@slyxup/core 0.1.0 → 0.2.1

package/.turbo/turbo-build.log

@@ -0,0 +1,4 @@
+
+> @slyxup/core@0.2.1 build /home/runner/work/stack/stack/packages/core
+> tsc -p tsconfig.json
+

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# @slyxup/core
+
+## 0.2.1
+
+### Patch Changes
+
+- [`2011599`](https://github.com/slyxup/stack/commit/2011599a9c989560e34bcea3147c18923e15962d) - CLI: new `slyxup auth` command group using @slyxup/core SDK — `auth signup`, `auth signin`, `auth verify` (email verification), `auth oauth` (opens Google/GitHub in browser). Browser open is non-blocking. CLI now depends on @slyxup/core.
+
+## 0.2.0
+
+### Minor Changes
+
+- [`7cf24ff`](https://github.com/slyxup/stack/commit/7cf24ffe37fe6f2bca41fdc0281618c2db02b3ae) - Full V1 SDKs: SlyxupClient with cookie jar, React provider + hooks, Next.js server helpers/middleware, themed UI components, slyxup CLI
+
+### Patch Changes
+
+- [`44da26b`](https://github.com/slyxup/stack/commit/44da26bd8f952b6fce4b67f75ddb0ef041a984ac) - ci: verify all packages CI/CD — little change in every package + auth/stack/billing
+
+- [`fe4f8bb`](https://github.com/slyxup/stack/commit/fe4f8bb4ab412a58303f59921548d3625b0675c9) - ci: second verify all — 14:55

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SlyxUp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,81 @@
+# @slyxup/core
+
+Core HTTP client for the SlyxUp Auth platform. Zero framework dependencies — works in browsers, Node.js, and edge runtimes.
+
+## Install
+
+```bash
+npm install @slyxup/core
+# pnpm add @slyxup/core
+```
+
+## Quick start
+
+```ts
+import { SlyxupClient } from '@slyxup/core';
+
+const client = new SlyxupClient({
+  publishableKey: 'pk_test_xxx',          // from `slyxup keys create`
+  apiUrl: 'https://auth.slyxup.online',   // default; override for self-host/local
+});
+
+// ── Auth ──
+await client.auth.signUp({ email: 'ada@example.com', password: 'password123', firstName: 'Ada' });
+await client.auth.signIn({ email: 'ada@example.com', password: 'password123' });
+await client.auth.signOut();
+
+// ── Sessions ──
+const { session, user } = await client.sessions.get();
+// session.expiresAt — ISO date; throws UnauthorizedError (401) when signed out
+
+// ── Users ──
+const me = await client.users.me();       // full profile
+await client.users.update({ firstName: 'Ada', lastName: 'Lovelace' });
+await client.users.delete();              // GDPR delete
+```
+
+The client keeps an internal cookie jar, so sign-in state persists across calls in **Node/SSR too** (browsers manage cookies natively).
+
+## Error handling
+
+```ts
+import { SlyxupError, UnauthorizedError, RateLimitError, NetworkError, ValidationError } from '@slyxup/core';
+
+try {
+  await client.auth.signIn({ email, password });
+} catch (e) {
+  if (e instanceof UnauthorizedError) showInvalidCredentials();
+  else if (e instanceof RateLimitError) backOff();
+  else if (e instanceof SlyxupError) console.error(e.status, e.code, e.message);
+}
+```
+
+| Error | Status | Meaning |
+|---|---|---|
+| `ValidationError` | 400 | Bad input |
+| `UnauthorizedError` | 401 | No/expired session |
+| `RateLimitError` | 429 | Too many requests |
+| `NetworkError` | 0 | Fetch failed |
+| `SlyxupError` | * | Base class (`e.status`, `e.code`) |
+
+## API surface
+
+| Namespace | Method | Endpoint |
+|---|---|---|
+| `auth.signUp(input)` | POST | `/v1/auth/sign-up` |
+| `auth.signIn(input)` | POST | `/v1/auth/sign-in` |
+| `auth.signOut()` | POST | `/v1/auth/sign-out` |
+| `sessions.get()` | GET | `/v1/session` |
+| `users.me()` | GET | `/v1/user` |
+| `users.update(patch)` | PATCH | `/v1/user` |
+| `users.delete()` | DELETE | `/v1/user` |
+
+## Framework wrappers
+
+- React hooks/components: [`@slyxup/react`](../react)
+- Next.js server helpers + middleware: [`@slyxup/nextjs`](../nextjs)
+- Prebuilt UI cards: [`@slyxup/ui`](../ui)
+
+## License
+
+MIT © [SlyxUp](https://github.com/slyxup/stack)

