@sylphx/management 0.1.0 → 0.2.1

package/dist/remoteConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteConfig.d.ts","sourceRoot":"","sources":["../src/remoteConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAY7C,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,EAAE,CASvB,CAAA;AAED,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,KAAK,MAAM,EACX,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,CAQrB,CAAA;AAED,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,KAAK,MAAM,EACX,OAAO,MAAM,EACb,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,CAKrB,CAAA;AAED,QAAA,MAAM,OAAO,GACZ,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,KAAK,MAAM,EACX,UAAU,MAAM,KACd,OAAO,CAAC,IAAI,CAQd,CAAA;AACD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA"}

package/dist/remoteConfig.js

@@ -0,0 +1,35 @@
+/**
+ * Remote config — server-persisted non-secret key-value store per env.
+ *
+ * Renamed from `config.ts` in the old OOP SDK to `remoteConfig.ts` (ADR-077
+ * Rule D) — disambiguates from the CLI-side local JSON store (`config.ts`)
+ * and the billing `plan`/`subscription` surface.
+ */
+import { resolveId as resolveEnvId } from './environments.js';
+import { request } from './http.js';
+const resolveEnv = async (client, projectId, envType) => {
+    if (!envType)
+        return undefined;
+    const envId = await resolveEnvId(client, projectId, envType);
+    return envId ?? undefined;
+};
+export const list = async (client, projectId, envType) => {
+    const env = await resolveEnv(client, projectId, envType);
+    const res = await request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/config`, { query: { env } });
+    return Array.isArray(res) ? res : (res.data ?? []);
+};
+export const get = async (client, projectId, key, envType) => {
+    const env = await resolveEnv(client, projectId, envType);
+    return request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/config/${encodeURIComponent(key)}`, { query: { env } });
+};
+export const set = async (client, projectId, key, value, envType) => {
+    const environmentId = envType ? await resolveEnvId(client, projectId, envType) : null;
+    return request(client, 'POST', `/projects/${encodeURIComponent(projectId)}/config`, {
+        body: { key, value, environmentId },
+    });
+};
+const _delete = async (client, projectId, key, envType) => {
+    const env = await resolveEnv(client, projectId, envType);
+    return request(client, 'DELETE', `/projects/${encodeURIComponent(projectId)}/config/${encodeURIComponent(key)}`, { query: { env } });
+};
+export { _delete as delete };

package/dist/resourceBindings.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resource bindings — link a managed resource (DB / storage / volume) to a
+ * project environment.
+ *
+ * Renamed from `resources.ts` (class: `ResourceBindingsResource`) in the old
+ * OOP SDK — the module name now matches the capability (ADR-077 Rule D).
+ */
+import type { Client } from './client.js';
+import type { ResourceBinding } from './types.js';
+export declare const list: (client: Client, resourceId: string) => Promise<ResourceBinding[]>;
+export interface BindInput {
+    readonly projectId: string;
+    readonly envType: string;
+    readonly role?: string;
+}
+export declare const create: (client: Client, resourceId: string, input: BindInput) => Promise<ResourceBinding>;
+declare const _delete: (client: Client, resourceId: string, bindingId: string) => Promise<void>;
+export { _delete as delete };
+//# sourceMappingURL=resourceBindings.d.ts.map

package/dist/resourceBindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceBindings.d.ts","sourceRoot":"","sources":["../src/resourceBindings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,eAAO,MAAM,IAAI,GAAU,QAAQ,MAAM,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,eAAe,EAAE,CAOxF,CAAA;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,OAAO,SAAS,KACd,OAAO,CAAC,eAAe,CAQzB,CAAA;AAED,QAAA,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,YAAY,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAKnF,CAAA;AACF,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA"}

