@startsimpli/api 0.5.20 → 0.5.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/api",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "description": "Type-safe Django REST API client for StartSimpli apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
@@ -23,14 +23,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "type-check": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "clean": "rm -rf dist"
-  },
   "dependencies": {
     "isomorphic-dompurify": "^3.10.0",
     "zod": "^4.3.6"
@@ -60,5 +52,13 @@
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
   }
-}
+}

package/src/constants/endpoints.ts

@@ -59,6 +59,9 @@ export const ENDPOINTS = {
   CONTACT_ENRICH: (id: string) => `api/v1/contacts/${id}/enrich`,
   CONTACTS_ENRICH_APOLLO: 'api/v1/contacts/enrich-apollo',
 
+  // Auth
+  AUTH_EARLY_REGISTER: 'api/v1/auth/early-register',
+
   // Users
   USER_ME: 'api/v1/users/me',
   USER_CHANGE_PASSWORD: 'api/v1/users/me/change-password',
@@ -66,6 +69,36 @@ export const ENDPOINTS = {
   // Companies / Feature flags
   FEATURE_FLAGS: 'api/v1/companies/feature-flags',
 
+  // Companies (startsim-o7s) — accepts numeric id OR slug
+  COMPANIES: 'api/v1/companies',
+  COMPANY: (idOrSlug: string) => `api/v1/companies/${idOrSlug}`,
+  COMPANY_FEATURE_FLAGS: (idOrSlug: string) => `api/v1/companies/${idOrSlug}/feature-flags`,
+
+  // Teams (startsim-o7s, startsim-tsm)
+  TEAMS: 'api/v1/teams',
+  TEAM: (idOrSlug: string) => `api/v1/teams/${idOrSlug}`,
+  TEAM_MEMBERS: (idOrSlug: string) => `api/v1/teams/${idOrSlug}/members`,
+  TEAM_BULK_INVITE: (idOrSlug: string) => `api/v1/teams/${idOrSlug}/bulk-invite`,
+  TEAM_REMOVE_MEMBER: (idOrSlug: string) => `api/v1/teams/${idOrSlug}/remove-member`,
+  TEAM_UPDATE_ROLE: (idOrSlug: string) => `api/v1/teams/${idOrSlug}/update-role`,
+  TEAM_MEMBERS_MY_TEAMS: 'api/v1/team-members/my-teams',
+
+  // Team invitations (startsim-tsm)
+  TEAM_INVITATIONS: 'api/v1/team-invitations',
+  TEAM_INVITATION: (id: string) => `api/v1/team-invitations/${id}`,
+  TEAM_INVITATION_ACCEPT: (id: string) => `api/v1/team-invitations/${id}/accept`,
+  TEAM_INVITATION_REVOKE: (id: string) => `api/v1/team-invitations/${id}/revoke`,
+
+  // Email domain claims (startsim-gpu)
+  TEAM_DOMAIN_CLAIMS: 'api/v1/team-domain-claims',
+  TEAM_DOMAIN_CLAIM: (id: string) => `api/v1/team-domain-claims/${id}`,
+  TEAM_DOMAIN_CLAIM_VERIFY_DNS: (id: string) => `api/v1/team-domain-claims/${id}/verify-dns`,
+  TEAM_DOMAIN_CLAIM_VERIFY_EMAIL_INITIATE: (id: string) =>
+    `api/v1/team-domain-claims/${id}/verify-email-initiate`,
+  TEAM_DOMAIN_CLAIM_VERIFY_EMAIL_CODE: (id: string) =>
+    `api/v1/team-domain-claims/${id}/verify-email-code`,
+  TEAM_DOMAIN_CLAIM_REVOKE: (id: string) => `api/v1/team-domain-claims/${id}/revoke`,
+
   // Markets (instruments, prices, analytics, news, health)
   INSTRUMENTS: 'api/v1/markets/instruments',
   INSTRUMENT: (symbol: string) => `api/v1/markets/instruments/${symbol}`,

