@protobase/client 0.46.2 → 0.46.4

package/dist/account-profile.d.ts

@@ -0,0 +1,17 @@
+//#region src/account-profile.d.ts
+/**
+ * A browser or app signed in to the account: its session token (to sign it out), whether it is this one, its user agent
+ * and IP address when known, when it signed in, was last active and expires, and the staff member's address for a
+ * staff session.
+ */
+export type DeviceSession = {
+  token: string;
+  current: boolean;
+  userAgent?: string;
+  ipAddress?: string;
+  createdAt: string;
+  updatedAt: string;
+  expiresAt: string;
+  staff?: string;
+};
+//#endregion

package/dist/account-profile.js

@@ -0,0 +1,83 @@
+import { authError } from "./auth-error.js";
+//#region src/account-profile.ts
+const isoDate = (value) => new Date(value).toISOString();
+/** The signed-in person's name, address, password and signed-in devices. Each call rejects with `AuthError`. */
+const accountProfile = (client) => ({
+	updateName: async (name) => {
+		const { error } = await client.updateUser({ name });
+		if (error) throw authError(error, "Could not change your name");
+	},
+	/** Changes the password, which the account must have; `signOutOthers` signs out every other device, this one stays signed in. */
+	changePassword: async (current, next, signOutOthers) => {
+		const { error } = await client.changePassword({
+			currentPassword: current,
+			newPassword: next,
+			revokeOtherSessions: signOutOthers
+		});
+		if (error) throw authError(error, "Could not change your password");
+	},
+	/**
+	* Gives an account without a password, such as one that signs in with emailed codes or GitHub, its first one; every
+	* device stays signed in. One that has a password already is refused (`PASSWORD_ALREADY_SET`).
+	*/
+	setPassword: async (next) => {
+		const { error } = await client.$fetch("/account/set-password", {
+			method: "POST",
+			body: { newPassword: next }
+		});
+		if (error) throw authError(error, "Could not set your password");
+	},
+	/**
+	* Mails a code to `newEmail` that moves the account to it, when the server has mail (`status().changeEmail`). The answer
+	* is the same when another account has the address, which then gets no code.
+	*/
+	requestEmailChange: async (newEmail) => {
+		const { error } = await client.$fetch("/email-otp/request-email-change", {
+			method: "POST",
+			body: { newEmail }
+		});
+		if (error) throw authError(error, "Could not send the code");
+	},
+	/** Moves the account to `newEmail` with the code mailed there; this device stays signed in, with the new address. */
+	changeEmail: async (newEmail, code) => {
+		const { error } = await client.$fetch("/email-otp/change-email", {
+			method: "POST",
+			body: {
+				newEmail,
+				otp: code
+			}
+		});
+		if (error) throw authError(error, "Could not change your address");
+	},
+	/** The devices signed in now, with this one marked `current`. */
+	sessions: async () => {
+		const [list, own] = await Promise.all([client.listSessions(), client.getSession()]);
+		if (list.error || !list.data) throw authError(list.error, "Could not read your devices");
+		const currentToken = own.data?.session.token;
+		return list.data.map((session) => {
+			const staff = session.impersonatedBy;
+			return {
+				token: session.token,
+				current: session.token === currentToken,
+				...session.userAgent && { userAgent: session.userAgent },
+				...session.ipAddress && { ipAddress: session.ipAddress },
+				createdAt: isoDate(session.createdAt),
+				updatedAt: isoDate(session.updatedAt),
+				expiresAt: isoDate(session.expiresAt),
+				...staff && { staff }
+			};
+		});
+	},
+	/** Signs out one device, by its session token from `sessions`. */
+	revokeSession: async (token) => {
+		const { error } = await client.revokeSession({ token });
+		if (error) throw authError(error, "Could not sign out the device");
+	},
+	/** Signs out every device but this one. */
+	revokeOtherSessions: async () => {
+		const { error } = await client.revokeOtherSessions();
+		if (error) throw authError(error, "Could not sign out your other devices");
+	}
+});
+//#endregion
+export { accountProfile };

package/dist/auth-types.d.ts

@@ -31,7 +31,8 @@ export type SamlSignIn = {
 };
 /**
  * `needsAdmin` while no user exists yet; `signInMethods` the ways to sign in the server's policy leaves on;
- * `passwordReset` when the server can email reset links; `signUp` when anyone can make their own account (see
+ * `passwordReset` when the server can email reset links; `changeEmail` when it can email the code that confirms a new
+ * address (see `account.requestEmailChange`); `signUp` when anyone can make their own account (see
  * `sendSignUpCode`); `socialProviders` the ids of the sign-in providers, for example
  * `github`; `platformSignIn` the one of them the platform adds; `samlProviders` the app's SAML identity providers; `staffSignIn` the operator provider's name when its staff
  * can sign in as people; `organizations` when the app has them; `anonymous` when visitors may browse what the project's
@@ -43,6 +44,7 @@ export type SetupStatus = {
   needsAdmin: boolean;
   signInMethods: SignInMethod[];
   passwordReset: boolean;
+  changeEmail?: boolean;
   signUp?: boolean;
   socialProviders: string[];
   platformSignIn?: PlatformSignIn;