package/dist/resourceBindings.js

@@ -0,0 +1,24 @@
+/**
+ * Resource bindings — link a managed resource (DB / storage / volume) to a
+ * project environment.
+ *
+ * Renamed from `resources.ts` (class: `ResourceBindingsResource`) in the old
+ * OOP SDK — the module name now matches the capability (ADR-077 Rule D).
+ */
+import { resolveId as resolveEnvId } from './environments.js';
+import { request } from './http.js';
+export const list = async (client, resourceId) => {
+    const res = await request(client, 'GET', `/resources/${encodeURIComponent(resourceId)}/bindings`);
+    return res.bindings ?? [];
+};
+export const create = async (client, resourceId, input) => {
+    const projectEnvironmentId = await resolveEnvId(client, input.projectId, input.envType);
+    if (!projectEnvironmentId) {
+        throw new Error(`Environment '${input.envType}' not found for project '${input.projectId}'`);
+    }
+    return request(client, 'POST', `/resources/${encodeURIComponent(resourceId)}/bindings`, {
+        body: { projectEnvironmentId, role: input.role ?? 'primary' },
+    });
+};
+const _delete = (client, resourceId, bindingId) => request(client, 'DELETE', `/resources/${encodeURIComponent(resourceId)}/bindings/${encodeURIComponent(bindingId)}`);
+export { _delete as delete };

package/dist/runners.d.ts

@@ -0,0 +1,60 @@
+/**
+ * CI runners — self-hosted machines that execute build / deploy jobs.
+ *
+ *   POST   /runners                    — register (returns one-time install token)
+ *   GET    /runners                    — list
+ *   GET    /runners/:id/jobs           — recent jobs for a runner
+ *   DELETE /runners/:id                — unregister
+ *
+ * The `registrationToken` returned by `register()` is shown ONCE — the
+ * server only keeps a hash. Runners exchange it for a long-lived
+ * credential during bootstrap.
+ */
+import type { Client } from './client.js';
+export type RunnerPlatform = 'linux' | 'macos' | 'windows';
+export type RunnerArch = 'x64' | 'arm64';
+export interface RunnerView {
+    readonly id: string;
+    readonly name: string;
+    readonly platform: RunnerPlatform;
+    readonly arch: RunnerArch;
+    readonly version: string | null;
+    readonly status: string;
+    readonly lastSeenAt: string | null;
+    readonly createdAt: string;
+    readonly labels?: readonly string[];
+    readonly maxJobs?: number;
+}
+export interface RunnerJob {
+    readonly id: string;
+    readonly runnerId: string | null;
+    readonly status: string;
+    readonly gitRepo: string;
+    readonly gitBranch: string;
+    readonly gitCommit: string | null;
+    readonly startedAt: string | null;
+    readonly finishedAt: string | null;
+}
+export interface RegisterInput {
+    readonly name: string;
+    readonly platform: RunnerPlatform;
+    readonly arch: RunnerArch;
+    readonly labels?: readonly string[];
+    readonly maxJobs?: number;
+}
+export interface RegisterResult {
+    readonly runnerId: string;
+    /** One-time install token — shown ONCE. */
+    readonly registrationToken: string;
+}
+export declare const register: (client: Client, input: RegisterInput) => Promise<RegisterResult>;
+export declare const list: (client: Client) => Promise<{
+    runners: readonly RunnerView[];
+}>;
+export declare const listJobs: (client: Client, runnerId: string) => Promise<{
+    jobs: readonly RunnerJob[];
+}>;
+export declare const unregister: (client: Client, runnerId: string) => Promise<{
+    success: boolean;
+}>;
+//# sourceMappingURL=runners.d.ts.map

package/dist/runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../src/runners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAC1D,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA;AAExC,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CAClC;AAED,eAAO,MAAM,QAAQ,GAAI,QAAQ,MAAM,EAAE,OAAO,aAAa,KAAG,OAAO,CAAC,cAAc,CACjC,CAAA;AAErD,eAAO,MAAM,IAAI,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAC7C,CAAA;AAEnC,eAAO,MAAM,QAAQ,GACpB,QAAQ,MAAM,EACd,UAAU,MAAM,KACd,OAAO,CAAC;IAAE,IAAI,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,CAC+B,CAAA;AAExE,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CACpB,CAAA"}

package/dist/runners.js

@@ -0,0 +1,17 @@
+/**
+ * CI runners — self-hosted machines that execute build / deploy jobs.
+ *
+ *   POST   /runners                    — register (returns one-time install token)
+ *   GET    /runners                    — list
+ *   GET    /runners/:id/jobs           — recent jobs for a runner
+ *   DELETE /runners/:id                — unregister
+ *
+ * The `registrationToken` returned by `register()` is shown ONCE — the
+ * server only keeps a hash. Runners exchange it for a long-lived
+ * credential during bootstrap.
+ */
+import { request } from './http.js';
+export const register = (client, input) => request(client, 'POST', '/runners', { body: input });
+export const list = (client) => request(client, 'GET', '/runners');
+export const listJobs = (client, runnerId) => request(client, 'GET', `/runners/${encodeURIComponent(runnerId)}/jobs`);
+export const unregister = (client, runnerId) => request(client, 'DELETE', `/runners/${encodeURIComponent(runnerId)}`);

