@meowpanel/api 0.3.0 → 0.5.0

package/script/src/resources/api-keys.d.ts

@@ -2,19 +2,17 @@ import type { HttpClient } from '../http.js';
 import { ResourceNamespace } from '../namespace.js';
 import { ReactiveResource } from '../reactive.js';
 import { type ISODate, type NanoID, type Paginated } from '../types.js';
-import type { MemberData } from './members.js';
-import { Member } from './members.js';
+import type { UserData } from './users.js';
+import { User } from './users.js';
 /** Raw API shape for an API key. @internal */
-interface ApiKeyData {
+export interface ApiKeyData {
     id: string;
-    issuer_type: string;
     name: string;
     description: string | null;
-    owner?: MemberData;
-    /** Only returned once, at creation time. */
-    token?: string;
+    owner_id: string;
+    owner?: UserData;
     permissions?: string[];
-    last_used_at?: ISODate | null;
+    revoked_at: ISODate | null;
     created_at: ISODate;
     updated_at: ISODate;
 }
@@ -23,31 +21,26 @@ interface ApiKeyData {
  *
  * Retrieved via {@link ApiKeysNamespace.list} or {@link ApiKeysNamespace.create}.
  *
- * > **Note:** The `token` field is only populated when the key is first created.
- * > It cannot be retrieved again after that. Store it securely.
+ * The bearer token is returned only once, by {@link ApiKeysNamespace.create}. It
+ * is never part of this resource. Store it securely when first received.
  */
 export declare class ApiKey extends ReactiveResource {
     /** The API key's unique NanoID. */
     readonly id: NanoID;
-    /** The issuer type, always `'api_key'`. */
-    readonly issuerType: string;
     /** Display name for this API key. */
     name: string;
     /** Description for this API key. */
     description: string | null;
-    /** The owner of this API key. Always present as full object. */
-    owner: Member | undefined;
-    /**
-     * The bearer token value.
-     *
-     * Only populated immediately after creation via {@link ApiKeysNamespace.create}.
-     * `undefined` on all subsequent fetches - store it securely when first received.
-     */
-    token: string | undefined;
+    /** The owner's bare NanoID (parsed from the namespaced `owner_id`). */
+    readonly ownerId: NanoID;
+    /** The owner's issuer type, e.g. `'user'` or `'system'`. */
+    readonly ownerType: string;
+    /** The owner of this API key. Requires `?include=owner`. */
+    owner: User | undefined;
     /** Permissions assigned to this API key. Requires `?include=permissions`. */
     permissions: string[] | undefined;
-    /** When this key was last used to authenticate a request, or `null` if never used. */
-    lastUsedAt: Date | null;
+    /** When this key was revoked, or `null` if active. */
+    revokedAt: Date | null;
     /** When this API key was created. */
     createdAt: Date;
     /** When this API key was last updated. */
@@ -123,5 +116,4 @@ export declare class ApiKeysNamespace extends ResourceNamespace<ApiKey, ApiKeyEv
      */
     create(payload: CreateApiKeyPayload): Promise<CreateApiKeyResult>;
 }
-export {};
 //# sourceMappingURL=api-keys.d.ts.map

