npm - @mosano-product-framework/sdk - Versions diffs - 0.2.2 → 0.2.3 - Mend

@mosano-product-framework/sdk 0.2.2 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/{chunk-R5KABORE.js → chunk-N73TORHR.js} +2 -2
package/dist/{chunk-R5KABORE.js.map → chunk-N73TORHR.js.map} +1 -1
package/dist/identity/index.js +1 -1
package/dist/identity/types.d.ts +7 -0
package/dist/index.js +2 -2
package/package.json +1 -1

package/dist/{chunk-R5KABORE.js → chunk-N73TORHR.js} RENAMED Viewed

@@ -955,5 +955,5 @@ function createAdminClient(options) {
 }
 export { AuthClientV0, createAdminClient, createAuthClient, identity_exports, isMFARequired, isMFASetupRequired };
-//# sourceMappingURL=chunk-R5KABORE.js.map
-//# sourceMappingURL=chunk-R5KABORE.js.map
+//# sourceMappingURL=chunk-N73TORHR.js.map
+//# sourceMappingURL=chunk-N73TORHR.js.map

package/dist/{chunk-R5KABORE.js.map → chunk-N73TORHR.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/identity/index.ts","../src/identity/v0.ts","../src/identity/types.ts"],"names":[],"mappings":";;;;;AAAA,IAAA,gBAAA,GAAA;AAAA,QAAA,CAAA,gBAAA,EAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,iBAAA,EAAA,MAAA,iBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,kBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;AC2BO,IAAM,YAAA,GAAN,cAA2B,SAAA,CAAU;AAAA;AAAA,EAEzB,eAAA;AAAA,EAEjB,YAAY,MAAA,EAA4B;AACtC,IAAA,MAAM,EAAE,eAAA,EAAiB,GAAG,YAAA,EAAa,GAAI,MAAA;AAC7C,IAAA,KAAA,CAAM;AAAA,MACJ,GAAG,YAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,YAAA,CAAa,OAAO,CAAA,GAAA;AAAA,KACjC,CAAA;AACD,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,OAAA,EAA0C;AAC9D,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,IAAA,EAAK;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,mBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,MAAM,WAAA,GAAc;AAAA,MAClB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,GAAI,KAAK,UAAA,GAAa,EAAE,YAAY,IAAA,CAAK,UAAA,KAAe,EAAC;AAAA,MACzD,GAAI,KAAK,SAAA,GAAY,EAAE,WAAW,IAAA,CAAK,SAAA,KAAc,EAAC;AAAA,MACtD,GAAI,KAAK,YAAA,GAAe,EAAE,cAAc,IAAA,CAAK,YAAA,KAAiB;AAAC,KACjE;AACA,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,yBAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,mBAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,yBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,aAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,mBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,uBAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,6BAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,kBAAA,CACJ,IAAA,EACA,OAAA,EACsC;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,2BAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,iBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,YAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,iBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,kBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,kBACJ,OAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MACV,uBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAA,CACJ,KAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MACzC,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,gBAAA,CACJ,KAAA,EACA,OAAA,EACyC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,KAAK,CAAC,CAAA,OAAA,CAAA;AAAA,MACzC,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,gBAAA,CACJ,YAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,YAAY,CAAC,CAAA,CAAA;AAAA,MAChD;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,YAAY,OAAA,EAAyD;AACzE,IAAA,OAAO,KAAK,GAAA,CAA0B,UAAA,EAAY,IAAA,CAAK,aAAA,CAAc,OAAO,CAAC,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,MAAM,OAAA,EAA8D;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAA+B,WAAA,EAAa,OAAO,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,KAAA,CAA6B,WAAA,EAAa,IAAA,EAAM,OAAO,CAAA;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAAW,OAAA,EAA0D;AACzE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA0B,oBAAoB,OAAO,CAAA;AACjF,IAAA,OAAO,QAAA,CAAS,MAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA0B,kBAAA,EAAoB,IAAA,EAAM,OAAO,CAAA;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,YAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,sBACJ,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,0BAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAAW,OAAA,EAA0D;AACzE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA0B,oBAAoB,OAAO,CAAA;AACjF,IAAA,OAAO,QAAA,CAAS,MAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA0B,kBAAA,EAAoB,IAAA,EAAM,OAAO,CAAA;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,YAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aACJ,OAAA,EACkC;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA4B,sBAAsB,OAAO,CAAA;AACrF,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CACJ,SAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,mBAAA,EAAsB,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MACnD,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,YAAY,OAAA,EAA2D;AAC3E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA2B,qBAAqB,OAAO,CAAA;AACnF,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,YAAA,CACJ,QAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAA;AAAA,MACjD,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,cAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,kBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YAAA,CACJ,IAAA,EACA,OAAA,EAC+B;AAC/B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA2B,UAAA,EAAY,IAAA,EAAM,OAAO,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,cACJ,OAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAA4B,mBAAA,EAAqB,OAAO,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,iBAAA,CACJ,QAAA,EACA,OAAA,EACqC;AACrC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,CAAA;AAAA,MACxC;AAAA,KACF;AACA,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,kBAAA,CACJ,QAAA,EACA,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,eAAA,CAAA;AAAA,MACxC,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,+BAAA,CACJ,QAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,YAAA,CAAA;AAAA,MACxC;AAAA,KACF;AACA,IAAA,OAAO,QAAA,CAAS,WAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,sBAAA,CACJ,QAAA,EACA,MAAA,EACA,MACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACV,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,SAAA,EAAY,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC9E,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,kBAAA,CACJ,QAAA,EACA,MAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,SAAA,EAAY,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC9E,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,UACJ,OAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,aAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA,CAA4B,cAAA,EAAgB,IAAA,EAAM,OAAO,CAAA;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,WAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA,CAA4B,eAAA,EAAiB,IAAA,EAAM,OAAO,CAAA;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,kBACJ,OAAA,EAC0C;AAC1C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,sBAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAEA,IAAA,MAAM,MAAM,QAAA,CAAS,OAAA;AACrB,IAAA,MAAM,IAAA,GAAQ,WAAA,IAAe,GAAA,GAAM,GAAA,CAAI,SAAA,GAAY,GAAA;AACnD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,WAAA,EAAa,QAAA,CAAS,eAAe,EAAA,EAAG;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,kBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,uBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,yBACJ,OAAA,EACiD;AACjD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,0BAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,MAAM,QAAA,CAAS,OAAA;AACrB,IAAA,MAAM,IAAA,GAAQ,WAAA,IAAe,GAAA,GAAM,GAAA,CAAI,SAAA,GAAY,GAAA;AACnD,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,yBAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,2BAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aACJ,OAAA,EACkC;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA4B,aAAa,OAAO,CAAA;AAC5E,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,aAAA,CACJ,SAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,iBAAA,CACJ,MAAA,EACA,OAAA,EACuC;AACvC,IAAA,MAAM,cAAc,IAAI,eAAA,CAAgB,EAAE,YAAA,EAAc,MAAA,CAAO,cAAc,CAAA;AAC7E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,kBAAA,EAAqB,WAAA,CAAY,QAAA,EAAU,CAAA,CAAA;AAAA,MAC3C,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAKA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,QAAA,CAAS,KAAA,EAAO;AAC1C,MAAA,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,yBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AAKnC,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,IAAA,CAAK,UAAU,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,0PAAA;AAAA,QAIA,EAAE,OAAO,OAAA,EAAQ;AAAA,QACjB,EAAE,KAAA,EAAO,CAAC,mBAAmB,CAAA;AAAE,OACjC;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,wBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AACF;;;ACjXO,SAAS,cAAc,QAAA,EAA0D;AACtF,EAAA,OAAO,cAAA,IAAkB,QAAA,IAAY,QAAA,CAAS,YAAA,KAAiB,IAAA;AACjE;AAKO,SAAS,mBAAmB,QAAA,EAA+D;AAChG,EAAA,OAAO,oBAAA,IAAwB,QAAA,IAAY,QAAA,CAAS,kBAAA,KAAuB,IAAA;AAC7E;;;AF1rBA,IAAM,yBAAA,GAA4B;AAAA,EAChC,yBAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA,uBAAA;AAAA,EACA,wBAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,iBAAiB,OAAA,EAA0C;AACzE,EAAA,MAAM,EAAE,aAAA,EAAe,iBAAA,EAAmB,cAAA,EAAgB,GAAG,cAAa,GAAI,OAAA;AAC9E,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,YAAY,CAAA;AAE5C,EAAA,yBAAA,CAA0B,MAAA,EAAQ,EAAE,aAAA,EAAe,cAAA,EAAgB,CAAA;AAEnE,EAAA,IAAI,iBAAA,EAAmB;AACrB,IAAA,MAAA,CAAO,IAAI,yBAAA,CAA0B;AAAA,MACnC,UAAU,iBAAA,CAAkB,QAAA;AAAA,MAC5B,cAAA,EAAgB;AAAA,KACjB,CAAC,CAAA;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACT;AA+CO,SAAS,kBAAkB,OAAA,EAA2C;AAC3E,EAAA,MAAM,EAAE,KAAA,EAAO,GAAG,YAAA,EAAa,GAAI,OAAA;AACnC,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,YAAY,CAAA;AAC5C,EAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,CAA0B,KAAK,CAAC,CAAA;AAC3C,EAAA,OAAO,MAAA;AACT","file":"chunk-R5KABORE.js","sourcesContent":["import type { ClientConfig, TokenProvider } from '../client/core/types.js';\nimport { attachStandardMiddlewares } from '../client/core/client-factory.js';\nimport { createTurnstileMiddleware } from '../client/middlewares/turnstile.js';\nimport {\n createAdminAuthMiddleware,\n type AdminAuthMiddlewareOptions,\n} from '../client/middlewares/admin-auth.js';\nimport type { TenantSelectionStore } from '../auth/tenant-selection.js';\nimport type { OAuthStateStore } from '../auth/oauth-state.js';\nimport { AuthClientV0 } from './v0.js';\n\n/*\n Provider for minting single-use Cloudflare Turnstile tokens.\n /\nexport interface TurnstileProvider {\n /* Mint a fresh single-use Turnstile token. /\n getToken: () => Promise<string>;\n}\n\n/\n Configuration options for the Auth client\n /\nexport interface AuthClientOptions extends Omit<ClientConfig, 'baseUrl'> {\n /\n Base URL for the Auth service\n /\n baseUrl: string;\n /* Optional token provider. Auto-wires auth middleware when provided. /\n tokenProvider?: TokenProvider;\n /* Optional Turnstile token provider for bot protection. /\n turnstileProvider?: TurnstileProvider;\n /\n Optional shared tenant selection. When provided, every request carries the\n * selected tenant headers. Construct it with `createTenantSelection()` and\n * share the same instance across identity/storage/graphql clients.\n /\n tenantProvider?: TenantSelectionStore;\n /\n Optional store for the OAuth CSRF state. When provided,\n * `getGoogleOAuthURL` persists the minted state so it survives the redirect.\n * Build one with `createOAuthStateStore()`.\n /\n oauthStateStore?: OAuthStateStore;\n}\n\n/\n Creates an Auth client for API v0\n \n @param options - Client configuration options\n * @returns AuthClientV0 instance\n \n @example\n * ```typescript\n * import { createAuthClient } from '@mosano-product-framework/sdk/identity';\n \n // Create client without authentication (for public endpoints)\n * const auth = createAuthClient({\n * baseUrl: 'https://api.example.com/auth',\n * });\n \n // Register a new user\n * const { access_token, refresh_token } = await auth.signUpEmailPassword({\n * name: 'John Doe',\n * email: 'john@example.com',\n * password: 'securePassword123',\n * });\n \n // Create authenticated client with token provider\n * const authenticatedAuth = createAuthClient({\n * baseUrl: 'https://api.example.com/auth',\n * tokenProvider: {\n * getAccessToken: () => localStorage.getItem('accessToken'),\n * onTokenExpired: () => { window.location.href = '/login'; },\n * },\n * });\n \n // Get user profile\n * const profile = await authenticatedAuth.getMe();\n * ```\n /\n/\n SDK endpoint paths that require a Turnstile token.\n * Must match the go-identity routes with turnstile.Verify() middleware.\n /\nconst TURNSTILE_PROTECTED_PATHS = [\n '/sign-up-email-password',\n '/sign-in-email-password',\n '/forgot-password-with-email',\n '/password/recovery/verify',\n '/password/reset',\n '/passkey/login/begin',\n '/passkey/login/finish',\n '/oauth/google/callback',\n '/accept', // matches /invitations/{token}/accept\n '/invite', // matches /tenants/{id}/members/invite\n];\n\nexport function createAuthClient(options: AuthClientOptions): AuthClientV0 {\n const { tokenProvider, turnstileProvider, tenantProvider, ...clientConfig } = options;\n const client = new AuthClientV0(clientConfig);\n\n attachStandardMiddlewares(client, { tokenProvider, tenantProvider });\n\n if (turnstileProvider) {\n client.use(createTurnstileMiddleware({\n getToken: turnstileProvider.getToken,\n protectedPaths: TURNSTILE_PROTECTED_PATHS,\n }));\n }\n\n return client;\n}\n\n/\n Configuration options for an admin-authenticated Auth client.\n \n SECURITY: Admin authentication uses the shared `ADMIN_JWT_SECRET`, which can\n * impersonate any user. Only construct an admin client server-side / in trusted\n * services. NEVER ship the secret to a browser.\n /\nexport interface AdminClientOptions extends Omit<ClientConfig, 'baseUrl'> {\n /* Base URL for the Auth service. /\n baseUrl: string;\n /* Admin auth options: either a pre-minted `token` or a minting `config`. /\n admin: AdminAuthMiddlewareOptions;\n}\n\n/\n Creates an admin-authenticated Auth client for API v0.\n \n The returned client sends `Authorization: Admin <jwt>` on every request,\n * acting on behalf of the configured principal. Mirrors {@link createAuthClient}\n * but wires the admin auth middleware instead of the Bearer one.\n \n SECURITY: Requires the shared `ADMIN_JWT_SECRET` (when using a minting\n * `config`). Server-side / trusted-service use ONLY — never expose the secret\n * to a browser.\n \n @param options - Client configuration options.\n * @returns AuthClientV0 instance authenticated as an admin.\n \n @example\n * ```typescript\n * import { createAdminClient } from '@mosano-product-framework/sdk/identity';\n \n // Mint a fresh admin token per request (server-side only).\n * const admin = createAdminClient({\n * baseUrl: 'https://api.example.com/auth',\n * admin: {\n * config: {\n * secret: process.env.ADMIN_JWT_SECRET!,\n * actOnBehalfOf: { userId, onTenantId: tenantId },\n * ttlSeconds: 60,\n * },\n * },\n * });\n * ```\n /\nexport function createAdminClient(options: AdminClientOptions): AuthClientV0 {\n const { admin, ...clientConfig } = options;\n const client = new AuthClientV0(clientConfig);\n client.use(createAdminAuthMiddleware(admin));\n return client;\n}\n\nexport { AuthClientV0, type AuthClientV0Config } from './v0.js';\nexport from './types.js';\n","import { MPFClient } from '../client/core/client.js';\nimport type { ClientConfig, RequestOptions } from '../client/core/types.js';\nimport { MPFValidationError } from '../client/core/errors.js';\nimport type { OAuthStateStore } from '../auth/oauth-state.js';\nimport type * as Types from './types.js';\n\n/*\n Configuration for the identity client.\n /\nexport interface AuthClientV0Config extends ClientConfig {\n /\n Optional store for the OAuth CSRF state. When provided,\n * `getGoogleOAuthURL` persists the minted state automatically so it survives\n * the redirect.\n \n Sending it back stays explicit — `GoogleOAuthCallbackRequest.state` is\n * required — because a security parameter should not be injected invisibly.\n /\n oauthStateStore?: OAuthStateStore;\n}\n\n/\n Auth API v0 client\n \n Provides methods for authentication, user management, sessions,\n * password recovery, and multi-tenant operations.\n /\nexport class AuthClientV0 extends MPFClient {\n /* Optional OAuth state store; see {@link AuthClientV0Config.oauthStateStore}. /\n private readonly oauthStateStore?: OAuthStateStore;\n\n constructor(config: AuthClientV0Config) {\n const { oauthStateStore, ...clientConfig } = config;\n super({\n ...clientConfig,\n baseUrl: `${clientConfig.baseUrl}/v0`,\n });\n this.oauthStateStore = oauthStateStore;\n }\n\n /\n Wraps request options with skipAuth: true for public endpoints\n * that do not require authentication headers.