@slyxup/core 0.2.4 → 1.0.1

package/dist/types.d.ts

@@ -3,9 +3,11 @@ export interface SlyxupUser {
     projectId: string | null;
     email: string;
     emailVerified: boolean;
+    username: string | null;
     firstName: string | null;
     lastName: string | null;
     avatarUrl: string | null;
+    twoFactorEnabled: boolean;
     preferences: Record<string, unknown> | null;
     createdAt: string;
     updatedAt: string;
@@ -16,18 +18,21 @@ export interface SlyxupSession {
     expiresAt: string;
 }
 export interface SignInInput {
-    email: string;
+    email?: string;
+    username?: string;
     password: string;
     projectId?: string;
 }
-export interface SignUpInput extends SignInInput {
+export interface SignUpInput extends Omit<SignInInput, 'username'> {
     firstName?: string;
     lastName?: string;
+    username?: string;
 }
 export interface UpdateUserInput {
     firstName?: string;
     lastName?: string;
     avatarUrl?: string;
+    username?: string | null;
     preferences?: Record<string, unknown>;
 }
 export interface SessionResponse {
@@ -51,6 +56,9 @@ export interface SlyxupSessionInfo {
 export interface SessionsResponse {
     ok: true;
     sessions: SlyxupSessionInfo[];
+    total: number;
+    limit: number;
+    offset: number;
 }
 export interface RevokeSessionsResponse {
     ok: true;
@@ -66,6 +74,44 @@ export interface AuthResponse {
     sessionToken?: string;
     expiresAt?: string;
 }
+/** Returned by signIn when the account has 2FA enabled. */
+export interface TwoFactorRequiredResponse {
+    ok: false;
+    code: '2FA_REQUIRED';
+    challengeToken: string;
+}
+/** Union returned by client.auth.signIn. */
+export type SignInResponse = AuthResponse | TwoFactorRequiredResponse;
+export interface TOTPSetupResponse {
+    ok: true;
+    secret: string;
+    provisioningUri: string;
+    accountName: string;
+}
+export interface EnableTOTPResponse {
+    ok: true;
+    recoveryCodes: string[];
+}
+export interface TwoFactorStatusResponse {
+    ok: boolean;
+    enabled: boolean;
+}
+export interface ConnectedAccount {
+    id: string;
+    provider: 'google' | 'github';
+    providerAccountId: string;
+    createdAt: string;
+}
+export interface ConnectedAccountsResponse {
+    ok: true;
+    accounts: ConnectedAccount[];
+}
+/** Input for completing a 2FA sign-in challenge. */
+export interface CompleteSignInInput {
+    challengeToken: string;
+    code?: string;
+    recoveryCode?: string;
+}
 export interface ErrorResponse {
     ok: false;
     error: string;
@@ -74,6 +120,8 @@ export type Result<T> = T | ErrorResponse;
 export interface SlyxupClientOptions {
     /** Publishable key — pk_test_xxx / pk_live_xxx */
     publishableKey?: string;
+    /** Secret key — sk_test_xxx / sk_live_xxx (server-side admin API) */
+    secretKey?: string;
     /** API base URL, default https://auth.slyxup.online */
     apiUrl?: string;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,yBAAyB,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,15 +1,10 @@
 {
   "name": "@slyxup/core",
-  "version": "0.2.4",
+  "version": "1.0.1",
   "description": "@slyxup/core — SlyxUp SDK",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/slyxup/stack.git",
@@ -26,5 +21,10 @@
   },
   "devDependencies": {
     "vitest": "^4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
   }
-}
+}

package/src/client.ts

@@ -7,14 +7,21 @@ import {
 import type {
   AuthResponse,
   ChangePasswordInput,
+  CompleteSignInInput,
+  ConnectedAccountsResponse,
+  EnableTOTPResponse,
   ErrorResponse,
   Result,
   RevokeSessionsResponse,
   SessionResponse,
   SessionsResponse,
   SignInInput,
+  SignInResponse,
   SignUpInput,
   SlyxupClientOptions,
+  TOTPSetupResponse,
+  TwoFactorRequiredResponse,
+  TwoFactorStatusResponse,
   UpdateUserInput,
   UserResponse,
 } from './types.js';
@@ -49,20 +56,32 @@ function createCookieJar() {
  */
 export class SlyxupClient {
   readonly publishableKey?: string;
+  readonly secretKey?: string;
   readonly apiUrl: string;
   private _getToken?: () => string | undefined;
   private _request?: <T>(path: string, init?: RequestInit) => Promise<T>;
 