package/dist/client.d.ts

@@ -1,2 +1,35 @@
-export * from './index';
+import type { AuthResponse, SessionResponse, SignInInput, SignUpInput, SlyxupClientOptions, UpdateUserInput, UserResponse } from './types.js';
+/**
+ * SlyxUp Core Client.
+ *
+ * ```ts
+ * const client = new SlyxupClient({ publishableKey: 'pk_test_xxx' });
+ * await client.auth.signIn({ email: 'a@b.com', password: '12345678' });
+ * const session = await client.sessions.get();
+ * ```
+ */
+export declare class SlyxupClient {
+    readonly publishableKey?: string;
+    readonly apiUrl: string;
+    readonly auth: {
+        signUp: (input: SignUpInput) => Promise<AuthResponse>;
+        signIn: (input: SignInInput) => Promise<AuthResponse>;
+        signOut: () => Promise<{
+            ok: true;
+        }>;
+    };
+    readonly sessions: {
+        get: () => Promise<SessionResponse>;
+    };
+    readonly users: {
+        me: () => Promise<UserResponse>;
+        update: (input: UpdateUserInput) => Promise<UserResponse>;
+        delete: () => Promise<{
+            ok: true;
+        }>;
+    };
+    constructor(options?: SlyxupClientOptions);
+}
+export * from './types.js';
+export * from './errors.js';
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EAGZ,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAC;AAkBpB;;;;;;;;GAQG;AACH,qBAAa,YAAY;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,IAAI,EAAE;QACb,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KACtC,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE;QACjB,GAAG,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;KACrC,CAAC;IAEF,QAAQ,CAAC,KAAK,EAAE;QACd,EAAE,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KACrC,CAAC;gBAEU,OAAO,GAAE,mBAAwB;CAuG9C;AAGD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/client.js