package/src/index.ts

@@ -25,7 +25,7 @@ export type { MessageStats } from './lib/message-stats';
 export { MessageTemplatesApi } from './lib/message-templates-api';
 export type { MessageTemplate, MessageTemplateFilters, CreateMessageTemplateInput } from './lib/message-templates-api';
 export { UsersApi } from './lib/users-api';
-export type { UserProfile, UpdateProfileRequest, ChangePasswordRequest, ChangePasswordResponse } from './types/user';
+export type { UserProfile, UpdateProfileRequest, ChangePasswordRequest, ChangePasswordResponse, EarlyRegisterRequest, EarlyRegisterResponse } from './types/user';
 export { FunnelsApi, isFunnelRunConflict, isFunnelValidationError } from './lib/funnels-api';
 export type {
   FunnelPreviewResult,
@@ -164,6 +164,10 @@ import { TargetListsApi } from './lib/target-lists-api';
 import { MessageTemplatesApi } from './lib/message-templates-api';
 import { MarketsApi } from './lib/markets-api';
 import { VaultApi } from './lib/vault-api';
+import { CompaniesApi } from './lib/companies-api';
+import { TeamsApi } from './lib/teams-api';
+import { TeamInvitationsApi } from './lib/team-invitations-api';
+import { DomainClaimsApi } from './lib/domain-claims-api';
 
 import type { ApiClientConfig } from './lib/api-client';
 
@@ -189,9 +193,20 @@ export function createStartSimpliApi(config: ApiClientConfig = {}) {
     messageTemplates: new MessageTemplatesApi(client),
     markets: new MarketsApi(client),
     vault: new VaultApi(client),
+    companies: new CompaniesApi(client),
+    teams: new TeamsApi(client),
+    teamInvitations: new TeamInvitationsApi(client),
+    domainClaims: new DomainClaimsApi(client),
   };
 }
 
+// Team management (startsim-o7s)
+export { CompaniesApi } from './lib/companies-api';
+export { TeamsApi } from './lib/teams-api';
+export type { MyTeamMembership } from './lib/teams-api';
+export { TeamInvitationsApi } from './lib/team-invitations-api';
+export { DomainClaimsApi } from './lib/domain-claims-api';
+
 // Vault API
 export { VaultApi } from './lib/vault-api';
 export type {

package/src/lib/__tests__/companies-api.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { CompaniesApi } from '../companies-api';
+
+function makeApi() {
+  const fetch = { get: vi.fn(), post: vi.fn(), patch: vi.fn(), delete: vi.fn() };
+  const api = new CompaniesApi({ fetch } as never);
+  return { api, fetch };
+}
+
+describe('CompaniesApi', () => {
+  let api: CompaniesApi;
+  let fetch: { get: ReturnType<typeof vi.fn>; post: ReturnType<typeof vi.fn>; patch: ReturnType<typeof vi.fn>; delete: ReturnType<typeof vi.fn> };
+
+  beforeEach(() => {
+    ({ api, fetch } = makeApi());
+  });
+
+  it('list passes params through to the companies endpoint', async () => {
+    fetch.get.mockResolvedValue({ results: [], count: 0 });
+    await api.list({ search: 'acme', pageSize: 50 });
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/companies', {
+      params: { search: 'acme', pageSize: 50 },
+    });
+  });
+
+  it('retrieve accepts either id or slug in the path', async () => {
+    fetch.get.mockResolvedValue({ id: '1', slug: 'acme' });
+    await api.retrieve('acme');
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/companies/acme');
+  });
+
+  it('update PATCHes the company with the camelCase payload', async () => {
+    fetch.patch.mockResolvedValue({ id: '1', slug: 'acme', name: 'Acme Inc.' });
+    await api.update('acme', { name: 'Acme Inc.' });
+    expect(fetch.patch).toHaveBeenCalledWith('api/v1/companies/acme', { name: 'Acme Inc.' });
+  });
+
+  it('featureFlags.get unwraps the flags envelope', async () => {
+    fetch.get.mockResolvedValue({ flags: { section_inbox: true } });
+    const flags = await api.featureFlags.get('acme');
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/companies/acme/feature-flags');
+    expect(flags).toEqual({ section_inbox: true });
+  });
+
+  it('featureFlags.update PATCHes a wrapped flags payload', async () => {
+    fetch.patch.mockResolvedValue({ flags: { section_inbox: false } });
+    const flags = await api.featureFlags.update('acme', { section_inbox: false });
+    expect(fetch.patch).toHaveBeenCalledWith('api/v1/companies/acme/feature-flags', {
+      flags: { section_inbox: false },
+    });
+    expect(flags).toEqual({ section_inbox: false });
+  });
+});

