required`) is a plain `auth_required` and leaves the current
 session alone. An account that also runs or works at a trainer on Fytkit can't
 sign in, sign up or complete two-factor through an app, and an existing app
-session can't change its password or email or close it:
+session can't change its password or email, resend its verification email or close it:
 `{ kind: "forbidden", code: "first_party_account" }`; point it to Fytkit's own
 sign-in. Enrolling twice in a program is `{ kind: "conflict" }` with the
 existing `enrollmentId`.
@@ -251,6 +258,23 @@ const unsubscribe = subscribeToMessages(fytkit, {
 unsubscribe();
 ```
 
+To show "Sam is writing…" while someone on the trainee's coaching team
+writes a reply, pass `onCoachTyping`. It reports `{ kind: "typing", names }`
+(display names, as the conversation shows them on their messages) and
+`{ kind: "idle" }`. It is live only: a name drops out by itself 8 seconds
+after its last sign (`COACH_TYPING_EXPIRY_MS`), so a lost "stopped" never
+leaves it showing, it goes `idle` when the channel is lost, and while you
+poll it never shows.
+
+```ts
+subscribeToMessages(fytkit, {
+  realtime,
+  onChange: () => refreshConversation(),
+  onCoachTyping: (typing) =>
+    setWritingLine(typing.kind === "typing" ? `${firstName(typing.names[0])} is writing…` : null),
+});
+```
+
 Polling spends your app's per-minute request limit, which all its users
 share, so stop as soon as the status is `live`. The full guide:
 [`messages.realtimeToken`](../../docs/developer/reference/data-namespaces.md#messagesrealtimetoken)
@@ -269,7 +293,8 @@ await fytkit.preferences.updateNotifications({ streakAlerts: false }); // partia
 
 - `resolveJoinCode` (a studio's join code to its client id, name, logo and app theme, with no client) and `app.bootstrap` (the launch read, revalidated with its ETag), with `resolvePaymentMode` ("Subscribe" link-out or "What your plan includes", per storefront)
 - `auth.signUp` / `signIn` / `signOut` / `getSession` / `onAuthStateChange`
-- `auth.requestPasswordReset` / `confirmPasswordReset` / `confirmEmail`
+- `auth.signInWithIdToken` (Sign in with Apple or Google, Fytkit Coach only: pass the raw nonce; Apple gets its SHA-256 hex, Google the raw nonce)
+- `auth.requestPasswordReset` / `confirmPasswordReset` / `confirmEmail` / `resendVerification`
 - Two-factor: `auth.verifyTotp` / `verifyBackupCode` / `requestEmailOtp` / `verifyEmailOtp` (sign-in), `enableTotp` / `verifyTotpSetup` / `disableTwoFactor` / `regenerateBackupCodes` / `getSecurityStatus` (management)
 - Account security: `auth.changePassword` / `changeEmail` / `confirmEmailChange` / `listSessions` / `revokeSession` / `revokeOtherSessions` / `closeAccount`
 - Data namespaces: `workouts`, `programs`, `recipes`, `nutrition`, `nutritionLog`, `profile`, `preferences`, `articles`, `enrollments`, `sessionLogs`, `progression`, `progress`, `bodyMetrics`, `bodyMeasurements`, `progressPhotos`, `checkIns`, `messages`, `timeline`, `health`, `habits`, `media`, `subscription`

package/dist/index.d.ts

@@ -156,6 +156,49 @@ declare type ClientEntitlementCode = "premium_workouts" | "premium_programs" | "
 
 declare type ClientEntitlements = readonly ClientEntitlementCode[] | "all";
 
+/**
+ * The input to `auth.closeAccount()`: the member's email as confirmation
+ * plus exactly one proof. `password` for an account with a password;
+ * `identityToken` for an account that signs in with Apple or Google only
+ * and has no password. Sending both, or neither, does not compile.
