@nexys/user-management-client 0.1.0 → 0.2.0

package/README.md

@@ -79,3 +79,22 @@ const myEndpoint: Endpoint<{ id: string }, Thing, ApiError> = {
 bun test           # 9 hermetic tests using a mock fetch
 bun run typecheck
 ```
+
+## Releasing
+
+Publishing runs in CI (`.github/workflows/publish-client.yml`, needs the
+`NPM_TOKEN` repo secret): bump `version` in `package.json`, then push a
+matching tag —
+
+```bash
+git tag client-v0.2.0 && git push origin client-v0.2.0
+```
+
+The workflow typechecks, tests, builds `dist/`, rewrites the package
+entries (`main`/`types`/`exports`) to point at `dist/` and runs
+`npm publish --provenance --access public`.
+
+Inside this repo the package entries stay on the TS source, so the
+workspaces (`apps/web`'s vite build, `packages/web`, `apps/e2e`) keep
+importing `src/` directly — only the published artifact is dist-based
+(with a `bun` export condition so bun consumers still get the source).

package/dist/endpoints/admin-users.d.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from "../endpoint.js";
 import type { ApiError } from "../result.js";
-import type { AdminUserDetail, AdminUserListResponse, UserRole, UserRoleRow, UserStatus } from "../types.js";
+import type { AdminUserListResponse, AdminUserRow, AuthMethodsResponse, UserMembership, UserRole, UserStatus } from "../types.js";
 export interface AdminListUsersInput {
     status?: UserStatus;
     includeDeleted?: boolean;
@@ -8,6 +8,54 @@ export interface AdminListUsersInput {
     offset?: number;
 }
 export declare const adminListUsers: Endpoint<AdminListUsersInput, AdminUserListResponse, ApiError>;
+/** Single user with linked auth providers — powers the detail page. */
+export declare const adminGetUser: Endpoint<{
+    userId: string;
+}, AdminUserRow, ApiError>;
+/** Auth-method inventory: accounts, passkeys, 2FA flag. */
+export declare const adminAuthMethods: Endpoint<{
+    userId: string;
+}, AuthMethodsResponse, ApiError>;
+/**
+ * Add a sign-in method as `{authType, value}`. authType "credential"
+ * sets a password (value = the password); a social authType (google,
+ * microsoft, …) pre-links the provider account (value = provider-side
+ * account id or email) so the user's first social sign-in lands here.
+ */
+export declare const adminAddAccount: Endpoint<{
+    userId: string;
+    authType: string;
+    value: string;
+}, {
+    id: string;
+    providerId: string;
+}, ApiError>;
+/** Unlink an account row (social link or password credential). 409 if it's the last sign-in method. */
+export declare const adminUnlinkAccount: Endpoint<{
+    userId: string;
+    accountId: string;
+}, {
+    ok: true;
+}, ApiError>;
+/** Remove a passkey. 409 if it's the last sign-in method. */
+export declare const adminDeletePasskey: Endpoint<{
+    userId: string;
+    passkeyId: string;
+}, {
+    ok: true;
+}, ApiError>;
+/** Admin kill-switch for a user's TOTP (lost authenticator). */
+export declare const adminDisableTwoFactor: Endpoint<{
+    userId: string;
+}, {
+    ok: true;
+}, ApiError>;
+/** Tenants the user belongs to — powers the "manage tenants" panel. */
+export declare const adminListUserTenants: Endpoint<{
+    userId: string;
+}, {
+    memberships: UserMembership[];
+}, ApiError>;
 export interface SetUserStatusResponse {
     ok: true;
     status: UserStatus;
@@ -18,6 +66,10 @@ export declare const adminSetUserStatus: Endpoint<{
     userId: string;
     status: UserStatus;
 }, SetUserStatusResponse, ApiError>;
+/**
+ * Role change rides the Better Auth admin-plugin route — the server
+ * guards demoting the last active superadmin (409).