package/src/lib/__tests__/domain-claims-api.test.ts

@@ -0,0 +1,68 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { DomainClaimsApi } from '../domain-claims-api';
+
+function makeApi() {
+  const fetch = { get: vi.fn(), post: vi.fn(), patch: vi.fn(), delete: vi.fn() };
+  const api = new DomainClaimsApi({ fetch } as never);
+  return { api, fetch };
+}
+
+describe('DomainClaimsApi', () => {
+  let api: DomainClaimsApi;
+  let fetch: { get: ReturnType<typeof vi.fn>; post: ReturnType<typeof vi.fn>; patch: ReturnType<typeof vi.fn>; delete: ReturnType<typeof vi.fn> };
+
+  beforeEach(() => {
+    ({ api, fetch } = makeApi());
+  });
+
+  it('list hits the team-domain-claims endpoint', async () => {
+    fetch.get.mockResolvedValue({ results: [], count: 0 });
+    await api.list({ companyId: 'c1', verified: true });
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/team-domain-claims', {
+      params: { companyId: 'c1', verified: true },
+    });
+  });
+
+  it('create POSTs the claim payload + returns the visible token', async () => {
+    fetch.post.mockResolvedValue({
+      id: 'd1',
+      domain: 'acme.com',
+      verificationToken: 'startsim-verify=xyz',
+    });
+    const r = await api.create({ companyId: 'c1', domain: 'acme.com' });
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-domain-claims', {
+      companyId: 'c1',
+      domain: 'acme.com',
+    });
+    expect(r.verificationToken).toBe('startsim-verify=xyz');
+  });
+
+  it('verifyDns posts the verify-dns action', async () => {
+    fetch.post.mockResolvedValue({ id: 'd1', verified: true });
+    await api.verifyDns('d1');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-domain-claims/d1/verify-dns');
+  });
+
+  it('verifyEmailInitiate posts the initiate action', async () => {
+    fetch.post.mockResolvedValue({ detail: 'sent' });
+    await api.verifyEmailInitiate('d1');
+    expect(fetch.post).toHaveBeenCalledWith(
+      'api/v1/team-domain-claims/d1/verify-email-initiate',
+    );
+  });
+
+  it('verifyEmailCode posts the code', async () => {
+    fetch.post.mockResolvedValue({ id: 'd1', verified: true });
+    await api.verifyEmailCode('d1', '123456');
+    expect(fetch.post).toHaveBeenCalledWith(
+      'api/v1/team-domain-claims/d1/verify-email-code',
+      { code: '123456' },
+    );
+  });
+
+  it('revoke posts the revoke action', async () => {
+    fetch.post.mockResolvedValue(undefined);
+    await api.revoke('d1');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-domain-claims/d1/revoke');
+  });
+});

package/src/lib/__tests__/team-invitations-api.test.ts

@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TeamInvitationsApi } from '../team-invitations-api';
+
+function makeApi() {
+  const fetch = { get: vi.fn(), post: vi.fn(), patch: vi.fn(), delete: vi.fn() };
+  const api = new TeamInvitationsApi({ fetch } as never);
+  return { api, fetch };
+}
+
+describe('TeamInvitationsApi', () => {
+  let api: TeamInvitationsApi;
+  let fetch: { get: ReturnType<typeof vi.fn>; post: ReturnType<typeof vi.fn>; patch: ReturnType<typeof vi.fn>; delete: ReturnType<typeof vi.fn> };
+
+  beforeEach(() => {
+    ({ api, fetch } = makeApi());
+  });
+
+  it('list reaches the invitations endpoint', async () => {
+    fetch.get.mockResolvedValue({ results: [], count: 0 });
+    await api.list({ teamId: 't1' });
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/team-invitations', {
+      params: { teamId: 't1' },
+    });
+  });
+
+  it('create POSTs the invitation payload', async () => {
+    fetch.post.mockResolvedValue({ id: 'i1', token: 'raw-token' });
+    const r = await api.create({ email: 'a@x.com', teamId: 't1', role: 'member' });
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-invitations', {
+      email: 'a@x.com',
+      teamId: 't1',
+      role: 'member',
+    });
+    expect(r.token).toBe('raw-token');
+  });
+
+  it('revoke POSTs the revoke action', async () => {
+    fetch.post.mockResolvedValue(undefined);
+    await api.revoke('i1');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-invitations/i1/revoke');
+  });
+
+  it('accept POSTs the token in the body', async () => {
+    fetch.post.mockResolvedValue({ id: 'i1', acceptedAt: '2025-01-01' });
+    await api.accept('i1', 'raw-token');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/team-invitations/i1/accept', {
+      token: 'raw-token',
+    });
+  });
+});