\n /\n private publicOptions(options?: RequestOptions): RequestOptions {\n return { ...options, skipAuth: true };\n }\n\n // ============================================================================\n // Public Endpoints - Authentication\n // ============================================================================\n\n /\n Register a new user with email and password\n \n Creates a new user account and returns access and refresh tokens.\n \n @param data - User registration data\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async signUpEmailPassword(\n data: Types.CreateUserRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n const cleanedData = {\n email: data.email,\n password: data.password,\n ...(data.first_name ? { first_name: data.first_name } : {}),\n ...(data.last_name ? { last_name: data.last_name } : {}),\n ...(data.display_name ? { display_name: data.display_name } : {}),\n };\n return this.post<Types.AccessDataResponse>(\n '/sign-up-email-password',\n cleanedData,\n this.publicOptions(options)\n );\n }\n\n /\n Login with email and password\n \n Authenticates a user and returns access and refresh tokens.\n \n @param data - Login credentials\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async signInEmailPassword(\n data: Types.LoginRequest,\n options?: RequestOptions\n ): Promise<Types.LoginResponse> {\n return this.post<Types.LoginResponse>(\n '/sign-in-email-password',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify MFA code to complete login\n \n After a login attempt returns mfa_required, submit the TOTP code\n * along with the MFA ticket to complete authentication.\n \n @param data - MFA ticket and TOTP code\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async verifyMFA(\n data: Types.MFAVerifyRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/mfa/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify MFA setup to complete first-time enrollment and login\n \n After a login attempt returns mfa_setup_required, verify the TOTP\n * setup by submitting a code from the authenticator app.\n \n @param data - MFA ticket and verification code\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async verifyMFASetup(\n data: Types.MFASetupVerifyRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/mfa/setup/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Public Endpoints - Password Recovery\n // ============================================================================\n\n /\n Send password recovery code to email\n \n Initiates the password recovery process by sending a verification code.\n \n @param data - Email address for recovery\n * @param options - Optional request options\n * @returns Success response\n /\n async forgotPasswordWithEmail(\n data: Types.SendRecoveryCodeRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/forgot-password-with-email',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify password recovery code\n \n Verifies the recovery code and returns a recovery token for password reset.\n \n @param data - Email and verification code\n * @param options - Optional request options\n * @returns Recovery token for password reset\n /\n async verifyRecoveryCode(\n data: Types.VerifyRecoveryCodeRequest,\n options?: RequestOptions\n ): Promise<Types.RecoveryTokenResponse> {\n return this.post<Types.RecoveryTokenResponse>(\n '/password/recovery/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Reset password with recovery token\n \n Resets the user's password and returns new access and refresh tokens.\n \n @param data - Recovery token and new password\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async resetPassword(\n data: Types.ResetPasswordRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/password/reset',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Public Endpoints - Sessions\n // ============================================================================\n\n /\n Renew session with refresh token\n \n Exchanges a valid refresh token for new access and refresh tokens.\n \n Tenant is selected per request via the `X-MPF-Tenant` header, so a renewal\n * neither takes nor changes a tenant.\n \n @param data - Refresh token\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async renewSession(\n data: Types.RenewSessionRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/sessions/renew',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Revoke session (logout)\n \n Revokes the session associated with the provided refresh token.\n * Requires authentication.\n \n @param data - Refresh token to revoke\n * @param options - Optional request options\n * @returns Success response\n /\n async revokeSession(\n data: Types.RevokeSessionRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/sessions/revoke',\n data,\n options\n );\n }\n\n // ============================================================================\n // Public Endpoints - Invitations\n // ============================================================================\n\n /\n List pending invitations for the authenticated user\n \n Returns all pending invitations for the currently authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of pending invitations\n /\n async listMyInvitations(\n options?: RequestOptions\n ): Promise<Types.PendingInvitationResponse[]> {\n return this.get<Types.PendingInvitationResponse[]>(\n '/users/me/invitations',\n options\n );\n }\n\n /\n Preview an invitation (public, pre-auth).\n \n Returns the tenant, role, and inviter display name for the\n * invitation-acceptance page. Email is intentionally omitted. Use this\n * to render the accept page before the user signs in.\n \n @param token - Invitation token\n * @param options - Optional request options\n * @returns Public-safe invitation preview\n /\n async previewInvitation(\n token: string,\n options?: RequestOptions\n ): Promise<Types.InvitationPreviewResponse> {\n return this.get<Types.InvitationPreviewResponse>(\n `/invitations/${encodeURIComponent(token)}`,\n this.publicOptions(options)\n );\n }\n\n /\n Accept an invitation.\n \n Requires the user to be authenticated. The user's primary verified\n * email must match the invitation. Creates the membership row.\n \n @param token - Invitation token\n * @param options - Optional request options\n * @returns Acceptance result (invitation + new membership)\n /\n async acceptInvitation(\n token: string,\n options?: RequestOptions\n ): Promise<Types.AcceptInvitationResponse> {\n return this.post<Types.AcceptInvitationResponse>(\n `/invitations/${encodeURIComponent(token)}/accept`,\n undefined,\n options\n );\n }\n\n /\n Revoke a pending invitation. Caller must be a manager of the tenant\n * that issued the invitation.\n \n @param invitationId - Invitation ID (not the token)\n * @param options - Optional request options\n /\n async revokeInvitation(\n invitationId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/invitations/${encodeURIComponent(invitationId)}`,\n options\n );\n }\n\n // ============================================================================\n // Public Endpoints - Health\n // ============================================================================\n\n /\n Health check endpoint\n \n Returns the health status of the service.\n \n @param options - Optional request options\n * @returns Health status\n /\n async healthCheck(options?: RequestOptions): Promise<Types.HealthResponse> {\n return this.get<Types.HealthResponse>('/healthz', this.publicOptions(options));\n }\n\n // ============================================================================\n // Protected Endpoints - User Profile\n // ============================================================================\n\n /\n Get current user profile\n \n Returns the authenticated user's profile information.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns User profile\n /\n async getMe(options?: RequestOptions): Promise<Types.UserProfileResponse> {\n return this.get<Types.UserProfileResponse>('/users/me', options);\n }\n\n /\n Update current user profile\n \n Updates the authenticated user's profile information.\n * Requires authentication.\n \n @param data - Profile update data\n * @param options - Optional request options\n * @returns Updated user profile\n /\n async updateMe(\n data: Types.UpdateProfileRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.patch<Types.SuccessResponse>('/users/me', data, options);\n }\n\n // ============================================================================\n // Protected Endpoints - Emails\n // ============================================================================\n\n /\n List user emails\n \n Returns all email addresses associated with the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of email addresses\n /\n async listEmails(options?: RequestOptions): Promise<Types.EmailResponse[]> {\n const response = await this.get<Types.EmailsResponse>('/users/me/emails', options);\n return response.emails;\n }\n\n /\n Add a new email address\n \n Adds a new email address to the authenticated user's account.\n * A verification code will be sent to the email.\n * Requires authentication.\n \n @param data - Email address to add\n * @param options - Optional request options\n * @returns Added email information\n /\n async addEmail(\n data: Types.AddEmailRequest,\n options?: RequestOptions\n ): Promise<Types.EmailResponse> {\n return this.post<Types.EmailResponse>('/users/me/emails', data, options);\n }\n\n /\n Verify an email address\n \n Verifies an email address using a verification code.\n * Requires authentication.\n \n @param emailId - Email ID to verify\n * @param data - Verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyEmail(\n emailId: string,\n data: Types.VerifyContactRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}/verify`,\n data,\n options\n );\n }\n\n /\n Delete an email address\n \n Removes an email address from the authenticated user's account.\n * Cannot delete the primary email.\n * Requires authentication.\n \n @param emailId - Email ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteEmail(\n emailId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}`,\n undefined,\n options\n );\n }\n\n /\n Set email as primary\n \n Sets the specified email address as the primary email for the user.\n * Email must be verified before it can be set as primary.\n * Requires authentication.\n \n @param emailId - Email ID to set as primary\n * @param options - Optional request options\n * @returns Success response\n /\n async setPrimaryEmail(\n emailId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}/set-primary`,\n undefined,\n options\n );\n }\n\n /\n Send email verification code\n \n Sends a verification code to the authenticated user's primary email address.\n * Use verifyEmail() to complete the verification.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Success response\n /\n async sendEmailVerification(\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/email/send-verification',\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Phones\n // ============================================================================\n\n /\n List user phones\n \n Returns all phone numbers associated with the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of phone numbers\n /\n async listPhones(options?: RequestOptions): Promise<Types.PhoneResponse[]> {\n const response = await this.get<Types.PhonesResponse>('/users/me/phones', options);\n return response.phones;\n }\n\n /\n Add a new phone number\n \n Adds a new phone number to the authenticated user's account.\n * A verification code will be sent to the phone.\n * Requires authentication.\n \n @param data - Phone number to add (E.164 format)\n * @param options - Optional request options\n * @returns Added phone information\n /\n async addPhone(\n data: Types.AddPhoneRequest,\n options?: RequestOptions\n ): Promise<Types.PhoneResponse> {\n return this.post<Types.PhoneResponse>('/users/me/phones', data, options);\n }\n\n /\n Verify a phone number\n \n Verifies a phone number using a verification code.\n * Requires authentication.\n \n @param phoneId - Phone ID to verify\n * @param data - Verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyPhone(\n phoneId: string,\n data: Types.VerifyContactRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}/verify`,\n data,\n options\n );\n }\n\n /\n Delete a phone number\n \n Removes a phone number from the authenticated user's account.\n * Cannot delete the primary phone.\n * Requires authentication.\n \n @param phoneId - Phone ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deletePhone(\n phoneId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}`,\n undefined,\n options\n );\n }\n\n /\n Set phone as primary\n \n Sets the specified phone number as the primary phone for the user.\n * Phone must be verified before it can be set as primary.\n * Requires authentication.\n \n @param phoneId - Phone ID to set as primary\n * @param options - Optional request options\n * @returns Success response\n /\n async setPrimaryPhone(\n phoneId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}/set-primary`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Sessions\n // ============================================================================\n\n /\n List user sessions\n \n Returns all active sessions for the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of sessions\n /\n async listSessions(\n options?: RequestOptions\n ): Promise<Types.SessionResponse[]> {\n const response = await this.get<Types.SessionsResponse>('/users/me/sessions', options);\n return response.sessions;\n }\n\n /\n Delete a session\n \n Revokes a specific session for the authenticated user.\n * Requires authentication.\n \n @param sessionId - Session ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteSession(\n sessionId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/sessions/${encodeURIComponent(sessionId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Clients\n // ============================================================================\n\n /\n List authorized OAuth clients\n \n Returns all OAuth clients authorized by the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of OAuth clients\n /\n async listClients(options?: RequestOptions): Promise<Types.ClientResponse[]> {\n const response = await this.get<Types.ClientsResponse>('/users/me/clients', options);\n return response.clients;\n }\n\n /\n Revoke OAuth client authorization\n \n Revokes authorization for a specific OAuth client.\n * Requires authentication.\n \n @param clientId - Client ID to revoke\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteClient(\n clientId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/clients/${encodeURIComponent(clientId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Password\n // ============================================================================\n\n /\n Update password (authenticated)\n \n Updates the authenticated user's password.\n * Requires authentication.\n \n @param data - Current and new password\n * @param options - Optional request options\n * @returns Success response\n /\n async updatePassword(\n data: Types.UpdatePasswordRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/password/update',\n data,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Tenants\n // ============================================================================\n\n /\n Create a new tenant\n \n Creates a new tenant organization. The authenticated user becomes the owner.\n * Requires authentication.\n \n @param data - Tenant creation data\n * @param options - Optional request options\n * @returns Created tenant information\n /\n async createTenant(\n data: Types.CreateTenantRequest,\n options?: RequestOptions\n ): Promise<Types.TenantResponse> {\n return this.post<Types.TenantResponse>('/tenants', data, options);\n }\n\n /\n List current user's tenants\n \n Returns all tenants the authenticated user is a member of.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of tenant information\n /\n async listMyTenants(\n options?: RequestOptions\n ): Promise<Types.TenantResponse[]> {\n return this.get<Types.TenantResponse[]>('/users/me/tenants', options);\n }\n\n // ============================================================================\n // Protected Endpoints - Tenant Members\n // ============================================================================\n\n /\n List tenant members\n \n Returns all members of the specified tenant.\n * Requires authentication and membership in the tenant.