+ */
 export declare const adminSetUserRole: Endpoint<{
     userId: string;
     role: UserRole;
@@ -31,26 +83,4 @@ export declare const adminRevokeUserTokens: Endpoint<{
     sessionsRevoked: number;
     refreshTokensRevoked: number;
 }, ApiError>;
-export declare const adminGetUser: Endpoint<{
-    userId: string;
-}, AdminUserDetail, ApiError>;
-export declare const adminDeleteUser: Endpoint<{
-    userId: string;
-}, {
-    ok: true;
-}, ApiError>;
-export declare const adminGetUserRoles: Endpoint<{
-    userId: string;
-    organizationId: string;
-}, {
-    roles: UserRoleRow[];
-}, ApiError>;
-export declare const adminToggleUserRole: Endpoint<{
-    userId: string;
-    organizationId: string;
-    roleId: string;
-    assign: boolean;
-}, {
-    ok: true;
-}, ApiError>;
 //# sourceMappingURL=admin-users.d.ts.map

package/dist/endpoints/admin-users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,QAAQ,EACR,WAAW,EACX,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC,mBAAmB,EACnB,qBAAqB,EACrB,QAAQ,CAYT,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,UAAU,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,EACtC,qBAAqB,EACrB,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CACrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,EAClC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAC1C;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,EACnE,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CACjC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB,eAAe,EACf,QAAQ,CAMT,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAMT,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CACtC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAC1C;IAAE,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,EACxB,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CACxC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,EAC3E;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC"}
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC,mBAAmB,EACnB,qBAAqB,EACrB,QAAQ,CAYT,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,YAAY,EAAE,QAAQ,CAK7E,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CACrC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB,mBAAmB,EACnB,QAAQ,CAOT,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACnD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAClC,QAAQ,CAOT,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAC1C;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,WAAW,EAAE,cAAc,EAAE,CAAA;CAAE,EACjC,QAAQ,CAMT,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,UAAU,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,EACtC,qBAAqB,EACrB,QAAQ,CAOT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CACrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,EAClC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAC1C;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,EACnE,QAAQ,CAOT,CAAC"}

package/dist/endpoints/admin-users.js

@@ -11,50 +11,83 @@ export const adminListUsers = {
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
-export const adminSetUserStatus = {
-    method: "POST",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/status`,
-    body: ({ status }) => ({ status }),
+/** Single user with linked auth providers — powers the detail page. */
+export const adminGetUser = {
+    method: "GET",
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}`,
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
-export const adminSetUserRole = {
-    method: "POST",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/role`,
-    body: ({ role }) => ({ role }),
-    parseOutput: () => ({ ok: true }),
+/** Auth-method inventory: accounts, passkeys, 2FA flag. */
+export const adminAuthMethods = {
+    method: "GET",
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/auth-methods`,
+    parseOutput: (data) => data,
     parseError: parseApiError,
 };
-export const adminRevokeUserTokens = {
+/**
+ * Add a sign-in method as `{authType, value}`. authType "credential"
+ * sets a password (value = the password); a social authType (google,
+ * microsoft, …) pre-links the provider account (value = provider-side
+ * account id or email) so the user's first social sign-in lands here.
+ */
+export const adminAddAccount = {
     method: "POST",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/revoke-tokens`,
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/accounts`,
+    body: ({ authType, value }) => ({ authType, value }),
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
-export const adminGetUser = {
-    method: "GET",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}`,
-    parseOutput: (data) => data,
+/** Unlink an account row (social link or password credential). 409 if it's the last sign-in method. */
+export const adminUnlinkAccount = {
+    method: "DELETE",
+    path: ({ userId, accountId }) => `/api/admin/users/${encodeURIComponent(userId)}/accounts/${encodeURIComponent(accountId)}`,
+    parseOutput: () => ({ ok: true }),
     parseError: parseApiError,
 };
-export const adminDeleteUser = {
+/** Remove a passkey. 409 if it's the last sign-in method. */
+export const adminDeletePasskey = {
     method: "DELETE",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}`,
+    path: ({ userId, passkeyId }) => `/api/admin/users/${encodeURIComponent(userId)}/passkeys/${encodeURIComponent(passkeyId)}`,
+    parseOutput: () => ({ ok: true }),
+    parseError: parseApiError,
+};
+/** Admin kill-switch for a user's TOTP (lost authenticator). */
+export const adminDisableTwoFactor = {
+    method: "POST",
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/two-factor/disable`,
     parseOutput: () => ({ ok: true }),
     parseError: parseApiError,
 };
-export const adminGetUserRoles = {
+/** Tenants the user belongs to — powers the "manage tenants" panel. */
+export const adminListUserTenants = {
     method: "GET",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/roles`,
-    query: ({ organizationId }) => ({ organizationId }),
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/tenants`,
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
-export const adminToggleUserRole = {
+export const adminSetUserStatus = {
     method: "POST",
-    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/roles`,
-    body: ({ organizationId, roleId, assign }) => ({ organizationId, roleId, assign }),
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/status`,
+    body: ({ status }) => ({ status }),
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
+/**
+ * Role change rides the Better Auth admin-plugin route — the server
+ * guards demoting the last active superadmin (409).