package/src/lib/__tests__/teams-api.test.ts

@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TeamsApi } from '../teams-api';
+
+function makeApi() {
+  const fetch = { get: vi.fn(), post: vi.fn(), patch: vi.fn(), delete: vi.fn() };
+  const api = new TeamsApi({ fetch } as never);
+  return { api, fetch };
+}
+
+describe('TeamsApi', () => {
+  let api: TeamsApi;
+  let fetch: { get: ReturnType<typeof vi.fn>; post: ReturnType<typeof vi.fn>; patch: ReturnType<typeof vi.fn>; delete: ReturnType<typeof vi.fn> };
+
+  beforeEach(() => {
+    ({ api, fetch } = makeApi());
+  });
+
+  it('list hits the teams endpoint with params', async () => {
+    fetch.get.mockResolvedValue({ results: [], count: 0 });
+    await api.list({ companyId: 'c1' });
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/teams', { params: { companyId: 'c1' } });
+  });
+
+  it('retrieve accepts slug', async () => {
+    fetch.get.mockResolvedValue({ id: '1', slug: 'eng' });
+    await api.retrieve('eng');
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/teams/eng');
+  });
+
+  it('members returns the bare array (no pagination wrapper)', async () => {
+    fetch.get.mockResolvedValue([{ id: 'm1', userId: 'u1', role: 'owner' }]);
+    const members = await api.members('eng');
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/teams/eng/members');
+    expect(members).toHaveLength(1);
+  });
+
+  it('bulkInvite POSTs the invitations array wrapped in an envelope', async () => {
+    fetch.post.mockResolvedValue({ invited: [], skipped: [] });
+    await api.bulkInvite('eng', [
+      { email: 'a@x.com', role: 'member' },
+      { email: 'b@x.com', role: 'admin' },
+    ]);
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/teams/eng/bulk-invite', {
+      invitations: [
+        { email: 'a@x.com', role: 'member' },
+        { email: 'b@x.com', role: 'admin' },
+      ],
+    });
+  });
+
+  it('removeMember sends userId in the body, not the URL', async () => {
+    fetch.post.mockResolvedValue(undefined);
+    await api.removeMember('eng', 'u42');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/teams/eng/remove-member', {
+      userId: 'u42',
+    });
+  });
+
+  it('updateRole sends userId + role in the body', async () => {
+    fetch.post.mockResolvedValue({ id: 'm1', userId: 'u42', role: 'admin' });
+    await api.updateRole('eng', 'u42', 'admin');
+    expect(fetch.post).toHaveBeenCalledWith('api/v1/teams/eng/update-role', {
+      userId: 'u42',
+      role: 'admin',
+    });
+  });
+
+  it('myTeams returns the unpaginated membership array', async () => {
+    fetch.get.mockResolvedValue([{ id: 'm1', teamId: 't1', role: 'owner' }]);
+    const rows = await api.myTeams();
+    expect(fetch.get).toHaveBeenCalledWith('api/v1/team-members/my-teams');
+    expect(rows[0].role).toBe('owner');
+  });
+});