package/dist/saml.d.ts

@@ -0,0 +1,44 @@
+/**
+ * SAML SSO — enterprise Identity Provider configuration per organization.
+ *
+ *   GET    /saml                          — provider for org (null if unconfigured)
+ *   POST   /saml                          — create provider
+ *   PATCH  /saml                          — update provider
+ *   POST   /saml/status                   — enable / disable
+ *   DELETE /saml                          — delete provider + accounts
+ *   GET    /saml/metadata                 — SP metadata XML (for IdP wiring)
+ *   GET    /saml/logs                     — authentication logs
+ *   POST   /saml/test                     — validate cert + reach SSO URL
+ *   GET    /saml/templates                — IdP setup templates (Okta/Azure/...)
+ *   GET    /saml/name-id-formats          — enum options + URIs
+ *   GET    /saml/signature-algorithms     — enum options + URIs
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084). Paths + methods
+ * come from `samlEndpoints`; types come from the matching schemas.
+ * Hand-written types are forbidden here.
+ *
+ * Admin-only. Certificate is PEM — `create()` / `update()` accept it as-is;
+ * the server validates the chain and stores the fingerprint. The raw IdP
+ * metadata XML returned by `metadata()` is feed-ready for the IdP's
+ * "Add Service Provider" flow — no post-processing required.
+ */
+import type { CreateSAMLProviderInput, CreateSAMLProviderResult, DeleteSAMLProviderResult, GetSAMLLogsResult, GetSAMLMetadataResult, GetSAMLProviderResult, ListSAMLIdPTemplatesResult, ListSAMLNameIdFormatsResult, ListSAMLSignatureAlgorithmsResult, SAMLAttributeMapping, SAMLAuthLog, SAMLIdPTemplate, SAMLNameIdFormat, SAMLNameIdFormatOption, SAMLProvider, SAMLProviderStatus, SAMLProviderType, SAMLSignatureAlgorithm, SAMLSignatureAlgorithmOption, SetSAMLProviderStatusResult, TestSAMLConfigInput, TestSAMLConfigResult, UpdateSAMLProviderInput, UpdateSAMLProviderResult } from '@sylphx/contract';
+import type { Client } from './client.js';
+export type { CreateSAMLProviderInput, CreateSAMLProviderResult, GetSAMLMetadataResult as MetadataResult, SAMLAttributeMapping, SAMLAuthLog as AuthLog, SAMLIdPTemplate as IdPTemplate, SAMLNameIdFormat, SAMLNameIdFormatOption as NameIdFormatOption, SAMLProvider, SAMLProviderStatus, SAMLProviderType, SAMLSignatureAlgorithm, SAMLSignatureAlgorithmOption as SignatureAlgorithmOption, TestSAMLConfigInput as TestConfigInput, TestSAMLConfigResult as TestConfigResult, UpdateSAMLProviderInput, };
+/**
+ * `Promise`-typed CRUD wrappers. Each routes through the contract endpoint
+ * descriptor so the path / method live in `@sylphx/contract` only.
+ */
+export declare const get: (client: Client, organizationId: string) => Promise<GetSAMLProviderResult>;
+export declare const create: (client: Client, input: CreateSAMLProviderInput) => Promise<CreateSAMLProviderResult>;
+export declare const update: (client: Client, input: UpdateSAMLProviderInput) => Promise<UpdateSAMLProviderResult>;
+export declare const setStatus: (client: Client, providerId: string, enabled: boolean) => Promise<SetSAMLProviderStatusResult>;
+declare const _delete: (client: Client, providerId: string) => Promise<DeleteSAMLProviderResult>;
+export { _delete as delete };
+export declare const metadata: (client: Client, organizationId: string) => Promise<GetSAMLMetadataResult>;
+export declare const logs: (client: Client, providerId: string, limit?: number) => Promise<GetSAMLLogsResult>;
+export declare const testConfig: (client: Client, input: TestSAMLConfigInput) => Promise<TestSAMLConfigResult>;
+export declare const templates: (client: Client) => Promise<ListSAMLIdPTemplatesResult>;
+export declare const nameIdFormats: (client: Client) => Promise<ListSAMLNameIdFormatsResult>;
+export declare const signatureAlgorithms: (client: Client) => Promise<ListSAMLSignatureAlgorithmsResult>;
+//# sourceMappingURL=saml.d.ts.map