package/script/src/resources/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/src/resources/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAY,MAAM,aAAa,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,8CAA8C;AAC9C,UAAU,UAAU;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACpB;AAQD;;;;;;;GAOG;AACH,qBAAa,MAAO,SAAQ,gBAAgB;IAC3C,mCAAmC;IACnC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,qCAAqC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACpB,oCAAoC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gEAAgE;IACzD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;OAKG;IACI,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,6EAA6E;IACtE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACzC,sFAAsF;IAC/E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,qCAAqC;IAC9B,SAAS,EAAE,IAAI,CAAC;IACvB,0CAA0C;IACnC,SAAS,EAAE,IAAI,CAAC;IAEvB,gBAAgB;gBACG,IAAI,EAAE,UAAU;CAanC;AAED,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IACnC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC5B,iFAAiF;IACjF,OAAO,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC;IAC5E,gBAAgB;gBACG,IAAI,EAAE,UAAU;IAInC;;;;;;OAMG;IACU,IAAI,CAChB,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAO7B;;;;;;;OAOG;IACU,MAAM,CAClB,OAAO,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAuB9B"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/src/resources/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAA4B,MAAM,aAAa,CAAC;AAClG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,8CAA8C;AAC9C,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACpB;AAQD;;;;;;;GAOG;AACH,qBAAa,MAAO,SAAQ,gBAAgB;IAC3C,mCAAmC;IACnC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACpB,oCAAoC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uEAAuE;IACvE,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,4DAA4D;IACrD,KAAK,EAAE,IAAI,GAAG,SAAS,CAAC;IAC/B,6EAA6E;IACtE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACzC,sDAAsD;IAC/C,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IAC9B,SAAS,EAAE,IAAI,CAAC;IACvB,0CAA0C;IACnC,SAAS,EAAE,IAAI,CAAC;IAEvB,gBAAgB;gBACG,IAAI,EAAE,UAAU;CAcnC;AAED,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IACnC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC5B,iFAAiF;IACjF,OAAO,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC;IAC5E,gBAAgB;gBACG,IAAI,EAAE,UAAU;IAInC;;;;;;OAMG;IACU,IAAI,CAChB,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAO7B;;;;;;;OAOG;IACU,MAAM,CAClB,OAAO,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAuB9B"}

package/script/src/resources/api-keys.js

@@ -4,37 +4,32 @@ exports.ApiKeysNamespace = exports.ApiKey = void 0;
 const namespace_js_1 = require("../namespace.js");
 const reactive_js_1 = require("../reactive.js");
 const types_js_1 = require("../types.js");
-const members_js_1 = require("./members.js");
+const users_js_1 = require("./users.js");
 /**
  * An API key credential for authenticating programmatic access to the MeowPanel API.
  *
  * Retrieved via {@link ApiKeysNamespace.list} or {@link ApiKeysNamespace.create}.
  *
- * > **Note:** The `token` field is only populated when the key is first created.
- * > It cannot be retrieved again after that. Store it securely.
+ * The bearer token is returned only once, by {@link ApiKeysNamespace.create}. It
+ * is never part of this resource. Store it securely when first received.
  */
 class ApiKey extends reactive_js_1.ReactiveResource {
     /** The API key's unique NanoID. */
     id;
-    /** The issuer type, always `'api_key'`. */
-    issuerType;
     /** Display name for this API key. */
     name;
     /** Description for this API key. */
     description;
-    /** The owner of this API key. Always present as full object. */
+    /** The owner's bare NanoID (parsed from the namespaced `owner_id`). */
+    ownerId;
+    /** The owner's issuer type, e.g. `'user'` or `'system'`. */
+    ownerType;
+    /** The owner of this API key. Requires `?include=owner`. */
     owner;
-    /**
-     * The bearer token value.
-     *
-     * Only populated immediately after creation via {@link ApiKeysNamespace.create}.
-     * `undefined` on all subsequent fetches - store it securely when first received.
-     */
-    token;
     /** Permissions assigned to this API key. Requires `?include=permissions`. */
     permissions;
-    /** When this key was last used to authenticate a request, or `null` if never used. */
-    lastUsedAt;
+    /** When this key was revoked, or `null` if active. */
+    revokedAt;
     /** When this API key was created. */
     createdAt;
     /** When this API key was last updated. */
@@ -43,13 +38,14 @@ class ApiKey extends reactive_js_1.ReactiveResource {
     constructor(data) {
         super();
         this.id = (0, types_js_1.toNanoID)(data.id);
-        this.issuerType = data.issuer_type;
         this.name = data.name;
         this.description = data.description;
-        this.owner = data.owner ? new members_js_1.Member(data.owner) : undefined;
-        this.token = data.token;
+        const owner = (0, types_js_1.parseIssuerRef)(data.owner_id);
+        this.ownerId = owner.id;
+        this.ownerType = owner.type;
+        this.owner = data.owner ? new users_js_1.User(data.owner) : undefined;
         this.permissions = data.permissions;
-        this.lastUsedAt = data.last_used_at ? new Date(data.last_used_at) : null;
+        this.revokedAt = data.revoked_at ? new Date(data.revoked_at) : null;
         this.createdAt = new Date(data.created_at);
         this.updatedAt = new Date(data.updated_at);
     }