package/src/lib/companies-api.ts

@@ -0,0 +1,48 @@
+/**
+ * Companies API wrapper for /api/v1/companies/*.
+ *
+ * The Django CompanyViewSet accepts numeric id OR slug as the URL identifier.
+ * Feature-flags get their own nested endpoint so app shells can fetch flags
+ * without pulling the full company object. startsim-o7s.
+ */
+
+import type { ApiClient } from './api-client';
+import { ENDPOINTS } from '../constants/endpoints';
+import type {
+  Company,
+  CompanyListParams,
+  UpdateCompanyInput,
+} from '../types/team';
+import type { FeatureFlags, FeatureFlagsResponse } from './feature-flags';
+import type { PaginatedResponse } from '../types';
+
+export class CompaniesApi {
+  constructor(private client: ApiClient) {}
+
+  /** List companies the current user belongs to. */
+  list(params?: CompanyListParams): Promise<PaginatedResponse<Company>> {
+    return this.client.fetch.get<PaginatedResponse<Company>>(ENDPOINTS.COMPANIES, { params });
+  }
+
+  /** Retrieve a single company by id or slug. */
+  retrieve(idOrSlug: string): Promise<Company> {
+    return this.client.fetch.get<Company>(ENDPOINTS.COMPANY(idOrSlug));
+  }
+
+  /** PATCH update — name, slug, settings. */
+  update(idOrSlug: string, patch: UpdateCompanyInput): Promise<Company> {
+    return this.client.fetch.patch<Company>(ENDPOINTS.COMPANY(idOrSlug), patch);
+  }
+
+  /** Per-company feature-flag accessors (admin-gated on PATCH). */
+  readonly featureFlags = {
+    get: (idOrSlug: string): Promise<FeatureFlags> =>
+      this.client.fetch
+        .get<FeatureFlagsResponse>(ENDPOINTS.COMPANY_FEATURE_FLAGS(idOrSlug))
+        .then((r) => r.flags),
+    update: (idOrSlug: string, patch: Partial<FeatureFlags>): Promise<FeatureFlags> =>
+      this.client.fetch
+        .patch<FeatureFlagsResponse>(ENDPOINTS.COMPANY_FEATURE_FLAGS(idOrSlug), { flags: patch })
+        .then((r) => r.flags),
+  };
+}

package/src/lib/domain-claims-api.ts

@@ -0,0 +1,63 @@
+/**
+ * EmailDomainClaim API wrapper for /api/v1/team-domain-claims/*.
+ *
+ * Two verification methods are supported by the backend (startsim-gpu):
+ *   - DNS TXT: caller adds a TXT record, then calls verify-dns.
+ *   - Email attestation: backend sends a 6-digit code to a postmaster@<domain>
+ *     mailbox; caller submits the code via verify-email-code.
+ */
+
+import type { ApiClient } from './api-client';
+import { ENDPOINTS } from '../constants/endpoints';
+import type {
+  EmailDomainClaim,
+  DomainClaimListParams,
+  CreateDomainClaimInput,
+  DomainVerifyEmailInitiateResponse,
+} from '../types/team';
+import type { PaginatedResponse } from '../types';
+
+export class DomainClaimsApi {
+  constructor(private client: ApiClient) {}
+
+  list(params?: DomainClaimListParams): Promise<PaginatedResponse<EmailDomainClaim>> {
+    return this.client.fetch.get<PaginatedResponse<EmailDomainClaim>>(
+      ENDPOINTS.TEAM_DOMAIN_CLAIMS,
+      { params },
+    );
+  }
+
+  /**
+   * Create a new claim. The response includes the verification_token (visible
+   * only to the creator); subsequent reads return null.
+   */
+  create(input: CreateDomainClaimInput): Promise<EmailDomainClaim> {
+    return this.client.fetch.post<EmailDomainClaim>(ENDPOINTS.TEAM_DOMAIN_CLAIMS, input);
+  }
+
+  /** Trigger DNS TXT lookup. Backend marks verified=true on a clean match. */
+  verifyDns(id: string): Promise<EmailDomainClaim> {
+    return this.client.fetch.post<EmailDomainClaim>(
+      ENDPOINTS.TEAM_DOMAIN_CLAIM_VERIFY_DNS(id),
+    );
+  }
+
+  /** Kick off email-attestation flow — backend emails postmaster@<domain>. */
+  verifyEmailInitiate(id: string): Promise<DomainVerifyEmailInitiateResponse> {
+    return this.client.fetch.post<DomainVerifyEmailInitiateResponse>(
+      ENDPOINTS.TEAM_DOMAIN_CLAIM_VERIFY_EMAIL_INITIATE(id),
+    );
+  }
+
+  /** Submit the postmaster mailbox's 6-digit code to complete attestation. */
+  verifyEmailCode(id: string, code: string): Promise<EmailDomainClaim> {
+    return this.client.fetch.post<EmailDomainClaim>(
+      ENDPOINTS.TEAM_DOMAIN_CLAIM_VERIFY_EMAIL_CODE(id),
+      { code },
+    );
+  }
+
+  revoke(id: string): Promise<void> {
+    return this.client.fetch.post<void>(ENDPOINTS.TEAM_DOMAIN_CLAIM_REVOKE(id));
+  }
+}

