@protobase/client 0.46.2 → 0.46.3

package/dist/account-profile.d.ts

@@ -0,0 +1,17 @@
+//#region src/account-profile.d.ts
+/**
+ * A browser or app signed in to the account: its session token (to sign it out), whether it is this one, its user agent
+ * and IP address when known, when it signed in, was last active and expires, and the staff member's address for a
+ * staff session.
+ */
+export type DeviceSession = {
+  token: string;
+  current: boolean;
+  userAgent?: string;
+  ipAddress?: string;
+  createdAt: string;
+  updatedAt: string;
+  expiresAt: string;
+  staff?: string;
+};
+//#endregion

package/dist/account-profile.js

@@ -0,0 +1,50 @@
+import { authError } from "./auth-error.js";
+//#region src/account-profile.ts
+const isoDate = (value) => new Date(value).toISOString();
+/** The signed-in person's name, password and signed-in devices. Each call rejects with `AuthError`. */
+const accountProfile = (client) => ({
+	updateName: async (name) => {
+		const { error } = await client.updateUser({ name });
+		if (error) throw authError(error, "Could not change your name");
+	},
+	/** Changes the password, which the account must have; `signOutOthers` signs out every other device, this one stays signed in. */
+	changePassword: async (current, next, signOutOthers) => {
+		const { error } = await client.changePassword({
+			currentPassword: current,
+			newPassword: next,
+			revokeOtherSessions: signOutOthers
+		});
+		if (error) throw authError(error, "Could not change your password");
+	},
+	/** The devices signed in now, with this one marked `current`. */
+	sessions: async () => {
+		const [list, own] = await Promise.all([client.listSessions(), client.getSession()]);
+		if (list.error || !list.data) throw authError(list.error, "Could not read your devices");
+		const currentToken = own.data?.session.token;
+		return list.data.map((session) => {
+			const staff = session.impersonatedBy;
+			return {
+				token: session.token,
+				current: session.token === currentToken,
+				...session.userAgent && { userAgent: session.userAgent },
+				...session.ipAddress && { ipAddress: session.ipAddress },
+				createdAt: isoDate(session.createdAt),
+				updatedAt: isoDate(session.updatedAt),
+				expiresAt: isoDate(session.expiresAt),
+				...staff && { staff }
+			};
+		});
+	},
+	/** Signs out one device, by its session token from `sessions`. */
+	revokeSession: async (token) => {
+		const { error } = await client.revokeSession({ token });
+		if (error) throw authError(error, "Could not sign out the device");
+	},
+	/** Signs out every device but this one. */
+	revokeOtherSessions: async () => {
+		const { error } = await client.revokeOtherSessions();
+		if (error) throw authError(error, "Could not sign out your other devices");
+	}
+});
+//#endregion
+export { accountProfile };

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { DeviceSession } from "./account-profile.js";
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey } from "./account-security.js";
 import { ConnectingClient } from "./connect.js";
@@ -23,7 +24,7 @@ export type AuthSessionOptions = {
 export declare const tokenExpiry: (token: string) => number;
 /**
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
- * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
+ * account with two-factor authentication), the account's name, password, devices, passkeys and two-factor authentication (`account`), the
  * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
  * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
@@ -50,6 +51,11 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
   /** Sets a new password with the token from a reset link; the link works once. */
   resetPassword: (token: string, newPassword: string) => Promise<void>;
   account: {
+    updateName: (name: string) => Promise<void>;
+    changePassword: (current: string, next: string, signOutOthers: boolean) => Promise<void>;
+    sessions: () => Promise<DeviceSession[]>;
+    revokeSession: (token: string) => Promise<void>;
+    revokeOtherSessions: () => Promise<void>;
     signInMethods: () => Promise<AccountSignIn>;
     passkeys: () => Promise<Passkey[]>;
     addPasskey: (name?: string) => Promise<void>;

