@slyxup/core 0.2.0 → 0.2.2

package/.turbo/turbo-build.log

@@ -0,0 +1,4 @@
+
+> @slyxup/core@0.2.2 build /home/runner/work/stack/stack/packages/core
+> tsc -p tsconfig.json
+

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @slyxup/core
 
+## 0.2.1
+
+### Patch Changes
+
+- [`2011599`](https://github.com/slyxup/stack/commit/2011599a9c989560e34bcea3147c18923e15962d) - CLI: new `slyxup auth` command group using @slyxup/core SDK — `auth signup`, `auth signin`, `auth verify` (email verification), `auth oauth` (opens Google/GitHub in browser). Browser open is non-blocking. CLI now depends on @slyxup/core.
+
 ## 0.2.0
 
 ### Minor Changes

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SlyxUp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -23,10 +23,18 @@ const client = new SlyxupClient({
 await client.auth.signUp({ email: 'ada@example.com', password: 'password123', firstName: 'Ada' });
 await client.auth.signIn({ email: 'ada@example.com', password: 'password123' });
 await client.auth.signOut();
+await client.auth.resendVerification('ada@example.com');   // resend email verification
 
 // ── Sessions ──
 const { session, user } = await client.sessions.get();
 // session.expiresAt — ISO date; throws UnauthorizedError (401) when signed out
+const { sessions } = await client.sessions.list();
+// SlyxupSessionInfo[]: { id, ipAddress, userAgent, expiresAt, createdAt, isCurrent }
+await client.sessions.revoke('session-id');  // revoke one device
+const { revoked } = await client.sessions.revokeOthers();  // sign out everywhere else
+
+// ── Password ──
+await client.password.change({ currentPassword, newPassword });
 
 // ── Users ──
 const me = await client.users.me();       // full profile
@@ -65,7 +73,12 @@ try {
 | `auth.signUp(input)` | POST | `/v1/auth/sign-up` |
 | `auth.signIn(input)` | POST | `/v1/auth/sign-in` |
 | `auth.signOut()` | POST | `/v1/auth/sign-out` |
+| `auth.resendVerification(email)` | POST | `/v1/verification/resend` |
 | `sessions.get()` | GET | `/v1/session` |
+| `sessions.list()` | GET | `/v1/sessions` |
+| `sessions.revoke(id)` | DELETE | `/v1/sessions/:id` |
+| `sessions.revokeOthers()` | DELETE | `/v1/sessions` |
+| `password.change(input)` | POST | `/v1/user/password` |
 | `users.me()` | GET | `/v1/user` |
 | `users.update(patch)` | PATCH | `/v1/user` |
 | `users.delete()` | DELETE | `/v1/user` |

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { AuthResponse, SessionResponse, SignInInput, SignUpInput, SlyxupClientOptions, UpdateUserInput, UserResponse } from './types.js';
+import type { AuthResponse, ChangePasswordInput, RevokeSessionsResponse, SessionResponse, SessionsResponse, SignInInput, SignUpInput, SlyxupClientOptions, UpdateUserInput, UserResponse } from './types.js';
 /**
  * SlyxUp Core Client.
  *
@@ -11,15 +11,30 @@ import type { AuthResponse, SessionResponse, SignInInput, SignUpInput, SlyxupCli
 export declare class SlyxupClient {
     readonly publishableKey?: string;
     readonly apiUrl: string;
+    private _getToken?;
+    private _request?;
     readonly auth: {
         signUp: (input: SignUpInput) => Promise<AuthResponse>;
         signIn: (input: SignInInput) => Promise<AuthResponse>;
         signOut: () => Promise<{
             ok: true;
         }>;
+        resendVerification: (email: string) => Promise<{
+            ok: true;
+        }>;
     };
     readonly sessions: {
         get: () => Promise<SessionResponse>;
+        list: () => Promise<SessionsResponse>;
+        revoke: (sessionId: string) => Promise<{
+            ok: true;
+        }>;
+        revokeOthers: () => Promise<RevokeSessionsResponse>;
+    };
+    readonly password: {
+        change: (input: ChangePasswordInput) => Promise<{
+            ok: true;
+        }>;
     };
     readonly users: {
         me: () => Promise<UserResponse>;
@@ -28,6 +43,10 @@ export declare class SlyxupClient {
             ok: true;
         }>;
     };
+    /** Get current session token (for custom project APIs that need Bearer) */
+    getToken(): string | undefined;
+    /** Raw request for custom endpoints (uses same auth headers + cookies as SDK) */
+    request<T>(path: string, init?: RequestInit): Promise<T>;
     constructor(options?: SlyxupClientOptions);
 }
 export * from './types.js';