@@ -1,2 +1,125 @@
-export * from './index';
+import { NetworkError, RateLimitError, SlyxupError, UnauthorizedError, } from './errors.js';
+const DEFAULT_API_URL = 'https://auth.slyxup.online';
+/** Minimal cookie jar so the SDK works in Node/SSR (browsers manage cookies natively). */
+function createCookieJar() {
+    let jar;
+    return {
+        capture(res) {
+            const setCookie = res.headers.get('set-cookie');
+            if (setCookie)
+                jar = setCookie.split(';')[0]?.trim();
+        },
+        header() {
+            return jar ? { Cookie: jar } : {};
+        },
+    };
+}
+/**
+ * SlyxUp Core Client.
+ *
+ * ```ts
+ * const client = new SlyxupClient({ publishableKey: 'pk_test_xxx' });
+ * await client.auth.signIn({ email: 'a@b.com', password: '12345678' });
+ * const session = await client.sessions.get();
+ * ```
+ */
+export class SlyxupClient {
+    publishableKey;
+    apiUrl;
+    auth;
+    sessions;
+    users;
+    constructor(options = {}) {
+        const jar = createCookieJar();
+        this.publishableKey = options.publishableKey;
+        this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, '');
+        const request = async (path, init = {}) => {
+            let res;
+            try {
+                res = await fetch(`${this.apiUrl}${path}`, {
+                    ...init,
+                    headers: {
+                        'Content-Type': 'application/json',
+                        ...jar.header(),
+                        ...init.headers,
+                    },
+                    credentials: 'include',
+                });
+            }
+            catch {
+                throw new NetworkError();
+            }
+            jar.capture(res);
+            const data = (await res
+                .json()
+                .catch(() => ({ ok: false, error: 'Invalid response' })));
+            if (!res.ok) {
+                if (res.status === 401)
+                    throw new UnauthorizedError('error' in data ? String(data.error) : undefined);
+                if (res.status === 429)
+                    throw new RateLimitError();
+                throw new SlyxupError('error' in data
+                    ? String(data.error)
+                    : `Request failed (${res.status})`, res.status, 'api_error');
+            }
+            return data;
+        };
+        const post = (path, body) => request(path, {
+            method: 'POST',
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        this.auth = {
+            signUp: async (input) => {
+                const res = await post('/v1/auth/sign-up', input);
+                if (!('user' in res))
+                    throw new SlyxupError(res.error, 400, 'api_error');
+                return res;
+            },
+            signIn: async (input) => {
+                const res = await post('/v1/auth/sign-in', input);
+                if (!('user' in res))
+                    throw new SlyxupError(res.error, 401, 'api_error');
+                return res;
+            },
+            signOut: async () => {
+                const res = await post('/v1/auth/sign-out');
+                return res;
+            },
+        };
+        this.sessions = {
+            get: async () => {
+                const res = await request('/v1/session');
+                if (!('session' in res))
+                    throw new UnauthorizedError(res.error);
+                return res;
+            },
+        };
+        this.users = {
+            me: async () => {
+                const res = await request('/v1/user');
+                if (!('user' in res))
+                    throw new UnauthorizedError(res.error);
+                return res;
+            },
+            update: async (input) => {
+                const res = await request('/v1/user', {
+                    method: 'PATCH',
+                    body: JSON.stringify(input),
+                });
+                if (!('user' in res))
+                    throw new SlyxupError(res.error, 400, 'api_error');
+                return res;
+            },
+            delete: async () => {
+                const res = await request('/v1/user', {
+                    method: 'DELETE',
+                });
+                return res;
+            },
+        };
+    }
+}
+// Re-exports so consumers can import from '@slyxup/core'
+export * from './types.js';
+export * from './errors.js';
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAarB,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,0FAA0F;AAC1F,SAAS,eAAe;IACtB,IAAI,GAAuB,CAAC;IAC5B,OAAO;QACL,OAAO,CAAC,GAAa;YACnB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM;YACJ,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACd,cAAc,CAAU;IACxB,MAAM,CAAS;IAEf,IAAI,CAIX;IAEO,QAAQ,CAEf;IAEO,KAAK,CAIZ;IAEF,YAAY,UAA+B,EAAE;QAC3C,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,KAAK,EACnB,IAAY,EACZ,OAAwC,EAAE,EACtB,EAAE;YACtB,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE;oBACzC,GAAG,IAAI;oBACP,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,GAAG,CAAC,MAAM,EAAE;wBACf,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;iBACpB,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAW,CAAC;YAEtE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;gBACnD,MAAM,IAAI,WAAW,CACnB,OAAO,IAAI,IAAI;oBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,GAAG,EACpC,GAAG,CAAC,MAAM,EACV,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,OAAO,IAAiB,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAC/C,OAAO,CAAI,IAAI,EAAE;YACf,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QAEL,IAAI,CAAC,IAAI,GAAG;YACV,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,mBAAmB,CAAC,CAAC;gBAC1D,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,aAAa,CAAC,CAAC;gBAC1D,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChE,OAAO,GAAG,CAAC;YACb,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG;YACX,EAAE,EAAE,KAAK,IAAI,EAAE;gBACb,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,EAAE;oBAClD,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,EAAE;oBAClD,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,yDAAyD;AACzD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+export declare class SlyxupError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(message: string, status: number, code: string);
+}
+export declare class UnauthorizedError extends SlyxupError {
+    constructor(message?: string);
+}
+export declare class ValidationError extends SlyxupError {
+    constructor(message?: string);
+}
+export declare class NetworkError extends SlyxupError {
+    constructor(message?: string);
+}
+export declare class RateLimitError extends SlyxupError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1D;AAED,qBAAa,iBAAkB,SAAQ,WAAW;gBACpC,OAAO,SAAiB;CAIrC;AAED,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,SAAsB;CAI1C;AAED,qBAAa,YAAa,SAAQ,WAAW;gBAC/B,OAAO,SAA2B;CAI/C;AAED,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,SAAsB;CAI1C"}