+ */
+export declare type CloseAccountInput = {
+    confirmEmail: string;
+    password: string;
+    identityToken?: never;
+} | {
+    confirmEmail: string;
+    identityToken: IdTokenReauthentication;
+    password?: never;
+};
+
+/**
+ * How long a staff member stays in {@link CoachTypingState}'s `names` after
+ * the last sign that they are writing. The dashboard repeats the sign every
+ * 3 seconds while they write.
+ */
+export declare const COACH_TYPING_EXPIRY_MS = 8000;
+
+/**
+ * Whether the trainee's coaching team is writing to them right now, for a
+ * "Sam is writing…" line under the conversation:
+ * - `idle`: nobody is.
+ * - `typing`: the staff members in `names` are, by the display name the
+ *   conversation shows on their messages, each name once, in the order
+ *   they started. Show the first, or "Sam and Alex are writing…".
+ *
+ * A hint, live only: it is heard only while the status is `live`, and goes
+ * back to `idle` when the channel is lost. A name that hears nothing more
+ * for 8 seconds ({@link COACH_TYPING_EXPIRY_MS}) drops out by itself, so a
+ * lost "stopped" never leaves it showing. While polling it stays `idle`.
+ */
+export declare type CoachTypingState = {
+    readonly kind: "idle";
+} | {
+    readonly kind: "typing";
+    readonly names: readonly string[];
+};
+
 export declare function createFytkitClient(options: FytkitClientOptions): FytkitClient;
 
 /**
@@ -169,7 +212,7 @@ export declare function createMemoryStorageAdapter(): TokenStorage;
 
 declare interface DeveloperAppRequestContext {
     readonly headers: Headers;
-    readonly surface?: RequestSurface;
+    readonly surface: RequestSurface;
 }
 
 /** The full SDK client surface. `auth.*` plus the public-router slices, minus auth (those live on `client.auth`). */
@@ -191,6 +234,23 @@ export declare interface FytkitClient {
             email: string;
             password: string;
         }) => Promise<SignInResult>;
+        /** Signs in, signs up or joins this studio with an Apple or Google ID
+         * token (Fytkit Coach only). `nonce` is the raw nonce the app generated:
+         * pass its SHA-256 hex to Apple, or the raw nonce to Google. `name` is the
+         * name Apple hands the app on the first authorisation (it is never in the
+         * token). `authorizationCode` is Apple's authorization code from the
+         * same sign-in (Apple only; a validation error with Google): the server
+         * exchanges it for a refresh token so it can revoke the app's Apple
+         * tokens when the account is closed. On `signed_in` the session is cached
+         * (emits signed_in); on `two_factor_required` continue with the `verify*`
+         * methods. Refusals carry a `code` (see `FytkitErrorCode`). */
+        signInWithIdToken: (input: {
+            provider: IdTokenProvider;
+            idToken: string;
+            nonce: string;
+            name?: string;
+            authorizationCode?: string;
+        }) => Promise<IdTokenSignInResult>;
         signOut: () => Promise<void>;
         /** Synchronously read the cached session, if any. */
         getSession: () => Session | null;
@@ -236,6 +296,8 @@ export declare interface FytkitClient {
         verifyTotpSetup: (input: {
             code: string;
         }) => Promise<void>;
+        /** Turns off 2FA and signs out every other device. The server rotates
+         * this session; the SDK swaps its stored token transparently. */
         disableTwoFactor: (input: {
             password: string;
         }) => Promise<void>;
@@ -283,14 +345,18 @@ export declare interface FytkitClient {
          * untouched; `changePassword` with `revokeOtherSessions: true` ends those. */
         revokeOtherSessions: () => Promise<void>;
         /** Permanently closes the member's account (cancels their subscriptions,
-         * anonymises their data, deletes the login) after re-verifying the email
-         * and password. On success the SDK clears its session and emits
-         * `signed_out`. A wrong password rejects with `{ kind: "server", status:
-         * 400, code: "invalid_password" }` and leaves the session signed in. */