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EAGZ,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAC;AAkBpB;;;;;;;;GAQG;AACH,qBAAa,YAAY;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,IAAI,EAAE;QACb,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KACtC,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE;QACjB,GAAG,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;KACrC,CAAC;IAEF,QAAQ,CAAC,KAAK,EAAE;QACd,EAAE,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KACrC,CAAC;gBAEU,OAAO,GAAE,mBAAwB;CAuG9C;AAGD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EAGnB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAC;AAqBpB;;;;;;;;GAQG;AACH,qBAAa,YAAY;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,SAAS,CAAC,CAA2B;IAC7C,OAAO,CAAC,QAAQ,CAAC,CAAsD;IAEvE,QAAQ,CAAC,IAAI,EAAE;QACb,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE;QACjB,GAAG,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;QACpC,IAAI,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;QACrD,YAAY,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;KACrD,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE;QACjB,MAAM,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KAC/D,CAAC;IAEF,QAAQ,CAAC,KAAK,EAAE;QACd,EAAE,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,CAAC,CAAC;KACrC,CAAC;IAEF,2EAA2E;IAC3E,QAAQ,IAAI,MAAM,GAAG,SAAS;IAG9B,iFAAiF;IAC3E,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;gBAKlD,OAAO,GAAE,mBAAwB;CAiK9C;AAGD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/client.js