   readonly auth: {
     signUp: (input: SignUpInput) => Promise<AuthResponse>;
-    signIn: (input: SignInInput) => Promise<AuthResponse>;
+    signIn: (input: SignInInput) => Promise<SignInResponse>;
     signOut: () => Promise<{ ok: true }>;
     resendVerification: (email: string) => Promise<{ ok: true }>;
+    forgotPassword: (
+      email: string,
+      projectId?: string
+    ) => Promise<{ ok: true }>;
+    resetPassword: (token: string, password: string) => Promise<{ ok: true }>;
+    verifyEmail: (token: string) => Promise<{ ok: true }>;
+    /** Complete a 2FA challenge returned by signIn. */
+    completeSignIn: (input: CompleteSignInInput) => Promise<AuthResponse>;
   };
 
   readonly sessions: {
     get: () => Promise<SessionResponse>;
-    list: () => Promise<SessionsResponse>;
+    list: (opts?: {
+      limit?: number;
+      offset?: number;
+    }) => Promise<SessionsResponse>;
     revoke: (sessionId: string) => Promise<{ ok: true }>;
     revokeOthers: () => Promise<RevokeSessionsResponse>;
   };
@@ -71,12 +90,100 @@ export class SlyxupClient {
     change: (input: ChangePasswordInput) => Promise<{ ok: true }>;
   };
 
+  readonly twoFactor: {
+    setup: () => Promise<TOTPSetupResponse>;
+    status: () => Promise<TwoFactorStatusResponse>;
+    enable: (secret: string, code: string) => Promise<EnableTOTPResponse>;
+    verify: (code: string) => Promise<{ ok: boolean; valid: boolean }>;
+    disable: (code: string) => Promise<{ ok: true }>;
+  };
+
+  readonly accounts: {
+    list: () => Promise<ConnectedAccountsResponse>;
+    unlink: (
+      accountId: string,
+      provider: 'google' | 'github'
+    ) => Promise<{ ok: true }>;
+  };
+
   readonly users: {
     me: () => Promise<UserResponse>;
     update: (input: UpdateUserInput) => Promise<UserResponse>;
     delete: () => Promise<{ ok: true }>;
   };
 
+  readonly admin: {
+    /** Get current project details */
+    getProject: () => Promise<{
+      ok: true;
+      project: { id: string; name: string; createdAt: string };
+    }>;
+    /** List users in the project */
+    listUsers: (opts?: { limit?: number; offset?: number }) => Promise<{
+      ok: true;
+      users: Array<{
+        id: string;
+        email: string;
+        firstName: string | null;
+        lastName: string | null;
+        emailVerified: boolean;
+        blocked: boolean;
+        createdAt: string;
+      }>;
+      total: number;
+    }>;
+    /** Get a single user by ID */
+    getUser: (
+      userId: string
+    ) => Promise<{
+      ok: true;
+      user: {
+        id: string;
+        email: string;
+        firstName: string | null;
+        lastName: string | null;
+        emailVerified: boolean;
+        blocked: boolean;
+        createdAt: string;
+        updatedAt: string;
+      };
+    }>;
+    /** List active sessions */
+    listSessions: () => Promise<{
+      ok: true;
+      sessions: Array<{
+        id: string;
+        userId: string;
+        ipAddress: string | null;
+        userAgent: string | null;
+        expiresAt: string;
+        isExpired: boolean;
+        createdAt: string;
+      }>;
+    }>;
+    /** List API keys */
+    listKeys: () => Promise<{
+      ok: true;
+      keys: Array<{
+        id: string;
+        name: string;
+        prefix: string;
+        environment: string;
+        type: string;
+        lastUsedAt: string | null;
+        createdAt: string;
+      }>;
+    }>;
+    /** Create an API key (full key returned only once) */
+    createKey: (input: {
+      name: string;
+      type: 'publishable' | 'secret';
+      environment: 'test' | 'live';
+    }) => Promise<{ ok: true; id: string; key: string; prefix: string }>;
+    /** Revoke an API key */
+    revokeKey: (keyId: string) => Promise<{ ok: true }>;
+  };
+
   /** Get current session token (for custom project APIs that need Bearer) */
   getToken(): string | undefined {
     return this._getToken?.();
@@ -89,15 +196,33 @@ export class SlyxupClient {
 