package/dist/errors.js

@@ -0,0 +1,36 @@
+// SlyxUp Core SDK — typed errors
+export class SlyxupError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.name = 'SlyxupError';
+        this.status = status;
+        this.code = code;
+    }
+}
+export class UnauthorizedError extends SlyxupError {
+    constructor(message = 'Unauthorized') {
+        super(message, 401, 'unauthorized');
+        this.name = 'UnauthorizedError';
+    }
+}
+export class ValidationError extends SlyxupError {
+    constructor(message = 'Validation failed') {
+        super(message, 400, 'validation_error');
+        this.name = 'ValidationError';
+    }
+}
+export class NetworkError extends SlyxupError {
+    constructor(message = 'Network request failed') {
+        super(message, 0, 'network_error');
+        this.name = 'NetworkError';
+    }
+}
+export class RateLimitError extends SlyxupError {
+    constructor(message = 'Too many requests') {
+        super(message, 429, 'rate_limited');
+        this.name = 'RateLimitError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,MAAc,EAAE,IAAY;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,OAAO,GAAG,cAAc;QAClC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,WAAW;IAC3C,YAAY,OAAO,GAAG,wBAAwB;QAC5C,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,2 +1,4 @@
-export declare const placeholder = "core";
+export { SlyxupClient } from './client.js';
+export * from './types.js';
+export * from './errors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -1,2 +1,4 @@
-export const placeholder = 'core';
+export { SlyxupClient } from './client.js';
+export * from './types.js';
+export * from './errors.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,57 @@
+export interface SlyxupUser {
+    id: string;
+    projectId: string | null;
+    email: string;
+    emailVerified: boolean;
+    firstName: string | null;
+    lastName: string | null;
+    avatarUrl: string | null;
+    preferences: Record<string, unknown> | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SlyxupSession {
+    id: string;
+    userId: string;
+    expiresAt: string;
+}
+export interface SignInInput {
+    email: string;
+    password: string;
+    projectId?: string;
+}
+export interface SignUpInput extends SignInInput {
+    firstName?: string;
+    lastName?: string;
+}
+export interface UpdateUserInput {
+    firstName?: string;
+    lastName?: string;
+    avatarUrl?: string;
+    preferences?: Record<string, unknown>;
+}
+export interface SessionResponse {
+    ok: true;
+    user: Pick<SlyxupUser, 'id' | 'email'>;
+    session: Pick<SlyxupSession, 'id' | 'expiresAt'>;
+}
+export interface UserResponse {
+    ok: true;
+    user: SlyxupUser;
+}
+export interface AuthResponse {
+    ok: true;
+    user: Pick<SlyxupUser, 'id' | 'email'>;
+}
+export interface ErrorResponse {
+    ok: false;
+    error: string;
+}
+export type Result<T> = T | ErrorResponse;
+export interface SlyxupClientOptions {
+    /** Publishable key — pk_test_xxx / pk_live_xxx */
+    publishableKey?: string;
+    /** API base URL, default https://auth.slyxup.online */
+    apiUrl?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/types.js

@@ -0,0 +1,3 @@
+// SlyxUp Core SDK — shared types
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,iCAAiC"}

package/package.json

@@ -1,9 +1,30 @@
 {
   "name": "@slyxup/core",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "@slyxup/core — SlyxUp SDK",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "scripts": { "build": "tsc -p tsconfig.json", "typecheck": "tsc --noEmit" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/slyxup/stack.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/slyxup/stack/tree/main/packages/core#readme",
+  "bugs": {
+    "url": "https://github.com/slyxup/stack/issues"
+  },
+  "author": "SlyxUp <hello@slyxup.online>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}

