@rebasepro/client 0.21.2-canary.g1ea48be → 0.23.0

package/dist/admin.d.ts

@@ -4,17 +4,22 @@ export type { AdminUser };
 export interface CreateAdminOptions {
     adminPath?: string;
 }
+/** The window and filter `GET /admin/users` takes. */
+export interface ListUsersOptions {
+    search?: string;
+    limit?: number;
+    offset?: number;
+    orderBy?: string;
+    orderDir?: "asc" | "desc";
+}
 export declare function createAdmin(transport: Transport, options?: CreateAdminOptions): {
-    listUsers: () => Promise<{
+    listUsers: (options?: ListUsersOptions) => Promise<{
         users: AdminUser[];
+        total: number;
+        limit: number;
+        offset: number;
     }>;
-    listUsersPaginated: (options?: {
-        search?: string;
-        limit?: number;
-        offset?: number;
-        orderBy?: string;
-        orderDir?: "asc" | "desc";
-    }) => Promise<{
+    listUsersPaginated: (options?: ListUsersOptions) => Promise<{
         users: AdminUser[];
         total: number;
         limit: number;

package/dist/auth.d.ts

@@ -34,6 +34,17 @@ export interface CreateAuthOptions {
      */
     authFlowMode?: "json" | "cookie";
 }
+/**
+ * Finishing a sign-in that the server refused with `MFA_REQUIRED`.
+ *
+ * That refusal carries `details.mfaToken` — proof the first factor was
+ * accepted, good for five minutes and for nothing but the two challenge routes
+ * — and `details.factors`, the factors the account can answer with.
+ */
+export interface MfaPendingOptions {
+    /** `details.mfaToken` of the `MFA_REQUIRED` refusal. */
+    mfaToken?: string;
+}
 export declare function createAuth(transport: Transport, options?: CreateAuthOptions): {
     signInWithEmail: (email: string, password: string) => Promise<{
         user: User;
@@ -184,8 +195,15 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
             success: boolean;
             message: string;
         }>;
-        /** Open a challenge against a verified factor. Expires in five minutes. */
-        challenge(factorId: string): Promise<{
+        /**
+         * Open a challenge against a verified factor. Expires in five minutes.
+         *
+         * Pass `mfaToken` to finish a sign-in that was refused with
+         * `MFA_REQUIRED`: it is the `details.mfaToken` of that refusal, and the
+         * challenge is opened with it as this one request's credential. Without
+         * it, the challenge steps up the session this client already holds.
+         */
+        challenge(factorId: string, options?: MfaPendingOptions): Promise<{
             challengeId: string;
             factorId: string;
             expiresAt: string;
@@ -194,10 +212,11 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
          * Answer a challenge with a TOTP code or a recovery code.
          *
          * This is where an MFA-enrolled account's real session is minted, at
-         * `aal2` — so the returned tokens replace the ones the sign-in handed
-         * back, and this client adopts them.
+         * `aal2` — so this client adopts the returned tokens and announces
+         * `SIGNED_IN`, exactly as any other sign-in does. Pass the same
+         * `mfaToken` the challenge was opened with when finishing a sign-in.
          */
-        verifyChallenge(challengeId: string, code: string): Promise<{
+        verifyChallenge(challengeId: string, code: string, options?: MfaPendingOptions): Promise<{
             user: User;
             accessToken: string;
             refreshToken: string;
@@ -229,6 +248,11 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         success: boolean;
         provider: string;
         alreadyLinked: boolean;
+        /**
+         * The provider's profile picture, when it has one. Usually a signed
+         * URL with an expiry, so copy the bytes rather than storing this.
+         */
+        photoURL?: string | null;
     }>;
     sendVerificationEmail: () => Promise<{
         success: boolean;

package/dist/backups.d.ts

@@ -1,5 +1,5 @@
 import { Transport } from "./transport.js";
-import type { BackupInfo, BackupDestinationKind } from "@rebasepro/types";
+import { type BackupInfo, type BackupDestinationKind } from "@rebasepro/types";
 export interface CreateBackupsOptions {
     backupsPath?: string;
 }

package/dist/index.d.ts

@@ -23,7 +23,7 @@ export { QueryBuilder, or, and, not, cond } from "@rebasepro/common";
 export { createCookieStorage, createMemoryStorage } from "./auth.js";
 export type { AuthConfig, AuthStorage, CookieStorageOptions, CreateAuthOptions } from "./auth.js";
 export type { User, RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
-export type { CreateAdminOptions } from "./admin.js";
+export type { CreateAdminOptions, ListUsersOptions } from "./admin.js";
 export type { AdminUser } from "./admin.js";
 export type { CreateCronOptions } from "./cron.js";
 export { createBackups } from "./backups.js";