@@ -12,6 +12,9 @@ function createCookieJar() {
         header() {
             return jar ? { Cookie: jar } : {};
         },
+        clear() {
+            jar = undefined;
+        },
     };
 }
 /**
@@ -26,21 +29,51 @@ function createCookieJar() {
 export class SlyxupClient {
     publishableKey;
     apiUrl;
+    _getToken;
+    _request;
     auth;
     sessions;
+    password;
     users;
+    /** Get current session token (for custom project APIs that need Bearer) */
+    getToken() {
+        return this._getToken?.();
+    }
+    /** Raw request for custom endpoints (uses same auth headers + cookies as SDK) */
+    async request(path, init) {
+        if (!this._request)
+            throw new Error('Client not initialized');
+        return this._request(path, init);
+    }
     constructor(options = {}) {
         const jar = createCookieJar();
+        let storedToken;
         this.publishableKey = options.publishableKey;
         this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, '');
-        const request = async (path, init = {}) => {
+        this._getToken = () => storedToken;
+        // _request will be assigned after `request` is defined below
+        const requestInner = async (path, init = {}) => {
             let res;
             try {
+                // Build headers: prefer cookie jar (SSR), fall back to stored Bearer token (browser cross-origin)
+                const authHeaders = {};
+                const jarHeader = jar.header();
+                if (Object.keys(jarHeader).length > 0) {
+                    Object.assign(authHeaders, jarHeader);
+                }
+                else if (storedToken) {
+                    authHeaders.Authorization = `Bearer ${storedToken}`;
+                }
+                // Always send publishable key so server can scope auth to the correct project
+                // and reject requests with invalid / missing keys (fixes demo-with-wrong-pk bug).
+                if (this.publishableKey && this.publishableKey !== 'pk_test_missing') {
+                    authHeaders['X-Publishable-Key'] = this.publishableKey;
+                }
                 res = await fetch(`${this.apiUrl}${path}`, {
                     ...init,
                     headers: {
                         'Content-Type': 'application/json',
-                        ...jar.header(),
+                        ...authHeaders,
                         ...init.headers,
                     },
                     credentials: 'include',
@@ -64,7 +97,7 @@ export class SlyxupClient {
             }
             return data;
         };
-        const post = (path, body) => request(path, {
+        const post = (path, body) => requestInner(path, {
             method: 'POST',
             body: body === undefined ? undefined : JSON.stringify(body),
         });
@@ -73,36 +106,78 @@ export class SlyxupClient {
                 const res = await post('/v1/auth/sign-up', input);
                 if (!('user' in res))
                     throw new SlyxupError(res.error, 400, 'api_error');
+                if (res.sessionToken)
+                    storedToken = res.sessionToken;
                 return res;
             },
             signIn: async (input) => {
                 const res = await post('/v1/auth/sign-in', input);
                 if (!('user' in res))
                     throw new SlyxupError(res.error, 401, 'api_error');
+                if (res.sessionToken)
+                    storedToken = res.sessionToken;
                 return res;
             },
             signOut: async () => {
                 const res = await post('/v1/auth/sign-out');
+                storedToken = undefined;
+                jar.clear();
+                return res;
+            },
+            resendVerification: async (email) => {
+                const res = await post('/v1/verification/resend', {
+                    email,
+                });
+                if (!res.ok)
+                    throw new SlyxupError(res.error, 400, 'api_error');
                 return res;
             },
         };
         this.sessions = {
             get: async () => {
-                const res = await request('/v1/session');
+                const res = await requestInner('/v1/session');
                 if (!('session' in res))
                     throw new UnauthorizedError(res.error);
                 return res;
             },
+            list: async () => {
+                const res = await requestInner('/v1/sessions');
+                if (!('sessions' in res))
+                    throw new SlyxupError(res.error, 400, 'api_error');
+                return res;
+            },
+            revoke: async (sessionId) => {
+                const res = await requestInner(`/v1/sessions/${sessionId}`, {
+                    method: 'DELETE',
+                });
+                return res;
+            },
+            revokeOthers: async () => {
+                const res = await requestInner('/v1/sessions', {
+                    method: 'DELETE',
+                });
+                if (!('revoked' in res))
+                    throw new SlyxupError(res.error, 400, 'api_error');
+                return res;
+            },
+        };
+        this.password = {
+            change: async (input) => {
+                const res = await post('/v1/user/password', input);
+                if (!res.ok)
+                    throw new SlyxupError(res.error, 400, 'api_error');
+                return res;
+            },
         };
         this.users = {
             me: async () => {
-                const res = await request('/v1/user');
+                const res = await requestInner('/v1/user');
                 if (!('user' in res))
                     throw new UnauthorizedError(res.error);
                 return res;
             },
             update: async (input) => {
-                const res = await request('/v1/user', {
+                const res = await requestInner('/v1/user', {
                     method: 'PATCH',
                     body: JSON.stringify(input),
                 });
@@ -111,15 +186,18 @@ export class SlyxupClient {
                 return res;
             },
             delete: async () => {
-                const res = await request('/v1/user', {
+                const res = await requestInner('/v1/user', {
                     method: 'DELETE',
                 });
                 return res;
             },
         };
+        this._request = requestInner;
     }
 }
 // Re-exports so consumers can import from '@slyxup/core'
 export * from './types.js';
 export * from './errors.js';
+// auto-version test 2026-08-27T10:01:57Z
+// ensure auto-version works for packages
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAarB,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,0FAA0F;AAC1F,SAAS,eAAe;IACtB,IAAI,GAAuB,CAAC;IAC5B,OAAO;QACL,OAAO,CAAC,GAAa;YACnB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM;YACJ,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACd,cAAc,CAAU;IACxB,MAAM,CAAS;IAEf,IAAI,CAIX;IAEO,QAAQ,CAEf;IAEO,KAAK,CAIZ;IAEF,YAAY,UAA+B,EAAE;QAC3C,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,KAAK,EACnB,IAAY,EACZ,OAAwC,EAAE,EACtB,EAAE;YACtB,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE;oBACzC,GAAG,IAAI;oBACP,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,GAAG,CAAC,MAAM,EAAE;wBACf,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;iBACpB,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAW,CAAC;YAEtE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;gBACnD,MAAM,IAAI,WAAW,CACnB,OAAO,IAAI,IAAI;oBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,GAAG,EACpC,GAAG,CAAC,MAAM,EACV,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,OAAO,IAAiB,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAC/C,OAAO,CAAI,IAAI,EAAE;YACf,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QAEL,IAAI,CAAC,IAAI,GAAG;YACV,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,mBAAmB,CAAC,CAAC;gBAC1D,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,aAAa,CAAC,CAAC;gBAC1D,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChE,OAAO,GAAG,CAAC;YACb,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG;YACX,EAAE,EAAE,KAAK,IAAI,EAAE;gBACb,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,EAAE;oBAClD,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAe,UAAU,EAAE;oBAClD,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,yDAAyD;AACzD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAgBrB,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,0FAA0F;AAC1F,SAAS,eAAe;IACtB,IAAI,GAAuB,CAAC;IAC5B,OAAO;QACL,OAAO,CAAC,GAAa;YACnB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM;YACJ,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,CAAC;QACD,KAAK;YACH,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACd,cAAc,CAAU;IACxB,MAAM,CAAS;IAChB,SAAS,CAA4B;IACrC,QAAQ,CAAuD;IAE9D,IAAI,CAKX;IAEO,QAAQ,CAKf;IAEO,QAAQ,CAEf;IAEO,KAAK,CAIZ;IAEF,2EAA2E;IAC3E,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAC5B,CAAC;IACD,iFAAiF;IACjF,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAkB;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,QAAQ,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,YAAY,UAA+B,EAAE;QAC3C,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC;QACnC,6DAA6D;QAE7D,MAAM,YAAY,GAAG,KAAK,EACxB,IAAY,EACZ,OAAwC,EAAE,EACtB,EAAE;YACtB,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,kGAAkG;gBAClG,MAAM,WAAW,GAA2B,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,WAAW,EAAE,CAAC;oBACvB,WAAW,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;gBACtD,CAAC;gBACD,8EAA8E;gBAC9E,kFAAkF;gBAClF,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;oBACrE,WAAW,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;gBACzD,CAAC;gBAED,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE;oBACzC,GAAG,IAAI;oBACP,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,WAAW;wBACd,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAC;YAC3B,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;iBACpB,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAW,CAAC;YAEtE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;gBACnD,MAAM,IAAI,WAAW,CACnB,OAAO,IAAI,IAAI;oBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,GAAG,EACpC,GAAG,CAAC,MAAM,EACV,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,OAAO,IAAiB,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAC/C,YAAY,CAAI,IAAI,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QAEL,IAAI,CAAC,IAAI,GAAG;YACV,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,IAAI,GAAG,CAAC,YAAY;oBAAE,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,IAAI,GAAG,CAAC,YAAY;oBAAE,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,mBAAmB,CAAC,CAAC;gBAC1D,WAAW,GAAG,SAAS,CAAC;gBACxB,GAAG,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,GAAmB,CAAC;YAC7B,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,yBAAyB,EAAE;oBAC9D,KAAK;iBACN,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,GAAG,GAAG,MAAM,YAAY,CAAkB,aAAa,CAAC,CAAC;gBAC/D,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChE,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,GAAG,GAAG,MAAM,YAAY,CAAmB,cAAc,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC;oBACtB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,SAAiB,EAAE,EAAE;gBAClC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAe,gBAAgB,SAAS,EAAE,EAAE;oBACxE,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,GAAmB,CAAC;YAC7B,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE;gBACvB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAyB,cAAc,EAAE;oBACrE,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;oBACrB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAe,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBACjE,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG;YACX,EAAE,EAAE,KAAK,IAAI,EAAE;gBACb,MAAM,GAAG,GAAG,MAAM,YAAY,CAAe,UAAU,CAAC,CAAC;gBACzD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAe,UAAU,EAAE;oBACvD,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;oBAClB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAe,UAAU,EAAE;oBACvD,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,GAAmB,CAAC;YAC7B,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,YAA8E,CAAC;IACjG,CAAC;CACF;AAED,yDAAyD;AACzD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,yCAAyC;AACzC,yCAAyC"}