\n \n @param tenantId - Tenant ID\n * @param options - Optional request options\n * @returns Array of tenant members\n /\n async listTenantMembers(\n tenantId: string,\n options?: RequestOptions\n ): Promise<Types.MembershipResponse[]> {\n const response = await this.get<Types.MembersResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members`,\n options\n );\n return response.members;\n }\n\n /\n Invite a member to tenant\n \n Sends an invitation to join the tenant. Requires authentication and\n * owner/admin role on the tenant.\n \n @param tenantId - Target tenant ID\n * @param data - Invitation data\n * @param options - Optional request options\n * @returns Invitation result, including a copyable accept_url\n /\n async inviteTenantMember(\n tenantId: string,\n data: Types.InviteMemberRequest,\n options?: RequestOptions\n ): Promise<Types.InvitationResponse> {\n return this.post<Types.InvitationResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/invite`,\n data,\n options\n );\n }\n\n /\n List pending invitations issued by the authenticated caller for a tenant.\n \n Returns only invitations whose `invited_by` matches the caller. Lets the\n * caller copy the `accept_url` of an invite they previously sent (for\n * example, to re-share if email delivery failed). Callers without a\n * membership, and members who never issued an invite for this tenant,\n * get an empty array.\n \n @param tenantId - Tenant ID\n * @param options - Optional request options\n * @returns Array of invitations issued by the caller\n /\n async listTenantInvitationsIssuedByMe(\n tenantId: string,\n options?: RequestOptions\n ): Promise<Types.IssuedInvitationResponse[]> {\n const response = await this.get<Types.IssuedInvitationsResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/invitations`,\n options\n );\n return response.invitations;\n }\n\n /\n Update member role\n \n Updates the role of a tenant member.\n * Requires authentication and owner role in the tenant.\n \n @param tenantId - Tenant ID\n * @param userId - User ID of the member\n * @param data - New role\n * @param options - Optional request options\n * @returns Updated membership information\n /\n async updateTenantMemberRole(\n tenantId: string,\n userId: string,\n data: Types.UpdateMemberRoleRequest,\n options?: RequestOptions\n ): Promise<Types.MembershipResponse> {\n return this.patch<Types.MembershipResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,\n data,\n options\n );\n }\n\n /\n Remove member from tenant\n \n Removes a member from the tenant.\n * Cannot remove the last owner.\n * Requires authentication and admin/owner role in the tenant.\n \n @param tenantId - Tenant ID\n * @param userId - User ID of the member to remove\n * @param options - Optional request options\n * @returns Success response\n /\n async removeTenantMember(\n tenantId: string,\n userId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - TOTP (Two-Factor Authentication)\n // ============================================================================\n\n /\n Setup TOTP two-factor authentication\n \n Initializes TOTP setup and returns the secret, QR code URL, and backup codes.\n * The setup must be verified with verifyTOTP() before it becomes active.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns TOTP setup data including secret and backup codes\n /\n async setupTOTP(\n options?: RequestOptions\n ): Promise<Types.TOTPSetupResponse> {\n return this.post<Types.TOTPSetupResponse>(\n '/totp/setup',\n undefined,\n options\n );\n }\n\n /\n Verify TOTP setup\n \n Verifies a TOTP code to complete the 2FA setup process.\n * After verification, TOTP will be required on future logins.\n * Requires authentication.\n \n @param data - TOTP verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyTOTP(\n data: Types.VerifyTOTPRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>('/totp/verify', data, options);\n }\n\n /\n Disable TOTP two-factor authentication\n \n Disables TOTP 2FA. Requires a valid TOTP code to confirm.\n * Requires authentication.\n \n @param data - TOTP code to confirm disable\n * @param options - Optional request options\n * @returns Success response\n /\n async disableTOTP(\n data: Types.DisableTOTPRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>('/totp/disable', data, options);\n }\n\n // ============================================================================\n // Passkey / WebAuthn - Public Endpoints\n // ============================================================================\n\n /\n Begin passkey login\n \n Starts the WebAuthn authentication process.\n * Returns options to pass to navigator.credentials.get().\n \n @param options - Optional request options\n * @returns WebAuthn request options\n /\n async beginPasskeyLogin(\n options?: RequestOptions\n ): Promise<Types.BeginPasskeyLoginResponse> {\n const response = await this.post<Types.BeginPasskeyLoginResponse & { session_key?: string }>(\n '/passkey/login/begin',\n undefined,\n this.publicOptions(options)\n );\n // Handle both shapes: server may return { publicKey: {...} } or flat { challenge, ... }\n const raw = response.options as unknown as Record<string, unknown>;\n const opts = ('publicKey' in raw ? raw.publicKey : raw) as Types.WebAuthnRequestOptions;\n return { options: opts, session_key: response.session_key ?? '' };\n }\n\n /\n Complete passkey login\n \n Completes the WebAuthn authentication and returns access tokens.\n \n @param data - WebAuthn assertion result from navigator.credentials.get()\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async finishPasskeyLogin(\n data: Types.FinishPasskeyLoginRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/passkey/login/finish',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Passkey / WebAuthn - Protected Endpoints\n // ============================================================================\n\n /\n Begin passkey registration\n \n Starts the WebAuthn registration process for the authenticated user.\n * Returns options to pass to navigator.credentials.create().\n * Requires authentication.\n \n @param options - Optional request options\n * @returns WebAuthn creation options\n /\n async beginPasskeyRegistration(\n options?: RequestOptions\n ): Promise<Types.BeginPasskeyRegistrationResponse> {\n const response = await this.post<Types.BeginPasskeyRegistrationResponse>(\n '/passkeys/register/begin',\n undefined,\n options\n );\n // Handle both shapes: server may return { publicKey: {...} } or flat { rp, user, ... }\n const raw = response.options as unknown as Record<string, unknown>;\n const opts = ('publicKey' in raw ? raw.publicKey : raw) as Types.WebAuthnCreationOptions;\n return { options: opts };\n }\n\n /\n Complete passkey registration\n \n Completes the WebAuthn registration with the attestation result.\n * Requires authentication.\n \n @param data - WebAuthn attestation result and optional passkey name\n * @param options - Optional request options\n * @returns Success response\n /\n async finishPasskeyRegistration(\n data: Types.FinishPasskeyRegistrationRequest,\n options?: RequestOptions\n ): Promise<Types.PasskeyResponse> {\n return this.post<Types.PasskeyResponse>(\n '/passkeys/register/finish',\n data,\n options\n );\n }\n\n /\n List registered passkeys\n \n Returns all passkeys registered by the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of passkey information\n /\n async listPasskeys(\n options?: RequestOptions\n ): Promise<Types.PasskeyResponse[]> {\n const response = await this.get<Types.PasskeysResponse>('/passkeys', options);\n return response.passkeys;\n }\n\n /\n Delete a passkey\n \n Removes a registered passkey from the authenticated user's account.\n * If the user has TOTP 2FA enabled, a valid TOTP code must be provided.\n * Requires authentication.\n \n @param passkeyId - Passkey ID to delete\n * @param data - Optional request body with TOTP code for 2FA verification\n * @param options - Optional request options\n * @returns Success response\n /\n async deletePasskey(\n passkeyId: string,\n data?: Types.DeletePasskeyRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/passkeys/${encodeURIComponent(passkeyId)}`,\n data,\n options\n );\n }\n\n // ============================================================================\n // Google OAuth - Public Endpoints\n // ============================================================================\n\n /\n Get Google OAuth authorization URL and its CSRF state.\n \n Returns `{ url, state }`. Redirect the user to `url`, and keep `state` —\n * `handleGoogleOAuthCallback` requires it. When the client was constructed\n * with an `oauthStateStore`, the state is persisted here automatically.\n \n @param params - Query parameters including redirect_uri\n * @param options - Optional request options\n * @returns The authorization URL and the single-use state to round-trip\n /\n async getGoogleOAuthURL(\n params: { redirect_uri: string },\n options?: RequestOptions\n ): Promise<Types.GoogleOAuthURLResponse> {\n const queryParams = new URLSearchParams({ redirect_uri: params.redirect_uri });\n const response = await this.get<Types.GoogleOAuthURLResponse>(\n `/oauth/google/url?${queryParams.toString()}`,\n this.publicOptions(options)\n );\n\n // Persist before the caller redirects. Done here rather than left to the\n // caller because \"remember to store this across a full-page redirect\" is\n // exactly the step whose omission made this flow exploitable.\n if (this.oauthStateStore && response.state) {\n this.oauthStateStore.save(response.state);\n }\n\n return response;\n }\n\n /\n Handle Google OAuth callback\n \n Exchanges the Google OAuth authorization code for access tokens.\n * Creates a new user if one doesn't exist with the Google email.\n \n The `state` from `getGoogleOAuthURL` is required: the server validates\n * it before exchanging the code, and rejects a mismatch, absence, expiry or\n * reuse. See {@link Types.GoogleOAuthCallbackRequest.state}.\n \n @param data - OAuth callback data: code, redirect_uri and state\n * @param options - Optional request options\n * @returns Access and refresh tokens\n * @throws {MPFValidationError} If `state` is missing or empty (client-side).\n /\n async handleGoogleOAuthCallback(\n data: Types.GoogleOAuthCallbackRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n // Fail here rather than sending a request the server must reject. A caller\n // reaching this with no state has lost the pending flow (wrong tab, cleared\n // storage, or a hand-rolled callback that dropped it) and the local error\n // names the cause; a server-side rejection would not.\n if (typeof data.state !== 'string' \|\| data.state === '') {\n throw new MPFValidationError(\n 'OAuth callback requires the `state` returned by getGoogleOAuthURL. ' +\n 'It is the CSRF defence for this flow: without it a callback carrying ' +\n \"an attacker's authorization code would be accepted. Persist it across \" +\n 'the redirect with createOAuthStateStore().',\n { field: 'state' },\n { state: ['state is required'] }\n );\n }\n\n return this.post<Types.AccessDataResponse>(\n '/oauth/google/callback',\n data,\n this.publicOptions(options)\n );\n }\n}\n","import type { MPFRole } from '../auth/claims-types.js';\n\n// NOTE: deliberately NOT re-exported (`export type { MPFRole }`).\n//\n// This module is namespace-re-exported from the root barrel as `AuthTypes`, and\n// tsup's declaration bundler mis-compiles a type re-export in that position: it\n// emitted `declare const types_MPFRole: typeof MPFRole;` — a value* declaration\n// for a type — which makes the shipped .d.ts fail to compile with\n// `TS2693: 'MPFRole' only refers to a type, but is being used as a value here`.\n//\n// Invisible in this repo because our tsconfig sets `skipLibCheck: true`; a\n// consumer building with `skipLibCheck: false` gets a hard error. Found by\n// typechecking the packed tarball from outside the workspace.\n//\n// `MPFRole` is still exported from the root barrel and from the `/auth` subpath\n// via `src/auth/claims-types.ts`, which is where it belongs.\n\n/*\n Roles accepted when WRITING a membership (inviting a member, updating a\n * role).\n \n Closed on purpose, and only here: on a request, autocomplete earns its keep\n * and an unknown role is a client bug worth catching at compile time.\n \n On RESPONSES the role is {@link MPFRole} (= `string`) instead. Roles are\n * database rows (`identity.tenant_membership_valid_roles`), so closing the union\n * on server output means a newly seeded role forces an SDK release — and it is\n * exactly how the fictional `'viewer'` role ended up in these types in five\n * places while the DB actually seeds `guest`.\n /\nexport type MPFTenantRoleInput = 'owner' \| 'admin' \| 'member' \| 'guest';\n\n// ============================================================================\n// Request Types\n// ============================================================================\n\n/\n Request body for user registration\n /\nexport interface CreateUserRequest {\n /* User's email address /\n email: string;\n /* User's password (minimum 8 characters) /\n password: string;\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n}\n\n/\n Request body for user login\n /\nexport interface LoginRequest {\n /* User's email address /\n email: string;\n /* User's password /\n password: string;\n}\n\n/\n Request body for profile update\n /\nexport interface UpdateProfileRequest {\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n /* Custom user metadata /\n metadata?: Record<string, unknown>;\n}\n\n/\n Request body for adding an email\n /\nexport interface AddEmailRequest {\n /* Email address to add /\n email: string;\n}\n\n/\n Request body for adding a phone number\n /\nexport interface AddPhoneRequest {\n /* Phone number in E.164 format /\n phone_number: string;\n}\n\n/\n Request body for verifying email or phone\n /\nexport interface VerifyContactRequest {\n /* 6-digit verification code /\n code: string;\n}\n\n/\n Request body for sending password recovery code\n /\nexport interface SendRecoveryCodeRequest {\n /* User's email address /\n email: string;\n}\n\n/\n Request body for verifying recovery code\n /\nexport interface VerifyRecoveryCodeRequest {\n /* User's email address /\n email: string;\n /* 6-digit verification code /\n verification_code: string;\n}\n\n/\n Request body for password reset\n /\nexport interface ResetPasswordRequest {\n /* Recovery token obtained from verification step /\n recovery_token: string;\n /* New password to set (minimum 8 characters) /\n new_password: string;\n}\n\n/\n Request body for authenticated password update\n /\nexport interface UpdatePasswordRequest {\n /* Current password for verification /\n current_password: string;\n /* New password to set (minimum 8 characters) /\n new_password: string;\n}\n\n/\n Request body for session renewal\n /\nexport interface RenewSessionRequest {\n /* The refresh token from the current session /\n refresh_token: string;\n}\n\n/\n Request body for session revocation\n /\nexport interface RevokeSessionRequest {\n /* The refresh token of the session to revoke /\n refresh_token: string;\n}\n\n/\n Request body for tenant creation\n /\nexport interface CreateTenantRequest {\n /* Name of the tenant organization /\n name: string;\n /* URL-friendly slug (auto-generated from name if omitted) /\n slug?: string;\n /* Optional description of the tenant /\n description?: string;\n}\n\n/\n Request body for inviting a member\n /\nexport interface InviteMemberRequest {\n /* Email address of the person to invite /\n email: string;\n /* Role to assign to the invited member /\n role: MPFTenantRoleInput;\n /\n Optional override for the configured accept URL template. The literal\n * \"{token}\" is replaced with the invitation token.\n /\n accept_url_template?: string;\n}\n\n/\n Result of POST /tenants/{id}/members/invite.\n /\nexport interface InvitationResponse {\n invitation_id: string;\n invite_token: string;\n /* Copyable URL the invitee can use; safe fallback if email delivery fails. /\n accept_url: string;\n email: string;\n role: string;\n expires_at: string;\n /* True when no existing user matches the invited email. /\n is_new_user: boolean;\n /* True when the invitation email was successfully dispatched. /\n email_sent: boolean;\n /* Legacy field. Always empty in the new invitation flow. /\n membership_id?: string;\n}\n\n/\n Public, pre-auth view of an invitation. Email is intentionally omitted.\n /\nexport interface InvitationPreviewResponse {\n tenant_id: string;\n tenant_name: string;\n tenant_slug?: string;\n role: string;\n inviter_display_name?: string;\n expires_at: string;\n /* True when the invitee has no verified account yet. /\n requires_signup: boolean;\n}\n\n/\n Result of POST /invitations/{token}/accept.