@picked/client 0.0.1-dev.1785305085063 → 0.0.1-dev.1785908062293

package/package.json

@@ -1,26 +1,25 @@
 {
   "name": "@picked/client",
-  "version": "0.0.1-dev.1785305085063",
+  "version": "0.0.1-dev.1785908062293",
   "dependencies": {
     "@withease/factories": "^1.0.5"
   },
   "devDependencies": {
     "@repo/eslint-config": "workspace:*",
     "@repo/typescript-config": "workspace:*",
-    "@rollup/plugin-replace": "^6.0.2",
-    "@size-limit/preset-small-lib": "^12.0.0",
-    "@testing-library/dom": "^10.4.0",
-    "@vitest/browser": "^4.1.8",
-    "@vitest/coverage-v8": "^4.1.8",
-    "effector": "^23.3.0",
-    "happy-dom": "^20.8.8",
-    "size-limit": "^12.0.0",
+    "@rollup/plugin-replace": "^6.0.3",
+    "@size-limit/preset-small-lib": "^12.1.0",
+    "@testing-library/dom": "^10.4.1",
+    "@vitest/browser": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.10",
+    "effector": "^23.4.4",
+    "happy-dom": "^20.11.1",
+    "size-limit": "^12.1.0",
     "tslib": "^2.8.1",
-    "typedoc": "^0.28.5",
-    "typedoc-plugin-markdown": "^4.6.3",
-    "vite": "^8.0.8",
-    "vite-plugin-dts": "^4.5.4",
-    "vitest": "^4.1.8"
+    "typedoc": "^0.28.20",
+    "typedoc-plugin-markdown": "^4.12.0",
+    "vite": "^8.2.0",
+    "vitest": "^4.1.10"
   },
   "exports": {
     ".": {
@@ -117,11 +116,11 @@
       "eslint.config.js"
     ],
     "ignoreBinaries": [
-      "knip",
-      "jscpd",
+      "attw",
       "eslint",
-      "tsgo",
-      "attw"
+      "jscpd",
+      "knip",
+      "tsgo"
     ],
     "exclude": [
       "duplicates"
@@ -148,20 +147,20 @@
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
   "peerDependencies": {
-    "effector": "^23.3.0"
+    "effector": "^23.4.4"
   },
   "private": false,
   "scripts": {
-    "build": "vite build && node scripts/copy-docs.js",
+    "build": "vite build && tsgo -p tsconfig.build.json && node scripts/copy-docs.js",
     "build:docs": "pnpm typedoc",
     "check": "pnpm type-check && pnpm lint && pnpm knip && pnpm jscpd",
-    "dev": "vite build --watch",
+    "dev": "node ../../scripts/sdk-watch-build.mjs -- node scripts/copy-docs.js",
     "jscpd": "jscpd src",
     "knip": "knip",
-    "lint": "if [ \"$AGENT\" = \"true\" ]; then echo \"[AGENT HINT] Prefer running lint on specific files from the repo root: node scripts/lint-files.js <files>\"; fi && eslint .",
+    "lint": "if [ \"$AGENT\" = \"true\" ]; then echo \"[AGENT HINT] Prefer running lint on specific files from the repo root: node scripts/lint-files.js <files>\"; fi && eslint . --cache --cache-location node_modules/.cache/eslint",
     "lint-files": "eslint",
     "lint:format": "eslint . --fix",
-    "lint:report": "eslint . -o './.reports/eslint.json' -f json || [ -f './.reports/eslint.json' ]",
+    "lint:report": "eslint . --cache --cache-location node_modules/.cache/eslint -o './.reports/eslint.json' -f json || [ -f './.reports/eslint.json' ]",
     "size": "size-limit",
     "test": "vitest run",
     "test:coverage": "../../scripts/vitest-coverage.sh",

package/dist/api-CPL40b7A.js

@@ -1,40 +0,0 @@
-//#region src/utils/client-headers.ts
-var e = "Picked-Client", t = "Picked-Version";
-function n(n, r) {
-	return {
-		[e]: n,
-		[t]: r
-	};
-}
-//#endregion
-//#region src/utils/version.ts
-var r = () => "0.0.1-dev.1785305085063", i = "v1";
-function a(e, t) {
-	return new URL(`/api/${i}/${t}`, e).toString();
-}
-function o(e) {
-	return {
-		...n("sdk", r()),
-		...e
-	};
-}
-async function s(e, t, n, r) {
-	let i = a(e, t);
-	return fetch(i, {
-		headers: o(n),
-		signal: r
-	});
-}
-async function c(e, t, n, r) {
-	let i = a(e, t);
-	return fetch(i, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...o(r)
-		},
-		body: JSON.stringify(n)
-	});
-}
-//#endregion
-export { n as i, c as n, r, s as t };