package/dist/auth.js

@@ -1,4 +1,5 @@
 import { AuthError, authError } from "./auth-error.js";
+import { accountProfile } from "./account-profile.js";
 import { accountSecurity } from "./account-security.js";
 import { connectClient } from "./connect.js";
 import { betterAuthClient } from "./better-auth-client.js";
@@ -20,7 +21,7 @@ const tokenExpiry = (token) => {
 };
 /**
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
-* account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
+* account with two-factor authentication), the account's name, password, devices, passkeys and two-factor authentication (`account`), the
 * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
 * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
@@ -150,7 +151,10 @@ const createAuthSession = (options = {}) => {
 			});
 			if (error) throw authError(error, "Could not set the password");
 		},
-		account: accountSecurity(client),
+		account: {
+			...accountSecurity(client),
+			...accountProfile(client)
+		},
 		connect: connectClient(client),
 		organizations: organizationsClient(client, () => token({ refresh: true })),
 		roles: rolesClient(client, () => token({ refresh: true })),

package/dist/index.d.ts

@@ -10,6 +10,7 @@ import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiE
 import { fileUrl } from "./file-urls.js";
 import { routedClient } from "./routed-client.js";
 import { SourceMeta, sourceMeta } from "./source-meta.js";
+import { DeviceSession } from "./account-profile.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey, RequiredSetup } from "./account-security.js";
 import { ConnectClient, ConnectingClient } from "./connect.js";
@@ -23,4 +24,4 @@ import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimeLastUpdate, RuntimePolicy, RuntimeStatus, RuntimeUpdateStage, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type ConnectClient, type ConnectedApp, type ConnectingClient, type CurrentOrganization, type DevicesClient, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InboxNotification, type InboxPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type NotificationHistoryClient, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RegisteredDevice, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, type WebDeviceRegistration, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type ConnectClient, type ConnectedApp, type ConnectingClient, type CurrentOrganization, type DeviceSession, type DevicesClient, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InboxNotification, type InboxPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type NotificationHistoryClient, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RegisteredDevice, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, type WebDeviceRegistration, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/static-session.d.ts

@@ -3,8 +3,9 @@ import { AuthSession } from "./auth.js";
 //#region src/static-session.d.ts
 /**
  * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
- * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
- * passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
+ * It never refreshes, so use a token that outlives the run. Its account has nothing to set up and no devices, and it
+ * cannot change its name, password, passkeys, two-factor authentication, the sign-in policy, organizations or its role,
+ * and is never a staff session.
  */
 export declare const createStaticSession: (token: string, user?: AuthUser) => AuthSession;
 //#endregion

package/dist/static-session.js

@@ -5,8 +5,9 @@ const unsupported = (what) => async () => {
 };
 /**
 * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
-* It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
-* passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
+* It never refreshes, so use a token that outlives the run. Its account has nothing to set up and no devices, and it
+* cannot change its name, password, passkeys, two-factor authentication, the sign-in policy, organizations or its role,
+* and is never a staff session.
 */
 const createStaticSession = (token, user = {
 	id: "token",
@@ -74,7 +75,12 @@ const createStaticSession = (token, user = {
 		linkedProviders: async () => [],
 		linkProvider: unsupported("link a sign-in provider"),
 		connectedApps: async () => [],
-		disconnectApp: unsupported("disconnect an app")
+		disconnectApp: unsupported("disconnect an app"),
+		updateName: unsupported("change its name"),
+		changePassword: unsupported("change its password"),
+		sessions: async () => [],
+		revokeSession: unsupported("sign out a device"),
+		revokeOtherSessions: unsupported("sign out other devices")
 	},
 	connect: {
 		client: unsupported("allow an app"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.46.2",
+  "version": "0.46.3",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.12",
-    "@protobase/layout": "0.46.2",
-    "@protobase/schema": "0.46.2",
+    "@protobase/layout": "0.46.3",
+    "@protobase/schema": "0.46.3",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.12"
   }