package/dist/saml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../src/saml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACX,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMzC,YAAY,EACX,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,IAAI,cAAc,EACvC,oBAAoB,EACpB,WAAW,IAAI,OAAO,EACtB,eAAe,IAAI,WAAW,EAC9B,gBAAgB,EAChB,sBAAsB,IAAI,kBAAkB,EAC5C,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,4BAA4B,IAAI,wBAAwB,EACxD,mBAAmB,IAAI,eAAe,EACtC,oBAAoB,IAAI,gBAAgB,EACxC,uBAAuB,GACvB,CAAA;AAED;;;GAGG;AAEH,eAAO,MAAM,GAAG,GAAI,QAAQ,MAAM,EAAE,gBAAgB,MAAM,KAAG,OAAO,CAAC,qBAAqB,CAGzF,CAAA;AAED,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,OAAO,uBAAuB,KAC5B,OAAO,CAAC,wBAAwB,CAGlC,CAAA;AAED,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,OAAO,uBAAuB,KAC5B,OAAO,CAAC,wBAAwB,CAGlC,CAAA;AAED,eAAO,MAAM,SAAS,GACrB,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,SAAS,OAAO,KACd,OAAO,CAAC,2BAA2B,CAGrC,CAAA;AAED,QAAA,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,wBAAwB,CAGrF,CAAA;AACD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA;AAE5B,eAAO,MAAM,QAAQ,GACpB,QAAQ,MAAM,EACd,gBAAgB,MAAM,KACpB,OAAO,CAAC,qBAAqB,CAG/B,CAAA;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,QAAQ,MAAM,KACZ,OAAO,CAAC,iBAAiB,CAK3B,CAAA;AAED,eAAO,MAAM,UAAU,GACtB,QAAQ,MAAM,EACd,OAAO,mBAAmB,KACxB,OAAO,CAAC,oBAAoB,CAG9B,CAAA;AAED,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,0BAA0B,CAG5E,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,2BAA2B,CAGjF,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,iCAAiC,CAG7F,CAAA"}

package/dist/saml.js

@@ -0,0 +1,77 @@
+/**
+ * SAML SSO — enterprise Identity Provider configuration per organization.
+ *
+ *   GET    /saml                          — provider for org (null if unconfigured)
+ *   POST   /saml                          — create provider
+ *   PATCH  /saml                          — update provider
+ *   POST   /saml/status                   — enable / disable
+ *   DELETE /saml                          — delete provider + accounts
+ *   GET    /saml/metadata                 — SP metadata XML (for IdP wiring)
+ *   GET    /saml/logs                     — authentication logs
+ *   POST   /saml/test                     — validate cert + reach SSO URL
+ *   GET    /saml/templates                — IdP setup templates (Okta/Azure/...)
+ *   GET    /saml/name-id-formats          — enum options + URIs
+ *   GET    /saml/signature-algorithms     — enum options + URIs
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084). Paths + methods
+ * come from `samlEndpoints`; types come from the matching schemas.
+ * Hand-written types are forbidden here.
+ *
+ * Admin-only. Certificate is PEM — `create()` / `update()` accept it as-is;
+ * the server validates the chain and stores the fingerprint. The raw IdP
+ * metadata XML returned by `metadata()` is feed-ready for the IdP's
+ * "Add Service Provider" flow — no post-processing required.
+ */
+import { samlEndpoints } from '@sylphx/contract';
+import { request } from './http.js';
+/**
+ * `Promise`-typed CRUD wrappers. Each routes through the contract endpoint
+ * descriptor so the path / method live in `@sylphx/contract` only.
+ */
+export const get = (client, organizationId) => {
+    const { method, path } = samlEndpoints.getProvider;
+    return request(client, method, path, { query: { organizationId } });
+};
+export const create = (client, input) => {
+    const { method, path } = samlEndpoints.createProvider;
+    return request(client, method, path, { body: input });
+};
+export const update = (client, input) => {
+    const { method, path } = samlEndpoints.updateProvider;
+    return request(client, method, path, { body: input });
+};
+export const setStatus = (client, providerId, enabled) => {
+    const { method, path } = samlEndpoints.setProviderStatus;
+    return request(client, method, path, { body: { providerId, enabled } });
+};
+const _delete = (client, providerId) => {
+    const { method, path } = samlEndpoints.deleteProvider;
+    return request(client, method, path, { body: { providerId } });
+};
+export { _delete as delete };
+export const metadata = (client, organizationId) => {
+    const { method, path } = samlEndpoints.getMetadata;
+    return request(client, method, path, { query: { organizationId } });
+};
+export const logs = (client, providerId, limit) => {
+    const { method, path } = samlEndpoints.getLogs;
+    return request(client, method, path, {
+        query: { providerId, limit: limit !== undefined ? String(limit) : undefined },
+    });
+};
+export const testConfig = (client, input) => {
+    const { method, path } = samlEndpoints.testConfig;
+    return request(client, method, path, { body: input });
+};
+export const templates = (client) => {
+    const { method, path } = samlEndpoints.listTemplates;
+    return request(client, method, path);
+};
+export const nameIdFormats = (client) => {
+    const { method, path } = samlEndpoints.listNameIdFormats;
+    return request(client, method, path);
+};
+export const signatureAlgorithms = (client) => {
+    const { method, path } = samlEndpoints.listSignatureAlgorithms;
+    return request(client, method, path);
+};