   constructor(options: SlyxupClientOptions = {}) {
     const jar = createCookieJar();
+    // Persist token in localStorage so refresh keeps session for cross-origin (auth -> billing) and for dashboard project APIs
+    const STORAGE_KEY = 'slyxup_session_token';
     let storedToken: string | undefined;
+    try {
+      if (typeof window !== 'undefined' && window.localStorage) {
+        storedToken = window.localStorage.getItem(STORAGE_KEY) ?? undefined;
+      }
+    } catch {}
+    const persistToken = (t: string | undefined) => {
+      storedToken = t;
+      try {
+        if (typeof window !== 'undefined' && window.localStorage) {
+          if (t) window.localStorage.setItem(STORAGE_KEY, t);
+          else window.localStorage.removeItem(STORAGE_KEY);
+        }
+      } catch {}
+    };
     this.publishableKey = options.publishableKey;
+    this.secretKey = options.secretKey;
     this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, '');
     this._getToken = () => storedToken;
     // _request will be assigned after `request` is defined below
 
     const requestInner = async <T>(
       path: string,
-      init: RequestInit & { body?: string } = {}
+      init: RequestInit & { body?: string } = {},
+      opts?: { captureError?: boolean }
     ): Promise<Result<T>> => {
       let res: Response;
       try {
@@ -134,6 +259,7 @@ export class SlyxupClient {
         .catch(() => ({ ok: false, error: 'Invalid response' }))) as object;
 
       if (!res.ok) {
+        if (opts?.captureError) return data as Result<T>;
         if (res.status === 401)
           throw new UnauthorizedError(
             'error' in data ? String(data.error) : undefined
@@ -151,30 +277,53 @@ export class SlyxupClient {
       return data as Result<T>;
     };
 
-    const post = <T>(path: string, body?: unknown) =>
-      requestInner<T>(path, {
-        method: 'POST',
-        body: body === undefined ? undefined : JSON.stringify(body),
-      });
+    const post = <T>(
+      path: string,
+      body?: unknown,
+      opts?: { captureError?: boolean }
+    ) =>
+      requestInner<T>(
+        path,
+        {
+          method: 'POST',
+          body: body === undefined ? undefined : JSON.stringify(body),
+        },
+        opts
+      );
 