-        closeAccount: (input: {
-            confirmEmail: string;
-            password: string;
-        }) => Promise<void>;
+         * anonymises their data, deletes the login, revokes the app's Sign in
+         * with Apple tokens) after re-verifying the email and one proof: the
+         * `password`, or, for an account without a password, a fresh Apple or
+         * Google `identityToken` (see `CloseAccountInput`). On success the SDK
+         * clears its session and emits `signed_out`. Every refusal leaves the
+         * session signed in: a wrong password rejects with `{ kind: "server",
+         * status: 400, code: "invalid_password" }`; the wrong proof for the
+         * account with `password_not_set` or `password_required` (`server`, 400);
+         * an ID token for another Apple or Google account with
+         * `reauth_identity_mismatch` (`forbidden`, 403); an unverifiable, reused
+         * or stale ID token with `invalid_id_token` (`server`, 400). */
+        closeAccount: (input: CloseAccountInput) => Promise<void>;
     };
     readonly workouts: PublicApi["workout"];
     readonly exercises: PublicApi["exercise"];
@@ -299,6 +365,15 @@ export declare interface FytkitClient {
     readonly equipment: PublicApi["equipment"];
     readonly recipes: PublicApi["recipe"];
     readonly nutrition: PublicApi["nutrition"];
+    /**
+     * The meal plan the trainee follows, one at a time: `list` (the active
+     * follow with its plan, or nothing), `start({ planId, startDate? })`, which
+     * stops the trainee's current follow of another plan, and `stop({ id })`.
+     * `startDate` is day 1 of week 1 in the trainee's own calendar, for
+     * "week 2 of 4, day 3". Writes are refused while a fytkit admin is signed
+     * in as the trainee.
+     */
+    readonly nutritionFollows: PublicApi["nutritionFollow"];
     readonly articles: PublicApi["article"];
     readonly enrollments: PublicApi["enrollment"];
     readonly favourites: PublicApi["favourite"];
@@ -440,13 +515,53 @@ export declare type FytkitError = {
  * - `"first_party_account"` (`forbidden`, 403) — the account also runs or
  *   works at a trainer on Fytkit, so an app may not sign it in, sign it up,
  *   reset its password or handle its two-factor steps (`signIn`, `signUp`,
- *   the `verify*` and TOTP methods), and an existing session can't change
+ *   `signInWithIdToken`, the `verify*` and TOTP methods), and an existing session can't change
  *   its password or email or close it (`changePassword`, `changeEmail`,
  *   `closeAccount`). The credentials were right; tell the
  *   person to sign in with Fytkit itself. `requestPasswordReset` never sends
- *   this: it answers `ok` and sends no email.
+ *   this: it answers `ok` and sends no email. `signInWithIdToken` also sends
+ *   it for a Fytkit platform administrator.
+ *
+ * `closeAccount` re-authentication refusals (see `CloseAccountInput`):
+ *
+ * - `"password_not_set"` (`server`, 400) — `password` was sent, but the
+ *   account has no password (it signs in with Apple or Google). Re-run the
+ *   provider's sign-in and send `identityToken` instead.
+ * - `"password_required"` (`server`, 400) — `identityToken` was sent, but the
+ *   account has a password. Ask for the password; an account with a password
+ *   always confirms with it.
+ * - `"reauth_identity_mismatch"` (`forbidden`, 403) — the ID token is valid
+ *   but is not for the Apple or Google account the member signs in with.
+ *   Ask them to use that account. The session is untouched.
+ *
+ * `closeAccount` with `identityToken` can also send `invalid_id_token` (the
+ * token could not be verified, was already used, or is older than 10
+ * minutes) and `social_sign_in_unavailable`, with the meanings below.
+ *
+ * `signInWithIdToken` refusals (the ID token is checked first, except for
+ * `social_sign_in_unavailable`); the first two are also `closeAccount`
+ * refusals:
+ *
+ * - `"social_sign_in_unavailable"` (`forbidden`, 403) — this app can't use
+ *   Sign in with Apple or Google: the provider is not configured for it, or
+ *   the app is a studio's own (custom) app. Hide the button.
