@settlemint/dalp-sdk 3.1.19-main.34690878128 → 3.1.19-release.34321146733

package/README.md

@@ -1,193 +1,206 @@
-# DALP SDK
-
-One typed client for the Platform API v2, derived from the platform's own route
-declaration. Calls are namespaced (`dalp.api.token.transfer(...)`), a queue
-backed write resolves once the chain has settled, and TanStack Query factories
-sit on the same nodes as the calls. The package ships no runtime schema
-library: the types are compile time only.
-
-Two interpreters over one route table. The package root returns promises. The
-`./effect` subpath returns Effect values with a typed failure channel. Neither
-pulls the other in, and a build gate keeps the root free of Effect.
+<p align="center">
+  <img src="https://github.com/settlemint/sdk/blob/main/logo.svg" width="200px" align="center" alt="SettleMint logo" />
+  <h1 align="center">DALP SDK</h1>
+  <p align="center">
+    <a href="https://settlemint.com">https://settlemint.com</a>
+    <br/>
+    Fully typed TypeScript SDK for the Digital Asset Lifecycle Platform API.
+  </p>
+</p>
+
+<p align="center">
+<a href="https://www.npmjs.com/package/@settlemint/dalp-sdk" rel="nofollow"><img src="https://img.shields.io/npm/v/@settlemint/dalp-sdk" alt="npm version"></a>
+<a href="https://www.npmjs.com/package/@settlemint/dalp-sdk" rel="nofollow"><img src="https://img.shields.io/npm/dw/@settlemint/dalp-sdk" alt="npm downloads"></a>
+</p>
+
+<div align="center">
+  <a href="https://settlemint.com">Website</a>
+  <span>&nbsp;&nbsp;&bull;&nbsp;&nbsp;</span>
+  <a href="https://www.npmjs.com/package/@settlemint/dalp-sdk">NPM</a>
+  <span>&nbsp;&nbsp;&bull;&nbsp;&nbsp;</span>
+  <a href="mailto:support@settlemint.com">Support</a>
+  <br />
+</div>
+
+## About
+
+The DALP SDK provides a fully typed client for the Digital Asset Lifecycle Platform API. Built on [oRPC](https://orpc.unnoq.com/) with contract-first types, it gives you auto-complete for every API namespace — tokens, identities, compliance, transactions, and more.
+
+## Installation
+
+```bash
+# npm
+npm install @settlemint/dalp-sdk
+
+# bun
+bun add @settlemint/dalp-sdk
+```
 
-## Client
+## Quick Start
 
-```ts
+```typescript
 import { createDalpClient } from "@settlemint/dalp-sdk";
 
 const dalp = createDalpClient({
-  baseUrl: "https://dalp.example.com",
+  url: "https://dalp.example.com",
   apiKey: "sm_dalp_...",
+  organizationId: "org_...", // optional, for multi-org setups
 });
 