package/dist/sandboxes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Ephemeral compute sandboxes (ADR-052 container_executions).
+ *
+ *   POST   /projects/:id/sandboxes   — create (waits for pod ready)
+ *   GET    /projects/:id/sandboxes   — list active sandboxes for a project
+ *   GET    /sandboxes/:id            — get details
+ *   DELETE /sandboxes/:id            — terminate
+ */
+import type { Client } from './client.js';
+import type { Sandbox, SandboxCreateResult, SandboxSummary } from './types.js';
+export declare const create: (client: Client, projectId: string, body: Record<string, unknown>) => Promise<SandboxCreateResult>;
+export declare const list: (client: Client, projectId: string) => Promise<SandboxSummary[]>;
+export declare const get: (client: Client, sandboxId: string) => Promise<Sandbox>;
+export declare const terminate: (client: Client, sandboxId: string) => Promise<void>;
+//# sourceMappingURL=sandboxes.d.ts.map

package/dist/sandboxes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxes.d.ts","sourceRoot":"","sources":["../src/sandboxes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE9E,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,mBAAmB,CAC4D,CAAA;AAE1F,eAAO,MAAM,IAAI,GAAU,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,cAAc,EAAE,CAOtF,CAAA;AAED,eAAO,MAAM,GAAG,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CACD,CAAA;AAEtE,eAAO,MAAM,SAAS,GAAU,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA"}

package/dist/sandboxes.js

@@ -0,0 +1,18 @@
+/**
+ * Ephemeral compute sandboxes (ADR-052 container_executions).
+ *
+ *   POST   /projects/:id/sandboxes   — create (waits for pod ready)
+ *   GET    /projects/:id/sandboxes   — list active sandboxes for a project
+ *   GET    /sandboxes/:id            — get details
+ *   DELETE /sandboxes/:id            — terminate
+ */
+import { request } from './http.js';
+export const create = (client, projectId, body) => request(client, 'POST', `/projects/${encodeURIComponent(projectId)}/sandboxes`, { body });
+export const list = async (client, projectId) => {
+    const res = await request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/sandboxes`);
+    return Array.isArray(res) ? res : (res.sandboxes ?? []);
+};
+export const get = (client, sandboxId) => request(client, 'GET', `/sandboxes/${encodeURIComponent(sandboxId)}`);
+export const terminate = async (client, sandboxId) => {
+    await request(client, 'DELETE', `/sandboxes/${encodeURIComponent(sandboxId)}`);
+};