\n /\nexport interface AcceptInvitationResponse {\n invitation_id: string;\n tenant_id: string;\n role: string;\n membership_id: string;\n accepted_at: string;\n}\n\n/\n Request body for updating member role\n /\nexport interface UpdateMemberRoleRequest {\n /* New role for the member /\n role: MPFTenantRoleInput;\n}\n\n// ============================================================================\n// TOTP (Two-Factor Authentication) Types\n// ============================================================================\n\n/\n Request body for verifying a TOTP code\n /\nexport interface VerifyTOTPRequest {\n /* 6-digit TOTP code from authenticator app /\n code: string;\n}\n\n/\n Request body for disabling TOTP\n /\nexport interface DisableTOTPRequest {\n /* 6-digit TOTP code to confirm disable /\n code: string;\n}\n\n/\n Request body for deleting a passkey (optional, required when user has TOTP 2FA enabled)\n /\nexport interface DeletePasskeyRequest {\n /* 6-digit TOTP code from authenticator app /\n totp_code?: string;\n}\n\n// ============================================================================\n// Passkey / WebAuthn Types\n// ============================================================================\n\n/* WebAuthn credential descriptor as serialized by the API /\nexport interface WebAuthnCredentialDescriptor {\n type: string;\n id: string;\n transports?: string[];\n}\n\n/* WebAuthn creation options as serialized by the API (base64url strings, not ArrayBuffers) /\nexport interface WebAuthnCreationOptions {\n rp: { id: string; name: string };\n user: { id: string; name: string; displayName: string };\n challenge: string;\n pubKeyCredParams: Array<{ type: string; alg: number }>;\n timeout?: number;\n excludeCredentials?: WebAuthnCredentialDescriptor[];\n authenticatorSelection?: {\n authenticatorAttachment?: string;\n residentKey?: string;\n requireResidentKey?: boolean;\n userVerification?: string;\n };\n attestation?: string;\n hints?: string[];\n extensions?: Record<string, unknown>;\n}\n\n/* WebAuthn request options as serialized by the API (base64url strings, not ArrayBuffers) /\nexport interface WebAuthnRequestOptions {\n challenge: string;\n rpId?: string;\n timeout?: number;\n allowCredentials?: WebAuthnCredentialDescriptor[];\n userVerification?: string;\n hints?: string[];\n extensions?: Record<string, unknown>;\n}\n\n/* Encoded credential sent back to the server after navigator.credentials.create/get /\nexport interface WebAuthnEncodedCredential {\n id: string;\n rawId: string;\n type: string;\n response: {\n clientDataJSON: string;\n attestationObject?: string;\n authenticatorData?: string;\n signature?: string;\n userHandle?: string \| null;\n };\n}\n\n/\n Request body for completing passkey registration\n /\nexport interface FinishPasskeyRegistrationRequest {\n /* Raw WebAuthn credential from navigator.credentials.create() /\n credential: WebAuthnEncodedCredential;\n /* Optional human-readable name for the passkey /\n name?: string;\n}\n\n/\n Request body for completing passkey login\n /\nexport interface FinishPasskeyLoginRequest {\n /* Raw WebAuthn credential from navigator.credentials.get() /\n credential: WebAuthnEncodedCredential;\n /* Session key returned from begin login /\n session_key: string;\n}\n\n// ============================================================================\n// Google OAuth Types\n// ============================================================================\n\n/\n Request body for Google OAuth callback\n /\nexport interface GoogleOAuthCallbackRequest {\n /* Authorization code from Google /\n code: string;\n /* Redirect URI used in the initial auth request /\n redirect_uri: string;\n /\n The `state` returned by `getGoogleOAuthURL`, round-tripped through the\n * redirect.\n \n Required, and required for a reason. It is the CSRF defence for this\n * flow: the server validates it before exchanging the code, so a callback\n * carrying an attacker's `code` but not the victim's `state` is rejected.\n * Without it, an attacker can sign a victim into the attacker's own account —\n * confirmed exploitable, not hypothetical.\n \n Persist it across the redirect with `createOAuthStateStore()` (web storage:\n * a full-page redirect discards anything held in memory).\n /\n state: string;\n}\n\n// ============================================================================\n// Response Types\n// ============================================================================\n\n/\n Response containing access and refresh tokens\n /\nexport interface AccessDataResponse {\n /* JWT access token for API authentication /\n access_token: string;\n /* Refresh token for session renewal /\n refresh_token: string;\n}\n\n/\n User profile information\n /\nexport interface UserProfileResponse {\n /* User's unique identifier /\n id: string;\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n /* User's avatar URL /\n avatar_url?: string;\n /* User's email addresses /\n emails: EmailResponse[];\n /* User's phone numbers /\n phones: PhoneResponse[];\n}\n\n/\n Email address information\n /\nexport interface EmailResponse {\n /* Email's unique identifier /\n id: string;\n /* Email address /\n email: string;\n /* Whether this is the primary email /\n is_primary: boolean;\n /* When the email was verified (ISO 8601), undefined if not verified /\n verified_at?: string;\n}\n\n/\n Phone number information\n /\nexport interface PhoneResponse {\n /* Phone's unique identifier /\n id: string;\n /* Phone number in E.164 format /\n phone_number: string;\n /* Whether this is the primary phone /\n is_primary: boolean;\n /* When the phone was verified (ISO 8601), undefined if not verified /\n verified_at?: string;\n}\n\n/\n Session client information\n /\nexport interface SessionClientInfo {\n /* Client name /\n name?: string;\n /* Client user agent string /\n user_agent?: string;\n /* Client IP address /\n ip_address?: string;\n /* When the client was last seen (ISO 8601) /\n last_seen_at?: string;\n}\n\n/\n Session information\n /\nexport interface SessionResponse {\n /* Session's unique identifier /\n id: string;\n /* Client ID associated with the session /\n client_id: string;\n /* Client information /\n client?: SessionClientInfo;\n /* When the session expires (ISO 8601) /\n expires_at: string;\n /* When the session was created (ISO 8601) /\n created_at: string;\n /* Whether this is the current session /\n is_current: boolean;\n}\n\n/\n OAuth client information\n /\nexport interface ClientResponse {\n /* Client's unique identifier /\n id: string;\n /* Client name /\n name?: string;\n /* Client user agent string /\n user_agent?: string;\n /* Client IP address /\n ip_address?: string;\n /* When the client was last seen (ISO 8601) /\n last_seen_at?: string;\n}\n\n/\n Tenant information\n /\nexport interface TenantResponse {\n /* Tenant's unique identifier /\n id: string;\n /* Tenant name /\n name: string;\n /* Tenant description /\n description?: string;\n /* Tenant slug (URL-friendly identifier) /\n slug?: string;\n /* When the tenant was created (ISO 8601) /\n created_at: string;\n}\n\n/\n Tenant membership information\n /\nexport interface MembershipResponse {\n /* Membership unique identifier /\n id: string;\n /* User's unique identifier /\n user_id: string;\n /* Member's role in the tenant /\n role: MPFRole;\n /* When the member was invited (ISO 8601) /\n invited_at?: string;\n /* When the invitation was accepted (ISO 8601) /\n accepted_at?: string;\n /* Member's display name /\n display_name?: string;\n /* Member's email address /\n email?: string;\n}\n\n/\n Response containing recovery token\n /\nexport interface RecoveryTokenResponse {\n /* Token to use for password reset /\n recovery_token: string;\n}\n\n/\n Simple success response\n /\nexport interface SuccessResponse {\n /* Indicates if the operation was successful /\n success: boolean;\n}\n\n/\n Error response from the API\n /\nexport interface ErrorResponse {\n /* Human-readable error message /\n error: string;\n /* Machine-readable error code /\n code?: string;\n /* Additional error details (validation errors, etc.) /\n details?: unknown;\n}\n\n/\n Validation error detail for a specific field\n /\nexport interface ValidationErrorDetail {\n /* Name of the field with validation error /\n field: string;\n /* Validation error message /\n message: string;\n}\n\n/\n Service health status response\n /\nexport interface HealthResponse {\n /* Health status /\n status: string;\n /* Service name /\n service: string;\n /* Current server timestamp (ISO 8601) /\n timestamp: string;\n}\n\n// ============================================================================\n// TOTP Response Types\n// ============================================================================\n\n/\n Response from TOTP setup containing secret and backup codes\n /\nexport interface TOTPSetupResponse {\n /* TOTP secret key for manual entry /\n secret: string;\n /* otpauth:// URL for QR code generation /\n qr_url: string;\n /* One-time backup codes for account recovery /\n backup_codes: string[];\n}\n\n// ============================================================================\n// Passkey Response Types\n// ============================================================================\n\n/\n Response from begin passkey registration\n /\nexport interface BeginPasskeyRegistrationResponse {\n /* WebAuthn PublicKeyCredentialCreationOptions /\n options: WebAuthnCreationOptions;\n}\n\n/\n Response from begin passkey login\n /\nexport interface BeginPasskeyLoginResponse {\n /* WebAuthn PublicKeyCredentialRequestOptions /\n options: WebAuthnRequestOptions;\n /* Session key to pass back in finish login /\n session_key: string;\n}\n\n/\n Passkey credential information\n /\nexport interface PasskeyResponse {\n /* Passkey's unique identifier /\n id: string;\n /* Human-readable name for the passkey /\n name?: string;\n /* When the passkey was registered (ISO 8601) /\n created_at: string;\n /* When the passkey was last used (ISO 8601) /\n last_used_at?: string;\n}\n\n// ============================================================================\n// OAuth Response Types\n// ============================================================================\n\n/\n A pending invitation for the current user\n /\nexport interface PendingInvitationResponse {\n /* Invitation/membership ID /\n id: string;\n /* Tenant ID the invitation is for /\n tenant_id: string;\n /* Tenant name /\n tenant_name: string;\n /* Tenant slug /\n tenant_slug?: string;\n /* Role assigned in the invitation /\n role: MPFRole;\n /* User ID of the person who sent the invitation /\n invited_by: string;\n /* When the invitation was sent (ISO 8601) /\n invited_at: string;\n /* Invitation token for accepting /\n token: string;\n}\n\n/\n A pending invitation issued by the authenticated caller, returned by\n * GET /tenants/{id}/invitations.\n /\nexport interface IssuedInvitationResponse {\n /* Invitation ID /\n id: string;\n /* Tenant the invitation was issued for /\n tenant_id: string;\n /* Email the invitation was sent to /\n email: string;\n /* Role the invitee will receive on accept /\n role: MPFRole;\n /* User ID of the inviter (always the authenticated caller) /\n invited_by: string;\n /* When the invitation was sent (ISO 8601) /\n invited_at: string;\n /* Expiration time (ISO 8601) /\n expires_at: string;\n /* Raw token. Most callers should use accept_url instead. /\n token: string;\n /\n Copyable URL the invitee can paste into a browser. Empty if the server\n * has no accept-URL template configured.\n /\n accept_url: string;\n /* Display name of the invitee, if they already have an account /\n display_name?: string;\n}\n\n/\n Response containing Google OAuth authorization URL\n /\nexport interface GoogleOAuthURLResponse {\n /* Full Google OAuth authorization URL to redirect user to /\n url: string;\n /\n Single-use CSRF state minted and recorded by the server.\n \n Persist this before redirecting and send it back on\n * `handleGoogleOAuthCallback`. Dropping it makes the callback trivially\n * forgeable — see {@link GoogleOAuthCallbackRequest.state}.\n /\n state: string;\n}\n\n// ============================================================================\n// List Wrapper Response Types\n// ============================================================================\n\n/\n Wrapper response for email list\n /\nexport interface EmailsResponse {\n emails: EmailResponse[];\n}\n\n/\n Wrapper response for phone list\n /\nexport interface PhonesResponse {\n phones: PhoneResponse[];\n}\n\n/\n Wrapper response for session list\n /\nexport interface SessionsResponse {\n sessions: SessionResponse[];\n}\n\n/\n Wrapper response for passkey list\n /\nexport interface PasskeysResponse {\n passkeys: PasskeyResponse[];\n}\n\n/\n Wrapper response for client list\n /\nexport interface ClientsResponse {\n clients: ClientResponse[];\n}\n\n/\n Wrapper response for member list\n /\nexport interface MembersResponse {\n members: MembershipResponse[];\n}\n\n/\n Wrapper response for pending-invitations-issued-by-caller list\n /\nexport interface IssuedInvitationsResponse {\n invitations: IssuedInvitationResponse[];\n}\n\n// ============================================================================\n// MFA Response Types\n// ============================================================================\n\n/\n Returned when MFA verification is needed to complete login\n /\nexport interface MFARequiredResponse {\n /* Always true for this response type /\n mfa_required: true;\n /* Short-lived JWT ticket for MFA verification /\n mfa_ticket: string;\n /* Available MFA methods (e.g., [\"totp\"]) /\n mfa_methods: string[];\n}\n\n/\n Returned when MFA setup is enforced and user hasn't set up TOTP yet\n /\nexport interface MFASetupRequiredResponse {\n /* Always true for this response type /\n mfa_setup_required: true;\n /* Short-lived JWT ticket for MFA setup verification /\n mfa_ticket: string;\n /* TOTP setup data including secret and QR code /\n totp_setup: TOTPSetupResponse;\n}\n\n/\n Union type for all possible login responses\n /\nexport type LoginResponse = AccessDataResponse \| MFARequiredResponse \| MFASetupRequiredResponse;\n\n/\n Type guard to check if login response requires MFA verification\n /\nexport function isMFARequired(response: LoginResponse): response is MFARequiredResponse {\n return 'mfa_required' in response && response.mfa_required === true;\n}\n\n/\n Type guard to check if login response requires MFA setup\n /\nexport function isMFASetupRequired(response: LoginResponse): response is MFASetupRequiredResponse {\n return 'mfa_setup_required' in response && response.mfa_setup_required === true;\n}\n\n// ============================================================================\n// MFA Request Types\n// ============================================================================\n\n/\n Request body for verifying MFA during login\n /\nexport interface MFAVerifyRequest {\n /* MFA ticket from login response /\n mfa_ticket: string;\n /* 6-digit TOTP code from authenticator app /\n totp_code: string;\n}\n\n/\n Request body for verifying MFA setup during first-time enrollment\n /\nexport interface MFASetupVerifyRequest {\n /* MFA ticket from login response /\n mfa_ticket: string;\n /* 6-digit TOTP code to verify setup */\n code: string;\n}\n"]}