-const tokens = await dalp.api.token.list({ limit: 25 }, { signal });
+// Every method is fully typed with auto-complete
+const tokens = await dalp.token.list({ query: {} });
+const system = await dalp.system.read({});
 ```
 
-A call takes one flat object. The route table says which of its keys are path
-parameters and which are query or body fields, so a call site names what it
-means and never restates the transport. The build refuses any route whose path
-parameter would collide with a body or query key, which is what makes the
-merge safe.
+## Auth Client
 
-`createDalpClient` owns the shared transport policy once: the credential
-mechanism, the acting-context headers (`organizationId`, `participant`,
-`executor`, `chainId`, `selectedSigners`, `idempotencyKey`), conditional
-`If-None-Match` reuse, custom fetch injection, the settlement bound, and abort
-propagation.
+Use `createDalpAuthClient` for Better Auth operations such as sign-up, session listing, organization management, API
+keys, device authorization, and wallet verification setup.
 
-**An API key cannot reach a browser.** `createDalpClient` throws at
-construction when a key is passed with `runtime: "browser"`, rather than at the
-first request. A key carries the full authority of the identity it belongs to.
-In a browser the client authenticates with the session cookie instead.
+```typescript
+import { createDalpAuthClient } from "@settlemint/dalp-sdk";
 
-### Dispatch by route id
-
-```ts
-const token = await dalp.execute("token/read", { assetId });
-```
+const auth = createDalpAuthClient({
+  url: "https://dalp.example.com",
+  apiKey: "sm_dalp_...",
+  organizationId: "org_...",
+});
 
-`execute` is typed against the id through the `DalpRouteTypes` registry, so a
-command surface built from route ids keeps the same request and response types
-the namespaced tree gives a call site. The CLI, the end-to-end harness, and the
-demo scripts are all built on it.
-
-### Settlement
-
-A queue-backed write carries a `Prefer` header derived from
-`settlementTimeoutMs`: undefined asks for `wait=15`, zero or less asks for
-`respond-async`, anything else asks for `wait=<seconds>`, clamped to the
-platform's 5 to 99 second range. `settlementTimeoutMs` sets that bound per
-client, and a call may override it.
-
-The platform does the waiting, not the client. When the write settles inside
-the wait, the call returns the route's HTTP 200 resource. When it does not, the
-call returns the declared HTTP 202 handle unchanged: a transaction write's
-`{ transactionId, status, statusUrl }`, or a custody write's `{ requestId,
-state, statusUrl }`. The client never polls a status URL on your behalf.
-
-Pass a transaction id to `waitForTransaction` to follow it to a terminal
-state. A write the funding gate parks on an operator payment reads as still
-queued for as long as the ask is open: the status row carries it as
-`activeRequirement`, and `waitForTransaction` restarts its own timeout on every
-status that reports one, so the wait it runs outlasts the pause. A caller that
-cannot wait that long ends the wait through `signal`, or passes
-`holdWhilePaused: false` to end on the first parked status instead. A custody
-handle has no equivalent helper: follow `statusUrl` yourself.
-
-### Conditional requests and ETags
-
-The client reuses a held body when the server answers a matching ETag with 304.
-Server ETags must be **strong content digests** computed **after
-authorization** inside the requester's partition. Version-stamp ETags
-(generation counters, watermarks, table versions) are forbidden for conditional
-request adopters: a stamp can collide across tenants or lag a body change.
-
-Identity changes that do not ride this client (browser sign-out, organization
-switch) must clear the held bodies, so a later GET cannot send another
-session's `If-None-Match`.
-
-```ts
-dalp.conditionalRequests.clear();
+const apiKeys = await auth.apiKey.list();
 ```
 
-## Effect
+For Node-side session flows, use the platform client. It keeps Better Auth cookies in an SDK-owned store and exposes the
+DAPI client and auth client together.
 
-```ts
-import { createDalpEffectClient } from "@settlemint/dalp-sdk/effect";
+```typescript
+import { createDalpPlatformClient } from "@settlemint/dalp-sdk";
 
-const dalp = createDalpEffectClient({ baseUrl, apiKey });
-const tokens = yield * dalp.api.token.list({ limit: 25 });
-```
-
-The same routes, returning `Effect` values that fail with `DalpRequestError`
-rather than throwing. `execute` is typed by route id here too.
+const platform = createDalpPlatformClient({
+  url: "https://dalp.example.com",
+});
 
-## The route table
+await platform.auth.signUp.email({
+  email: "user@example.com",
+  password: "Password123!",
+  name: "Example User",
+});
 