package/dist/types.d.ts

@@ -35,6 +35,27 @@ export interface SessionResponse {
     user: Pick<SlyxupUser, 'id' | 'email'>;
     session: Pick<SlyxupSession, 'id' | 'expiresAt'>;
 }
+export interface ChangePasswordInput {
+    currentPassword: string;
+    newPassword: string;
+}
+export interface SlyxupSessionInfo {
+    id: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    expiresAt: string;
+    createdAt: string;
+    /** true when this session belongs to the caller's current cookie */
+    isCurrent: boolean;
+}
+export interface SessionsResponse {
+    ok: true;
+    sessions: SlyxupSessionInfo[];
+}
+export interface RevokeSessionsResponse {
+    ok: true;
+    revoked: number;
+}
 export interface UserResponse {
     ok: true;
     user: SlyxupUser;
@@ -42,6 +63,8 @@ export interface UserResponse {
 export interface AuthResponse {
     ok: true;
     user: Pick<SlyxupUser, 'id' | 'email'>;
+    sessionToken?: string;
+    expiresAt?: string;
 }
 export interface ErrorResponse {
     ok: false;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,14 +1,10 @@
 {
   "name": "@slyxup/core",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "@slyxup/core — SlyxUp SDK",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc --noEmit"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/slyxup/stack.git",
@@ -22,5 +18,13 @@
   "license": "MIT",
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
   }
-}
+}

package/src/client.ts

@@ -6,9 +6,12 @@ import {
 } from './errors.js';
 import type {
   AuthResponse,
+  ChangePasswordInput,
   ErrorResponse,
   Result,
+  RevokeSessionsResponse,
   SessionResponse,
+  SessionsResponse,
   SignInInput,
   SignUpInput,
   SlyxupClientOptions,
@@ -29,6 +32,9 @@ function createCookieJar() {
     header(): Record<string, string> {
       return jar ? { Cookie: jar } : {};
     },
+    clear() {
+      jar = undefined;
+    },
   };
 }
 