+ * - `"invalid_id_token"` (`server`, 400) — the ID token could not be
+ *   verified (expired, wrong audience, nonce mismatch, already used, or no
+ *   email on a first sign-in). Start the provider's sign-in again with a new
+ *   nonce.
+ * - `"social_email_unverified"` (`server`, 400) — the provider has not
+ *   verified the account's email address.
+ * - `"social_email_has_password"` (`forbidden`, 403) — the email already
+ *   belongs to an account with a password. Ask the person to sign in with
+ *   their password; accounts are never linked implicitly.
+ * - `"social_email_has_other_provider"` (`forbidden`, 403) — the email
+ *   already belongs to an account that signs in with the other provider.
+ *   Ask the person to use that one.
+ * - `"two_factor_join_unsupported"` (`forbidden`, 403) — the account uses
+ *   two-step verification and is not yet a member of this studio; it can't
+ *   join a new studio from the app.
  */
-export declare type FytkitErrorCode = "reauth_required" | "invalid_password" | "invalid_code" | "first_party_account" | (string & {});
+export declare type FytkitErrorCode = "reauth_required" | "invalid_password" | "invalid_code" | "first_party_account" | "social_sign_in_unavailable" | "invalid_id_token" | "social_email_unverified" | "social_email_has_password" | "social_email_has_other_provider" | "two_factor_join_unsupported" | "password_not_set" | "password_required" | "reauth_identity_mismatch" | (string & {});
 
 /**
  * The server's structured refusal on a `FytkitError`: why it said no and
@@ -663,6 +778,43 @@ export declare interface FytkitRefusalRetryAt {
     readonly retryAfterMs?: number;
 }
 
+/** The identity providers whose ID tokens `auth.signInWithIdToken` accepts. */
+export declare type IdTokenProvider = "apple" | "google";
+
+/**
+ * A fresh Apple or Google ID token that proves the signed-in member is
+ * present, for `auth.closeAccount` on an account without a password. Run
+ * the provider's sign-in again with a new nonce, as for `signInWithIdToken`:
+ * `nonce` is the raw nonce the app generated (pass its SHA-256 hex to Apple,
+ * the raw nonce to Google). The token must be at most 10 minutes old and
+ * belong to the Apple or Google account the member signs in with.
+ * `authorizationCode` is Apple's authorization code from that same sign-in
+ * (Apple only); send it so the server can revoke the app's Apple tokens.
+ */
+export declare interface IdTokenReauthentication {
+    provider: IdTokenProvider;
+    idToken: string;
+    nonce: string;
+    authorizationCode?: string;
+}
+
+/**
+ * The discriminated return value from `auth.signInWithIdToken()`. As
+ * `SignInResult`, plus `memberCreated` on `"signed_in"`: true when this call
+ * made the person a member of this studio (a new account, or an existing
+ * account joining this studio for the first time), so the app can show its
+ * onboarding. `"two_factor_required"` continues with the same `verify*`
+ * methods as `signIn`'s challenge.