1	+ {"version":3,"sources":["../src/identity/index.ts","../src/identity/v0.ts","../src/identity/types.ts"],"names":[],"mappings":";;;;;AAAA,IAAA,gBAAA,GAAA;AAAA,QAAA,CAAA,gBAAA,EAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,iBAAA,EAAA,MAAA,iBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,kBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;AC2BO,IAAM,YAAA,GAAN,cAA2B,SAAA,CAAU;AAAA;AAAA,EAEzB,eAAA;AAAA,EAEjB,YAAY,MAAA,EAA4B;AACtC,IAAA,MAAM,EAAE,eAAA,EAAiB,GAAG,YAAA,EAAa,GAAI,MAAA;AAC7C,IAAA,KAAA,CAAM;AAAA,MACJ,GAAG,YAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,YAAA,CAAa,OAAO,CAAA,GAAA;AAAA,KACjC,CAAA;AACD,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,OAAA,EAA0C;AAC9D,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,IAAA,EAAK;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,mBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,MAAM,WAAA,GAAc;AAAA,MAClB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,GAAI,KAAK,UAAA,GAAa,EAAE,YAAY,IAAA,CAAK,UAAA,KAAe,EAAC;AAAA,MACzD,GAAI,KAAK,SAAA,GAAY,EAAE,WAAW,IAAA,CAAK,SAAA,KAAc,EAAC;AAAA,MACtD,GAAI,KAAK,YAAA,GAAe,EAAE,cAAc,IAAA,CAAK,YAAA,KAAiB;AAAC,KACjE;AACA,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,yBAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,mBAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,yBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,SAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,aAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,mBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,uBAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,6BAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,kBAAA,CACJ,IAAA,EACA,OAAA,EACsC;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,2BAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,iBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,YAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,iBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,kBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,kBACJ,OAAA,EAC4C;AAC5C,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MACV,uBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAA,CACJ,KAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MACzC,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,gBAAA,CACJ,KAAA,EACA,OAAA,EACyC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,KAAK,CAAC,CAAA,OAAA,CAAA;AAAA,MACzC,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,gBAAA,CACJ,YAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,aAAA,EAAgB,kBAAA,CAAmB,YAAY,CAAC,CAAA,CAAA;AAAA,MAChD;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,YAAY,OAAA,EAAyD;AACzE,IAAA,OAAO,KAAK,GAAA,CAA0B,UAAA,EAAY,IAAA,CAAK,aAAA,CAAc,OAAO,CAAC,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,MAAM,OAAA,EAA8D;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAA+B,WAAA,EAAa,OAAO,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,KAAA,CAA6B,WAAA,EAAa,IAAA,EAAM,OAAO,CAAA;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAAW,OAAA,EAA0D;AACzE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA0B,oBAAoB,OAAO,CAAA;AACjF,IAAA,OAAO,QAAA,CAAS,MAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA0B,kBAAA,EAAoB,IAAA,EAAM,OAAO,CAAA;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,YAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,sBACJ,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,0BAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAAW,OAAA,EAA0D;AACzE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA0B,oBAAoB,OAAO,CAAA;AACjF,IAAA,OAAO,QAAA,CAAS,MAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAA,CACJ,IAAA,EACA,OAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA0B,kBAAA,EAAoB,IAAA,EAAM,OAAO,CAAA;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAA,CACJ,OAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,iBAAA,EAAoB,kBAAA,CAAmB,OAAO,CAAC,CAAA,YAAA,CAAA;AAAA,MAC/C,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aACJ,OAAA,EACkC;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA4B,sBAAsB,OAAO,CAAA;AACrF,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CACJ,SAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,mBAAA,EAAsB,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MACnD,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,YAAY,OAAA,EAA2D;AAC3E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA2B,qBAAqB,OAAO,CAAA;AACnF,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,YAAA,CACJ,QAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAA;AAAA,MACjD,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,cAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,kBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YAAA,CACJ,IAAA,EACA,OAAA,EAC+B;AAC/B,IAAA,OAAO,IAAA,CAAK,IAAA,CAA2B,UAAA,EAAY,IAAA,EAAM,OAAO,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,cACJ,OAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAA4B,mBAAA,EAAqB,OAAO,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,iBAAA,CACJ,QAAA,EACA,OAAA,EACqC;AACrC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,CAAA;AAAA,MACxC;AAAA,KACF;AACA,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,kBAAA,CACJ,QAAA,EACA,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,eAAA,CAAA;AAAA,MACxC,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,+BAAA,CACJ,QAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,YAAA,CAAA;AAAA,MACxC;AAAA,KACF;AACA,IAAA,OAAO,QAAA,CAAS,WAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,sBAAA,CACJ,QAAA,EACA,MAAA,EACA,MACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACV,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,SAAA,EAAY,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC9E,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,kBAAA,CACJ,QAAA,EACA,MAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,SAAA,EAAY,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC9E,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,UACJ,OAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,aAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA,CAA4B,cAAA,EAAgB,IAAA,EAAM,OAAO,CAAA;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,WAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA,CAA4B,eAAA,EAAiB,IAAA,EAAM,OAAO,CAAA;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,kBACJ,OAAA,EAC0C;AAC1C,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,sBAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAEA,IAAA,MAAM,MAAM,QAAA,CAAS,OAAA;AACrB,IAAA,MAAM,IAAA,GAAQ,WAAA,IAAe,GAAA,GAAM,GAAA,CAAI,SAAA,GAAY,GAAA;AACnD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,WAAA,EAAa,QAAA,CAAS,eAAe,EAAA,EAAG;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,kBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,uBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,yBACJ,OAAA,EACiD;AACjD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,0BAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,MAAM,QAAA,CAAS,OAAA;AACrB,IAAA,MAAM,IAAA,GAAQ,WAAA,IAAe,GAAA,GAAM,GAAA,CAAI,SAAA,GAAY,GAAA;AACnD,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,yBAAA,CACJ,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,2BAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aACJ,OAAA,EACkC;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAA4B,aAAa,OAAO,CAAA;AAC5E,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,aAAA,CACJ,SAAA,EACA,IAAA,EACA,OAAA,EACgC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAA,UAAA,EAAa,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,iBAAA,CACJ,MAAA,EACA,OAAA,EACuC;AACvC,IAAA,MAAM,cAAc,IAAI,eAAA,CAAgB,EAAE,YAAA,EAAc,MAAA,CAAO,cAAc,CAAA;AAC7E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA,kBAAA,EAAqB,WAAA,CAAY,QAAA,EAAU,CAAA,CAAA;AAAA,MAC3C,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAKA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,QAAA,CAAS,KAAA,EAAO;AAC1C,MAAA,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,yBAAA,CACJ,IAAA,EACA,OAAA,EACmC;AAKnC,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,IAAA,CAAK,UAAU,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,0PAAA;AAAA,QAIA,EAAE,OAAO,OAAA,EAAQ;AAAA,QACjB,EAAE,KAAA,EAAO,CAAC,mBAAmB,CAAA;AAAE,OACjC;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MACV,wBAAA;AAAA,MACA,IAAA;AAAA,MACA,IAAA,CAAK,cAAc,OAAO;AAAA,KAC5B;AAAA,EACF;AACF;;;AC1WO,SAAS,cAAc,QAAA,EAA0D;AACtF,EAAA,OAAO,cAAA,IAAkB,QAAA,IAAY,QAAA,CAAS,YAAA,KAAiB,IAAA;AACjE;AAKO,SAAS,mBAAmB,QAAA,EAA+D;AAChG,EAAA,OAAO,oBAAA,IAAwB,QAAA,IAAY,QAAA,CAAS,kBAAA,KAAuB,IAAA;AAC7E;;;AFjsBA,IAAM,yBAAA,GAA4B;AAAA,EAChC,yBAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA,uBAAA;AAAA,EACA,wBAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAEO,SAAS,iBAAiB,OAAA,EAA0C;AACzE,EAAA,MAAM,EAAE,aAAA,EAAe,iBAAA,EAAmB,cAAA,EAAgB,GAAG,cAAa,GAAI,OAAA;AAC9E,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,YAAY,CAAA;AAE5C,EAAA,yBAAA,CAA0B,MAAA,EAAQ,EAAE,aAAA,EAAe,cAAA,EAAgB,CAAA;AAEnE,EAAA,IAAI,iBAAA,EAAmB;AACrB,IAAA,MAAA,CAAO,IAAI,yBAAA,CAA0B;AAAA,MACnC,UAAU,iBAAA,CAAkB,QAAA;AAAA,MAC5B,cAAA,EAAgB;AAAA,KACjB,CAAC,CAAA;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACT;AA+CO,SAAS,kBAAkB,OAAA,EAA2C;AAC3E,EAAA,MAAM,EAAE,KAAA,EAAO,GAAG,YAAA,EAAa,GAAI,OAAA;AACnC,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAa,YAAY,CAAA;AAC5C,EAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,CAA0B,KAAK,CAAC,CAAA;AAC3C,EAAA,OAAO,MAAA;AACT","file":"chunk-N73TORHR.js","sourcesContent":["import type { ClientConfig, TokenProvider } from '../client/core/types.js';\nimport { attachStandardMiddlewares } from '../client/core/client-factory.js';\nimport { createTurnstileMiddleware } from '../client/middlewares/turnstile.js';\nimport {\n createAdminAuthMiddleware,\n type AdminAuthMiddlewareOptions,\n} from '../client/middlewares/admin-auth.js';\nimport type { TenantSelectionStore } from '../auth/tenant-selection.js';\nimport type { OAuthStateStore } from '../auth/oauth-state.js';\nimport { AuthClientV0 } from './v0.js';\n\n/*\n Provider for minting single-use Cloudflare Turnstile tokens.\n /\nexport interface TurnstileProvider {\n /* Mint a fresh single-use Turnstile token. /\n getToken: () => Promise<string>;\n}\n\n/\n Configuration options for the Auth client\n /\nexport interface AuthClientOptions extends Omit<ClientConfig, 'baseUrl'> {\n /\n Base URL for the Auth service\n /\n baseUrl: string;\n /* Optional token provider. Auto-wires auth middleware when provided. /\n tokenProvider?: TokenProvider;\n /* Optional Turnstile token provider for bot protection. /\n turnstileProvider?: TurnstileProvider;\n /\n Optional shared tenant selection. When provided, every request carries the\n * selected tenant headers. Construct it with `createTenantSelection()` and\n * share the same instance across identity/storage/graphql clients.\n /\n tenantProvider?: TenantSelectionStore;\n /\n Optional store for the OAuth CSRF state. When provided,\n * `getGoogleOAuthURL` persists the minted state so it survives the redirect.\n * Build one with `createOAuthStateStore()`.\n /\n oauthStateStore?: OAuthStateStore;\n}\n\n/\n Creates an Auth client for API v0\n \n @param options - Client configuration options\n * @returns AuthClientV0 instance\n \n @example\n * ```typescript\n * import { createAuthClient } from '@mosano-product-framework/sdk/identity';\n \n // Create client without authentication (for public endpoints)\n * const auth = createAuthClient({\n * baseUrl: 'https://api.example.com/auth',\n * });\n \n // Register a new user\n * const { access_token, refresh_token } = await auth.signUpEmailPassword({\n * name: 'John Doe',\n * email: 'john@example.com',\n * password: 'securePassword123',\n * });\n \n // Create authenticated client with token provider\n * const authenticatedAuth = createAuthClient({\n * baseUrl: 'https://api.example.com/auth',\n * tokenProvider: {\n * getAccessToken: () => localStorage.getItem('accessToken'),\n * onTokenExpired: () => { window.location.href = '/login'; },\n * },\n * });\n \n // Get user profile\n * const profile = await authenticatedAuth.getMe();\n * ```\n /\n/\n SDK endpoint paths that require a Turnstile token.\n * Must match the go-identity routes with turnstile.Verify() middleware.\n /\nconst TURNSTILE_PROTECTED_PATHS = [\n '/sign-up-email-password',\n '/sign-in-email-password',\n '/forgot-password-with-email',\n '/password/recovery/verify',\n '/password/reset',\n '/passkey/login/begin',\n '/passkey/login/finish',\n '/oauth/google/callback',\n '/accept', // matches /invitations/{token}/accept\n '/invite', // matches /tenants/{id}/members/invite\n];\n\nexport function createAuthClient(options: AuthClientOptions): AuthClientV0 {\n const { tokenProvider, turnstileProvider, tenantProvider, ...clientConfig } = options;\n const client = new AuthClientV0(clientConfig);\n\n attachStandardMiddlewares(client, { tokenProvider, tenantProvider });\n\n if (turnstileProvider) {\n client.use(createTurnstileMiddleware({\n getToken: turnstileProvider.getToken,\n protectedPaths: TURNSTILE_PROTECTED_PATHS,\n }));\n }\n\n return client;\n}\n\n/\n Configuration options for an admin-authenticated Auth client.\n \n SECURITY: Admin authentication uses the shared `ADMIN_JWT_SECRET`, which can\n * impersonate any user. Only construct an admin client server-side / in trusted\n * services. NEVER ship the secret to a browser.\n /\nexport interface AdminClientOptions extends Omit<ClientConfig, 'baseUrl'> {\n /* Base URL for the Auth service. /\n baseUrl: string;\n /* Admin auth options: either a pre-minted `token` or a minting `config`. /\n admin: AdminAuthMiddlewareOptions;\n}\n\n/\n Creates an admin-authenticated Auth client for API v0.\n \n The returned client sends `Authorization: Admin <jwt>` on every request,\n * acting on behalf of the configured principal. Mirrors {@link createAuthClient}\n * but wires the admin auth middleware instead of the Bearer one.\n \n SECURITY: Requires the shared `ADMIN_JWT_SECRET` (when using a minting\n * `config`). Server-side / trusted-service use ONLY — never expose the secret\n * to a browser.\n \n @param options - Client configuration options.\n * @returns AuthClientV0 instance authenticated as an admin.\n \n @example\n * ```typescript\n * import { createAdminClient } from '@mosano-product-framework/sdk/identity';\n \n // Mint a fresh admin token per request (server-side only).\n * const admin = createAdminClient({\n * baseUrl: 'https://api.example.com/auth',\n * admin: {\n * config: {\n * secret: process.env.ADMIN_JWT_SECRET!,\n * actOnBehalfOf: { userId, onTenantId: tenantId },\n * ttlSeconds: 60,\n * },\n * },\n * });\n * ```\n /\nexport function createAdminClient(options: AdminClientOptions): AuthClientV0 {\n const { admin, ...clientConfig } = options;\n const client = new AuthClientV0(clientConfig);\n client.use(createAdminAuthMiddleware(admin));\n return client;\n}\n\nexport { AuthClientV0, type AuthClientV0Config } from './v0.js';\nexport from './types.js';\n","import { MPFClient } from '../client/core/client.js';\nimport type { ClientConfig, RequestOptions } from '../client/core/types.js';\nimport { MPFValidationError } from '../client/core/errors.js';\nimport type { OAuthStateStore } from '../auth/oauth-state.js';\nimport type * as Types from './types.js';\n\n/*\n Configuration for the identity client.\n /\nexport interface AuthClientV0Config extends ClientConfig {\n /\n Optional store for the OAuth CSRF state. When provided,\n * `getGoogleOAuthURL` persists the minted state automatically so it survives\n * the redirect.\n \n Sending it back stays explicit — `GoogleOAuthCallbackRequest.state` is\n * required — because a security parameter should not be injected invisibly.\n /\n oauthStateStore?: OAuthStateStore;\n}\n\n/\n Auth API v0 client\n \n Provides methods for authentication, user management, sessions,\n * password recovery, and multi-tenant operations.\n /\nexport class AuthClientV0 extends MPFClient {\n /* Optional OAuth state store; see {@link AuthClientV0Config.oauthStateStore}. /\n private readonly oauthStateStore?: OAuthStateStore;\n\n constructor(config: AuthClientV0Config) {\n const { oauthStateStore, ...clientConfig } = config;\n super({\n ...clientConfig,\n baseUrl: `${clientConfig.baseUrl}/v0`,\n });\n this.oauthStateStore = oauthStateStore;\n }\n\n /\n Wraps request options with skipAuth: true for public endpoints\n * that do not require authentication headers.\n /\n private publicOptions(options?: RequestOptions): RequestOptions {\n return { ...options, skipAuth: true };\n }\n\n // ============================================================================\n // Public Endpoints - Authentication\n // ============================================================================\n\n /\n Register a new user with email and password\n \n Creates a new user account and returns access and refresh tokens.\n \n @param data - User registration data\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async signUpEmailPassword(\n data: Types.CreateUserRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n const cleanedData = {\n email: data.email,\n password: data.password,\n ...(data.first_name ? { first_name: data.first_name } : {}),\n ...(data.last_name ? { last_name: data.last_name } : {}),\n ...(data.display_name ? { display_name: data.display_name } : {}),\n };\n return this.post<Types.AccessDataResponse>(\n '/sign-up-email-password',\n cleanedData,\n this.publicOptions(options)\n );\n }\n\n /\n Login with email and password\n \n Authenticates a user and returns access and refresh tokens.\n \n @param data - Login credentials\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async signInEmailPassword(\n data: Types.LoginRequest,\n options?: RequestOptions\n ): Promise<Types.LoginResponse> {\n return this.post<Types.LoginResponse>(\n '/sign-in-email-password',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify MFA code to complete login\n \n After a login attempt returns mfa_required, submit the TOTP code\n * along with the MFA ticket to complete authentication.