package/dist/api-Dz5rgRgQ.cjs

@@ -1 +0,0 @@
-var e=`Picked-Client`,t=`Picked-Version`;function n(n,r){return{[e]:n,[t]:r}}var r=()=>`0.0.1-dev.1785305085063`,i=`v1`;function a(e,t){return new URL(`/api/${i}/${t}`,e).toString()}function o(e){return{...n(`sdk`,r()),...e}}async function s(e,t,n,r){let i=a(e,t);return fetch(i,{headers:o(n),signal:r})}async function c(e,t,n,r){let i=a(e,t);return fetch(i,{method:`POST`,headers:{"Content-Type":`application/json`,...o(r)},body:JSON.stringify(n)})}Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return s}});

package/dist/docs/actions.mdx

@@ -1,78 +0,0 @@
----
-layout: docs
----
-
-import { Screenshot } from '../../components/Screenshot'
-
-# Actions
-
-An action is a side effect that triggers when the flow reaches it. Use actions for tasks like tracking events, sending data to external services, or triggering webhooks.
-
-<Screenshot
-  route="/{orgSlug}/{projectId}/workspaces/{workspaceId}/actions"
-  alt="The actions list for a workspace on the Picked dashboard"
-/>
-
-## Create an action
-
-1. Open your project.
-2. Click **Actions** in the sidebar.
-3. Click **New Action**.
-4. Enter a name and key.
-5. Click **Create**.
-
-The key is a unique identifier used in your application. It's set once and can't be changed later.
-
-## Configure an action
-
-**Name**: The display name shown in the dashboard. Not visible to visitors.
-
-**Key**: The programmatic identifier your application uses to reference this action. Not visible to visitors.
-
-## Register in your application
-
-Actions must be registered when creating the Picked client. Pass an `actions` object where each key matches an action key from the dashboard:
-
-```typescript
-import { createClient } from '@picked/client'
-
-const picked = createClient({
-  projectId: 'your-project-id',
-  actions: {
-    'track-signup': () => {
-      analytics.track('signup_completed')
-    },
-    'notify': (params) => {
-      sendNotification(params)
-    },
-    'check-eligibility': async () => {
-      const response = await fetch('/api/eligibility')
-      // Throw only when the request itself fails — that takes the failure branch.
-      if (!response.ok) throw new Error('Eligibility request failed')
-    },
-  },
-})
-```
-
-Each action is a function that receives optional parameters and usually runs a side effect. When the flow reaches an action node, the SDK calls the matching function and branches on whether it succeeds or throws — see [Success and failure branching](#success-and-failure-branching).
-
-See [SDK Actions](/sdk/actions) for more details.
-
-## Use actions in flows
-
-In the flow builder, drag an action from the entity browser onto the canvas. Connect it to the point in the flow where you want it to trigger.
-
-Actions execute when the flow reaches their node. They don't interrupt the visitor's experience — by default the flow continues to the next connected node.
-
-### Success and failure branching
-
-An action node can have two outgoing branches: **success** and **failure**. The SDK chooses the branch from the action's outcome:
-
-- **Failure** — the action throws (or its promise rejects). The flow follows the failure branch.
-- **Success** — the action resolves to any value: nothing, `true`, `false`, or a string. A returned `false` is a valid response, not a failure. The flow follows the success branch.
-
-Reserve the failure branch for genuine errors — throw on the failure case, for example `if (!response.ok) throw new Error(...)`. A valid negative result is _not_ a failure: an API that returns `200` with, say, `{ serviced: false }` should record that value as a response and branch on it with a condition rather than throw. If an action node has only a single plain connection (no explicit success or failure branch), the flow continues through it on either outcome.
-
-## Reuse actions
-
-Actions are project-level entities. Use the same action in multiple experience flows. Changes to an action's configuration apply everywhere it's used.