package/dist/search.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Indexed search — analytics, corpus stats, and document listing.
+ *
+ *   GET  /search/projects/:projectId/analytics  — top queries, CTR, latency
+ *   GET  /search/projects/:projectId/stats      — corpus size + namespace breakdown
+ *   GET  /search/projects/:projectId/documents  — paginated document list
+ *
+ * Console-facing only — the SDK-level search *write* endpoints (index /
+ * query / click) remain internal. Consumers index documents through the
+ * runtime SDK; this namespace is for operator-grade introspection.
+ */
+import type { Client } from './client.js';
+export interface TopQuery {
+    readonly query: string;
+    readonly count: number;
+}
+export interface SearchAnalytics {
+    readonly totalQueries: number;
+    readonly avgLatencyMs: number;
+    readonly clickThroughRate: number;
+    readonly topQueries: readonly TopQuery[];
+}
+export interface AnalyticsOptions {
+    readonly namespace?: string;
+    readonly dateFrom?: string;
+    readonly dateTo?: string;
+}
+export declare const analytics: (client: Client, projectId: string, options?: AnalyticsOptions) => Promise<SearchAnalytics>;
+export interface NamespaceStats {
+    readonly namespace: string;
+    readonly count: number;
+}
+export interface SearchStats {
+    readonly totalDocuments: number;
+    readonly documentsWithEmbedding: number;
+    readonly byNamespace: readonly NamespaceStats[];
+}
+export declare const stats: (client: Client, projectId: string, namespace?: string) => Promise<SearchStats>;
+export interface SearchDocument {
+    readonly id: string;
+    readonly namespace: string;
+    readonly externalId: string | null;
+    readonly title: string | null;
+    readonly contentPreview: string;
+    readonly url: string | null;
+    readonly category: string | null;
+    readonly type: string | null;
+    readonly tags: readonly string[] | null;
+    readonly hasEmbedding: boolean;
+    readonly impressions: number;
+    readonly clicks: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface ListDocumentsResult {
+    readonly documents: readonly SearchDocument[];
+    readonly total: number;
+    readonly hasMore: boolean;
+}
+export interface ListDocumentsOptions {
+    readonly namespace?: string;
+    readonly limit?: number;
+    readonly offset?: number;
+}
+export declare const listDocuments: (client: Client, projectId: string, options?: ListDocumentsOptions) => Promise<ListDocumentsResult>;
+//# sourceMappingURL=search.d.ts.map

package/dist/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../src/search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,SAAS,GACrB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,gBAAgB,KACxB,OAAO,CAAC,eAAe,CAOvB,CAAA;AAEH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;CAC/C;AAED,eAAO,MAAM,KAAK,GACjB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,CAGnB,CAAA;AAEH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,aAAa,GACzB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,mBAAmB,CAO3B,CAAA"}

package/dist/search.js

@@ -0,0 +1,29 @@
+/**
+ * Indexed search — analytics, corpus stats, and document listing.
+ *
+ *   GET  /search/projects/:projectId/analytics  — top queries, CTR, latency
+ *   GET  /search/projects/:projectId/stats      — corpus size + namespace breakdown
+ *   GET  /search/projects/:projectId/documents  — paginated document list
+ *
+ * Console-facing only — the SDK-level search *write* endpoints (index /
+ * query / click) remain internal. Consumers index documents through the
+ * runtime SDK; this namespace is for operator-grade introspection.
+ */
+import { request } from './http.js';
+export const analytics = (client, projectId, options) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/analytics`, {
+    query: {
+        namespace: options?.namespace,
+        dateFrom: options?.dateFrom,
+        dateTo: options?.dateTo,
+    },
+});
+export const stats = (client, projectId, namespace) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/stats`, {
+    query: { namespace },
+});
+export const listDocuments = (client, projectId, options) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/documents`, {
+    query: {
+        namespace: options?.namespace,
+        limit: options?.limit !== undefined ? String(options.limit) : undefined,
+        offset: options?.offset !== undefined ? String(options.offset) : undefined,
+    },
+});