package/src/client.ts

@@ -1 +1,171 @@
-export * from './index';
+import {
+  NetworkError,
+  RateLimitError,
+  SlyxupError,
+  UnauthorizedError,
+} from './errors.js';
+import type {
+  AuthResponse,
+  ErrorResponse,
+  Result,
+  SessionResponse,
+  SignInInput,
+  SignUpInput,
+  SlyxupClientOptions,
+  UpdateUserInput,
+  UserResponse,
+} from './types.js';
+
+const DEFAULT_API_URL = 'https://auth.slyxup.online';
+
+/** Minimal cookie jar so the SDK works in Node/SSR (browsers manage cookies natively). */
+function createCookieJar() {
+  let jar: string | undefined;
+  return {
+    capture(res: Response) {
+      const setCookie = res.headers.get('set-cookie');
+      if (setCookie) jar = setCookie.split(';')[0]?.trim();
+    },
+    header(): Record<string, string> {
+      return jar ? { Cookie: jar } : {};
+    },
+  };
+}
+
+/**
+ * SlyxUp Core Client.
+ *
+ * ```ts
+ * const client = new SlyxupClient({ publishableKey: 'pk_test_xxx' });
+ * await client.auth.signIn({ email: 'a@b.com', password: '12345678' });
+ * const session = await client.sessions.get();
+ * ```
+ */
+export class SlyxupClient {
+  readonly publishableKey?: string;
+  readonly apiUrl: string;
+
+  readonly auth: {
+    signUp: (input: SignUpInput) => Promise<AuthResponse>;
+    signIn: (input: SignInInput) => Promise<AuthResponse>;
+    signOut: () => Promise<{ ok: true }>;
+  };
+
+  readonly sessions: {
+    get: () => Promise<SessionResponse>;
+  };
+
+  readonly users: {
+    me: () => Promise<UserResponse>;
+    update: (input: UpdateUserInput) => Promise<UserResponse>;
+    delete: () => Promise<{ ok: true }>;
+  };
+
+  constructor(options: SlyxupClientOptions = {}) {
+    const jar = createCookieJar();
+    this.publishableKey = options.publishableKey;
+    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, '');
+
+    const request = async <T>(
+      path: string,
+      init: RequestInit & { body?: string } = {}
+    ): Promise<Result<T>> => {
+      let res: Response;
+      try {
+        res = await fetch(`${this.apiUrl}${path}`, {
+          ...init,
+          headers: {
+            'Content-Type': 'application/json',
+            ...jar.header(),
+            ...init.headers,
+          },
+          credentials: 'include',
+        });
+      } catch {
+        throw new NetworkError();
+      }
+      jar.capture(res);
+
+      const data = (await res
+        .json()
+        .catch(() => ({ ok: false, error: 'Invalid response' }))) as object;
+
+      if (!res.ok) {
+        if (res.status === 401)
+          throw new UnauthorizedError(
+            'error' in data ? String(data.error) : undefined
+          );
+        if (res.status === 429) throw new RateLimitError();
+        throw new SlyxupError(
+          'error' in data
+            ? String(data.error)
+            : `Request failed (${res.status})`,
+          res.status,
+          'api_error'
+        );
+      }
+
+      return data as Result<T>;
+    };
+
+    const post = <T>(path: string, body?: unknown) =>
+      request<T>(path, {
+        method: 'POST',
+        body: body === undefined ? undefined : JSON.stringify(body),
+      });
+
+    this.auth = {
+      signUp: async (input) => {
+        const res = await post<AuthResponse>('/v1/auth/sign-up', input);
+        if (!('user' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      signIn: async (input) => {
+        const res = await post<AuthResponse>('/v1/auth/sign-in', input);
+        if (!('user' in res))
+          throw new SlyxupError(res.error, 401, 'api_error');
+        return res;
+      },
+      signOut: async () => {
+        const res = await post<{ ok: true }>('/v1/auth/sign-out');
+        return res as { ok: true };
+      },
+    };
+
+    this.sessions = {
+      get: async () => {
+        const res = await request<SessionResponse>('/v1/session');
+        if (!('session' in res)) throw new UnauthorizedError(res.error);
+        return res;
+      },
+    };
+
+    this.users = {
+      me: async () => {
+        const res = await request<UserResponse>('/v1/user');
+        if (!('user' in res)) throw new UnauthorizedError(res.error);
+        return res;
+      },
+      update: async (input) => {
+        const res = await request<UserResponse>('/v1/user', {
+          method: 'PATCH',
+          body: JSON.stringify(input),
+        });
+        if (!('user' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      delete: async () => {
+        const res = await request<{ ok: true }>('/v1/user', {
+          method: 'DELETE',
+        });
+        return res as { ok: true };
+      },
+    };
+  }
+}
+
+// Re-exports so consumers can import from '@slyxup/core'
+export * from './types.js';
+export * from './errors.js';

package/src/errors.ts

@@ -0,0 +1,41 @@
+// SlyxUp Core SDK — typed errors
+
+export class SlyxupError extends Error {
+  readonly status: number;
+  readonly code: string;
+
+  constructor(message: string, status: number, code: string) {
+    super(message);
+    this.name = 'SlyxupError';
+    this.status = status;
+    this.code = code;
+  }
+}
+
+export class UnauthorizedError extends SlyxupError {
+  constructor(message = 'Unauthorized') {
+    super(message, 401, 'unauthorized');
+    this.name = 'UnauthorizedError';
+  }
+}
+
+export class ValidationError extends SlyxupError {
+  constructor(message = 'Validation failed') {
+    super(message, 400, 'validation_error');
+    this.name = 'ValidationError';
+  }
+}
+
+export class NetworkError extends SlyxupError {
+  constructor(message = 'Network request failed') {
+    super(message, 0, 'network_error');
+    this.name = 'NetworkError';
+  }
+}
+
+export class RateLimitError extends SlyxupError {
+  constructor(message = 'Too many requests') {
+    super(message, 429, 'rate_limited');
+    this.name = 'RateLimitError';
+  }
+}