\n \n @param data - MFA ticket and TOTP code\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async verifyMFA(\n data: Types.MFAVerifyRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/mfa/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify MFA setup to complete first-time enrollment and login\n \n After a login attempt returns mfa_setup_required, verify the TOTP\n * setup by submitting a code from the authenticator app.\n \n @param data - MFA ticket and verification code\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async verifyMFASetup(\n data: Types.MFASetupVerifyRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/mfa/setup/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Public Endpoints - Password Recovery\n // ============================================================================\n\n /\n Send password recovery code to email\n \n Initiates the password recovery process by sending a verification code.\n \n @param data - Email address for recovery\n * @param options - Optional request options\n * @returns Success response\n /\n async forgotPasswordWithEmail(\n data: Types.SendRecoveryCodeRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/forgot-password-with-email',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Verify password recovery code\n \n Verifies the recovery code and returns a recovery token for password reset.\n \n @param data - Email and verification code\n * @param options - Optional request options\n * @returns Recovery token for password reset\n /\n async verifyRecoveryCode(\n data: Types.VerifyRecoveryCodeRequest,\n options?: RequestOptions\n ): Promise<Types.RecoveryTokenResponse> {\n return this.post<Types.RecoveryTokenResponse>(\n '/password/recovery/verify',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Reset password with recovery token\n \n Resets the user's password and returns new access and refresh tokens.\n \n @param data - Recovery token and new password\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async resetPassword(\n data: Types.ResetPasswordRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/password/reset',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Public Endpoints - Sessions\n // ============================================================================\n\n /\n Renew session with refresh token\n \n Exchanges a valid refresh token for new access and refresh tokens.\n \n Tenant is selected per request via the `X-MPF-Tenant` header, so a renewal\n * neither takes nor changes a tenant.\n \n @param data - Refresh token\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async renewSession(\n data: Types.RenewSessionRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/sessions/renew',\n data,\n this.publicOptions(options)\n );\n }\n\n /\n Revoke session (logout)\n \n Revokes the session associated with the provided refresh token.\n * Requires authentication.\n \n @param data - Refresh token to revoke\n * @param options - Optional request options\n * @returns Success response\n /\n async revokeSession(\n data: Types.RevokeSessionRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/sessions/revoke',\n data,\n options\n );\n }\n\n // ============================================================================\n // Public Endpoints - Invitations\n // ============================================================================\n\n /\n List pending invitations for the authenticated user\n \n Returns all pending invitations for the currently authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of pending invitations\n /\n async listMyInvitations(\n options?: RequestOptions\n ): Promise<Types.PendingInvitationResponse[]> {\n return this.get<Types.PendingInvitationResponse[]>(\n '/users/me/invitations',\n options\n );\n }\n\n /\n Preview an invitation (public, pre-auth).\n \n Returns the tenant, role, and inviter display name for the\n * invitation-acceptance page. Email is intentionally omitted. Use this\n * to render the accept page before the user signs in.\n \n @param token - Invitation token\n * @param options - Optional request options\n * @returns Public-safe invitation preview\n /\n async previewInvitation(\n token: string,\n options?: RequestOptions\n ): Promise<Types.InvitationPreviewResponse> {\n return this.get<Types.InvitationPreviewResponse>(\n `/invitations/${encodeURIComponent(token)}`,\n this.publicOptions(options)\n );\n }\n\n /\n Accept an invitation.\n \n Requires the user to be authenticated. The user's primary verified\n * email must match the invitation. Creates the membership row.\n \n @param token - Invitation token\n * @param options - Optional request options\n * @returns Acceptance result (invitation + new membership)\n /\n async acceptInvitation(\n token: string,\n options?: RequestOptions\n ): Promise<Types.AcceptInvitationResponse> {\n return this.post<Types.AcceptInvitationResponse>(\n `/invitations/${encodeURIComponent(token)}/accept`,\n undefined,\n options\n );\n }\n\n /\n Revoke a pending invitation. Caller must be a manager of the tenant\n * that issued the invitation.\n \n @param invitationId - Invitation ID (not the token)\n * @param options - Optional request options\n /\n async revokeInvitation(\n invitationId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/invitations/${encodeURIComponent(invitationId)}`,\n options\n );\n }\n\n // ============================================================================\n // Public Endpoints - Health\n // ============================================================================\n\n /\n Health check endpoint\n \n Returns the health status of the service.\n \n @param options - Optional request options\n * @returns Health status\n /\n async healthCheck(options?: RequestOptions): Promise<Types.HealthResponse> {\n return this.get<Types.HealthResponse>('/healthz', this.publicOptions(options));\n }\n\n // ============================================================================\n // Protected Endpoints - User Profile\n // ============================================================================\n\n /\n Get current user profile\n \n Returns the authenticated user's profile information.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns User profile\n /\n async getMe(options?: RequestOptions): Promise<Types.UserProfileResponse> {\n return this.get<Types.UserProfileResponse>('/users/me', options);\n }\n\n /\n Update current user profile\n \n Updates the authenticated user's profile information.\n * Requires authentication.\n \n @param data - Profile update data\n * @param options - Optional request options\n * @returns Updated user profile\n /\n async updateMe(\n data: Types.UpdateProfileRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.patch<Types.SuccessResponse>('/users/me', data, options);\n }\n\n // ============================================================================\n // Protected Endpoints - Emails\n // ============================================================================\n\n /\n List user emails\n \n Returns all email addresses associated with the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of email addresses\n /\n async listEmails(options?: RequestOptions): Promise<Types.EmailResponse[]> {\n const response = await this.get<Types.EmailsResponse>('/users/me/emails', options);\n return response.emails;\n }\n\n /\n Add a new email address\n \n Adds a new email address to the authenticated user's account.\n * A verification code will be sent to the email.\n * Requires authentication.\n \n @param data - Email address to add\n * @param options - Optional request options\n * @returns Added email information\n /\n async addEmail(\n data: Types.AddEmailRequest,\n options?: RequestOptions\n ): Promise<Types.EmailResponse> {\n return this.post<Types.EmailResponse>('/users/me/emails', data, options);\n }\n\n /\n Verify an email address\n \n Verifies an email address using a verification code.\n * Requires authentication.\n \n @param emailId - Email ID to verify\n * @param data - Verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyEmail(\n emailId: string,\n data: Types.VerifyContactRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}/verify`,\n data,\n options\n );\n }\n\n /\n Delete an email address\n \n Removes an email address from the authenticated user's account.\n * Cannot delete the primary email.\n * Requires authentication.\n \n @param emailId - Email ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteEmail(\n emailId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}`,\n undefined,\n options\n );\n }\n\n /\n Set email as primary\n \n Sets the specified email address as the primary email for the user.\n * Email must be verified before it can be set as primary.\n * Requires authentication.\n \n @param emailId - Email ID to set as primary\n * @param options - Optional request options\n * @returns Success response\n /\n async setPrimaryEmail(\n emailId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/emails/${encodeURIComponent(emailId)}/set-primary`,\n undefined,\n options\n );\n }\n\n /\n Send email verification code\n \n Sends a verification code to the authenticated user's primary email address.\n * Use verifyEmail() to complete the verification.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Success response\n /\n async sendEmailVerification(\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/email/send-verification',\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Phones\n // ============================================================================\n\n /\n List user phones\n \n Returns all phone numbers associated with the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of phone numbers\n /\n async listPhones(options?: RequestOptions): Promise<Types.PhoneResponse[]> {\n const response = await this.get<Types.PhonesResponse>('/users/me/phones', options);\n return response.phones;\n }\n\n /\n Add a new phone number\n \n Adds a new phone number to the authenticated user's account.\n * A verification code will be sent to the phone.\n * Requires authentication.\n \n @param data - Phone number to add (E.164 format)\n * @param options - Optional request options\n * @returns Added phone information\n /\n async addPhone(\n data: Types.AddPhoneRequest,\n options?: RequestOptions\n ): Promise<Types.PhoneResponse> {\n return this.post<Types.PhoneResponse>('/users/me/phones', data, options);\n }\n\n /\n Verify a phone number\n \n Verifies a phone number using a verification code.\n * Requires authentication.\n \n @param phoneId - Phone ID to verify\n * @param data - Verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyPhone(\n phoneId: string,\n data: Types.VerifyContactRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}/verify`,\n data,\n options\n );\n }\n\n /\n Delete a phone number\n \n Removes a phone number from the authenticated user's account.\n * Cannot delete the primary phone.\n * Requires authentication.\n \n @param phoneId - Phone ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deletePhone(\n phoneId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}`,\n undefined,\n options\n );\n }\n\n /\n Set phone as primary\n \n Sets the specified phone number as the primary phone for the user.\n * Phone must be verified before it can be set as primary.\n * Requires authentication.\n \n @param phoneId - Phone ID to set as primary\n * @param options - Optional request options\n * @returns Success response\n /\n async setPrimaryPhone(\n phoneId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n `/users/me/phones/${encodeURIComponent(phoneId)}/set-primary`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Sessions\n // ============================================================================\n\n /\n List user sessions\n \n Returns all active sessions for the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of sessions\n /\n async listSessions(\n options?: RequestOptions\n ): Promise<Types.SessionResponse[]> {\n const response = await this.get<Types.SessionsResponse>('/users/me/sessions', options);\n return response.sessions;\n }\n\n /\n Delete a session\n \n Revokes a specific session for the authenticated user.\n * Requires authentication.\n \n @param sessionId - Session ID to delete\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteSession(\n sessionId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/sessions/${encodeURIComponent(sessionId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Clients\n // ============================================================================\n\n /\n List authorized OAuth clients\n \n Returns all OAuth clients authorized by the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of OAuth clients\n /\n async listClients(options?: RequestOptions): Promise<Types.ClientResponse[]> {\n const response = await this.get<Types.ClientsResponse>('/users/me/clients', options);\n return response.clients;\n }\n\n /\n Revoke OAuth client authorization\n \n Revokes authorization for a specific OAuth client.\n * Requires authentication.\n \n @param clientId - Client ID to revoke\n * @param options - Optional request options\n * @returns Success response\n /\n async deleteClient(\n clientId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/users/me/clients/${encodeURIComponent(clientId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Password\n // ============================================================================\n\n /\n Update password (authenticated)\n \n Updates the authenticated user's password.\n * Requires authentication.\n \n @param data - Current and new password\n * @param options - Optional request options\n * @returns Success response\n /\n async updatePassword(\n data: Types.UpdatePasswordRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>(\n '/password/update',\n data,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - Tenants\n // ============================================================================\n\n /\n Create a new tenant\n \n Creates a new tenant organization. The authenticated user becomes the owner.\n * Requires authentication.\n \n @param data - Tenant creation data\n * @param options - Optional request options\n * @returns Created tenant information\n /\n async createTenant(\n data: Types.CreateTenantRequest,\n options?: RequestOptions\n ): Promise<Types.TenantResponse> {\n return this.post<Types.TenantResponse>('/tenants', data, options);\n }\n\n /\n List current user's tenants\n \n Returns all tenants the authenticated user is a member of.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of tenant information\n /\n async listMyTenants(\n options?: RequestOptions\n ): Promise<Types.TenantResponse[]> {\n return this.get<Types.TenantResponse[]>('/users/me/tenants', options);\n }\n\n // ============================================================================\n // Protected Endpoints - Tenant Members\n // ============================================================================\n\n /\n List tenant members\n \n Returns all members of the specified tenant.\n * Requires authentication and membership in the tenant.\n \n @param tenantId - Tenant ID\n * @param options - Optional request options\n * @returns Array of tenant members\n /\n async listTenantMembers(\n tenantId: string,\n options?: RequestOptions\n ): Promise<Types.MembershipResponse[]> {\n const response = await this.get<Types.MembersResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members`,\n options\n );\n return response.members;\n }\n\n /\n Invite a member to tenant\n \n Sends an invitation to join the tenant. Requires authentication and\n * owner/admin role on the tenant.\n \n @param tenantId - Target tenant ID\n * @param data - Invitation data\n * @param options - Optional request options\n * @returns Invitation result, including a copyable accept_url\n /\n async inviteTenantMember(\n tenantId: string,\n data: Types.InviteMemberRequest,\n options?: RequestOptions\n ): Promise<Types.InvitationResponse> {\n return this.post<Types.InvitationResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/invite`,\n data,\n options\n );\n }\n\n /\n List pending invitations issued by the authenticated caller for a tenant.\n \n Returns only invitations whose `invited_by` matches the caller. Lets the\n * caller copy the `accept_url` of an invite they previously sent (for\n * example, to re-share if email delivery failed). Callers without a\n * membership, and members who never issued an invite for this tenant,\n * get an empty array.