@@ -44,15 +50,25 @@ function createCookieJar() {
 export class SlyxupClient {
   readonly publishableKey?: string;
   readonly apiUrl: string;
+  private _getToken?: () => string | undefined;
+  private _request?: <T>(path: string, init?: RequestInit) => Promise<T>;
 
   readonly auth: {
     signUp: (input: SignUpInput) => Promise<AuthResponse>;
     signIn: (input: SignInInput) => Promise<AuthResponse>;
     signOut: () => Promise<{ ok: true }>;
+    resendVerification: (email: string) => Promise<{ ok: true }>;
   };
 
   readonly sessions: {
     get: () => Promise<SessionResponse>;
+    list: () => Promise<SessionsResponse>;
+    revoke: (sessionId: string) => Promise<{ ok: true }>;
+    revokeOthers: () => Promise<RevokeSessionsResponse>;
+  };
+
+  readonly password: {
+    change: (input: ChangePasswordInput) => Promise<{ ok: true }>;
   };
 
   readonly users: {
@@ -61,22 +77,49 @@ export class SlyxupClient {
     delete: () => Promise<{ ok: true }>;
   };
 
+  /** Get current session token (for custom project APIs that need Bearer) */
+  getToken(): string | undefined {
+    return this._getToken?.();
+  }
+  /** Raw request for custom endpoints (uses same auth headers + cookies as SDK) */
+  async request<T>(path: string, init?: RequestInit): Promise<T> {
+    if (!this._request) throw new Error('Client not initialized');
+    return this._request<T>(path, init);
+  }
+
   constructor(options: SlyxupClientOptions = {}) {
     const jar = createCookieJar();
+    let storedToken: string | undefined;
     this.publishableKey = options.publishableKey;
     this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, '');
+    this._getToken = () => storedToken;
+    // _request will be assigned after `request` is defined below
 
-    const request = async <T>(
+    const requestInner = async <T>(
       path: string,
       init: RequestInit & { body?: string } = {}
     ): Promise<Result<T>> => {
       let res: Response;
       try {
+        // Build headers: prefer cookie jar (SSR), fall back to stored Bearer token (browser cross-origin)
+        const authHeaders: Record<string, string> = {};
+        const jarHeader = jar.header();
+        if (Object.keys(jarHeader).length > 0) {
+          Object.assign(authHeaders, jarHeader);
+        } else if (storedToken) {
+          authHeaders.Authorization = `Bearer ${storedToken}`;
+        }
+        // Always send publishable key so server can scope auth to the correct project
+        // and reject requests with invalid / missing keys (fixes demo-with-wrong-pk bug).
+        if (this.publishableKey && this.publishableKey !== 'pk_test_missing') {
+          authHeaders['X-Publishable-Key'] = this.publishableKey;
+        }
+
         res = await fetch(`${this.apiUrl}${path}`, {
           ...init,
           headers: {
             'Content-Type': 'application/json',
-            ...jar.header(),
+            ...authHeaders,
             ...init.headers,
           },
           credentials: 'include',
@@ -109,7 +152,7 @@ export class SlyxupClient {
     };
 
     const post = <T>(path: string, body?: unknown) =>
-      request<T>(path, {
+      requestInner<T>(path, {
         method: 'POST',
         body: body === undefined ? undefined : JSON.stringify(body),
       });
@@ -119,36 +162,75 @@ export class SlyxupClient {
         const res = await post<AuthResponse>('/v1/auth/sign-up', input);
         if (!('user' in res))
           throw new SlyxupError(res.error, 400, 'api_error');
+        if (res.sessionToken) storedToken = res.sessionToken;
         return res;
       },
       signIn: async (input) => {
         const res = await post<AuthResponse>('/v1/auth/sign-in', input);
         if (!('user' in res))
           throw new SlyxupError(res.error, 401, 'api_error');
+        if (res.sessionToken) storedToken = res.sessionToken;
         return res;
       },
       signOut: async () => {
         const res = await post<{ ok: true }>('/v1/auth/sign-out');
+        storedToken = undefined;
+        jar.clear();
+        return res as { ok: true };
+      },
+      resendVerification: async (email: string) => {
+        const res = await post<{ ok: true }>('/v1/verification/resend', {
+          email,
+        });
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
         return res as { ok: true };
       },
     };
 