package/script/src/resources/auth.d.ts

@@ -1,28 +1,69 @@
 import type { HttpClient } from '../http.js';
+import { type ApiKeyAccount, type UserAccount } from './account.js';
 /**
  * A single authentication provider and its display configuration.
  */
 export interface AuthProvider {
+    /** Relative submission URL for this provider, e.g. `"/v1/auth/email"`. */
+    url: string;
     /** Provider-specific display fields, e.g. `{ display_name: 'WHMCS' }`. */
     fields: Record<string, string>;
 }
+/** Email-verification policy for the panel. `'off'` when email is unavailable. */
+export type EmailVerificationMode = 'off' | 'optional' | 'required';
 /**
  * Metadata about the panel's authentication configuration.
  */
 export interface AuthMeta {
     /** Available auth providers keyed by provider ID (e.g. `'email'`, `'whmcs'`). */
     providers: Record<string, AuthProvider>;
+    /** Email capability and verification policy. */
+    email: {
+        /** `true` when an email transport is configured. */
+        available: boolean;
+        /** The verification policy in effect. */
+        verification: EmailVerificationMode;
+    };
+}
+/** The opaque session token returned by a login or exchange. */
+export interface LoginResult {
+    /**
+     * The opaque session token. Usable only on `/auth/*` routes; call
+     * {@link AuthResource.refresh} with it set as the bearer token to obtain an access token.
+     */
+    token: string;
+}
+/** The result of redeeming an exchange code. */
+export interface ExchangeResult extends LoginResult {
+    /** The post-login redirect path, or `null`. */
+    redirect: string | null;
+}
+/** The access token (and optional account) from a refresh. */
+export interface RefreshResult {
+    /** Always `"Bearer"`. */
+    tokenType: string;
+    /** Lifetime of the access token, in seconds. */
+    expiresInSeconds: number;
+    /** The JWT access token to use on all non-auth routes. */
+    accessToken: string;
+    /** The authenticated account. Present only when requested with `includeAccount`. */
+    account?: UserAccount | ApiKeyAccount;
 }
 /**
- * Resource for authentication configuration.
+ * Resource for authentication configuration and login flows.
  *
  * Access via `api.auth`.
  *
+ * The flow: submit credentials ({@link login}) or redeem a code ({@link exchange}) to get an
+ * opaque session token, set it as the client token, then call {@link refresh} to obtain the
+ * short-lived access token used for all other requests.
+ *
  * @example
  * ```ts ignore
- * const { providers } = await api.auth.getMeta();
- * if (providers.email) console.log('Email login available');
- * if (providers.whmcs) console.log('WHMCS:', providers.whmcs.fields.display_name);
+ * const { token } = await api.auth.loginWithEmail('me@example.com', 'hunter2');
+ * api.setToken(token);
+ * const { accessToken } = await api.auth.refresh();
+ * api.setToken(accessToken);
  * ```
  */
 export declare class AuthResource {
@@ -35,5 +76,30 @@ export declare class AuthResource {
      * Returns the available login providers and their display fields.
      */
     getMeta(): Promise<AuthMeta>;
+    /**
+     * Submit credentials to a login provider.
+     *
+     * @param provider    The provider id, e.g. `"email"`.
+     * @param credentials The provider's fields (for `email`: `{ email, password }`).
+     */
+    login(provider: string, credentials: Record<string, unknown>): Promise<LoginResult>;
+    /** Log in with email and password. */
+    loginWithEmail(email: string, password: string): Promise<LoginResult>;
+    /**
+     * Redeem a single-use exchange code (e.g. from a WHMCS SSO redirect) for a session token.
+     *
+     * @param code The exchange code.
+     */
+    exchange(code: string): Promise<ExchangeResult>;
+    /**
+     * Exchange the current (opaque session) token for a short-lived access token.
+     *
+     * Call this with the session token set as the client's bearer token.
+     *
+     * @param opts `includeAccount` also returns the authenticated account.
+     */
+    refresh(opts?: {
+        includeAccount?: boolean;
+    }): Promise<RefreshResult>;
 }
 //# sourceMappingURL=auth.d.ts.map