package/dist/docs/api/authentication.md

@@ -1,376 +0,0 @@
----
-layout: docs
----
-
-# Authentication
-
-The Picked API supports multiple authentication methods: email/password sessions, OAuth providers, magic links, and API keys. This guide covers each method and explains how to manage sessions and multi-factor authentication (MFA).
-
-## Email and password login
-
-The `sessionCreate` mutation authenticates a user with email and password and returns a session.
-
-```graphql
-mutation {
-  sessionCreate(input: {
-    email: "user@example.com"
-    password: "secure-password"
-  }) {
-    session {
-      accessToken
-      refreshToken
-      expiresAt
-      user {
-        id
-        email
-      }
-      aal
-    }
-    requiresMfa
-    mfaFactors {
-      id
-      factorType
-      status
-    }
-  }
-}
-```
-
-If the user has MFA enabled, the response sets `requiresMfa` to `true` and returns the enrolled `mfaFactors`. The caller must complete an MFA challenge before receiving a fully authenticated session. See the [MFA](#multi-factor-authentication-mfa) section below.
-
-If MFA is not enabled, the response includes a `session` with an `accessToken`, a `refreshToken`, and an `expiresAt` timestamp.
-
-## Account creation
-
-New accounts are created with the `accountCreate` mutation:
-
-```graphql
-mutation {
-  accountCreate(input: {
-    email: "newuser@example.com"
-    password: "secure-password"
-    metadata: { firstName: "Jane", lastName: "Doe" }
-  }) {
-    user {
-      id
-      email
-    }
-    session {
-      accessToken
-      refreshToken
-    }
-  }
-}
-```
-
-The `metadata` field is optional and accepts arbitrary JSON for storing profile information. When email verification is required, the returned session is `null` until the email is verified.
-
-## Email verification
-
-After account creation, the user receives a verification email containing a token. The `accountVerifyEmail` mutation completes verification:
-
-```graphql
-mutation {
-  accountVerifyEmail(input: {
-    email: "newuser@example.com"
-    token: "verification-token-from-email"
-  }) {
-    session {
-      accessToken
-      refreshToken
-    }
-  }
-}
-```
-
-If the verification email needs to be resent:
-
-```graphql
-mutation {
-  accountResendVerification(input: {
-    email: "newuser@example.com"
-  }) {
-    success
-  }
-}
-```
-
-## OAuth flow (Google)
-
-The API supports Google as an OAuth provider. The flow has two steps.
-
-### Step 1: Get the authorization URL
-
-```graphql
-mutation {
-  oauthAuthorize(input: {
-    provider: GOOGLE
-    redirectUrl: "https://app.example.com/auth/callback"
-    scopes: ["openid", "email", "profile"]
-  }) {
-    url
-  }
-}
-```
-
-The caller redirects the user to the returned `url`. After the user authenticates with Google, they are redirected back to a URL on the same dashboard deployment with a `code` parameter, where the caller exchanges it for a session.
-
-### Step 2: Exchange the code for a session
-
-```graphql
-mutation {
-  oauthCallback(input: {
-    provider: GOOGLE
-    code: "auth-code-from-google"
-  }) {
-    session {
-      accessToken
-      refreshToken
-      expiresAt
-    }
-  }
-}
-```
-
-## Magic links
-
-Magic links allow passwordless authentication via email.
-
-### Send a magic link
-
-```graphql
-mutation {
-  magicLinkSend(input: {
-    email: "user@example.com"
-    redirectUrl: "https://app.example.com/auth/verify"
-  }) {
-    success
-  }
-}
-```
-
-The user receives an email containing a link with a token.
-
-### Verify the magic link
-
-```graphql
-mutation {
-  magicLinkVerify(input: {
-    email: "user@example.com"
-    token: "token-from-magic-link"
-  }) {
-    session {
-      accessToken
-      refreshToken
-    }
-  }
-}
-```
-
-## Password management
-
-### Reset a forgotten password
-
-Send a password reset email:
-
-```graphql
-mutation {
-  passwordResetSend(input: {
-    email: "user@example.com"
-    redirectUrl: "https://app.example.com/reset-password"
-  }) {
-    success
-  }
-}
-```
-
-Complete the reset with the token from the email:
-
-```graphql
-mutation {
-  passwordReset(input: {
-    email: "user@example.com"
-    token: "reset-token-from-email"
-    newPassword: "new-secure-password"
-  }) {
-    session {
-      accessToken
-      refreshToken