package/dist/secrets.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Encrypted secrets vault — AES-256-GCM at rest, env-scoped, versioned.
+ *
+ *   GET    /secrets                   — list (project + optional env)
+ *   GET    /secrets/detail?id=&reveal — get one (reveal opt-in only)
+ *   POST   /secrets                   — create
+ *   PATCH  /secrets                   — update (new value → new version)
+ *   DELETE /secrets                   — delete
+ *   POST   /secrets/rollback          — restore a past version
+ *   GET    /secrets/stats             — per-env counts
+ *
+ * Secrets are distinct from `envVars`: envVars are plain K/V for runtime
+ * injection; secrets are a first-class vault with version history, audit
+ * trail, and on-demand decryption. Prefer secrets when the value must
+ * never leak into build logs or reach the filesystem.
+ *
+ * The `reveal` flag on `get()` MUST be passed explicitly — without it
+ * the API returns a masked string. Callers opting in accept full
+ * responsibility for shielding the plaintext.
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084).
+ */
+import type { CreateSecretInput, CreateSecretResult, RollbackSecretResult, SecretDetail, SecretListItem, UpdateSecretInput, UpdateSecretResult } from '@sylphx/contract';
+import type { Client } from './client.js';
+export type { CreateSecretInput as CreateInput, CreateSecretResult as CreateResult, EnvironmentRef, RollbackSecretResult as RollbackResult, SecretDetail, SecretListItem, SecretVersion, UpdateSecretInput as UpdateInput, UpdateSecretResult as UpdateResult, } from '@sylphx/contract';
+export interface ListOptions {
+    readonly environmentId?: string;
+    readonly includeInactive?: boolean;
+}
+export declare const list: (client: Client, projectId: string, options?: ListOptions) => Promise<{
+    secrets: readonly SecretListItem[];
+}>;
+export declare const get: (client: Client, id: string, options?: {
+    reveal?: boolean;
+}) => Promise<SecretDetail>;
+export declare const create: (client: Client, input: CreateSecretInput) => Promise<CreateSecretResult>;
+export declare const update: (client: Client, input: UpdateSecretInput) => Promise<UpdateSecretResult>;
+declare const _delete: (client: Client, id: string) => Promise<{
+    success: boolean;
+}>;
+export { _delete as delete };
+export declare const rollback: (client: Client, id: string, version: string) => Promise<RollbackSecretResult>;
+export interface EnvironmentStats {
+    readonly environmentId: string | null;
+    readonly count: number;
+}
+export declare const stats: (client: Client, projectId: string) => Promise<{
+    stats: readonly EnvironmentStats[];
+}>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,YAAY,EACX,iBAAiB,IAAI,WAAW,EAChC,kBAAkB,IAAI,YAAY,EAClC,cAAc,EACd,oBAAoB,IAAI,cAAc,EACtC,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,IAAI,WAAW,EAChC,kBAAkB,IAAI,YAAY,GAClC,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,WAAW,KACnB,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,CAShD,CAAA;AAED,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,IAAI,MAAM,EACV,UAAU;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,KAC5B,OAAO,CAAC,YAAY,CAKtB,CAAA;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,iBAAiB,KAAG,OAAO,CAAC,kBAAkB,CAG3F,CAAA;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,iBAAiB,KAAG,OAAO,CAAC,kBAAkB,CAG3F,CAAA;AAED,QAAA,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAGzE,CAAA;AACD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA;AAE5B,eAAO,MAAM,QAAQ,GACpB,QAAQ,MAAM,EACd,IAAI,MAAM,EACV,SAAS,MAAM,KACb,OAAO,CAAC,oBAAoB,CAG9B,CAAA;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,eAAO,MAAM,KAAK,GACjB,QAAQ,MAAM,EACd,WAAW,MAAM,KACf,OAAO,CAAC;IAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAAE,CAGhD,CAAA"}