+ */
+export const adminSetUserRole = {
+    method: "POST",
+    path: () => "/api/auth/admin/set-role",
+    body: (input) => input,
     parseOutput: () => ({ ok: true }),
     parseError: parseApiError,
 };
+export const adminRevokeUserTokens = {
+    method: "POST",
+    path: ({ userId }) => `/api/admin/users/${encodeURIComponent(userId)}/revoke-tokens`,
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
 //# sourceMappingURL=admin-users.js.map

package/dist/endpoints/admin-users.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-users.js","sourceRoot":"","sources":["../../src/endpoints/admin-users.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAgB7C,MAAM,CAAC,MAAM,cAAc,GAIvB;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB;IAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA6B;IACpD,UAAU,EAAE,aAAa;CAC1B,CAAC;AASF,MAAM,CAAC,MAAM,kBAAkB,GAI3B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS;IAC7E,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA6B;IACpD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAIzB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,OAAO;IAC3E,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9B,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAI9B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,gBAAgB;IACpF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CACpB,IAA2E;IAC7E,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAIrB;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,EAAE;IACtE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAuB;IAC9C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAIxB;IACF,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,EAAE;IACtE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAI1B;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,QAAQ;IAC5E,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;IACnD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAgC;IACvD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAI5B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,QAAQ;IAC5E,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClF,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC"}
+{"version":3,"file":"admin-users.js","sourceRoot":"","sources":["../../src/endpoints/admin-users.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAiB7C,MAAM,CAAC,MAAM,cAAc,GAIvB;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB;IAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA6B;IACpD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAyD;IAChF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,EAAE;IACtE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAoB;IAC3C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAIzB;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,eAAe;IAC/D,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA2B;IAClD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAIxB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,WAAW;IAC/E,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACpD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA0C;IACjE,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAI3B;IACF,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAC9B,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE;IAC5F,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAI3B;IACF,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAC9B,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE;IAC5F,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAI9B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,qBAAqB;IACrE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAI7B;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,UAAU;IAC9E,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAyC;IAChE,UAAU,EAAE,aAAa;CAC1B,CAAC;AASF,MAAM,CAAC,MAAM,kBAAkB,GAI3B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS;IAC7E,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA6B;IACpD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAIzB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,0BAA0B;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAI9B;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,gBAAgB;IACpF,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CACpB,IAA2E;IAC7E,UAAU,EAAE,aAAa;CAC1B,CAAC"}

package/dist/endpoints/api-tokens.d.ts

@@ -0,0 +1,23 @@
+import type { Endpoint } from "../endpoint.js";
+import type { ApiError } from "../result.js";
+import type { ApiTokenCreated, ApiTokenRow } from "../types.js";
+/**
+ * Personal API tokens ("CLI" credentials). They authenticate as
+ * `Authorization: Bearer um_…` or `x-api-key`. Creating/revoking
+ * requires a session credential — a token cannot mint more tokens.
+ * Revoked tokens keep their row (status flips); the server's retention
+ * policy deletes dead rows after TOKEN_RETENTION_DAYS.
+ */
+export declare const createApiToken: Endpoint<{
+    name: string;
+    expiresInDays?: number;
+}, ApiTokenCreated, ApiError>;
+export declare const listApiTokens: Endpoint<void, {
+    tokens: ApiTokenRow[];
+}, ApiError>;
+export declare const revokeApiToken: Endpoint<{
+    id: string;
+}, {
+    ok: true;
+}, ApiError>;
+//# sourceMappingURL=api-tokens.d.ts.map

package/dist/endpoints/api-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens.d.ts","sourceRoot":"","sources":["../../src/endpoints/api-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,eAAe,EACf,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,EAAE,QAAQ,CAK7E,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAK3E,CAAC"}

package/dist/endpoints/api-tokens.js

@@ -0,0 +1,28 @@
+import { parseApiError } from "../result.js";
+/**
+ * Personal API tokens ("CLI" credentials). They authenticate as
+ * `Authorization: Bearer um_…` or `x-api-key`. Creating/revoking
+ * requires a session credential — a token cannot mint more tokens.
+ * Revoked tokens keep their row (status flips); the server's retention
+ * policy deletes dead rows after TOKEN_RETENTION_DAYS.