-```ts
-import { routeIds, routeTable } from "@settlemint/dalp-sdk/routes";
+const sessionCookie = platform.cookieStore.header;
 ```
 
-`./routes` publishes the generated table both interpreters dispatch through:
-every v2 route's id, method, path template, statuses, and traits. It carries no
-client and no Effect, so a tool that only needs to know what the platform
-serves loads this rather than a client.
-
-## TanStack Query
-
-```ts
-const options = dalp.api.token.list.queryOptions({ limit: 25 });
-const transfer = dalp.api.token.transfer.mutationOptions();
+### Auth Namespaces
+
+All namespaces below are fully typed on `DalpAuthClient` — every operation has auto-complete and a typed return value.
+
+| Namespace             | Operations                                                                                                    | Description                                                |
+| --------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| `signIn`              | `email`                                                                                                       | Sign in with email and password                            |
+| `signUp`              | `email`                                                                                                       | Register a new account                                     |
+| `getSession`          | —                                                                                                             | Fetch the current session                                  |
+| `listSessions`        | —                                                                                                             | List all active sessions                                   |
+| `revokeSession`       | —                                                                                                             | Revoke a specific session                                  |
+| `revokeOtherSessions` | —                                                                                                             | Revoke all sessions except the current one                 |
+| `apiKey`              | `create`, `list`, `delete`                                                                                    | Manage API keys                                            |
+| `organization`        | `create`, `list`, `setActive`, `inviteMember`, `acceptInvitation`, `listMembers`, `addMember`, `removeMember` | Manage organizations and membership                        |
+| `admin`               | `listUsers`, `createUser`, `removeUser`, `setRole`                                                            | Administrative user management                             |
+| `device`              | `code`, `token`, `approve`, `deny`                                                                            | Device authorization flow                                  |
+| `twoFactor`           | `enable`, `disable`, `verifyTotp`, `verifyBackupCode`, `generateBackupCodes`                                  | Account-level TOTP two-factor authentication               |
+| `wallet.pincode`      | `enable`, `disable`, `update`, `reset`                                                                        | Wallet pincode protection                                  |
+| `wallet.twoFactor`    | `enable`, `disable`, `verify`                                                                                 | Wallet two-factor verification                             |
+| `wallet.secretCodes`  | `generate`, `confirm`                                                                                         | Wallet secret (recovery) codes                             |
+| `passkey`             | —                                                                                                             | Account-level passkey registration (browser/WebAuthn only) |
+
+```typescript
+// Enable account-level 2FA and verify a TOTP code
+await auth.twoFactor.enable({ password: "..." });
+await auth.twoFactor.verifyTotp({ code: "123456" });
 ```
 
-Every read node carries `queryOptions`; every write node carries
-`mutationOptions`. They are plain objects in the shapes TanStack
-Query expects, so nothing forces you into that library and nothing stops you
-using something else.
-
-Cache keys are derived from route identity plus canonicalized input, so two
-callers passing the same parameters in a different key order share one entry.
-`./react-query` exports `queryKeyFor` and `canonicalize` for building a
-matching invalidation filter, and `UI_SETTLEMENT_TIMEOUT_MS`, the bound the
-mutation factories default to.
-
-## Scalars
-
-Custom wire formats (BigDecimal amounts, EVM addresses, and the
-`OrganizationId` entity brand) are not expressed structurally in the generated
-OpenAPI document, so `./scalars` carries a decoder for each:
-`decodeBigDecimal`, `decodeEthereumAddress`, `decodeOrganizationId`, and the
-exchange-rate response transformer. The route table names which fields carry a
-scalar, keyed by dotted path, so a consumer applies a decoder where the
-declaration says one lives rather than guessing from a field name.
-`OrganizationId` is the only entity id branded end to end across the platform;
-every other identifier crossing this boundary is a plain string.
-
-## Auth
-
-```ts
-import { createDalpAuthClient } from "@settlemint/dalp-sdk/auth";
+```typescript
+// Enable wallet pincode protection
+await auth.wallet.pincode.enable({ pincode: "1234", password: "..." });
 ```
 
-The route surface already carries every auth REST route. `./auth` covers what a
-REST call cannot express: the session and cookie state machine, plugin actions
-that must run in the browser (`passkeyClient` drives the WebAuthn ceremony
-through `navigator.credentials`), and the access-control model that evaluates a
-permission locally instead of round-tripping. It sits off the package root
-because it costs roughly 70 KiB of Better Auth that a consumer who only calls
-routes should not pay.
+## Configuration
 
-Better Auth's client types reference zod, so `zod` is an optional peer
-dependency: install it if you use `./auth`, skip it otherwise. No code in this
-package imports zod at runtime.
+```typescript
+import { createDalpClient } from "@settlemint/dalp-sdk";
 
-## Bundler and paymaster
+const dalp = createDalpClient({
+  // Required
+  url: "https://dalp.example.com",
 
-```ts
-import { createDalpBundlerClient } from "@settlemint/dalp-sdk/bundler";
+  // Required for authenticated routes
+  apiKey: "sm_dalp_...",
+
+  // Optional
+  organizationId: "org_...", // multi-org scoping
+  headers: { "User-Agent": "MyApp" }, // override default headers
+  idempotencyKey: "req_abc123", // ⚠️ sent on EVERY request — use only for single-mutation clients
+  requestValidation: false, // validate requests client-side (default: false)
+  responseValidation: false, // validate responses client-side (default: false)
+  fetch: customFetch, // custom fetch implementation
+});
 ```
 