package/dist/secrets.js

@@ -0,0 +1,61 @@
+/**
+ * Encrypted secrets vault — AES-256-GCM at rest, env-scoped, versioned.
+ *
+ *   GET    /secrets                   — list (project + optional env)
+ *   GET    /secrets/detail?id=&reveal — get one (reveal opt-in only)
+ *   POST   /secrets                   — create
+ *   PATCH  /secrets                   — update (new value → new version)
+ *   DELETE /secrets                   — delete
+ *   POST   /secrets/rollback          — restore a past version
+ *   GET    /secrets/stats             — per-env counts
+ *
+ * Secrets are distinct from `envVars`: envVars are plain K/V for runtime
+ * injection; secrets are a first-class vault with version history, audit
+ * trail, and on-demand decryption. Prefer secrets when the value must
+ * never leak into build logs or reach the filesystem.
+ *
+ * The `reveal` flag on `get()` MUST be passed explicitly — without it
+ * the API returns a masked string. Callers opting in accept full
+ * responsibility for shielding the plaintext.
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084).
+ */
+import { secretsEndpoints } from '@sylphx/contract';
+import { request } from './http.js';
+export const list = (client, projectId, options) => {
+    const { method, path } = secretsEndpoints.list;
+    return request(client, method, path, {
+        query: {
+            projectId,
+            environmentId: options?.environmentId,
+            includeInactive: options?.includeInactive ? 'true' : undefined,
+        },
+    });
+};
+export const get = (client, id, options) => {
+    const { method, path } = secretsEndpoints.get;
+    return request(client, method, path, {
+        query: { id, reveal: options?.reveal ? 'true' : undefined },
+    });
+};
+export const create = (client, input) => {
+    const { method, path } = secretsEndpoints.create;
+    return request(client, method, path, { body: input });
+};
+export const update = (client, input) => {
+    const { method, path } = secretsEndpoints.update;
+    return request(client, method, path, { body: input });
+};
+const _delete = (client, id) => {
+    const { method, path } = secretsEndpoints.delete;
+    return request(client, method, path, { body: { id } });
+};
+export { _delete as delete };
+export const rollback = (client, id, version) => {
+    const { method, path } = secretsEndpoints.rollback;
+    return request(client, method, path, { body: { id, version } });
+};
+export const stats = (client, projectId) => {
+    const { method, path } = secretsEndpoints.stats;
+    return request(client, method, path, { query: { projectId } });
+};

package/dist/security.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Security Console — user-facing security settings (Management plane).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/security/*`. Paths come
+ * from `@sylphx/contract` (`securityEndpoints`, mount `/security/*`).
+ *
+ * This is the SDK surface the CLI / Console UI use to drive the
+ * authenticated user's own security settings — distinct from
+ * `@sylphx/sdk.auth` (BaaS plane, end-user sign-in/sign-up) and from
+ * `authSettings.ts` (Management plane, project-level OAuth/SAML config).
+ *
+ * Initial scope (ADR-089 closure for P0-1 — email change). Other
+ * sub-namespaces (2FA, OAuth, password, passkeys, sessions, score,
+ * alerts) follow the same pattern as endpoints stabilise.
+ */
+import type { Client } from './client.js';
+export interface EmailChangeRequestInput {
+    readonly newEmail: string;
+}
+export interface EmailChangeRequestResult {
+    readonly success: boolean;
+    readonly message: string;
+    readonly expiresAt: string;
+}
+/**
+ * Request a change of the authenticated user's email address.
+ *
+ * The Platform issues a 32-byte verification token, persists a pending
+ * `email_change_requests` row, and emails the verification link to the
+ * **new** address. The current address is left untouched until the user
+ * confirms via {@link confirmEmailChange}. Audit-emitted as
+ * `email_change.create` with the new address masked.
+ *
+ * Errors:
+ *   - 409 — `newEmail` is already in use by another account
+ *   - 404 — current user not found (should not happen for a valid session)
+ */
+export declare const requestEmailChange: (client: Client, body: EmailChangeRequestInput) => Promise<EmailChangeRequestResult>;
+export interface EmailChangeConfirmInput {
+    readonly token: string;
+}
+export interface EmailChangeConfirmResult {
+    readonly success: boolean;
+    readonly newEmail: string;
+}
+/**
+ * Confirm a pending email change using the token delivered via email.
+ *
+ * On success the `users.email` column is updated, the pending request is
+ * deleted, a security alert is recorded, and a notification is sent to
+ * the **previous** address. Audit-emitted as `user.update` with
+ * `metadata.action = 'email_changed'`.
+ *
+ * Errors:
+ *   - 422 — invalid or expired token (the row is cleaned up on expiry)
+ */
+export declare const confirmEmailChange: (client: Client, body: EmailChangeConfirmInput) => Promise<EmailChangeConfirmResult>;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,MAAM,uBAAuB,KAC3B,OAAO,CAAC,wBAAwB,CAGlC,CAAA;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,MAAM,uBAAuB,KAC3B,OAAO,CAAC,wBAAwB,CAGlC,CAAA"}