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { DeviceSession } from "./account-profile.js";
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey } from "./account-security.js";
 import { ConnectingClient } from "./connect.js";
@@ -23,7 +24,7 @@ export type AuthSessionOptions = {
 export declare const tokenExpiry: (token: string) => number;
 /**
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
- * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
+ * account with two-factor authentication), the account's name, password, devices, passkeys and two-factor authentication (`account`), the
  * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
  * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
@@ -50,6 +51,14 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
   /** Sets a new password with the token from a reset link; the link works once. */
   resetPassword: (token: string, newPassword: string) => Promise<void>;
   account: {
+    updateName: (name: string) => Promise<void>;
+    changePassword: (current: string, next: string, signOutOthers: boolean) => Promise<void>;
+    setPassword: (next: string) => Promise<void>;
+    requestEmailChange: (newEmail: string) => Promise<void>;
+    changeEmail: (newEmail: string, code: string) => Promise<void>;
+    sessions: () => Promise<DeviceSession[]>;
+    revokeSession: (token: string) => Promise<void>;
+    revokeOtherSessions: () => Promise<void>;
     signInMethods: () => Promise<AccountSignIn>;
     passkeys: () => Promise<Passkey[]>;
     addPasskey: (name?: string) => Promise<void>;

package/dist/auth.js

@@ -1,4 +1,5 @@
 import { AuthError, authError } from "./auth-error.js";
+import { accountProfile } from "./account-profile.js";
 import { accountSecurity } from "./account-security.js";
 import { connectClient } from "./connect.js";
 import { betterAuthClient } from "./better-auth-client.js";
@@ -20,7 +21,7 @@ const tokenExpiry = (token) => {
 };
 /**
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
-* account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
+* account with two-factor authentication), the account's name, password, devices, passkeys and two-factor authentication (`account`), the
 * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
 * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
@@ -76,6 +77,7 @@ const createAuthSession = (options = {}) => {
 				needsAdmin: Boolean(body.needsAdmin),
 				signInMethods: body.signInMethods ?? ["password"],
 				passwordReset: Boolean(body.passwordReset),
+				...body.changeEmail && { changeEmail: true },
 				...body.signUp && { signUp: true },
 				socialProviders: body.socialProviders ?? [],
 				...body.platformSignIn && { platformSignIn: body.platformSignIn },
@@ -150,7 +152,10 @@ const createAuthSession = (options = {}) => {
 			});
 			if (error) throw authError(error, "Could not set the password");
 		},
-		account: accountSecurity(client),
+		account: {
+			...accountSecurity(client),
+			...accountProfile(client)
+		},
 		connect: connectClient(client),
 		organizations: organizationsClient(client, () => token({ refresh: true })),
 		roles: rolesClient(client, () => token({ refresh: true })),

package/dist/index.d.ts

@@ -10,6 +10,7 @@ import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiE
 import { fileUrl } from "./file-urls.js";
 import { routedClient } from "./routed-client.js";
 import { SourceMeta, sourceMeta } from "./source-meta.js";
+import { DeviceSession } from "./account-profile.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey, RequiredSetup } from "./account-security.js";
 import { ConnectClient, ConnectingClient } from "./connect.js";
@@ -23,4 +24,4 @@ import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimeLastUpdate, RuntimePolicy, RuntimeStatus, RuntimeUpdateStage, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type ConnectClient, type ConnectedApp, type ConnectingClient, type CurrentOrganization, type DevicesClient, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InboxNotification, type InboxPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type NotificationHistoryClient, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RegisteredDevice, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, type WebDeviceRegistration, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type ConnectClient, type ConnectedApp, type ConnectingClient, type CurrentOrganization, type DeviceSession, type DevicesClient, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InboxNotification, type InboxPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type NotificationHistoryClient, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RegisteredDevice, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, type WebDeviceRegistration, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/static-session.d.ts

@@ -3,8 +3,9 @@ import { AuthSession } from "./auth.js";
 //#region src/static-session.d.ts
 /**
  * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
- * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
- * passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
+ * It never refreshes, so use a token that outlives the run. Its account has nothing to set up and no devices, and it
+ * cannot change its name, password, passkeys, two-factor authentication, the sign-in policy, organizations or its role,
+ * and is never a staff session.
  */
 export declare const createStaticSession: (token: string, user?: AuthUser) => AuthSession;
 //#endregion

package/dist/static-session.js

@@ -5,8 +5,9 @@ const unsupported = (what) => async () => {
 };
 /**
 * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
-* It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
-* passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
+* It never refreshes, so use a token that outlives the run. Its account has nothing to set up and no devices, and it
+* cannot change its name, password, passkeys, two-factor authentication, the sign-in policy, organizations or its role,
+* and is never a staff session.
 */
 const createStaticSession = (token, user = {
 	id: "token",
@@ -74,7 +75,15 @@ const createStaticSession = (token, user = {
 		linkedProviders: async () => [],
 		linkProvider: unsupported("link a sign-in provider"),
 		connectedApps: async () => [],
-		disconnectApp: unsupported("disconnect an app")
+		disconnectApp: unsupported("disconnect an app"),
+		updateName: unsupported("change its name"),
+		changePassword: unsupported("change its password"),
+		setPassword: unsupported("set its password"),
+		requestEmailChange: unsupported("change its address"),
+		changeEmail: unsupported("change its address"),
+		sessions: async () => [],
+		revokeSession: unsupported("sign out a device"),
+		revokeOtherSessions: unsupported("sign out other devices")
 	},
 	connect: {
 		client: unsupported("allow an app"),

package/dist/types.d.ts

@@ -261,6 +261,7 @@ export type Meta = {
   resources: ResourceModel[];
   views: ViewModel[];
   pages?: PageModel[];
+  account?: PageModel;
   permissions?: Record<string, ResourcePermissions>;
   userMenu?: UserMenuModel;
   signIn?: SignInViewModel[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.46.2",
+  "version": "0.46.4",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.12",
-    "@protobase/layout": "0.46.2",
-    "@protobase/schema": "0.46.2",
+    "@protobase/layout": "0.46.4",
+    "@protobase/schema": "0.46.4",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.12"
   }