package/src/index.ts

@@ -1 +1,3 @@
-export const placeholder = 'core';
+export { SlyxupClient } from './client.js';
+export * from './types.js';
+export * from './errors.js';

package/src/types.ts

@@ -0,0 +1,68 @@
+// SlyxUp Core SDK — shared types
+
+export interface SlyxupUser {
+  id: string;
+  projectId: string | null;
+  email: string;
+  emailVerified: boolean;
+  firstName: string | null;
+  lastName: string | null;
+  avatarUrl: string | null;
+  preferences: Record<string, unknown> | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface SlyxupSession {
+  id: string;
+  userId: string;
+  expiresAt: string;
+}
+
+export interface SignInInput {
+  email: string;
+  password: string;
+  projectId?: string;
+}
+
+export interface SignUpInput extends SignInInput {
+  firstName?: string;
+  lastName?: string;
+}
+
+export interface UpdateUserInput {
+  firstName?: string;
+  lastName?: string;
+  avatarUrl?: string;
+  preferences?: Record<string, unknown>;
+}
+
+export interface SessionResponse {
+  ok: true;
+  user: Pick<SlyxupUser, 'id' | 'email'>;
+  session: Pick<SlyxupSession, 'id' | 'expiresAt'>;
+}
+
+export interface UserResponse {
+  ok: true;
+  user: SlyxupUser;
+}
+
+export interface AuthResponse {
+  ok: true;
+  user: Pick<SlyxupUser, 'id' | 'email'>;
+}
+
+export interface ErrorResponse {
+  ok: false;
+  error: string;
+}
+
+export type Result<T> = T | ErrorResponse;
+
+export interface SlyxupClientOptions {
+  /** Publishable key — pk_test_xxx / pk_live_xxx */
+  publishableKey?: string;
+  /** API base URL, default https://auth.slyxup.online */
+  apiUrl?: string;
+}