-`createDalpBundlerClient` keeps the eight established ERC-4337 method names
-while calling the v2 REST resources underneath. It accepts EntryPoint v0.9
-`viem` shapes and returns the corresponding typed values.
+## API Namespaces
+
+| Namespace          | Description                |
+| ------------------ | -------------------------- |
+| `account`          | Manage accounts            |
+| `actions`          | Manage actions             |
+| `addons`           | Manage addons              |
+| `admin`            | Administrative operations  |
+| `contacts`         | Manage contacts            |
+| `exchangeRates`    | View exchange rates        |
+| `externalToken`    | Manage external tokens     |
+| `identityRecovery` | Recover lost identities    |
+| `monitoring`       | Platform monitoring        |
+| `search`           | Search across the platform |
+| `settings`         | Platform settings          |
+| `system`           | System administration      |
+| `token`            | Manage security tokens     |
+| `transaction`      | View transactions          |
+| `user`             | Manage platform users      |
+
+## Endpoint Coverage
+
+The SDK covers 100% of the v2 REST API: it is generated from the same oRPC contract that the server implements, and a
+CI check (`bun run check:sdk-coverage`) diffs every mounted API route against the contract on every change. Endpoints
+intentionally outside the SDK contract are named in a committed allowlist with a reason each, in these categories:
+
+- **v1-frozen** — the deliberately frozen v1 REST surface
+- **internal-ops** — health probes, CSP report sink, theme CSS, static manifests
+- **webhook-receiver** — provider webhook receivers (DFNS, Ripple, compliance providers)
+- **better-auth** — auth plumbing, covered by the SDK auth client instead
+- **docs / asset-delivery / bundler / orpc-mount** — API docs pages, binary asset delivery, the ERC-4337 bundler
+  JSON-RPC passthrough (covered by the SDK bundler client), and the oRPC transport mounts themselves
+
+## Subpath Exports
+
+```typescript
+// Main entry — client factory, error codes, serializers
+import { createDalpAuthClient, createDalpClient, createDalpPlatformClient } from "@settlemint/dalp-sdk";
+
+// Type-only — for function signatures without runtime code
+import type { DalpClient, DalpClientConfig } from "@settlemint/dalp-sdk/types";
+
+// Plugins — optional oRPC link plugins for advanced usage
+import { BatchLinkPlugin, RequestValidationPlugin } from "@settlemint/dalp-sdk/plugins";
+```
 
-## Webhooks and transaction wait
+## Security
 
-- `./verify-webhook` verifies an inbound webhook signature.
-- `./sign-webhook-receipt` signs a webhook delivery receipt (Node only).
-- `./wait-for-transaction` is a bounded poll to a terminal state, for a
-  transaction id from any source, including the 202 handle a client write
-  returns when the platform's wait runs out.
+- **API key authentication** — issued via the DALP dashboard (Settings → API Keys) or via `dalp login`
+- Public routes can be called without an API key; authenticated routes still require one
+- Security headers (`x-api-key`, `x-organization-id`) cannot be overridden by custom headers
+- Client-side request validation can be enabled to catch schema violations early
 
-## Package root
+## Errors
 
-The root stays small: the client factory, its options and errors, cookie-store
-transport, and the version constants. A consumer who only
-calls routes never pays for auth, bundler, TanStack Query, or webhook code.
+DAPI errors thrown by the SDK use `DalpSdkError` and include `message`, `why`, `fix`, `status`, `retryable`, and the
+public DAPI error id when the server returns one.
 
-## Documentation
+## License
 
-The integrator guide lives under Developer reference in the platform docs:
-install and credentials, calling routes, mutations and settlement, streaming,
-TanStack Query, server rendering in TanStack Start and Next.js, and the Effect
-surface.
+This project is licensed under the **SettleMint Commercial Customer Source License**. See the LICENSE file included in the package for full terms.