package/src/lib/team-invitations-api.ts

@@ -0,0 +1,49 @@
+/**
+ * TeamInvitations API wrapper for /api/v1/team-invitations/*.
+ *
+ * The accept endpoint is intentionally public-ish — it accepts an unauth
+ * caller carrying the one-time invite token in the body. The TeamMember
+ * row is created idempotently by the backend manager (startsim-tsm).
+ */
+
+import type { ApiClient } from './api-client';
+import { ENDPOINTS } from '../constants/endpoints';
+import type {
+  TeamInvitation,
+  TeamInvitationListParams,
+  CreateTeamInvitationInput,
+} from '../types/team';
+import type { PaginatedResponse } from '../types';
+
+export class TeamInvitationsApi {
+  constructor(private client: ApiClient) {}
+
+  list(params?: TeamInvitationListParams): Promise<PaginatedResponse<TeamInvitation>> {
+    return this.client.fetch.get<PaginatedResponse<TeamInvitation>>(
+      ENDPOINTS.TEAM_INVITATIONS,
+      { params },
+    );
+  }
+
+  /**
+   * Send a single invitation. The create response includes the raw token;
+   * subsequent reads will redact it.
+   */
+  create(input: CreateTeamInvitationInput): Promise<TeamInvitation> {
+    return this.client.fetch.post<TeamInvitation>(ENDPOINTS.TEAM_INVITATIONS, input);
+  }
+
+  revoke(id: string): Promise<void> {
+    return this.client.fetch.post<void>(ENDPOINTS.TEAM_INVITATION_REVOKE(id));
+  }
+
+  /**
+   * Accept an invitation. The caller posts the one-time token; the backend
+   * wires the TeamMember idempotently (startsim-tsm).
+   */
+  accept(id: string, token: string): Promise<TeamInvitation> {
+    return this.client.fetch.post<TeamInvitation>(ENDPOINTS.TEAM_INVITATION_ACCEPT(id), {
+      token,
+    });
+  }
+}

package/src/lib/teams-api.ts

@@ -0,0 +1,73 @@
+/**
+ * Teams API wrapper for /api/v1/teams/* plus the bulk-mgmt actions shipped
+ * by startsim-tsm (bulk-invite, remove-member, update-role).
+ *
+ * The Django TeamViewSet accepts numeric id OR slug. Member-mutation
+ * endpoints take user_id in the body, not the URL. startsim-o7s.
+ */
+
+import type { ApiClient } from './api-client';
+import { ENDPOINTS } from '../constants/endpoints';
+import type {
+  Team,
+  TeamMember,
+  TeamListParams,
+  BulkInviteEntry,
+  BulkInviteResult,
+  TeamRole,
+} from '../types/team';
+import type { PaginatedResponse } from '../types';
+
+/** Shape returned by /team-members/my-teams/ — a flat array of memberships. */
+export interface MyTeamMembership extends TeamMember {
+  team?: Team;
+}
+
+export class TeamsApi {
+  constructor(private client: ApiClient) {}
+
+  /** List teams visible to the current user. */
+  list(params?: TeamListParams): Promise<PaginatedResponse<Team>> {
+    return this.client.fetch.get<PaginatedResponse<Team>>(ENDPOINTS.TEAMS, { params });
+  }
+
+  /** Retrieve a single team by id or slug. */
+  retrieve(idOrSlug: string): Promise<Team> {
+    return this.client.fetch.get<Team>(ENDPOINTS.TEAM(idOrSlug));
+  }
+
+  /** List members of a team. Backend returns the full set (no pagination). */
+  members(idOrSlug: string): Promise<TeamMember[]> {
+    return this.client.fetch.get<TeamMember[]>(ENDPOINTS.TEAM_MEMBERS(idOrSlug));
+  }
+
+  /**
+   * Bulk-invite endpoint shipped by startsim-tsm. Sends one POST with the
+   * full list of {email, role} pairs and returns invited + skipped.
+   */
+  bulkInvite(idOrSlug: string, invitations: BulkInviteEntry[]): Promise<BulkInviteResult> {
+    return this.client.fetch.post<BulkInviteResult>(ENDPOINTS.TEAM_BULK_INVITE(idOrSlug), {
+      invitations,
+    });
+  }
+
+  /** Remove a member from the team. user_id goes in the body (not the URL). */
+  removeMember(idOrSlug: string, userId: string): Promise<void> {
+    return this.client.fetch.post<void>(ENDPOINTS.TEAM_REMOVE_MEMBER(idOrSlug), {
+      userId,
+    });
+  }
+
+  /** Promote/demote a member — fails if it would leave zero OWNERs. */
+  updateRole(idOrSlug: string, userId: string, role: TeamRole): Promise<TeamMember> {
+    return this.client.fetch.post<TeamMember>(ENDPOINTS.TEAM_UPDATE_ROLE(idOrSlug), {
+      userId,
+      role,
+    });
+  }
+
+  /** Return the current user's membership rows across every team they touch. */
+  myTeams(): Promise<MyTeamMembership[]> {
+    return this.client.fetch.get<MyTeamMembership[]>(ENDPOINTS.TEAM_MEMBERS_MY_TEAMS);
+  }
+}