     this.auth = {
       signUp: async (input) => {
         const res = await post<AuthResponse>('/v1/auth/sign-up', input);
         if (!('user' in res))
           throw new SlyxupError(res.error, 400, 'api_error');
-        if (res.sessionToken) storedToken = res.sessionToken;
+        if (res.sessionToken) persistToken(res.sessionToken);
         return res;
       },
       signIn: async (input) => {
-        const res = await post<AuthResponse>('/v1/auth/sign-in', input);
+        // The server may answer 403 with code 2FA_REQUIRED — we must surface
+        // the challenge back to the caller instead of throwing a generic error.
+        const res = await post<SignInResponse>('/v1/auth/sign-in', input, {
+          captureError: true,
+        });
+        if ('challengeToken' in res) {
+          return res as TwoFactorRequiredResponse;
+        }
         if (!('user' in res))
-          throw new SlyxupError(res.error, 401, 'api_error');
-        if (res.sessionToken) storedToken = res.sessionToken;
+          throw new UnauthorizedError(
+            (res as { error?: string }).error ?? 'Sign in failed'
+          );
+        if (res.sessionToken) persistToken(res.sessionToken);
+        return res;
+      },
+      completeSignIn: async (input) => {
+        const res = await post<AuthResponse>('/v1/auth/sign-in/2fa', input);
+        if (!('user' in res)) throw new UnauthorizedError(res.error);
+        if (res.sessionToken) persistToken(res.sessionToken);
         return res;
       },
       signOut: async () => {
         const res = await post<{ ok: true }>('/v1/auth/sign-out');
-        storedToken = undefined;
+        persistToken(undefined);
         jar.clear();
         return res as { ok: true };
       },
@@ -185,6 +334,35 @@ export class SlyxupClient {
         if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
         return res as { ok: true };
       },
+      forgotPassword: async (email: string, projectId?: string) => {
+        const res = await post<{ ok: true }>(
+          '/v1/verification/password/forgot',
+          {
+            email,
+            projectId,
+          }
+        );
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: true };
+      },
+      resetPassword: async (token: string, password: string) => {
+        const res = await post<{ ok: true }>(
+          '/v1/verification/password/reset',
+          {
+            token,
+            password,
+          }
+        );
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: true };
+      },
+      verifyEmail: async (token: string) => {
+        const res = await post<{ ok: true }>('/v1/verification/verify', {
+          token,
+        });
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: true };
+      },
     };
 
     this.sessions = {
@@ -193,16 +371,26 @@ export class SlyxupClient {
         if (!('session' in res)) throw new UnauthorizedError(res.error);
         return res;
       },
-      list: async () => {
-        const res = await requestInner<SessionsResponse>('/v1/sessions');
+      list: async (opts?: { limit?: number; offset?: number }) => {
+        const params = new URLSearchParams();
+        if (opts?.limit !== undefined) params.set('limit', String(opts.limit));
+        if (opts?.offset !== undefined)
+          params.set('offset', String(opts.offset));
+        const qs = params.toString();
+        const res = await requestInner<SessionsResponse>(
+          `/v1/sessions${qs ? `?${qs}` : ''}`
+        );
         if (!('sessions' in res))
           throw new SlyxupError(res.error, 400, 'api_error');
         return res;
       },
       revoke: async (sessionId: string) => {
-        const res = await requestInner<{ ok: true }>(`/v1/sessions/${sessionId}`, {
-          method: 'DELETE',
-        });
+        const res = await requestInner<{ ok: true }>(
+          `/v1/sessions/${sessionId}`,
+          {
+            method: 'DELETE',
+          }
+        );
         return res as { ok: true };
       },
       revokeOthers: async () => {
@@ -223,6 +411,65 @@ export class SlyxupClient {
       },
     };
 
+    this.twoFactor = {
+      setup: async () => {
+        const res = await requestInner<TOTPSetupResponse>('/v1/user/2fa/setup');
+        if (!('secret' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      status: async () => {
+        const res = await requestInner<TwoFactorStatusResponse>(
+          '/v1/user/2fa/status'
+        );
+        return res as TwoFactorStatusResponse;
+      },
+      enable: async (secret, code) => {
+        const res = await post<EnableTOTPResponse>(
+          '/v1/user/2fa/enable',
+          { secret, code },
+          { captureError: true }
+        );
+        if (!('recoveryCodes' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      verify: async (code) => {
+        const res = await post<{ ok: boolean; valid: boolean }>(
+          '/v1/user/2fa/verify',
+          { code },
+          { captureError: true }
+        );
+        if (!('valid' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: boolean; valid: boolean };
+      },
+      disable: async (code) => {
+        const res = await post<{ ok: true }>('/v1/user/2fa/disable', { code });
+        if (!res.ok) throw new SlyxupError(res.error, 400, 'api_error');
+        return res as { ok: true };
+      },
+    };
+
+    this.accounts = {
+      list: async () => {
+        const res =
+          await requestInner<ConnectedAccountsResponse>('/v1/user/accounts');
+        if (!('accounts' in res))
+          throw new SlyxupError(res.error, 400, 'api_error');
+        return res;
+      },
+      unlink: async (accountId, provider) => {
+        const res = await requestInner<{ ok: true }>(
+          `/v1/user/accounts/${accountId}?provider=${encodeURIComponent(provider)}`,
+          {
+            method: 'DELETE',
+          }
+        );
+        return res as { ok: true };
+      },
+    };
+
     this.users = {
       me: async () => {
         const res = await requestInner<UserResponse>('/v1/user');
@@ -246,7 +493,138 @@ export class SlyxupClient {
       },
     };
 