package/test/client.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { SlyxupClient } from '../src/client.js';
+import { SlyxupError, UnauthorizedError, NetworkError, RateLimitError } from '../src/errors.js';
+
+function mockFetch(
+  data: unknown,
+  init?: { ok?: boolean; status?: number; headers?: Record<string, string> }
+) {
+  const fn = vi.fn().mockResolvedValue({
+    ok: init?.ok ?? true,
+    status: init?.status ?? 200,
+    headers: {
+      get: (key: string) => {
+        const lower = key.toLowerCase();
+        for (const [k, v] of Object.entries(init?.headers ?? {})) {
+          if (k.toLowerCase() === lower) return v;
+        }
+        return null;
+      },
+    },
+    json: () => Promise.resolve(data),
+  });
+  global.fetch = fn;
+  return fn;
+}
+
+describe('SlyxupClient', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('constructor', () => {
+    it('should use default apiUrl', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient();
+      expect(client.apiUrl).toBe('https://auth.slyxup.online');
+    });
+
+    it('should strip trailing slash from apiUrl', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost:3000/' });
+      expect(client.apiUrl).toBe('http://localhost:3000');
+    });
+
+    it('should store publishableKey', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient({ publishableKey: 'pk_test_123' });
+      expect(client.publishableKey).toBe('pk_test_123');
+    });
+  });
+
+  describe('auth.signUp', () => {
+    it('should POST to /v1/auth/sign-up with JSON body', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signUp({
+        email: 'a@b.com',
+        password: '12345678',
+        firstName: 'Test',
+      });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-up',
+        expect.objectContaining({
+          method: 'POST',
+          body: JSON.stringify({ email: 'a@b.com', password: '12345678', firstName: 'Test' }),
+        })
+      );
+      expect(res).toEqual({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+    });
+
+    it('should throw SlyxupError when response has no user', async () => {
+      mockFetch({ ok: true, error: 'Invalid email' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signUp({ email: 'bad', password: '12345678' })
+      ).rejects.toThrow(SlyxupError);
+    });
+  });
+
+  describe('auth.signIn', () => {
+    it('should POST to /v1/auth/sign-in', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signIn({ email: 'a@b.com', password: 'pass' });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-in',
+        expect.objectContaining({ method: 'POST' })
+      );
+      expect(res).toEqual({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+    });
+
+    it('should throw UnauthorizedError on 401', async () => {
+      mockFetch({ ok: false, error: 'Bad credentials' }, { ok: false, status: 401 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signIn({ email: 'a@b.com', password: 'wrong' })
+      ).rejects.toThrow(UnauthorizedError);
+    });
+
+    it('should throw SlyxupError when response has no user', async () => {
+      mockFetch({ ok: true, error: 'No user' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signIn({ email: 'a@b.com', password: 'pass' })
+      ).rejects.toThrow(SlyxupError);
+    });
+  });
+
+  describe('auth.signOut', () => {
+    it('should POST to /v1/auth/sign-out', async () => {
+      const fn = mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signOut();
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-out',
+        expect.objectContaining({ method: 'POST' })
+      );
+      expect(res).toEqual({ ok: true });
+    });
+  });
+
+  describe('sessions.get', () => {
+    it('should GET /v1/session', async () => {
+      const data = { ok: true, user: { id: 'u1', email: 'a@b.com' }, session: { id: 's1', expiresAt: '2030' } };
+      const fn = mockFetch(data);
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.sessions.get();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/session', expect.anything());
+      expect(res).toEqual(data);
+    });
+
+    it('should throw UnauthorizedError when no session in response', async () => {
+      mockFetch({ ok: true, error: 'No session' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(UnauthorizedError);
+    });
+
+    it('should throw NetworkError when fetch rejects', async () => {
+      global.fetch = vi.fn().mockRejectedValue(new Error('fetch failed'));
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(NetworkError);
+    });
+  });
+
+  describe('users.me', () => {
+    it('should GET /v1/user', async () => {
+      const user = { id: 'u1', email: 'a@b.com', firstName: 'Test', lastName: 'User', createdAt: '', updatedAt: '', projectId: null, emailVerified: true, avatarUrl: null, preferences: null };
+      const fn = mockFetch({ ok: true, user });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.users.me();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/user', expect.anything());
+      expect(res.user).toEqual(user);
+    });
+
+    it('should throw UnauthorizedError when no user', async () => {
+      mockFetch({ ok: true, error: 'Not found' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.users.me()).rejects.toThrow(UnauthorizedError);
+    });
+  });
+
+  describe('users.update', () => {
+    it('should PATCH /v1/user with JSON body', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', firstName: 'Jane' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await client.users.update({ firstName: 'Jane' });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/user',
+        expect.objectContaining({ method: 'PATCH', body: JSON.stringify({ firstName: 'Jane' }) })
+      );
+    });
+  });
+
+  describe('users.delete', () => {
+    it('should DELETE /v1/user', async () => {
+      const fn = mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.users.delete();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/user', expect.objectContaining({ method: 'DELETE' }));
+      expect(res).toEqual({ ok: true });
+    });
+  });
+
+  describe('cookie jar', () => {
+    it('should capture Set-Cookie and forward as Cookie header', async () => {
+      const fn = vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          headers: {
+            get: (key: string) => key.toLowerCase() === 'set-cookie' ? 'slyxup_session=abc123; Path=/; HttpOnly' : null,
+          },
+          json: () => Promise.resolve({ ok: true, user: { id: 'u1', email: 'a@b.com' } }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          headers: { get: () => null },
+          json: () => Promise.resolve({ ok: true, user: { id: 'u1', email: 'a@b.com' }, session: { id: 's1', expiresAt: '2030' } }),
+        });
+      global.fetch = fn;
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await client.auth.signIn({ email: 'a@b.com', password: 'pass' });
+      await client.sessions.get();
+      expect(fn).toHaveBeenCalledTimes(2);
+      const secondCall = fn.mock.calls[1] as any[];
+      expect(secondCall[1].headers).toMatchObject({ Cookie: 'slyxup_session=abc123' });
+    });
+  });
+
+  describe('error handling', () => {
+    it('should throw RateLimitError on 429', async () => {
+      mockFetch({ error: 'rate limited' }, { ok: false, status: 429 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(RateLimitError);
+    });
+
+    it('should throw NetworkError when fetch rejects', async () => {
+      global.fetch = vi.fn().mockRejectedValue(new TypeError('Failed to fetch'));
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.auth.signIn({ email: 'a', password: 'b' })).rejects.toThrow(NetworkError);
+    });
+
+    it('should throw SlyxupError on 500 with error message', async () => {
+      mockFetch({ error: 'Server error' }, { ok: false, status: 500 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      try {
+        await client.sessions.get();
+        expect.fail('Should have thrown');
+      } catch (e) {
+        expect(e).toBeInstanceOf(SlyxupError);
+        expect((e as SlyxupError).status).toBe(500);
+        expect((e as SlyxupError).code).toBe('api_error');
+        expect((e as SlyxupError).message).toBe('Server error');
+      }
+    });
+
+    it('should handle invalid JSON gracefully', async () => {
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        status: 200,
+        headers: { get: () => null },
+        json: () => Promise.reject(new Error('not json')),
+      });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(UnauthorizedError);
+    });
+  });
+});