\n \n @param tenantId - Tenant ID\n * @param options - Optional request options\n * @returns Array of invitations issued by the caller\n /\n async listTenantInvitationsIssuedByMe(\n tenantId: string,\n options?: RequestOptions\n ): Promise<Types.IssuedInvitationResponse[]> {\n const response = await this.get<Types.IssuedInvitationsResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/invitations`,\n options\n );\n return response.invitations;\n }\n\n /\n Update member role\n \n Updates the role of a tenant member.\n * Requires authentication and owner role in the tenant.\n \n @param tenantId - Tenant ID\n * @param userId - User ID of the member\n * @param data - New role\n * @param options - Optional request options\n * @returns Updated membership information\n /\n async updateTenantMemberRole(\n tenantId: string,\n userId: string,\n data: Types.UpdateMemberRoleRequest,\n options?: RequestOptions\n ): Promise<Types.MembershipResponse> {\n return this.patch<Types.MembershipResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,\n data,\n options\n );\n }\n\n /\n Remove member from tenant\n \n Removes a member from the tenant.\n * Cannot remove the last owner.\n * Requires authentication and admin/owner role in the tenant.\n \n @param tenantId - Tenant ID\n * @param userId - User ID of the member to remove\n * @param options - Optional request options\n * @returns Success response\n /\n async removeTenantMember(\n tenantId: string,\n userId: string,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,\n undefined,\n options\n );\n }\n\n // ============================================================================\n // Protected Endpoints - TOTP (Two-Factor Authentication)\n // ============================================================================\n\n /\n Setup TOTP two-factor authentication\n \n Initializes TOTP setup and returns the secret, QR code URL, and backup codes.\n * The setup must be verified with verifyTOTP() before it becomes active.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns TOTP setup data including secret and backup codes\n /\n async setupTOTP(\n options?: RequestOptions\n ): Promise<Types.TOTPSetupResponse> {\n return this.post<Types.TOTPSetupResponse>(\n '/totp/setup',\n undefined,\n options\n );\n }\n\n /\n Verify TOTP setup\n \n Verifies a TOTP code to complete the 2FA setup process.\n * After verification, TOTP will be required on future logins.\n * Requires authentication.\n \n @param data - TOTP verification code\n * @param options - Optional request options\n * @returns Success response\n /\n async verifyTOTP(\n data: Types.VerifyTOTPRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>('/totp/verify', data, options);\n }\n\n /\n Disable TOTP two-factor authentication\n \n Disables TOTP 2FA. Requires a valid TOTP code to confirm.\n * Requires authentication.\n \n @param data - TOTP code to confirm disable\n * @param options - Optional request options\n * @returns Success response\n /\n async disableTOTP(\n data: Types.DisableTOTPRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.post<Types.SuccessResponse>('/totp/disable', data, options);\n }\n\n // ============================================================================\n // Passkey / WebAuthn - Public Endpoints\n // ============================================================================\n\n /\n Begin passkey login\n \n Starts the WebAuthn authentication process.\n * Returns options to pass to navigator.credentials.get().\n \n @param options - Optional request options\n * @returns WebAuthn request options\n /\n async beginPasskeyLogin(\n options?: RequestOptions\n ): Promise<Types.BeginPasskeyLoginResponse> {\n const response = await this.post<Types.BeginPasskeyLoginResponse & { session_key?: string }>(\n '/passkey/login/begin',\n undefined,\n this.publicOptions(options)\n );\n // Handle both shapes: server may return { publicKey: {...} } or flat { challenge, ... }\n const raw = response.options as unknown as Record<string, unknown>;\n const opts = ('publicKey' in raw ? raw.publicKey : raw) as Types.WebAuthnRequestOptions;\n return { options: opts, session_key: response.session_key ?? '' };\n }\n\n /\n Complete passkey login\n \n Completes the WebAuthn authentication and returns access tokens.\n \n @param data - WebAuthn assertion result from navigator.credentials.get()\n * @param options - Optional request options\n * @returns Access and refresh tokens\n /\n async finishPasskeyLogin(\n data: Types.FinishPasskeyLoginRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n return this.post<Types.AccessDataResponse>(\n '/passkey/login/finish',\n data,\n this.publicOptions(options)\n );\n }\n\n // ============================================================================\n // Passkey / WebAuthn - Protected Endpoints\n // ============================================================================\n\n /\n Begin passkey registration\n \n Starts the WebAuthn registration process for the authenticated user.\n * Returns options to pass to navigator.credentials.create().\n * Requires authentication.\n \n @param options - Optional request options\n * @returns WebAuthn creation options\n /\n async beginPasskeyRegistration(\n options?: RequestOptions\n ): Promise<Types.BeginPasskeyRegistrationResponse> {\n const response = await this.post<Types.BeginPasskeyRegistrationResponse>(\n '/passkeys/register/begin',\n undefined,\n options\n );\n // Handle both shapes: server may return { publicKey: {...} } or flat { rp, user, ... }\n const raw = response.options as unknown as Record<string, unknown>;\n const opts = ('publicKey' in raw ? raw.publicKey : raw) as Types.WebAuthnCreationOptions;\n return { options: opts };\n }\n\n /\n Complete passkey registration\n \n Completes the WebAuthn registration with the attestation result.\n * Requires authentication.\n \n @param data - WebAuthn attestation result and optional passkey name\n * @param options - Optional request options\n * @returns Success response\n /\n async finishPasskeyRegistration(\n data: Types.FinishPasskeyRegistrationRequest,\n options?: RequestOptions\n ): Promise<Types.PasskeyResponse> {\n return this.post<Types.PasskeyResponse>(\n '/passkeys/register/finish',\n data,\n options\n );\n }\n\n /\n List registered passkeys\n \n Returns all passkeys registered by the authenticated user.\n * Requires authentication.\n \n @param options - Optional request options\n * @returns Array of passkey information\n /\n async listPasskeys(\n options?: RequestOptions\n ): Promise<Types.PasskeyResponse[]> {\n const response = await this.get<Types.PasskeysResponse>('/passkeys', options);\n return response.passkeys;\n }\n\n /\n Delete a passkey\n \n Removes a registered passkey from the authenticated user's account.\n * If the user has TOTP 2FA enabled, a valid TOTP code must be provided.\n * Requires authentication.\n \n @param passkeyId - Passkey ID to delete\n * @param data - Optional request body with TOTP code for 2FA verification\n * @param options - Optional request options\n * @returns Success response\n /\n async deletePasskey(\n passkeyId: string,\n data?: Types.DeletePasskeyRequest,\n options?: RequestOptions\n ): Promise<Types.SuccessResponse> {\n return this.delete<Types.SuccessResponse>(\n `/passkeys/${encodeURIComponent(passkeyId)}`,\n data,\n options\n );\n }\n\n // ============================================================================\n // Google OAuth - Public Endpoints\n // ============================================================================\n\n /\n Get Google OAuth authorization URL and its CSRF state.\n \n Returns `{ url, state }`. Redirect the user to `url`, and keep `state` —\n * `handleGoogleOAuthCallback` requires it. When the client was constructed\n * with an `oauthStateStore`, the state is persisted here automatically.\n \n @param params - Query parameters including redirect_uri\n * @param options - Optional request options\n * @returns The authorization URL and the single-use state to round-trip\n /\n async getGoogleOAuthURL(\n params: { redirect_uri: string },\n options?: RequestOptions\n ): Promise<Types.GoogleOAuthURLResponse> {\n const queryParams = new URLSearchParams({ redirect_uri: params.redirect_uri });\n const response = await this.get<Types.GoogleOAuthURLResponse>(\n `/oauth/google/url?${queryParams.toString()}`,\n this.publicOptions(options)\n );\n\n // Persist before the caller redirects. Done here rather than left to the\n // caller because \"remember to store this across a full-page redirect\" is\n // exactly the step whose omission made this flow exploitable.\n if (this.oauthStateStore && response.state) {\n this.oauthStateStore.save(response.state);\n }\n\n return response;\n }\n\n /\n Handle Google OAuth callback\n \n Exchanges the Google OAuth authorization code for access tokens.\n * Creates a new user if one doesn't exist with the Google email.\n \n The `state` from `getGoogleOAuthURL` is required: the server validates\n * it before exchanging the code, and rejects a mismatch, absence, expiry or\n * reuse. See {@link Types.GoogleOAuthCallbackRequest.state}.\n \n @param data - OAuth callback data: code, redirect_uri and state\n * @param options - Optional request options\n * @returns Access and refresh tokens\n * @throws {MPFValidationError} If `state` is missing or empty (client-side).\n /\n async handleGoogleOAuthCallback(\n data: Types.GoogleOAuthCallbackRequest,\n options?: RequestOptions\n ): Promise<Types.AccessDataResponse> {\n // Fail here rather than sending a request the server must reject. A caller\n // reaching this with no state has lost the pending flow (wrong tab, cleared\n // storage, or a hand-rolled callback that dropped it) and the local error\n // names the cause; a server-side rejection would not.\n if (typeof data.state !== 'string' \|\| data.state === '') {\n throw new MPFValidationError(\n 'OAuth callback requires the `state` returned by getGoogleOAuthURL. ' +\n 'It is the CSRF defence for this flow: without it a callback carrying ' +\n \"an attacker's authorization code would be accepted. Persist it across \" +\n 'the redirect with createOAuthStateStore().',\n { field: 'state' },\n { state: ['state is required'] }\n );\n }\n\n return this.post<Types.AccessDataResponse>(\n '/oauth/google/callback',\n data,\n this.publicOptions(options)\n );\n }\n}\n","import type { MPFRole } from '../auth/claims-types.js';\n\n// NOTE: deliberately NOT re-exported (`export type { MPFRole }`).\n//\n// This module is namespace-re-exported from the root barrel as `AuthTypes`, and\n// tsup's declaration bundler mis-compiles a type re-export in that position: it\n// emitted `declare const types_MPFRole: typeof MPFRole;` — a value* declaration\n// for a type — which makes the shipped .d.ts fail to compile with\n// `TS2693: 'MPFRole' only refers to a type, but is being used as a value here`.\n//\n// Invisible in this repo because our tsconfig sets `skipLibCheck: true`; a\n// consumer building with `skipLibCheck: false` gets a hard error. Found by\n// typechecking the packed tarball from outside the workspace.\n//\n// `MPFRole` is still exported from the root barrel and from the `/auth` subpath\n// via `src/auth/claims-types.ts`, which is where it belongs.\n\n/*\n Roles accepted when WRITING a membership (inviting a member, updating a\n * role).\n \n Closed on purpose, and only here: on a request, autocomplete earns its keep\n * and an unknown role is a client bug worth catching at compile time.\n \n On RESPONSES the role is {@link MPFRole} (= `string`) instead. Roles are\n * database rows (`identity.tenant_membership_valid_roles`), so closing the union\n * on server output means a newly seeded role forces an SDK release — and it is\n * exactly how the fictional `'viewer'` role ended up in these types in five\n * places while the DB actually seeds `guest`.\n /\nexport type MPFTenantRoleInput = 'owner' \| 'admin' \| 'member' \| 'guest';\n\n// ============================================================================\n// Request Types\n// ============================================================================\n\n/\n Request body for user registration\n /\nexport interface CreateUserRequest {\n /* User's email address /\n email: string;\n /* User's password (minimum 8 characters) /\n password: string;\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n}\n\n/\n Request body for user login\n /\nexport interface LoginRequest {\n /* User's email address /\n email: string;\n /* User's password /\n password: string;\n}\n\n/\n Request body for profile update\n /\nexport interface UpdateProfileRequest {\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n /* Custom user metadata /\n metadata?: Record<string, unknown>;\n}\n\n/\n Request body for adding an email\n /\nexport interface AddEmailRequest {\n /* Email address to add /\n email: string;\n}\n\n/\n Request body for adding a phone number\n /\nexport interface AddPhoneRequest {\n /* Phone number in E.164 format /\n phone_number: string;\n}\n\n/\n Request body for verifying email or phone\n /\nexport interface VerifyContactRequest {\n /* 6-digit verification code /\n code: string;\n}\n\n/\n Request body for sending password recovery code\n /\nexport interface SendRecoveryCodeRequest {\n /* User's email address /\n email: string;\n}\n\n/\n Request body for verifying recovery code\n /\nexport interface VerifyRecoveryCodeRequest {\n /* User's email address /\n email: string;\n /* 6-digit verification code /\n verification_code: string;\n}\n\n/\n Request body for password reset\n /\nexport interface ResetPasswordRequest {\n /* Recovery token obtained from verification step /\n recovery_token: string;\n /* New password to set (minimum 8 characters) /\n new_password: string;\n}\n\n/\n Request body for authenticated password update\n /\nexport interface UpdatePasswordRequest {\n /* Current password for verification /\n current_password: string;\n /* New password to set (minimum 8 characters) /\n new_password: string;\n}\n\n/\n Request body for session renewal\n /\nexport interface RenewSessionRequest {\n /* The refresh token from the current session /\n refresh_token: string;\n}\n\n/\n Request body for session revocation\n /\nexport interface RevokeSessionRequest {\n /* The refresh token of the session to revoke /\n refresh_token: string;\n}\n\n/\n Request body for tenant creation\n /\nexport interface CreateTenantRequest {\n /* Name of the tenant organization /\n name: string;\n /* URL-friendly slug (auto-generated from name if omitted) /\n slug?: string;\n /* Optional description of the tenant /\n description?: string;\n}\n\n/\n Request body for inviting a member\n /\nexport interface InviteMemberRequest {\n /* Email address of the person to invite /\n email: string;\n /* Role to assign to the invited member /\n role: MPFTenantRoleInput;\n /\n Optional override for the configured accept URL template. The literal\n * \"{token}\" is replaced with the invitation token.\n /\n accept_url_template?: string;\n}\n\n/\n Result of POST /tenants/{id}/members/invite.\n /\nexport interface InvitationResponse {\n invitation_id: string;\n invite_token: string;\n /* Copyable URL the invitee can use; safe fallback if email delivery fails. /\n accept_url: string;\n email: string;\n role: string;\n expires_at: string;\n /* True when no existing user matches the invited email. /\n is_new_user: boolean;\n /* True when the invitation email was successfully dispatched. /\n email_sent: boolean;\n /* Legacy field. Always empty in the new invitation flow. /\n membership_id?: string;\n}\n\n/\n Public, pre-auth view of an invitation. Email is intentionally omitted.\n /\nexport interface InvitationPreviewResponse {\n tenant_id: string;\n tenant_name: string;\n tenant_slug?: string;\n role: string;\n inviter_display_name?: string;\n expires_at: string;\n /* True when the invitee has no verified account yet. /\n requires_signup: boolean;\n}\n\n/\n Result of POST /invitations/{token}/accept.