package/dist/{auth/permissions.d.ts → auth-permissions.d.ts}

@@ -1,7 +1,7 @@
 /**
  * Client-side Better Auth access-control metadata for DALP auth clients.
  *
- * Related: packages/dapi/auth/src/utils/permissions.ts, kit/sdk/src/auth/live.ts
+ * Related: packages/dalp/auth/src/utils/permissions.ts, kit/sdk/src/auth.ts
  *
  * @module
  */
@@ -10,3 +10,4 @@ export declare const accessControl: AccessControl;
 export declare const adminRole: Role;
 export declare const ownerRole: Role;
 export declare const memberRole: Role;
+//# sourceMappingURL=auth-permissions.d.ts.map

package/dist/auth-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-permissions.d.ts","sourceRoot":"","sources":["../src/auth-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,IAAI,EAAuB,MAAM,4BAA4B,CAAC;AAuBhG,eAAO,MAAM,aAAa,EAAE,aAI1B,CAAC;AAEH,eAAO,MAAM,SAAS,EAAE,IAOtB,CAAC;AAEH,eAAO,MAAM,SAAS,EAAE,IAMtB,CAAC;AAEH,eAAO,MAAM,UAAU,EAAE,IAKvB,CAAC"}

package/dist/{auth/wallet-plugins.d.ts → auth-wallet-plugins.d.ts}

@@ -1,69 +1,3 @@
-import type { DalpAuthResult } from "./client.ts";
-export type WalletAuthOperation<TInput, TData> = (input: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
-/** Typed client actions supplied by the three DALP wallet-auth plugins. */
-export interface DalpWalletAuthClient {
-    readonly wallet: {
-        readonly pincode: {
-            readonly enable: WalletAuthOperation<{
-                readonly pincode: string;
-                readonly password?: string;
-            }, {
-                readonly success: boolean;
-            }>;
-            readonly update: WalletAuthOperation<{
-                readonly newPincode: string;
-                readonly password: string;
-            }, {
-                readonly success: boolean;
-            }>;
-            readonly disable: WalletAuthOperation<{
-                readonly password: string;
-            }, {
-                readonly success: boolean;
-            }>;
-            readonly reset: WalletAuthOperation<{
-                readonly newPincode: string;
-                readonly recoveryCode: string;
-            }, {
-                readonly success: boolean;
-                readonly recoveryCodes?: ReadonlyArray<string>;
-            }>;
-        };
-        readonly twoFactor: {
-            readonly enable: WalletAuthOperation<{
-                readonly issuer?: string;
-                readonly password?: string;
-            }, {
-                readonly totpURI: string;
-            }>;
-            readonly verify: WalletAuthOperation<{
-                readonly code: string;
-            }, {
-                readonly status: boolean;
-            }>;
-            readonly disable: WalletAuthOperation<{
-                readonly password: string;
-            }, {
-                readonly status: boolean;
-            }>;
-        };
-        readonly secretCodes: {
-            readonly generate: WalletAuthOperation<{
-                readonly password?: string;
-            }, {
-                readonly rotated: boolean;
-                readonly secretCodes: ReadonlyArray<string>;
-                readonly verificationId: string;
-            }>;
-            readonly confirm: WalletAuthOperation<{
-                readonly stored: boolean;
-                readonly verificationId: string;
-            }, {
-                readonly success: boolean;
-            }>;
-        };
-    };
-}
 export declare const walletPincodeClient: () => {
     id: "wallet-pincode";
     $InferServerPlugin: {
@@ -144,7 +78,9 @@ export declare const walletSecretCodesClient: () => {
         signal: "$sessionSignal";
     }[];
 };
-export type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
-export type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
+type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
+type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
 /** CLI coverage keys for DALP wallet Better Auth plugin endpoints (no leading slash). */
-export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys>;
+export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys & string>;
+export {};
+//# sourceMappingURL=auth-wallet-plugins.d.ts.map

package/dist/auth-wallet-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wallet-plugins.d.ts","sourceRoot":"","sources":["../src/auth-wallet-plugins.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBK,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;CAoBG,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;CAmBC,CAAC;AAEtC,KAAK,iBAAiB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,EAAE,GAAG,IAAI,GAAG,KAAK,CAAC;AAErF,KAAK,0BAA0B,GAC3B,MAAM,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,aAAa,CAAC,GAC3D,MAAM,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,aAAa,CAAC,GAC7D,MAAM,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,aAAa,CAAC,CAAC;AAEpE,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,0BAA0B,GAAG,MAAM,CAAC,CAAC"}