+ */
+export declare type IdTokenSignInResult = {
+    readonly kind: "signed_in";
+    readonly session: Session;
+    readonly memberCreated: boolean;
+} | {
+    readonly kind: "two_factor_required";
+    readonly challenge: TwoFactorChallenge;
+};
+
 /** A coach a join code's studio names publicly. */
 export declare interface JoinCodeCoach {
     /** The coach's public name. */
@@ -906,6 +1058,46 @@ declare const publicRouter: {
                 }>>;
             }, $strip>], "kind">;
         }, $strip>, Record<never, never>, Record<never, never>>;
+        signInWithIdToken: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, {
+            trainerId: string;
+            appId: ActiveDeveloperAppId;
+            clientId: string | undefined;
+            hasActiveSubscription: boolean;
+            clientEntitlements: ClientEntitlements;
+            authMode: "dev-app";
+            developerApp: CallingDeveloperApp;
+            impersonatedBy: string | null;
+        }>, ZodObject<    {
+            provider: ZodEnum<    {
+                apple: "apple";
+                google: "google";
+            }>;
+            idToken: ZodString;
+            nonce: ZodString;
+            name: ZodOptional<ZodString>;
+            authorizationCode: ZodOptional<ZodString>;
+        }, $strip>, ZodObject<    {
+            data: ZodDiscriminatedUnion<[ZodObject<    {
+                kind: ZodLiteral<"signed_in">;
+                user: ZodObject<    {
+                    id: ZodString;
+                    email: ZodString;
+                }, $strip>;
+                session: ZodObject<    {
+                    accessToken: ZodString;
+                    expiresAt: ZodString;
+                }, $strip>;
+                memberCreated: ZodBoolean;
+            }, $strip>, ZodObject<    {
+                kind: ZodLiteral<"two_factor_required">;
+                twoFactorToken: ZodString;
+                availableMethods: ZodArray<ZodEnum<    {
+                    totp: "totp";
+                    backup_code: "backup_code";
+                    email_otp: "email_otp";
+                }>>;
+            }, $strip>], "kind">;
+        }, $strip>, Record<never, never>, Record<never, never>>;
         signOut: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, {
             trainerId: string;
             appId: ActiveDeveloperAppId;
@@ -1059,6 +1251,7 @@ declare const publicRouter: {
         }, $strip>, ZodObject<    {
             data: ZodObject<    {
                 success: ZodLiteral<true>;
+                accessToken: ZodString;
             }, $strip>;
         }, $strip>, Record<never, never>, Record<never, never>>;
         regenerateBackupCodes: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, {
@@ -1179,6 +1372,8 @@ declare const publicRouter: {
                 twoFactorEnabled: ZodBoolean;
                 totpEnabled: ZodBoolean;
                 hasBackupCodes: ZodBoolean;
+                passwordChangedAt: ZodNullable<ZodString>;
+                backupCodesRemaining: ZodNullable<ZodNumber>;
             }, $strip>;
         }, $strip>, Record<never, never>, Record<never, never>>;
         changePassword: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, {
@@ -1243,7 +1438,16 @@ declare const publicRouter: {
             impersonatedBy: string | null;
         }>, ZodObject<    {
             confirmEmail: ZodString;
-            password: ZodString;
+            password: ZodOptional<ZodString>;
+            identityToken: ZodOptional<ZodObject<    {
+                provider: ZodEnum<    {
+                    apple: "apple";
+                    google: "google";
+                }>;
+                idToken: ZodString;
+                nonce: ZodString;
+                authorizationCode: ZodOptional<ZodString>;
+            }, $strip>>;
         }, $strip>, ZodObject<    {
             data: ZodObject<    {
                 success: ZodLiteral<true>;
@@ -1694,6 +1898,63 @@ declare const publicRouter: {
             }, $strip>;
         }, $strip>, Record<never, never>, Record<never, never>>;
     };
+    nutritionFollow: {
+        list: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, ApiKeyContext>, Schema<unknown, unknown>, ZodObject<    {
+            data: ZodArray<ZodObject<    {
+                id: ZodString;
+                planId: ZodString;
+                status: ZodEnum<    {