     this.sessions = {
       get: async () => {
-        const res = await request<SessionResponse>('/v1/session');
+        const res = await requestInner<SessionResponse>('/v1/session');
         if (!('session' in res)) throw new UnauthorizedError(res.error);
         return res;
       },
+      list: async () => {
+        const res = await requestInner<SessionsResponse>('/v1/sessions');
+        if (!('sessions' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      revoke: async (sessionId: string) => {
+        const res = await requestInner<{ ok: true }>(`/v1/sessions/${sessionId}`, {
+          method: 'DELETE',
+        });
+        return res as { ok: true };
+      },
+      revokeOthers: async () => {
+        const res = await requestInner<RevokeSessionsResponse>('/v1/sessions', {
+          method: 'DELETE',
+        });
+        if (!('revoked' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+    };
+
+    this.password = {
+      change: async (input) => {
+        const res = await post<{ ok: true }>('/v1/user/password', input);
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: true };
+      },
     };
 
     this.users = {
       me: async () => {
-        const res = await request<UserResponse>('/v1/user');
+        const res = await requestInner<UserResponse>('/v1/user');
         if (!('user' in res)) throw new UnauthorizedError(res.error);
         return res;
       },
       update: async (input) => {
-        const res = await request<UserResponse>('/v1/user', {
+        const res = await requestInner<UserResponse>('/v1/user', {
           method: 'PATCH',
           body: JSON.stringify(input),
         });
@@ -157,15 +239,19 @@ export class SlyxupClient {
         return res;
       },
       delete: async () => {
-        const res = await request<{ ok: true }>('/v1/user', {
+        const res = await requestInner<{ ok: true }>('/v1/user', {
           method: 'DELETE',
         });
         return res as { ok: true };
       },
     };
+
+    this._request = requestInner as unknown as <T>(path: string, init?: RequestInit) => Promise<T>;
   }
 }
 
 // Re-exports so consumers can import from '@slyxup/core'
 export * from './types.js';
 export * from './errors.js';
+// auto-version test 2026-08-27T10:01:57Z
+// ensure auto-version works for packages

package/src/types.ts

@@ -43,6 +43,31 @@ export interface SessionResponse {
   session: Pick<SlyxupSession, 'id' | 'expiresAt'>;
 }
 
+export interface ChangePasswordInput {
+  currentPassword: string;
+  newPassword: string;
+}
+
+export interface SlyxupSessionInfo {
+  id: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  expiresAt: string;
+  createdAt: string;
+  /** true when this session belongs to the caller's current cookie */
+  isCurrent: boolean;
+}
+
+export interface SessionsResponse {
+  ok: true;
+  sessions: SlyxupSessionInfo[];
+}
+
+export interface RevokeSessionsResponse {
+  ok: true;
+  revoked: number;
+}
+
 export interface UserResponse {
   ok: true;
   user: SlyxupUser;
@@ -51,6 +76,8 @@ export interface UserResponse {
 export interface AuthResponse {
   ok: true;
   user: Pick<SlyxupUser, 'id' | 'email'>;
+  sessionToken?: string;
+  expiresAt?: string;
 }
 