package/script/src/resources/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/src/resources/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7C;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,YAAY;IAEL,OAAO,CAAC,QAAQ,CAAC,IAAI;IADxC,gBAAgB;gBACoB,IAAI,EAAE,UAAU;IAEpD;;;;OAIG;IACI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;CAGnC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/src/resources/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAW,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAc7E;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxC,gDAAgD;IAChD,KAAK,EAAE;QACN,oDAAoD;QACpD,SAAS,EAAE,OAAO,CAAC;QACnB,yCAAyC;QACzC,YAAY,EAAE,qBAAqB,CAAC;KACpC,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACd;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAe,SAAQ,WAAW;IAClD,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC7B,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAY;IAEL,OAAO,CAAC,QAAQ,CAAC,IAAI;IADxC,gBAAgB;gBACoB,IAAI,EAAE,UAAU;IAEpD;;;;OAIG;IACI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAInC;;;;;OAKG;IACI,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1F,sCAAsC;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI5E;;;;OAIG;IACI,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAItD;;;;;;OAMG;IACU,OAAO,CAAC,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;CAcrF"}

package/script/src/resources/auth.js

@@ -1,16 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthResource = void 0;
+const account_js_1 = require("./account.js");
 /**
- * Resource for authentication configuration.
+ * Resource for authentication configuration and login flows.
  *
  * Access via `api.auth`.
  *
+ * The flow: submit credentials ({@link login}) or redeem a code ({@link exchange}) to get an
+ * opaque session token, set it as the client token, then call {@link refresh} to obtain the
+ * short-lived access token used for all other requests.
+ *
  * @example
  * ```ts ignore
- * const { providers } = await api.auth.getMeta();
- * if (providers.email) console.log('Email login available');
- * if (providers.whmcs) console.log('WHMCS:', providers.whmcs.fields.display_name);
+ * const { token } = await api.auth.loginWithEmail('me@example.com', 'hunter2');
+ * api.setToken(token);
+ * const { accessToken } = await api.auth.refresh();
+ * api.setToken(accessToken);
  * ```
  */
 class AuthResource {
@@ -27,5 +33,42 @@ class AuthResource {
     getMeta() {
         return this.http.get('/auth');
     }
+    /**
+     * Submit credentials to a login provider.
+     *
+     * @param provider    The provider id, e.g. `"email"`.
+     * @param credentials The provider's fields (for `email`: `{ email, password }`).
+     */
+    login(provider, credentials) {
+        return this.http.post(`/auth/${encodeURIComponent(provider)}`, credentials);
+    }
+    /** Log in with email and password. */
+    loginWithEmail(email, password) {
+        return this.login('email', { email, password });
+    }
+    /**
+     * Redeem a single-use exchange code (e.g. from a WHMCS SSO redirect) for a session token.
+     *
+     * @param code The exchange code.
+     */
+    exchange(code) {
+        return this.http.post('/auth/exchange', { code });
+    }
+    /**
+     * Exchange the current (opaque session) token for a short-lived access token.
+     *
+     * Call this with the session token set as the client's bearer token.
+     *
+     * @param opts `includeAccount` also returns the authenticated account.
+     */
+    async refresh(opts = {}) {
+        const raw = await this.http.post('/auth/refresh', undefined, opts.includeAccount ? { params: { include: 'account' } } : {});
+        return {
+            tokenType: raw.token_type,
+            expiresInSeconds: raw.expires_in_seconds,
+            accessToken: raw.access_token,
+            account: raw.account ? account_js_1.Account.create(raw.account, this.http) : undefined,
+        };
+    }
 }
 exports.AuthResource = AuthResource;