package/dist/auth.d.ts

@@ -1,22 +1,115 @@
-/**
- * The DALP Better Auth client, on its own subpath.
- *
- * The generated SDK already exposes every auth REST operation, so nothing here
- * exists to reach an endpoint. This surface exists for the parts a REST call
- * cannot express: the session and cookie state machine, the plugin actions that
- * run in the browser rather than over HTTP — `passkeyClient` drives the WebAuthn
- * ceremony through `navigator.credentials` — and the access-control model that
- * evaluates a permission locally instead of round-tripping `has-permission`.
- *
- * It is held off the package root because it costs roughly 70 KiB of Better
- * Auth that a consumer who only calls operations should never pay.
- *
- * @module
- */
-export { createDalpAuthClient, makeDalpAuthClient } from "./auth/live.ts";
-export type { DalpAuthClient } from "./auth/live.ts";
-export { decodeDalpAuthClientConfig } from "./auth/client.ts";
-export type { DalpAuthClientConfig, 
-/** @deprecated Prefer `DalpAuthClient` — this is the typed operation surface, not a separate client. */
-DalpCliAuthClient, DalpAuthError, DalpAuthOperation, DalpAuthResult, DalpOrganizationInvitation, DalpOrganizationInvitationsQuery, DalpOrganizationMember, DalpOrganizationMembersQuery, DecodedDalpAuthClientConfig, } from "./auth/client.ts";
-export type { WalletAuthEndpointPath } from "./auth/wallet-plugins.ts";
+import { DalpCookieStore } from "./cookie-store.js";
+export interface DalpAuthClientConfig {
+    /** Base URL of the DALP API (e.g., `"https://dalp.example.com"`). */
+    url: string;
+    /** API key used for Better Auth API-key-authenticated operations. */
+    apiKey?: string;
+    /** Better Auth session token sent as an Authorization bearer token. */
+    sessionToken?: string;
+    /** Cookie header value for explicit Node/browser-session handoff. */
+    cookie?: string;
+    /** Cookie store for Node-side session persistence across Better Auth calls. */
+    cookieStore?: DalpCookieStore;
+    /**
+     * Organization ID for multi-tenant setups.
+     * Sent as `x-organization-id` when provided.
+     */
+    organizationId?: string;
+    /**
+     * Additional headers merged into every Better Auth request.
+     * Can override defaults like `User-Agent` but cannot override configured security headers.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Custom `fetch` implementation.
+     * Use this to inject logging, proxy configuration, or test doubles.
+     */
+    fetch?: typeof globalThis.fetch;
+}
+export interface DalpAuthError {
+    code?: string;
+    message?: string;
+    status?: number;
+    statusText?: string;
+    [key: string]: unknown;
+}
+export interface DalpAuthResult<TData = unknown, TError = DalpAuthError> {
+    data: TData | null;
+    error: TError | null;
+}
+export type DalpAuthOperation<TInput = Record<string, unknown>, TData = unknown> = (input?: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+export interface DalpAuthClient {
+    signIn: Record<string, DalpAuthOperation> & {
+        email: DalpAuthOperation;
+    };
+    signUp: Record<string, DalpAuthOperation> & {
+        email: DalpAuthOperation;
+    };
+    getSession: DalpAuthOperation;
+    listSessions: DalpAuthOperation;
+    revokeSession: DalpAuthOperation;
+    revokeOtherSessions: DalpAuthOperation;
+    apiKey: Record<string, DalpAuthOperation> & {
+        create: DalpAuthOperation;
+        list: DalpAuthOperation;
+        delete: DalpAuthOperation;
+    };
+    organization: Record<string, DalpAuthOperation> & {
+        create: DalpAuthOperation;
+        list: DalpAuthOperation;
+        setActive: DalpAuthOperation;
+        inviteMember: DalpAuthOperation;
+        acceptInvitation: DalpAuthOperation;
+        listMembers: DalpAuthOperation;
+        addMember: DalpAuthOperation;
+        removeMember: DalpAuthOperation;
+    };
+    admin: Record<string, DalpAuthOperation> & {
+        listUsers: DalpAuthOperation;