package/src/lib/users-api.ts

@@ -7,6 +7,8 @@ import type {
   UpdateProfileRequest,
   ChangePasswordRequest,
   ChangePasswordResponse,
+  EarlyRegisterRequest,
+  EarlyRegisterResponse,
 } from '../types/user';
 import { ENDPOINTS } from '../constants/endpoints';
 import type { ApiClient } from './api-client';
@@ -37,4 +39,15 @@ export class UsersApi {
       data
     );
   }
+
+  /**
+   * Passwordless early-access registration (name + email only).
+   * Public endpoint — no auth token required.
+   */
+  async earlyRegister(data: EarlyRegisterRequest): Promise<EarlyRegisterResponse> {
+    return this.client.fetch.post<EarlyRegisterResponse>(
+      ENDPOINTS.AUTH_EARLY_REGISTER,
+      data
+    );
+  }
 }

package/src/types/index.ts

@@ -98,6 +98,28 @@ export type {
   ApolloEnrichmentSummary,
 } from './enrichment';
 
+// Team / Company / Invitation / Domain-claim types (startsim-o7s)
+export type {
+  Company,
+  AuthUserLike,
+  TeamRole,
+  Team,
+  TeamMember,
+  TeamInvitation,
+  DomainVerificationMethod,
+  EmailDomainClaim,
+  CompanyListParams,
+  UpdateCompanyInput,
+  TeamListParams,
+  BulkInviteEntry,
+  BulkInviteResult,
+  TeamInvitationListParams,
+  CreateTeamInvitationInput,
+  DomainClaimListParams,
+  CreateDomainClaimInput,
+  DomainVerifyEmailInitiateResponse,
+} from './team';
+
 // Error types
 export type {
   FieldError,