+                    active: "active";
+                    stopped: "stopped";
+                }>;
+                startDate: ZodISODate;
+                startedAt: ZodString;
+                stoppedAt: ZodNullable<ZodString>;
+                plan: ZodObject<    {
+                    id: ZodString;
+                    title: ZodString;
+                    description: ZodString;
+                    accessLevel: ZodEnum<    {
+                        free: "free";
+                        premium: "premium";
+                    }>;
+                    canAccess: ZodBoolean;
+                    status: ZodEnum<    {
+                        draft: "draft";
+                        published: "published";
+                        archived: "archived";
+                    }>;
+                    durationWeeks: ZodNumber;
+                    headerImageUrl: ZodNullable<ZodString>;
+                }, $strip>;
+            }, $strip>>;
+        }, $strip>, Record<never, never>, Record<never, never>>;
+        start: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, ApiKeyContext>, ZodObject<    {
+            planId: ZodString;
+            startDate: ZodOptional<ZodISODate>;
+        }, $strip>, ZodObject<    {
+            data: ZodObject<    {
+                id: ZodString;
+                planId: ZodString;
+                status: ZodEnum<    {
+                    active: "active";
+                    stopped: "stopped";
+                }>;
+                startDate: ZodISODate;
+                startedAt: ZodString;
+                stoppedAt: ZodNullable<ZodString>;
+                stoppedFollowId: ZodNullable<ZodString>;
+            }, $strip>;
+        }, $strip>, Record<never, never>, Record<never, never>>;
+        stop: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, ApiKeyContext>, ZodObject<    {
+            id: ZodString;
+        }, $strip>, ZodObject<    {
+            data: ZodObject<    {
+                id: ZodString;
+                status: ZodLiteral<"stopped">;
+            }, $strip>;
+        }, $strip>, Record<never, never>, Record<never, never>>;
+    };
     nutritionLog: {
         getDay: DecoratedProcedure<MergedInitialContext<DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext & Record<never, never>, DeveloperAppRequestContext>, MergedCurrentContext<DeveloperAppRequestContext, ApiKeyContext>, ZodObject<    {
             date: ZodString;
@@ -1830,6 +2091,10 @@ declare const publicRouter: {
                     lb: "lb";
                     kg: "kg";
                 }>;
+                lengthUnit: ZodEnum<    {
+                    in: "in";
+                    cm: "cm";
+                }>;
                 timezone: ZodNullable<ZodString>;
                 fitnessGoal: ZodNullable<ZodEnum<    {
                     lose_fat: "lose_fat";
@@ -1857,6 +2122,10 @@ declare const publicRouter: {
                 lb: "lb";
                 kg: "kg";
             }>>;
+            lengthUnit: ZodOptional<ZodEnum<    {
+                in: "in";
+                cm: "cm";
+            }>>;
             fitnessGoal: ZodOptional<ZodNullable<ZodEnum<    {
                 lose_fat: "lose_fat";
                 build_muscle: "build_muscle";
@@ -1876,6 +2145,10 @@ declare const publicRouter: {
                     lb: "lb";
                     kg: "kg";
                 }>;
+                lengthUnit: ZodEnum<    {
+                    in: "in";
+                    cm: "cm";
+                }>;
                 timezone: ZodNullable<ZodString>;
                 fitnessGoal: ZodNullable<ZodEnum<    {
                     lose_fat: "lose_fat";
@@ -2376,6 +2649,7 @@ declare const publicRouter: {
                             videoAssetId: ZodNullable<ZodString>;
                             headerImageId: ZodNullable<ZodString>;
                             headerImageUrl: ZodNullable<ZodString>;
+                            durationMinutes: ZodNullable<ZodNumber>;
                             blocks: ZodArray<ZodObject<    {
                                 id: ZodString;
                                 title: ZodString;
@@ -2448,6 +2722,7 @@ declare const publicRouter: {
                         videoAssetId: ZodNullable<ZodString>;
                         headerImageId: ZodNullable<ZodString>;
                         headerImageUrl: ZodNullable<ZodString>;
+                        durationMinutes: ZodNullable<ZodNumber>;