+ */
+export const createApiToken = {
+    method: "POST",
+    path: () => "/api/me/tokens",
+    body: (input) => input,
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
+export const listApiTokens = {
+    method: "GET",
+    path: () => "/api/me/tokens",
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
+export const revokeApiToken = {
+    method: "DELETE",
+    path: (input) => `/api/me/tokens/${input.id}`,
+    parseOutput: () => ({ ok: true }),
+    parseError: parseApiError,
+};
+//# sourceMappingURL=api-tokens.js.map

package/dist/endpoints/api-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens.js","sourceRoot":"","sources":["../../src/endpoints/api-tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAIvB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB;IAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAuB;IAC9C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAwD;IAChF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB;IAC5B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAiC;IACxD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAqD;IAC9E,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,KAAK,CAAC,EAAE,EAAE;IAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC"}

package/dist/endpoints/auth.d.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from "../endpoint.js";
 import type { ApiError } from "../result.js";
-import type { AuthSuccess } from "../types.js";
+import type { AuthSuccess, SignInResult } from "../types.js";
 /** Sign-up surfaces a couple of specific codes the UI may want to switch on. */
 export type SignUpError = ApiError | {
     kind: "http";
@@ -17,6 +17,11 @@ export declare const signUp: Endpoint<{
     name: string;
     email: string;
     password: string;
+    /**
+     * Project-scoped sign-up: the target project must exist and have
+     * `allowSignup` enabled (403 `signup_disabled` otherwise).
+     */
+    projectId?: string;
 }, AuthSuccess, SignUpError>;
 /** Sign-in collapses bad-email / bad-password into one enumeration-safe code. */
 export type SignInError = ApiError | {
@@ -33,7 +38,9 @@ export type SignInError = ApiError | {
 export declare const signIn: Endpoint<{
     email: string;
     password: string;
-}, AuthSuccess, SignInError>;
+}, SignInResult, SignInError>;
+/** Full user + session snapshot; `null` body when unauthenticated. */
+export declare const getSession: Endpoint<void, AuthSuccess | null, ApiError>;
 export declare const signOut: Endpoint<void, {
     success: boolean;
 }, ApiError>;
@@ -44,7 +51,7 @@ export declare const requestPasswordReset: Endpoint<{
 }, ApiError>;
 export declare const resetPassword: Endpoint<{
     token: string;
-    password: string;
+    newPassword: string;
 }, {
     ok: true;
 }, ApiError>;
@@ -59,14 +66,16 @@ export declare const verifyMagicLink: Endpoint<{
     ok: true;
 }, ApiError>;
 /**
- * Better Auth admin-plugin user create. The rust server doesn't expose
- * this route yet; the journey suite uses the endpoint to verify the
- * absence + the permission check.
+ * Better Auth admin-plugin user create. Superadmin/useradmin only;
+ * the account lands active + email-verified with a password
+ * credential. Returns the full user under `user`.
  */
 export declare const adminCreateUser: Endpoint<{
     email: string;
     password: string;
-    name: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
     role?: string;
 }, {
     user: {
@@ -74,12 +83,46 @@ export declare const adminCreateUser: Endpoint<{
         email: string;
     };
 }, ApiError>;
+/**
+ * Better Auth admin-plugin user update — edit name and/or email.
+ * Email keeps its verified flag; uniqueness enforced (422).
+ */
+export declare const adminUpdateUser: Endpoint<{
+    userId: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+    email?: string;
+}, {
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+}, ApiError>;
+/**
+ * Better Auth admin-plugin user delete (soft delete — sets
+ * `deletedAt` and revokes the user's sessions). Idempotent.
+ */
+export declare const adminRemoveUser: Endpoint<{
+    userId: string;
+}, {
+    success: true;
+    sessionsRevoked: number;
+    refreshTokensRevoked: number;
+}, ApiError>;
 export declare const getProviders: Endpoint<void, {
     providers: string[];
 }, ApiError>;
 export declare const socialSignIn: Endpoint<{
     provider: string;
     callbackURL?: string;
+    /**
+     * Project-scoped flow. If the callback would create a *new* user,
+     * the project's `allowSignup` setting gates it; existing users
+     * sign in regardless.