package/src/types/team.ts

@@ -0,0 +1,175 @@
+/**
+ * Team / Company / Invitation / Domain-claim types.
+ *
+ * Mirrors the Django serializers in apps.companies / apps.teams /
+ * apps.email_domain_claims. The FetchWrapper transforms snake_case ↔ camelCase
+ * at the boundary, so types here are camelCase. startsim-o7s.
+ */
+
+/** A Company is the top-level org tenant in StartSimpli. */
+export interface Company {
+  id: string;
+  slug: string;
+  name: string;
+  /** Free-form per-company settings blob (feature flags + product prefs). */
+  settings: Record<string, unknown>;
+  /** Hydrated by `?expand=owner`; otherwise just present as a foreign-key id. */
+  owner?: AuthUserLike | null;
+  ownerId?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/**
+ * Trimmed AuthUser used by the team-mgmt serializers.
+ *
+ * Imported from @startsimpli/auth in practice, but we keep an internal shape
+ * here so @startsimpli/api stays decoupled from the auth package's exports.
+ * The real AuthUser is structurally compatible.
+ */
+export interface AuthUserLike {
+  id: string;
+  email: string;
+  firstName?: string;
+  lastName?: string;
+  fullName?: string;
+}
+
+/** Role hierarchy on a TeamMember (mirrors backend `Role` choices). */
+export type TeamRole = 'owner' | 'admin' | 'member' | 'viewer';
+
+/** A Team scopes role assignments inside a Company. */
+export interface Team {
+  id: string;
+  slug: string;
+  name: string;
+  companyId: string;
+  settings: Record<string, unknown>;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/** A TeamMember pins a user into a Team at a specific role. */
+export interface TeamMember {
+  id: string;
+  userId: string;
+  teamId: string;
+  role: TeamRole;
+  invitedById?: string | null;
+  joinedAt: string;
+  /** Optional hydrated user (when serializer expands it). */
+  user?: AuthUserLike;
+}
+
+/**
+ * Pending or accepted invitation to join a Team.
+ * `token` is write-only after create — surfaced only in the create response
+ * so apps can build accept-links.
+ */
+export interface TeamInvitation {
+  id: string;
+  email: string;
+  teamId: string;
+  role: TeamRole;
+  /** Only present in the create-response. Backend redacts on subsequent reads. */
+  token?: string;
+  invitedById: string;
+  expiresAt: string;
+  acceptedAt?: string | null;
+  revokedAt?: string | null;
+  isExpired: boolean;
+  isAccepted: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/** Verification method used for an EmailDomainClaim. */
+export type DomainVerificationMethod = 'dns_txt' | 'email_attestation';
+
+/**
+ * A Company's claim on an email domain — gates "anyone @acme.com auto-joins"
+ * behavior once verified. See startsim-gpu.
+ */
+export interface EmailDomainClaim {
+  id: string;
+  companyId: string;
+  domain: string;
+  verified: boolean;
+  verificationMethod?: DomainVerificationMethod | null;
+  /** Only visible to the creator on POST — otherwise null/absent. */
+  verificationToken?: string | null;
+  verifiedAt?: string | null;
+  verifiedById?: string | null;
+  lastVerifiedCheckAt?: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+// ---- API request/payload shapes -------------------------------------------
+
+export interface CompanyListParams {
+  page?: number;
+  pageSize?: number;
+  search?: string;
+  ordering?: string;
+  [key: string]: unknown;
+}
+
+export interface UpdateCompanyInput {
+  name?: string;
+  slug?: string;
+  settings?: Record<string, unknown>;
+}
+
+export interface TeamListParams {
+  page?: number;
+  pageSize?: number;
+  search?: string;
+  companyId?: string;
+  ordering?: string;
+  [key: string]: unknown;
+}
+
+export interface BulkInviteEntry {
+  email: string;
+  role: TeamRole;
+}
+
+export interface BulkInviteResult {
+  invited: TeamInvitation[];
+  /** Backend may return duplicates / failures per the bulk endpoint. */
+  skipped?: Array<{ email: string; reason: string }>;
+}
+
+export interface TeamInvitationListParams {
+  page?: number;
+  pageSize?: number;
+  teamId?: string;
+  ordering?: string;
+  [key: string]: unknown;
+}
+
+export interface CreateTeamInvitationInput {
+  email: string;
+  teamId: string;
+  role: TeamRole;
+}
+
+export interface DomainClaimListParams {
+  page?: number;
+  pageSize?: number;
+  companyId?: string;
+  verified?: boolean;
+  ordering?: string;
+  [key: string]: unknown;
+}
+
+export interface CreateDomainClaimInput {
+  companyId: string;
+  domain: string;
+}
+
+export interface DomainVerifyEmailInitiateResponse {
+  /** Backend confirms an attestation email has been queued. */
+  detail: string;
+}

package/src/types/user.ts

@@ -24,9 +24,28 @@ export interface UpdateProfileRequest {
 export interface ChangePasswordRequest {
   oldPassword: string;
   newPassword: string;
-  newPasswordConfirm: string;
 }
 
 export interface ChangePasswordResponse {
   detail: string;
 }
+
+/**
+ * Passwordless early-access registration — name + email only.
+ * Hits POST /api/v1/auth/early-register/ (public, no auth).
+ */
+export interface EarlyRegisterRequest {
+  email: string;
+  firstName?: string;
+  lastName?: string;
+}
+
+export interface EarlyRegisterResponse {
+  user: {
+    id: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+  };
+  message: string;
+}