                         blocks: ZodArray<ZodObject<    {
                             id: ZodString;
                             title: ZodString;
@@ -2513,6 +2788,7 @@ declare const publicRouter: {
                     videoAssetId: ZodNullable<ZodString>;
                     headerImageId: ZodNullable<ZodString>;
                     headerImageUrl: ZodNullable<ZodString>;
+                    durationMinutes: ZodNullable<ZodNumber>;
                     blocks: ZodArray<ZodObject<    {
                         id: ZodString;
                         title: ZodString;
@@ -3219,6 +3495,7 @@ declare const publicRouter: {
                 }>;
                 valueCm: ZodString;
             }, $strip>>;
+            clientRequestId: ZodOptional<ZodString>;
         }, $strip>, ZodObject<    {
             data: ZodArray<ZodObject<    {
                 id: ZodString;
@@ -5431,12 +5708,12 @@ declare const publicRouter: {
                     name: ZodString;
                     description: ZodString;
                     icon: ZodNullable<ZodEnum<    {
+                        Apple: "Apple";
                         Footprints: "Footprints";
                         Moon: "Moon";
                         GlassWater: "GlassWater";
                         Beef: "Beef";
                         StretchHorizontal: "StretchHorizontal";
-                        Apple: "Apple";
                         Brain: "Brain";
                         Sun: "Sun";
                     }>>;
@@ -5588,12 +5865,12 @@ declare const publicRouter: {
                     name: ZodString;
                     description: ZodString;
                     icon: ZodNullable<ZodEnum<    {
+                        Apple: "Apple";
                         Footprints: "Footprints";
                         Moon: "Moon";
                         GlassWater: "GlassWater";
                         Beef: "Beef";
                         StretchHorizontal: "StretchHorizontal";
-                        Apple: "Apple";
                         Brain: "Brain";
                         Sun: "Sun";
                     }>>;
@@ -6267,7 +6544,7 @@ export declare interface RealtimeConnection {
  */
 export declare function refusalData<R extends keyof FytkitRefusalDataByReason>(error: unknown, reason: R): FytkitRefusalDataByReason[R] | null;
 
-declare type RequestSurface = "rpc" | "rest";
+declare type RequestSurface = "rpc" | "rest" | "internal";
 
 /**
  * Returned by `auth.resendVerification`. `already_verified`: the member's
@@ -6356,6 +6633,10 @@ export declare interface SecurityStatus {
     readonly twoFactorEnabled: boolean;
     readonly totpEnabled: boolean;
     readonly hasBackupCodes: boolean;
+    /** When the password was last set or changed (ISO 8601); null when the account has no password. */
+    readonly passwordChangedAt: string | null;
+    /** Unused backup codes left; null when two-factor is off, 0 when every code is used. */
+    readonly backupCodesRemaining: number | null;
 }
 
 /** Cached session in storage. `expiresAt` is an ISO-8601 string from the server. */
@@ -6418,7 +6699,10 @@ export declare type SignInResult = {
  * `refused`.
  *
  * `onChange` carries no data: read the conversation and the unread count
- * again. Poll while the status is `connecting` or `fallback`. Needs
+ * again. `onCoachTyping`, when given, says who on the coaching team is
+ * writing to the trainee while the channel is live
+ * ({@link CoachTypingState}). Poll while the status is `connecting` or
+ * `fallback`. Needs
  * `@supabase/supabase-js` 2.87.1 or later (see {@link RealtimeClientFactory}).
  *
  * @example
@@ -6451,6 +6735,14 @@ export declare interface SubscribeToMessagesOptions {
     readonly onChange: () => void;
     /** Each change of {@link MessagesRealtimeStatus}, starting with `connecting`. */
     readonly onStatus?: (status: MessagesRealtimeStatus) => void;
+    /**
+     * Each change of {@link CoachTypingState}: someone on the trainee's
+     * coaching team started or stopped writing to them. Optional; never
+     * called before a `typing`. A subscription that ends by itself
+     * (`refused`, or `fallback` for good) reports `idle` first if anyone was
+     * writing; after `unsubscribe()`, nothing is reported.
+     */
+    readonly onCoachTyping?: (typing: CoachTypingState) => void;
 }
 
 /** Pluggable storage so the SDK runs in browser, SSR, and tests. */