-    this._request = requestInner as unknown as <T>(path: string, init?: RequestInit) => Promise<T>;
+    // ── Admin API (requires secretKey) ──
+    const sk = options.secretKey;
+    const adminRequest = async <T>(
+      path: string,
+      init: RequestInit = {}
+    ): Promise<T> => {
+      if (!sk)
+        throw new SlyxupError(
+          'Secret key required for admin API',
+          400,
+          'api_error'
+        );
+      const res = await fetch(`${this.apiUrl}${path}`, {
+        ...init,
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${sk}`,
+          ...init.headers,
+        },
+      });
+      const data = (await res
+        .json()
+        .catch(() => ({ ok: false, error: 'Invalid response' }))) as object;
+      if (!res.ok) {
+        throw new SlyxupError(
+          'error' in data
+            ? String((data as { error: unknown }).error)
+            : `Request failed (${res.status})`,
+          res.status,
+          'api_error'
+        );
+      }
+      return data as T;
+    };
+
+    this.admin = {
+      getProject: async () => {
+        const res = await adminRequest<{
+          ok: true;
+          project: { id: string; name: string; createdAt: string };
+        }>('/v1/admin/project');
+        return res;
+      },
+      listUsers: async (opts) => {
+        const params = new URLSearchParams();
+        if (opts?.limit !== undefined) params.set('limit', String(opts.limit));
+        if (opts?.offset !== undefined)
+          params.set('offset', String(opts.offset));
+        const qs = params.toString();
+        const res = await adminRequest<{
+          ok: true;
+          users: Array<{
+            id: string;
+            email: string;
+            firstName: string | null;
+            lastName: string | null;
+            emailVerified: boolean;
+            blocked: boolean;
+            createdAt: string;
+          }>;
+          total: number;
+        }>(`/v1/admin/users${qs ? `?${qs}` : ''}`);
+        return res;
+      },
+      getUser: async (userId) => {
+        const res = await adminRequest<{
+          ok: true;
+          user: {
+            id: string;
+            email: string;
+            firstName: string | null;
+            lastName: string | null;
+            emailVerified: boolean;
+            blocked: boolean;
+            createdAt: string;
+            updatedAt: string;
+          };
+        }>(`/v1/admin/users/${encodeURIComponent(userId)}`);
+        return res;
+      },
+      listSessions: async () => {
+        const res = await adminRequest<{
+          ok: true;
+          sessions: Array<{
+            id: string;
+            userId: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            expiresAt: string;
+            isExpired: boolean;
+            createdAt: string;
+          }>;
+        }>('/v1/admin/sessions');
+        return res;
+      },
+      listKeys: async () => {
+        const res = await adminRequest<{
+          ok: true;
+          keys: Array<{
+            id: string;
+            name: string;
+            prefix: string;
+            environment: string;
+            type: string;
+            lastUsedAt: string | null;
+            createdAt: string;
+          }>;
+        }>('/v1/admin/keys');
+        return res;
+      },
+      createKey: async (input) => {
+        const res = await adminRequest<{
+          ok: true;
+          id: string;
+          key: string;
+          prefix: string;
+        }>('/v1/admin/keys', { method: 'POST', body: JSON.stringify(input) });
+        return res;
+      },
+      revokeKey: async (keyId) => {
+        const res = await adminRequest<{ ok: true }>(
+          `/v1/admin/keys/${encodeURIComponent(keyId)}`,
+          { method: 'DELETE' }
+        );
+        return res as { ok: true };
+      },
+    };
+
+    this._request = requestInner as unknown as <T>(
+      path: string,
+      init?: RequestInit
+    ) => Promise<T>;
   }
 }