+     */
+    projectId?: string;
 }, {
     url: string;
     redirect: true;

package/dist/endpoints/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,eAAO,MAAM,MAAM,EAAE,QAAQ,CAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACjD,WAAW,EACX,WAAW,CAOZ,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,eAAO,MAAM,MAAM,EAAE,QAAQ,CAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACnC,WAAW,EACX,WAAW,CAOZ,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,CAKlE,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAMpF,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,QAAQ,CAClC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACnC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAMhF,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAM/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAChE;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACvC,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,QAAQ,CAK1E,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CACjC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1C;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,EAC/B,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAChD;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,gFAAgF;AAChF,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,eAAO,MAAM,MAAM,EAAE,QAAQ,CAC3B;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,WAAW,EACX,WAAW,CAOZ,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,eAAO,MAAM,MAAM,EAAE,QAAQ,CAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACnC,YAAY,EACZ,WAAW,CAOZ,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,CAKnE,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,CAKlE,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAMpF,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,QAAQ,CAClC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACtC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAMhF,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EAAE,QAAQ,CAM/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACvC,QAAQ,CAOT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACrD,QAAQ,CAOT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CACpC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,EACxE,QAAQ,CAQT,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,QAAQ,CAK1E,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CACjC;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,EAC/B,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAChD;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC"}

package/dist/endpoints/auth.js

@@ -13,6 +13,13 @@ export const signIn = {
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
+/** Full user + session snapshot; `null` body when unauthenticated. */
+export const getSession = {
+    method: "GET",
+    path: () => "/api/auth/get-session",
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
 export const signOut = {
     method: "POST",
     path: () => "/api/auth/sign-out",
@@ -29,7 +36,7 @@ export const requestPasswordReset = {
 export const resetPassword = {
     method: "POST",
     path: () => "/api/auth/reset-password",
-    body: (input) => input,
+    body: (input) => ({ token: input.token, newPassword: input.newPassword }),
     parseOutput: () => ({ ok: true }),
     parseError: parseApiError,
 };
@@ -48,9 +55,9 @@ export const verifyMagicLink = {
     parseError: parseApiError,
 };
 /**
- * Better Auth admin-plugin user create. The rust server doesn't expose
- * this route yet; the journey suite uses the endpoint to verify the
- * absence + the permission check.
+ * Better Auth admin-plugin user create. Superadmin/useradmin only;
+ * the account lands active + email-verified with a password
+ * credential. Returns the full user under `user`.
  */
 export const adminCreateUser = {
     method: "POST",
@@ -59,6 +66,28 @@ export const adminCreateUser = {
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
+/**
+ * Better Auth admin-plugin user update — edit name and/or email.
+ * Email keeps its verified flag; uniqueness enforced (422).
+ */
+export const adminUpdateUser = {
+    method: "POST",
+    path: () => "/api/auth/admin/update-user",
+    body: (input) => input,
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
+/**
+ * Better Auth admin-plugin user delete (soft delete — sets
+ * `deletedAt` and revokes the user's sessions). Idempotent.
+ */
+export const adminRemoveUser = {
+    method: "POST",
+    path: () => "/api/auth/admin/remove-user",
+    body: (input) => input,
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
 export const getProviders = {
     method: "GET",
     path: () => "/api/providers",

package/dist/endpoints/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS7C,MAAM,CAAC,MAAM,MAAM,GAIf;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,yBAAyB;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAmB;IAC1C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAQF,MAAM,CAAC,MAAM,MAAM,GAIf;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,yBAAyB;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAmB;IAC1C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAmD;IACrE,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,oBAAoB;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAwD;IACvF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,2BAA2B;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAItB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,0BAA0B;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAwD;IACnF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAC1C,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAwD;IAClF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACjC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAIxB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA+C;IACtE,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAsD;IAC7E,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB;IAC5B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA+B;IACtD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAIrB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,0BAA0B;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAuC;IAC9D,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAIvB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,2BAA2B;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS7C,MAAM,CAAC,MAAM,MAAM,GAaf;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,yBAAyB;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAmB;IAC1C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAQF,MAAM,CAAC,MAAM,MAAM,GAIf;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,yBAAyB;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAoB;IAC3C,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAiD;IACtE,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,uBAAuB;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA0B;IACjD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAmD;IACrE,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,oBAAoB;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAwD;IACvF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,2BAA2B;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAItB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,0BAA0B;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IACzE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAwD;IACnF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAC1C,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAwD;IAClF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACjC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAWxB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA+C;IACtE,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAUxB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA6D;IACpF,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAIxB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B;IACzC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CACpB,IAAgF;IAClF,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAsD;IAC7E,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB;IAC5B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA+B;IACtD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAarB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,0BAA0B;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAuC;IAC9D,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAIvB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,2BAA2B;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC"}

package/dist/endpoints/index.d.ts

@@ -1,9 +1,13 @@
+export * from "./api-tokens.js";
 export * from "./auth.js";
 export * from "./me.js";
+export * from "./passkeys.js";
+export * from "./two-factor.js";
 export * from "./refresh-tokens.js";
 export * from "./admin-users.js";
 export * from "./admin-audit.js";
 export * from "./admin-keys.js";
 export * from "./health.js";
 export * from "./tenants.js";
+export * from "./projects.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/endpoints/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/endpoints/index.js

@@ -1,9 +1,13 @@
+export * from "./api-tokens.js";
 export * from "./auth.js";
 export * from "./me.js";
+export * from "./passkeys.js";
+export * from "./two-factor.js";
 export * from "./refresh-tokens.js";
 export * from "./admin-users.js";
 export * from "./admin-audit.js";
 export * from "./admin-keys.js";
 export * from "./health.js";
 export * from "./tenants.js";
+export * from "./projects.js";
 //# sourceMappingURL=index.js.map

package/dist/endpoints/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/endpoints/me.d.ts

@@ -1,7 +1,15 @@
 import type { Endpoint } from "../endpoint.js";
 import type { ApiError } from "../result.js";
-import type { MeResponse, TokenMintResponse, TokenRefreshResponse } from "../types.js";
+import type { MeResponse, TokenMintResponse, TokenRefreshResponse, UserMembership } from "../types.js";
 export declare const me: Endpoint<void, MeResponse, ApiError>;
+/**
+ * The caller's own tenant memberships — self-service counterpart of
+ * the admin-only `adminListUserTenants`, for org discovery before
+ * `setActiveTenant`.
+ */
+export declare const myTenants: Endpoint<void, {
+    memberships: UserMembership[];
+}, ApiError>;
 export declare const updateProfile: Endpoint<{
     name?: string;
     image?: string | null;
@@ -11,6 +19,11 @@ export declare const updateProfile: Endpoint<{
 export declare const mintToken: Endpoint<void, TokenMintResponse, ApiError>;
 export declare const refreshToken: Endpoint<{
     refreshToken: string;
+    /**
+     * The expiring access token — lets the rotation carry its active
+     * organization forward (membership re-validated server-side).
+     */
+    accessToken?: string;
 }, TokenRefreshResponse, ApiError>;
 /** Cookie-based refresh — no body needed, the httpOnly cookie carries the token. */
 export declare const refreshViaCookie: Endpoint<void, TokenRefreshResponse, ApiError>;

package/dist/endpoints/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/endpoints/me.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAKnD,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,QAAQ,CAClC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACxC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAKjE,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CACjC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EACxB,oBAAoB,EACpB,QAAQ,CAOT,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,CAMzE,CAAC"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/endpoints/me.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAKnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,CAC9B,IAAI,EACJ;IAAE,WAAW,EAAE,cAAc,EAAE,CAAA;CAAE,EACjC,QAAQ,CAMT,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,QAAQ,CAClC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACxC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,EACZ,QAAQ,CAOT,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAKjE,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAAQ,CACjC;IACE,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,oBAAoB,EACpB,QAAQ,CAOT,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,CAMzE,CAAC"}

package/dist/endpoints/me.js

@@ -5,6 +5,17 @@ export const me = {
     parseOutput: (data) => data,
     parseError: parseApiError,
 };
+/**
+ * The caller's own tenant memberships — self-service counterpart of
+ * the admin-only `adminListUserTenants`, for org discovery before
+ * `setActiveTenant`.
+ */
+export const myTenants = {
+    method: "GET",
+    path: () => "/api/me/tenants",
+    parseOutput: (data) => data,
+    parseError: parseApiError,
+};
 export const updateProfile = {
     method: "PATCH",
     path: () => "/api/me",

package/dist/endpoints/me.js.map

@@ -1 +1 @@
-{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/endpoints/me.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAO7C,MAAM,CAAC,MAAM,EAAE,GAAyC;IACtD,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAkB;IACzC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAItB;IACF,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAgD;IACpE,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB;IAC7B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAyB;IAChD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAIrB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAC3B;IACE,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB;IAC/B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC"}
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/endpoints/me.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C,MAAM,CAAC,MAAM,EAAE,GAAyC;IACtD,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAkB;IACzC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAIlB;IACF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB;IAC7B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAyC;IAChE,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAItB;IACF,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAgD;IACpE,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB;IAC7B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAyB;IAChD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAWrB;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAC3B;IACE,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB;IAC/B,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAA4B;IACnD,UAAU,EAAE,aAAa;CAC1B,CAAC"}