 export interface ErrorResponse {

package/test/client.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { SlyxupClient } from '../src/client.js';
+import { SlyxupError, UnauthorizedError, NetworkError, RateLimitError } from '../src/errors.js';
+
+function mockFetch(
+  data: unknown,
+  init?: { ok?: boolean; status?: number; headers?: Record<string, string> }
+) {
+  const fn = vi.fn().mockResolvedValue({
+    ok: init?.ok ?? true,
+    status: init?.status ?? 200,
+    headers: {
+      get: (key: string) => {
+        const lower = key.toLowerCase();
+        for (const [k, v] of Object.entries(init?.headers ?? {})) {
+          if (k.toLowerCase() === lower) return v;
+        }
+        return null;
+      },
+    },
+    json: () => Promise.resolve(data),
+  });
+  global.fetch = fn;
+  return fn;
+}
+
+describe('SlyxupClient', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('constructor', () => {
+    it('should use default apiUrl', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient();
+      expect(client.apiUrl).toBe('https://auth.slyxup.online');
+    });
+
+    it('should strip trailing slash from apiUrl', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost:3000/' });
+      expect(client.apiUrl).toBe('http://localhost:3000');
+    });
+
+    it('should store publishableKey', () => {
+      mockFetch({ ok: true });
+      const client = new SlyxupClient({ publishableKey: 'pk_test_123' });
+      expect(client.publishableKey).toBe('pk_test_123');
+    });
+  });
+
+  describe('auth.signUp', () => {
+    it('should POST to /v1/auth/sign-up with JSON body', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signUp({
+        email: 'a@b.com',
+        password: '12345678',
+        firstName: 'Test',
+      });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-up',
+        expect.objectContaining({
+          method: 'POST',
+          body: JSON.stringify({ email: 'a@b.com', password: '12345678', firstName: 'Test' }),
+        })
+      );
+      expect(res).toEqual({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+    });
+
+    it('should throw SlyxupError when response has no user', async () => {
+      mockFetch({ ok: true, error: 'Invalid email' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signUp({ email: 'bad', password: '12345678' })
+      ).rejects.toThrow(SlyxupError);
+    });
+  });
+
+  describe('auth.signIn', () => {
+    it('should POST to /v1/auth/sign-in', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signIn({ email: 'a@b.com', password: 'pass' });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-in',
+        expect.objectContaining({ method: 'POST' })
+      );
+      expect(res).toEqual({ ok: true, user: { id: 'u1', email: 'a@b.com' } });
+    });
+
+    it('should throw UnauthorizedError on 401', async () => {
+      mockFetch({ ok: false, error: 'Bad credentials' }, { ok: false, status: 401 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signIn({ email: 'a@b.com', password: 'wrong' })
+      ).rejects.toThrow(UnauthorizedError);
+    });
+
+    it('should throw SlyxupError when response has no user', async () => {
+      mockFetch({ ok: true, error: 'No user' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(
+        client.auth.signIn({ email: 'a@b.com', password: 'pass' })
+      ).rejects.toThrow(SlyxupError);
+    });
+  });
+
+  describe('auth.signOut', () => {
+    it('should POST to /v1/auth/sign-out', async () => {
+      const fn = mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.auth.signOut();
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/auth/sign-out',
+        expect.objectContaining({ method: 'POST' })
+      );
+      expect(res).toEqual({ ok: true });
+    });
+  });
+
+  describe('sessions.get', () => {
+    it('should GET /v1/session', async () => {
+      const data = { ok: true, user: { id: 'u1', email: 'a@b.com' }, session: { id: 's1', expiresAt: '2030' } };
+      const fn = mockFetch(data);
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.sessions.get();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/session', expect.anything());
+      expect(res).toEqual(data);
+    });
+
+    it('should throw UnauthorizedError when no session in response', async () => {
+      mockFetch({ ok: true, error: 'No session' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(UnauthorizedError);
+    });
+
+    it('should throw NetworkError when fetch rejects', async () => {
+      global.fetch = vi.fn().mockRejectedValue(new Error('fetch failed'));
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(NetworkError);
+    });
+  });
+
+  describe('users.me', () => {
+    it('should GET /v1/user', async () => {
+      const user = { id: 'u1', email: 'a@b.com', firstName: 'Test', lastName: 'User', createdAt: '', updatedAt: '', projectId: null, emailVerified: true, avatarUrl: null, preferences: null };
+      const fn = mockFetch({ ok: true, user });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.users.me();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/user', expect.anything());
+      expect(res.user).toEqual(user);
+    });
+
+    it('should throw UnauthorizedError when no user', async () => {
+      mockFetch({ ok: true, error: 'Not found' });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.users.me()).rejects.toThrow(UnauthorizedError);
+    });
+  });
+
+  describe('users.update', () => {
+    it('should PATCH /v1/user with JSON body', async () => {
+      const fn = mockFetch({ ok: true, user: { id: 'u1', firstName: 'Jane' } });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await client.users.update({ firstName: 'Jane' });
+      expect(fn).toHaveBeenCalledWith(
+        'http://localhost/v1/user',
+        expect.objectContaining({ method: 'PATCH', body: JSON.stringify({ firstName: 'Jane' }) })
+      );
+    });
+  });
+
+  describe('users.delete', () => {
+    it('should DELETE /v1/user', async () => {
+      const fn = mockFetch({ ok: true });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      const res = await client.users.delete();
+      expect(fn).toHaveBeenCalledWith('http://localhost/v1/user', expect.objectContaining({ method: 'DELETE' }));
+      expect(res).toEqual({ ok: true });
+    });
+  });
+
+  describe('cookie jar', () => {
+    it('should capture Set-Cookie and forward as Cookie header', async () => {
+      const fn = vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          headers: {
+            get: (key: string) => key.toLowerCase() === 'set-cookie' ? 'slyxup_session=abc123; Path=/; HttpOnly' : null,
+          },
+          json: () => Promise.resolve({ ok: true, user: { id: 'u1', email: 'a@b.com' } }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          headers: { get: () => null },
+          json: () => Promise.resolve({ ok: true, user: { id: 'u1', email: 'a@b.com' }, session: { id: 's1', expiresAt: '2030' } }),
+        });
+      global.fetch = fn;
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await client.auth.signIn({ email: 'a@b.com', password: 'pass' });
+      await client.sessions.get();
+      expect(fn).toHaveBeenCalledTimes(2);
+      const secondCall = fn.mock.calls[1] as any[];
+      expect(secondCall[1].headers).toMatchObject({ Cookie: 'slyxup_session=abc123' });
+    });
+  });
+
+  describe('error handling', () => {
+    it('should throw RateLimitError on 429', async () => {
+      mockFetch({ error: 'rate limited' }, { ok: false, status: 429 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(RateLimitError);
+    });
+
+    it('should throw NetworkError when fetch rejects', async () => {
+      global.fetch = vi.fn().mockRejectedValue(new TypeError('Failed to fetch'));
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.auth.signIn({ email: 'a', password: 'b' })).rejects.toThrow(NetworkError);
+    });
+
+    it('should throw SlyxupError on 500 with error message', async () => {
+      mockFetch({ error: 'Server error' }, { ok: false, status: 500 });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      try {
+        await client.sessions.get();
+        expect.fail('Should have thrown');
+      } catch (e) {
+        expect(e).toBeInstanceOf(SlyxupError);
+        expect((e as SlyxupError).status).toBe(500);
+        expect((e as SlyxupError).code).toBe('api_error');
+        expect((e as SlyxupError).message).toBe('Server error');
+      }
+    });
+
+    it('should handle invalid JSON gracefully', async () => {
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        status: 200,
+        headers: { get: () => null },
+        json: () => Promise.reject(new Error('not json')),
+      });
+      const client = new SlyxupClient({ apiUrl: 'http://localhost' });
+      await expect(client.sessions.get()).rejects.toThrow(UnauthorizedError);
+    });
+  });
+});