-    }
-  }
-}
-```
-
-### Update an existing password
-
-This mutation requires authentication:
-
-```graphql
-mutation {
-  passwordUpdate(input: {
-    currentPassword: "old-password"
-    newPassword: "new-secure-password"
-  }) {
-    success
-  }
-}
-```
-
-## Multi-factor authentication (MFA)
-
-MFA adds a second layer of security using phone-based verification. The API supports enrolling, challenging, verifying, and unenrolling MFA factors. All MFA mutations require authentication.
-
-### Enroll a factor
-
-```graphql
-mutation {
-  mfaFactorEnroll(input: {
-    factorType: PHONE
-    phone: "+15551234567"
-    friendlyName: "My Phone"
-  }) {
-    factor {
-      id
-      factorType
-      status
-    }
-  }
-}
-```
-
-A newly enrolled factor has a status of `UNVERIFIED` until confirmed via a challenge.
-
-### Send a challenge
-
-```graphql
-mutation {
-  mfaChallengeSend(input: {
-    factorId: "factor-id"
-  }) {
-    challengeId
-  }
-}
-```
-
-This sends a verification code to the enrolled phone number.
-
-### Verify the challenge
-
-```graphql
-mutation {
-  mfaChallengeVerify(input: {
-    factorId: "factor-id"
-    challengeId: "challenge-id"
-    code: "123456"
-  }) {
-    session {
-      accessToken
-      refreshToken
-      aal
-    }
-  }
-}
-```
-
-On success, the session is upgraded to Authenticator Assurance Level `AAL2`. The factor status changes to `VERIFIED`.
-
-### Unenroll a factor
-
-```graphql
-mutation {
-  mfaFactorUnenroll(input: {
-    factorId: "factor-id"
-  }) {
-    success
-  }
-}
-```
-
-## Using a session
-
-After obtaining a session, the caller includes the access token in the `Authorization` header of every authenticated request:
-
-```
-Authorization: Bearer <accessToken>
-```
-
-The `expiresAt` field on the session indicates when the access token expires. The caller should refresh the session before the token expires.
-
-### Authenticator assurance levels
-
-The session includes an `aal` field indicating the authentication strength:
-
-| Level | Meaning |
-|-------|---------|
-| `AAL1` | Single-factor authentication (email/password, OAuth, or magic link) |
-| `AAL2` | Multi-factor authentication (MFA challenge completed) |
-
-Some operations may require `AAL2`. If a caller with `AAL1` attempts such an operation, the API returns an authorization error.
-
-## Session refresh
-
-Access tokens are short-lived. The `sessionRefresh` mutation exchanges a refresh token for a new session:
-
-```graphql
-mutation {
-  sessionRefresh(input: {
-    refreshToken: "v1.refresh-token..."
-  }) {
-    session {
-      accessToken
-      refreshToken
-      expiresAt
-    }
-  }
-}
-```
-
-The response includes a new `accessToken` and a new `refreshToken`. The previous refresh token is invalidated. This mutation does not require the `Authorization` header.
-
-## API key authentication
-
-API keys provide long-lived, scoped access to the API. They are typically used for server-to-server integrations and automated workflows.
-
-To authenticate with an API key, include it in the `x-api-key` header:
-
-```
-x-api-key: pk_live_abc123...
-```
-
-API keys are scoped to an organization and optionally to a specific project. They carry a defined set of [authorization scopes](./authorization-and-scopes.md) that determine which operations the key can perform.
-
-See [API Keys](/api-keys) for managing keys from the dashboard UI.
-
-### Creating an API key
-
-The `apiKeyCreate` mutation creates a new API key. This mutation is only available to session-authenticated users (not other API keys):
-
-```graphql
-mutation {
-  apiKeyCreate(input: {
-    organizationId: "org-id"
-    name: "CI/CD Pipeline Key"
-    projectId: "project-id"
-    scopes: [ORGANIZATION_READ, ORGANIZATION_PROJECTS_READ]
-  }) {
-    apiKey
-  }
-}
-```
-
-The full API key string is returned only once in the response. Store it securely; it cannot be retrieved again.
-
-The requested scopes must be a subset of the creating user's scopes. See [Authorization and Scopes](./authorization-and-scopes.md) for more details.
-
-### Revoking an API key
-
-```graphql
-mutation {
-  apiKeyRevoke(input: {
-    keyId: "key-id"
-    organizationId: "org-id"
-  })
-}
-```
-
-Revoked keys are immediately invalidated and cannot be used for further requests.