package/test/errors.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect } from 'vitest';
+import {
+  SlyxupError,
+  UnauthorizedError,
+  ValidationError,
+  NetworkError,
+  RateLimitError,
+} from '../src/errors.js';
+
+describe('SlyxupError', () => {
+  it('should set message, status, code, and name', () => {
+    const err = new SlyxupError('test', 500, 'test_error');
+    expect(err.message).toBe('test');
+    expect(err.status).toBe(500);
+    expect(err.code).toBe('test_error');
+    expect(err.name).toBe('SlyxupError');
+  });
+
+  it('should be instanceof Error', () => {
+    const err = new SlyxupError('test', 400, 'err');
+    expect(err).toBeInstanceOf(Error);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    const err = new SlyxupError('test', 400, 'err');
+    expect(err).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('UnauthorizedError', () => {
+  it('should have default values', () => {
+    const err = new UnauthorizedError();
+    expect(err.message).toBe('Unauthorized');
+    expect(err.status).toBe(401);
+    expect(err.code).toBe('unauthorized');
+    expect(err.name).toBe('UnauthorizedError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new UnauthorizedError('Custom');
+    expect(err.message).toBe('Custom');
+    expect(err.status).toBe(401);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new UnauthorizedError()).toBeInstanceOf(SlyxupError);
+    expect(new UnauthorizedError()).toBeInstanceOf(Error);
+  });
+});
+
+describe('ValidationError', () => {
+  it('should have default values', () => {
+    const err = new ValidationError();
+    expect(err.message).toBe('Validation failed');
+    expect(err.status).toBe(400);
+    expect(err.code).toBe('validation_error');
+    expect(err.name).toBe('ValidationError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new ValidationError('Bad input');
+    expect(err.message).toBe('Bad input');
+    expect(err.status).toBe(400);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new ValidationError()).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('NetworkError', () => {
+  it('should have default values', () => {
+    const err = new NetworkError();
+    expect(err.message).toBe('Network request failed');
+    expect(err.status).toBe(0);
+    expect(err.code).toBe('network_error');
+    expect(err.name).toBe('NetworkError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new NetworkError('Timeout');
+    expect(err.message).toBe('Timeout');
+    expect(err.status).toBe(0);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new NetworkError()).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('RateLimitError', () => {
+  it('should have default values', () => {
+    const err = new RateLimitError();
+    expect(err.message).toBe('Too many requests');
+    expect(err.status).toBe(429);
+    expect(err.code).toBe('rate_limited');
+    expect(err.name).toBe('RateLimitError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new RateLimitError('Slow down');
+    expect(err.message).toBe('Slow down');
+    expect(err.status).toBe(429);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new RateLimitError()).toBeInstanceOf(SlyxupError);
+  });
+});

package/tsconfig.json

@@ -1 +1 @@
-{ "extends": "../../tsconfig.json", "compilerOptions": { "outDir": "dist", "rootDir": "src" }, "include": ["src"] }
+{ "extends": "../../tsconfig.json", "compilerOptions": { "outDir": "dist", "rootDir": "src", "lib": ["ES2022", "DOM", "DOM.Iterable"] }, "include": ["src"] }

package/vitest.config.ts

@@ -0,0 +1,2 @@
+import { defineConfig } from 'vitest/config';
+export default defineConfig({ test: { globals: true, environment: 'node' } });