package/test/errors.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect } from 'vitest';
+import {
+  SlyxupError,
+  UnauthorizedError,
+  ValidationError,
+  NetworkError,
+  RateLimitError,
+} from '../src/errors.js';
+
+describe('SlyxupError', () => {
+  it('should set message, status, code, and name', () => {
+    const err = new SlyxupError('test', 500, 'test_error');
+    expect(err.message).toBe('test');
+    expect(err.status).toBe(500);
+    expect(err.code).toBe('test_error');
+    expect(err.name).toBe('SlyxupError');
+  });
+
+  it('should be instanceof Error', () => {
+    const err = new SlyxupError('test', 400, 'err');
+    expect(err).toBeInstanceOf(Error);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    const err = new SlyxupError('test', 400, 'err');
+    expect(err).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('UnauthorizedError', () => {
+  it('should have default values', () => {
+    const err = new UnauthorizedError();
+    expect(err.message).toBe('Unauthorized');
+    expect(err.status).toBe(401);
+    expect(err.code).toBe('unauthorized');
+    expect(err.name).toBe('UnauthorizedError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new UnauthorizedError('Custom');
+    expect(err.message).toBe('Custom');
+    expect(err.status).toBe(401);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new UnauthorizedError()).toBeInstanceOf(SlyxupError);
+    expect(new UnauthorizedError()).toBeInstanceOf(Error);
+  });
+});
+
+describe('ValidationError', () => {
+  it('should have default values', () => {
+    const err = new ValidationError();
+    expect(err.message).toBe('Validation failed');
+    expect(err.status).toBe(400);
+    expect(err.code).toBe('validation_error');
+    expect(err.name).toBe('ValidationError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new ValidationError('Bad input');
+    expect(err.message).toBe('Bad input');
+    expect(err.status).toBe(400);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new ValidationError()).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('NetworkError', () => {
+  it('should have default values', () => {
+    const err = new NetworkError();
+    expect(err.message).toBe('Network request failed');
+    expect(err.status).toBe(0);
+    expect(err.code).toBe('network_error');
+    expect(err.name).toBe('NetworkError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new NetworkError('Timeout');
+    expect(err.message).toBe('Timeout');
+    expect(err.status).toBe(0);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new NetworkError()).toBeInstanceOf(SlyxupError);
+  });
+});
+
+describe('RateLimitError', () => {
+  it('should have default values', () => {
+    const err = new RateLimitError();
+    expect(err.message).toBe('Too many requests');
+    expect(err.status).toBe(429);
+    expect(err.code).toBe('rate_limited');
+    expect(err.name).toBe('RateLimitError');
+  });
+
+  it('should accept custom message', () => {
+    const err = new RateLimitError('Slow down');
+    expect(err.message).toBe('Slow down');
+    expect(err.status).toBe(429);
+  });
+
+  it('should be instanceof SlyxupError', () => {
+    expect(new RateLimitError()).toBeInstanceOf(SlyxupError);
+  });
+});

package/vitest.config.ts

@@ -0,0 +1,2 @@
+import { defineConfig } from 'vitest/config';
+export default defineConfig({ test: { globals: true, environment: 'node' } });