\n /\nexport interface AcceptInvitationResponse {\n invitation_id: string;\n tenant_id: string;\n role: string;\n membership_id: string;\n accepted_at: string;\n}\n\n/\n Request body for updating member role\n /\nexport interface UpdateMemberRoleRequest {\n /* New role for the member /\n role: MPFTenantRoleInput;\n}\n\n// ============================================================================\n// TOTP (Two-Factor Authentication) Types\n// ============================================================================\n\n/\n Request body for verifying a TOTP code\n /\nexport interface VerifyTOTPRequest {\n /* 6-digit TOTP code from authenticator app /\n code: string;\n}\n\n/\n Request body for disabling TOTP\n /\nexport interface DisableTOTPRequest {\n /* 6-digit TOTP code to confirm disable /\n code: string;\n}\n\n/\n Request body for deleting a passkey (optional, required when user has TOTP 2FA enabled)\n /\nexport interface DeletePasskeyRequest {\n /* 6-digit TOTP code from authenticator app /\n totp_code?: string;\n}\n\n// ============================================================================\n// Passkey / WebAuthn Types\n// ============================================================================\n\n/* WebAuthn credential descriptor as serialized by the API /\nexport interface WebAuthnCredentialDescriptor {\n type: string;\n id: string;\n transports?: string[];\n}\n\n/* WebAuthn creation options as serialized by the API (base64url strings, not ArrayBuffers) /\nexport interface WebAuthnCreationOptions {\n rp: { id: string; name: string };\n user: { id: string; name: string; displayName: string };\n challenge: string;\n pubKeyCredParams: Array<{ type: string; alg: number }>;\n timeout?: number;\n excludeCredentials?: WebAuthnCredentialDescriptor[];\n authenticatorSelection?: {\n authenticatorAttachment?: string;\n residentKey?: string;\n requireResidentKey?: boolean;\n userVerification?: string;\n };\n attestation?: string;\n hints?: string[];\n extensions?: Record<string, unknown>;\n}\n\n/* WebAuthn request options as serialized by the API (base64url strings, not ArrayBuffers) /\nexport interface WebAuthnRequestOptions {\n challenge: string;\n rpId?: string;\n timeout?: number;\n allowCredentials?: WebAuthnCredentialDescriptor[];\n userVerification?: string;\n hints?: string[];\n extensions?: Record<string, unknown>;\n}\n\n/* Encoded credential sent back to the server after navigator.credentials.create/get /\nexport interface WebAuthnEncodedCredential {\n id: string;\n rawId: string;\n type: string;\n response: {\n clientDataJSON: string;\n attestationObject?: string;\n authenticatorData?: string;\n signature?: string;\n userHandle?: string \| null;\n };\n}\n\n/\n Request body for completing passkey registration\n /\nexport interface FinishPasskeyRegistrationRequest {\n /* Raw WebAuthn credential from navigator.credentials.create() /\n credential: WebAuthnEncodedCredential;\n /* Optional human-readable name for the passkey /\n name?: string;\n}\n\n/\n Request body for completing passkey login\n /\nexport interface FinishPasskeyLoginRequest {\n /* Raw WebAuthn credential from navigator.credentials.get() /\n credential: WebAuthnEncodedCredential;\n /* Session key returned from begin login /\n session_key: string;\n}\n\n// ============================================================================\n// Google OAuth Types\n// ============================================================================\n\n/\n Request body for Google OAuth callback\n /\nexport interface GoogleOAuthCallbackRequest {\n /* Authorization code from Google /\n code: string;\n /* Redirect URI used in the initial auth request /\n redirect_uri: string;\n /\n The `state` returned by `getGoogleOAuthURL`, round-tripped through the\n * redirect.\n \n Required, and required for a reason. It is the CSRF defence for this\n * flow: the server validates it before exchanging the code, so a callback\n * carrying an attacker's `code` but not the victim's `state` is rejected.\n * Without it, an attacker can sign a victim into the attacker's own account —\n * confirmed exploitable, not hypothetical.\n \n Persist it across the redirect with `createOAuthStateStore()` (web storage:\n * a full-page redirect discards anything held in memory).\n /\n state: string;\n}\n\n// ============================================================================\n// Response Types\n// ============================================================================\n\n/\n Response containing access and refresh tokens\n /\nexport interface AccessDataResponse {\n /* JWT access token for API authentication /\n access_token: string;\n /* Refresh token for session renewal /\n refresh_token: string;\n}\n\n/\n User profile information\n /\nexport interface UserProfileResponse {\n /* User's unique identifier /\n id: string;\n /* User's display name /\n display_name?: string;\n /* User's first name /\n first_name?: string;\n /* User's last name /\n last_name?: string;\n /* User's avatar URL /\n avatar_url?: string;\n /* User's email addresses /\n emails: EmailResponse[];\n /* User's phone numbers /\n phones: PhoneResponse[];\n}\n\n/\n Email address information\n /\nexport interface EmailResponse {\n /* Email's unique identifier /\n id: string;\n /* Email address /\n email: string;\n /* Whether this is the primary email /\n is_primary: boolean;\n /* When the email was verified (ISO 8601), undefined if not verified /\n verified_at?: string;\n}\n\n/\n Phone number information\n /\nexport interface PhoneResponse {\n /* Phone's unique identifier /\n id: string;\n /* Phone number in E.164 format /\n phone_number: string;\n /* Whether this is the primary phone /\n is_primary: boolean;\n /* When the phone was verified (ISO 8601), undefined if not verified /\n verified_at?: string;\n}\n\n/\n Session client information\n /\nexport interface SessionClientInfo {\n /* Client name /\n name?: string;\n /* Client user agent string /\n user_agent?: string;\n /* Client IP address /\n ip_address?: string;\n /* When the client was last seen (ISO 8601) /\n last_seen_at?: string;\n}\n\n/\n Session information\n /\nexport interface SessionResponse {\n /* Session's unique identifier /\n id: string;\n /* Client ID associated with the session /\n client_id: string;\n /* Client information /\n client?: SessionClientInfo;\n /* When the session expires (ISO 8601) /\n expires_at: string;\n /* When the session was created (ISO 8601) /\n created_at: string;\n /* Whether this is the current session /\n is_current: boolean;\n}\n\n/\n OAuth client information\n /\nexport interface ClientResponse {\n /* Client's unique identifier /\n id: string;\n /* Client name /\n name?: string;\n /* Client user agent string /\n user_agent?: string;\n /* Client IP address /\n ip_address?: string;\n /* When the client was last seen (ISO 8601) /\n last_seen_at?: string;\n}\n\n/\n Tenant information\n /\nexport interface TenantResponse {\n /* Tenant's unique identifier /\n id: string;\n /* Tenant name /\n name: string;\n /\n The tenant's kind, a value of `identity.tenant_types`. Always present —\n * the column is NOT NULL with DEFAULT 'tenant'. Prefer this over the access\n * token's `typ` claim, which is a snapshot and can be stale for up to the\n * token's lifetime if the type changes out of band.\n /\n type: string;\n /* Tenant description /\n description?: string;\n /* Tenant slug (URL-friendly identifier) /\n slug?: string;\n /* When the tenant was created (ISO 8601) /\n created_at: string;\n}\n\n/\n Tenant membership information\n /\nexport interface MembershipResponse {\n /* Membership unique identifier /\n id: string;\n /* User's unique identifier /\n user_id: string;\n /* Member's role in the tenant /\n role: MPFRole;\n /* When the member was invited (ISO 8601) /\n invited_at?: string;\n /* When the invitation was accepted (ISO 8601) /\n accepted_at?: string;\n /* Member's display name /\n display_name?: string;\n /* Member's email address /\n email?: string;\n}\n\n/\n Response containing recovery token\n /\nexport interface RecoveryTokenResponse {\n /* Token to use for password reset /\n recovery_token: string;\n}\n\n/\n Simple success response\n /\nexport interface SuccessResponse {\n /* Indicates if the operation was successful /\n success: boolean;\n}\n\n/\n Error response from the API\n /\nexport interface ErrorResponse {\n /* Human-readable error message /\n error: string;\n /* Machine-readable error code /\n code?: string;\n /* Additional error details (validation errors, etc.) /\n details?: unknown;\n}\n\n/\n Validation error detail for a specific field\n /\nexport interface ValidationErrorDetail {\n /* Name of the field with validation error /\n field: string;\n /* Validation error message /\n message: string;\n}\n\n/\n Service health status response\n /\nexport interface HealthResponse {\n /* Health status /\n status: string;\n /* Service name /\n service: string;\n /* Current server timestamp (ISO 8601) /\n timestamp: string;\n}\n\n// ============================================================================\n// TOTP Response Types\n// ============================================================================\n\n/\n Response from TOTP setup containing secret and backup codes\n /\nexport interface TOTPSetupResponse {\n /* TOTP secret key for manual entry /\n secret: string;\n /* otpauth:// URL for QR code generation /\n qr_url: string;\n /* One-time backup codes for account recovery /\n backup_codes: string[];\n}\n\n// ============================================================================\n// Passkey Response Types\n// ============================================================================\n\n/\n Response from begin passkey registration\n /\nexport interface BeginPasskeyRegistrationResponse {\n /* WebAuthn PublicKeyCredentialCreationOptions /\n options: WebAuthnCreationOptions;\n}\n\n/\n Response from begin passkey login\n /\nexport interface BeginPasskeyLoginResponse {\n /* WebAuthn PublicKeyCredentialRequestOptions /\n options: WebAuthnRequestOptions;\n /* Session key to pass back in finish login /\n session_key: string;\n}\n\n/\n Passkey credential information\n /\nexport interface PasskeyResponse {\n /* Passkey's unique identifier /\n id: string;\n /* Human-readable name for the passkey /\n name?: string;\n /* When the passkey was registered (ISO 8601) /\n created_at: string;\n /* When the passkey was last used (ISO 8601) /\n last_used_at?: string;\n}\n\n// ============================================================================\n// OAuth Response Types\n// ============================================================================\n\n/\n A pending invitation for the current user\n /\nexport interface PendingInvitationResponse {\n /* Invitation/membership ID /\n id: string;\n /* Tenant ID the invitation is for /\n tenant_id: string;\n /* Tenant name /\n tenant_name: string;\n /* Tenant slug /\n tenant_slug?: string;\n /* Role assigned in the invitation /\n role: MPFRole;\n /* User ID of the person who sent the invitation /\n invited_by: string;\n /* When the invitation was sent (ISO 8601) /\n invited_at: string;\n /* Invitation token for accepting /\n token: string;\n}\n\n/\n A pending invitation issued by the authenticated caller, returned by\n * GET /tenants/{id}/invitations.\n /\nexport interface IssuedInvitationResponse {\n /* Invitation ID /\n id: string;\n /* Tenant the invitation was issued for /\n tenant_id: string;\n /* Email the invitation was sent to /\n email: string;\n /* Role the invitee will receive on accept /\n role: MPFRole;\n /* User ID of the inviter (always the authenticated caller) /\n invited_by: string;\n /* When the invitation was sent (ISO 8601) /\n invited_at: string;\n /* Expiration time (ISO 8601) /\n expires_at: string;\n /* Raw token. Most callers should use accept_url instead. /\n token: string;\n /\n Copyable URL the invitee can paste into a browser. Empty if the server\n * has no accept-URL template configured.\n /\n accept_url: string;\n /* Display name of the invitee, if they already have an account /\n display_name?: string;\n}\n\n/\n Response containing Google OAuth authorization URL\n /\nexport interface GoogleOAuthURLResponse {\n /* Full Google OAuth authorization URL to redirect user to /\n url: string;\n /\n Single-use CSRF state minted and recorded by the server.\n \n Persist this before redirecting and send it back on\n * `handleGoogleOAuthCallback`. Dropping it makes the callback trivially\n * forgeable — see {@link GoogleOAuthCallbackRequest.state}.\n /\n state: string;\n}\n\n// ============================================================================\n// List Wrapper Response Types\n// ============================================================================\n\n/\n Wrapper response for email list\n /\nexport interface EmailsResponse {\n emails: EmailResponse[];\n}\n\n/\n Wrapper response for phone list\n /\nexport interface PhonesResponse {\n phones: PhoneResponse[];\n}\n\n/\n Wrapper response for session list\n /\nexport interface SessionsResponse {\n sessions: SessionResponse[];\n}\n\n/\n Wrapper response for passkey list\n /\nexport interface PasskeysResponse {\n passkeys: PasskeyResponse[];\n}\n\n/\n Wrapper response for client list\n /\nexport interface ClientsResponse {\n clients: ClientResponse[];\n}\n\n/\n Wrapper response for member list\n /\nexport interface MembersResponse {\n members: MembershipResponse[];\n}\n\n/\n Wrapper response for pending-invitations-issued-by-caller list\n /\nexport interface IssuedInvitationsResponse {\n invitations: IssuedInvitationResponse[];\n}\n\n// ============================================================================\n// MFA Response Types\n// ============================================================================\n\n/\n Returned when MFA verification is needed to complete login\n /\nexport interface MFARequiredResponse {\n /* Always true for this response type /\n mfa_required: true;\n /* Short-lived JWT ticket for MFA verification /\n mfa_ticket: string;\n /* Available MFA methods (e.g., [\"totp\"]) /\n mfa_methods: string[];\n}\n\n/\n Returned when MFA setup is enforced and user hasn't set up TOTP yet\n /\nexport interface MFASetupRequiredResponse {\n /* Always true for this response type /\n mfa_setup_required: true;\n /* Short-lived JWT ticket for MFA setup verification /\n mfa_ticket: string;\n /* TOTP setup data including secret and QR code /\n totp_setup: TOTPSetupResponse;\n}\n\n/\n Union type for all possible login responses\n /\nexport type LoginResponse = AccessDataResponse \| MFARequiredResponse \| MFASetupRequiredResponse;\n\n/\n Type guard to check if login response requires MFA verification\n /\nexport function isMFARequired(response: LoginResponse): response is MFARequiredResponse {\n return 'mfa_required' in response && response.mfa_required === true;\n}\n\n/\n Type guard to check if login response requires MFA setup\n /\nexport function isMFASetupRequired(response: LoginResponse): response is MFASetupRequiredResponse {\n return 'mfa_setup_required' in response && response.mfa_setup_required === true;\n}\n\n// ============================================================================\n// MFA Request Types\n// ============================================================================\n\n/\n Request body for verifying MFA during login\n /\nexport interface MFAVerifyRequest {\n /* MFA ticket from login response /\n mfa_ticket: string;\n /* 6-digit TOTP code from authenticator app /\n totp_code: string;\n}\n\n/\n Request body for verifying MFA setup during first-time enrollment\n /\nexport interface MFASetupVerifyRequest {\n /* MFA ticket from login response /\n mfa_ticket: string;\n /* 6-digit TOTP code to verify setup */\n code: string;\n}\n"]}

package/dist/identity/index.js CHANGED Viewed

@@ -1,4 +1,4 @@
-export { AuthClientV0, createAdminClient, createAuthClient, isMFARequired, isMFASetupRequired } from '../chunk-R5KABORE.js';
+export { AuthClientV0, createAdminClient, createAuthClient, isMFARequired, isMFASetupRequired } from '../chunk-N73TORHR.js';
 import '../chunk-B3JXAPMM.js';
 import '../chunk-3OKR4MSV.js';
 import '../chunk-S5DKGPUY.js';

package/dist/identity/types.d.ts CHANGED Viewed

@@ -418,6 +418,13 @@ export interface TenantResponse {
     id: string;
     /** Tenant name */
     name: string;
+    /**
+     * The tenant's kind, a value of `identity.tenant_types`. Always present —
+     * the column is NOT NULL with DEFAULT 'tenant'. Prefer this over the access
+     * token's `typ` claim, which is a snapshot and can be stale for up to the
+     * token's lifetime if the type changes out of band.
+     */
+    type: string;
     /** Tenant description */
     description?: string;
     /** Tenant slug (URL-friendly identifier) */

package/dist/index.js CHANGED Viewed

@@ -2,8 +2,8 @@ import { peer_free_exports } from './chunk-2WY2XQCV.js';
 export { peer_free_exports as client } from './chunk-2WY2XQCV.js';
 import { auth_exports } from './chunk-FYUVJL4T.js';
 export { auth_exports as auth } from './chunk-FYUVJL4T.js';
-import { identity_exports } from './chunk-R5KABORE.js';
-export { identity_exports as identity } from './chunk-R5KABORE.js';
+import { identity_exports } from './chunk-N73TORHR.js';
+export { identity_exports as identity } from './chunk-N73TORHR.js';
 import './chunk-B3JXAPMM.js';
 import { storage_exports } from './chunk-HZWDNBJS.js';
 export { storage_exports as storage } from './chunk-HZWDNBJS.js';

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@mosano-product-framework/sdk",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "MPF SDK: typed clients for the MPF services",
   "type": "module",
   "main": "./dist/index.js",