+        createUser: DalpAuthOperation;
+        removeUser: DalpAuthOperation;
+        setRole: DalpAuthOperation;
+    };
+    device: Record<string, DalpAuthOperation> & {
+        code: DalpAuthOperation;
+        token: DalpAuthOperation;
+        approve: DalpAuthOperation;
+        deny: DalpAuthOperation;
+    };
+    passkey: Record<string, DalpAuthOperation>;
+    twoFactor: Record<string, DalpAuthOperation> & {
+        enable: DalpAuthOperation;
+        disable: DalpAuthOperation;
+        verifyTotp: DalpAuthOperation;
+        verifyBackupCode: DalpAuthOperation;
+        generateBackupCodes: DalpAuthOperation;
+    };
+    wallet: {
+        pincode: {
+            enable: DalpAuthOperation;
+            disable: DalpAuthOperation;
+            update: DalpAuthOperation;
+            reset: DalpAuthOperation;
+        };
+        twoFactor: {
+            enable: DalpAuthOperation;
+            disable: DalpAuthOperation;
+            verify: DalpAuthOperation;
+        };
+        secretCodes: {
+            generate: DalpAuthOperation;
+            confirm: DalpAuthOperation;
+        };
+        passkey: {
+            register: DalpAuthOperation;
+            complete: DalpAuthOperation;
+            disable: DalpAuthOperation;
+            challenge: DalpAuthOperation;
+            verify: DalpAuthOperation;
+        };
+    };
+    $fetch: (path: string, options?: Record<string, unknown>) => Promise<unknown>;
+    $ERROR_CODES: Record<string, unknown>;
+}
+export declare function createDalpAuthClient(config: DalpAuthClientConfig): DalpAuthClient;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA0B,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAK5E,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IAEZ,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,eAAe,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,aAAa;IACrE,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAGD,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO,IAAI,CACjF,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,KACd,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAC1C,KAAK,EAAE,iBAAiB,CAAC;KAC1B,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAC1C,KAAK,EAAE,iBAAiB,CAAC;KAC1B,CAAC;IACF,UAAU,EAAE,iBAAiB,CAAC;IAC9B,YAAY,EAAE,iBAAiB,CAAC;IAChC,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,EAAE,iBAAiB,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAC1C,MAAM,EAAE,iBAAiB,CAAC;QAC1B,IAAI,EAAE,iBAAiB,CAAC;QACxB,MAAM,EAAE,iBAAiB,CAAC;KAC3B,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAChD,MAAM,EAAE,iBAAiB,CAAC;QAC1B,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,iBAAiB,CAAC;QAC7B,YAAY,EAAE,iBAAiB,CAAC;QAChC,gBAAgB,EAAE,iBAAiB,CAAC;QACpC,WAAW,EAAE,iBAAiB,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,YAAY,EAAE,iBAAiB,CAAC;KACjC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QACzC,SAAS,EAAE,iBAAiB,CAAC;QAC7B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,OAAO,EAAE,iBAAiB,CAAC;KAC5B,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAC1C,IAAI,EAAE,iBAAiB,CAAC;QACxB,KAAK,EAAE,iBAAiB,CAAC;QACzB,OAAO,EAAE,iBAAiB,CAAC;QAC3B,IAAI,EAAE,iBAAiB,CAAC;KACzB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QAC7C,MAAM,EAAE,iBAAiB,CAAC;QAC1B,OAAO,EAAE,iBAAiB,CAAC;QAC3B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,gBAAgB,EAAE,iBAAiB,CAAC;QACpC,mBAAmB,EAAE,iBAAiB,CAAC;KACxC,CAAC;IACF,MAAM,EAAE;QACN,OAAO,EAAE;YACP,MAAM,EAAE,iBAAiB,CAAC;YAC1B,OAAO,EAAE,iBAAiB,CAAC;YAC3B,MAAM,EAAE,iBAAiB,CAAC;YAC1B,KAAK,EAAE,iBAAiB,CAAC;SAC1B,CAAC;QACF,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB,CAAC;YAC1B,OAAO,EAAE,iBAAiB,CAAC;YAC3B,MAAM,EAAE,iBAAiB,CAAC;SAC3B,CAAC;QACF,WAAW,EAAE;YACX,QAAQ,EAAE,iBAAiB,CAAC;YAC5B,OAAO,EAAE,iBAAiB,CAAC;SAC5B,CAAC;QACF,OAAO,EAAE;YACP,QAAQ,EAAE,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,iBAAiB,CAAC;YAC5B,OAAO,EAAE,iBAAiB,CAAC;YAC3B,SAAS,EAAE,iBAAiB,CAAC;YAC7B,MAAM,EAAE,iBAAiB,CAAC;SAC3B,CAAC;KACH,CAAC;IAEF,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CA+CjF"}