@takeal/cusfront-sdk 0.1.0 → 0.2.8

package/dist/resources/auth.cjs

@@ -38,6 +38,40 @@ var AuthResource = class {
     await Promise.resolve(this.tokens.set(resp.access_token));
     return resp;
   }
+  /** Create an end-user account and sign it in. The JWT is stored.
+   *  `wallet_currency` must be one the deployment offers; omit it to take
+   *  the deployment default (it can be switched later via `client.wallet`
+   *  while the wallet is empty).
+   *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */
+  async register(input) {
+    const resp = await this.http.post("/auth/register", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Finish a `totp_setup_required` login: send the first code from the
+   *  authenticator app. The JWT is stored. The response carries ten
+   *  one-time `backup_codes` that are never returned again, so show them to
+   *  the user right away and don't keep them on the device. */
+  async completeTotpSetup(input) {
+    const resp = await this.http.post("/auth/login/totp-setup", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Change the signed-in user's password. Every other session of the
+   *  account is signed out; this one stays valid.
+   *  Errors: 400 when the new password fails the policy, 401 when the
+   *  current one is wrong. */
+  async changePassword(input) {
+    return this.http.post("/auth/password", {
+      body: input
+    });
+  }
   /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
    *  telegram/email; for TOTP it short-circuits back to the challenge. */
   async switchMethod(input) {
@@ -74,10 +108,9 @@ var AuthResource = class {
   async me() {
     return this.http.get("/auth/me");
   }
-  /** Local sign-out. The SDK doesn't currently call a server-side
-   *  endpoint (the Takeal API issues stateless JWTs); clearing the
-   *  store is enough. Server-side session invalidation may land
-   *  with a future session table. */
+  /** Local sign-out: forgets the stored JWT. To end the session on the
+   *  server as well, revoke it first with `client.sessions.revoke(jti)`
+   *  (the current one is marked `current: true` in `client.sessions.list()`). */
   async signOut() {
     await Promise.resolve(this.tokens.clear());
   }

package/dist/resources/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/auth.ts"],"names":[],"mappings":";;;AAoGO,IAAM,eAAN,MAAmB;AAAA,EACxB,WAAA,CACmB,MACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA,EAIH,MAAM,MAAM,KAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAoB,aAAA,EAAe;AAAA,MAC9D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,UAAU,KAAA,EAAO;AACxB,MAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,KAAA,EAA4C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,kBAAA,EAAoB;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,UAAU,KAAA,EAA2C;AACzD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,wBAAA,EAA0B;AAAA,MACrE,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,aAAa,KAAA,EAAoD;AACrE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAsB,wBAAA,EAA0B;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,KAAA,EAAiD;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,yBAAA,EAA2B;AAAA,MACtE,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,KAAA,EAAyC;AACvD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa,EAAE,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,EAAG,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA,EAIA,MAAM,EAAA,GAAoB;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAU,UAAU,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AACF","file":"auth.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { TokenStore } from \"../token-store.js\";\n\n/**\n * Auth resource — `client.auth.*`.\n *\n * Covers the end-user-facing staged auth flow: password login\n * with optional TOTP/OTP step-up. The shape mirrors the responses\n * the Takeal API returns from `/auth/login`, `/auth/login/totp`,\n * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.\n *\n * The login methods stash the JWT in the configured `TokenStore` on\n * success so subsequent `client.*` calls authenticate automatically.\n * Step-up responses (TotpRequired / OtpSent) carry their own short-\n * lived challenge token which the caller passes to the next method\n * — those tokens DO NOT go through the TokenStore (they're not the\n * end-state JWT).\n */\n\nexport interface User {\n  id: string;\n  email: string;\n  role: string;\n  is_active: boolean;\n  /** True for users auto-provisioned via the Telegram Mini App who still hold\n   *  a synthetic placeholder email. The client should prompt for a real email\n   *  and attach it via `auth.linkEmail` — this flips the flag to false. */\n  email_pending?: boolean;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface LoginInput {\n  email: string;\n  password: string;\n}\n\n/** Discriminated union — `stage` is the discriminator. */\nexport type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;\n\nexport interface JwtIssued {\n  stage: \"jwt\";\n  access_token: string;\n  expires_at: string;\n  user: User;\n  /** True iff the user's role grants `system.view_hub`.\n   *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */\n  hub_access?: boolean;\n}\n\nexport interface TotpRequired {\n  stage: \"totp_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** Alternate second factors. Pick one with `/2fa/switch`. */\n  available_methods: AvailableMethod[];\n}\n\nexport interface TotpSetupRequired {\n  stage: \"totp_setup_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** OTPAuth URI rendered as a QR by the consumer. */\n  otpauth_url: string;\n  /** Same secret base32-encoded — for manual entry alongside QR. */\n  secret_base32: string;\n}\n\nexport interface AvailableMethod {\n  kind: \"totp\" | \"telegram_otp\" | \"email_otp\";\n  /** Short user-facing hint, e.g. `\"Telegram (@user)\"` or `\"e****@example.com\"`. */\n  hint?: string;\n}\n\nexport interface TotpVerifyInput {\n  challenge_token: string;\n  /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */\n  code: string;\n}\n\nexport interface OtpVerifyInput {\n  challenge_token: string;\n  /** 6-digit one-time code delivered via the selected channel. */\n  code: string;\n}\n\nexport interface SwitchMethodInput {\n  challenge_token: string;\n  method: AvailableMethod[\"kind\"];\n}\n\nexport interface OtpSentResponse {\n  stage: \"otp_sent\";\n  challenge_token: string;\n  expires_at: string;\n  method: AvailableMethod[\"kind\"];\n  hint?: string;\n  available_methods: AvailableMethod[];\n}\n\nexport class AuthResource {\n  constructor(\n    private readonly http: HttpClient,\n    private readonly tokens: TokenStore,\n  ) {}\n\n  /** Password-auth entry. May resolve to a JWT, or to a step-up\n   *  challenge that needs `verifyTotp` / `verifyOtp` next. */\n  async login(input: LoginInput): Promise<LoginResponse> {\n    const resp = await this.http.post<LoginResponse>(\"/auth/login\", {\n      body: input,\n      skipAuth: true,\n    });\n    if (resp.stage === \"jwt\") {\n      await Promise.resolve(this.tokens.set(resp.access_token));\n    }\n    return resp;\n  }\n\n  /** Verify a TOTP code (or XXXX-XXXX backup code) against a\n   *  `totp_required` challenge. On success the JWT is stored. */\n  async verifyTotp(input: TotpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/totp\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Verify a 6-digit OTP code (Telegram / email) against an\n   *  `otp_sent` challenge. */\n  async verifyOtp(input: OtpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/otp/verify\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for\n   *  telegram/email; for TOTP it short-circuits back to the challenge. */\n  async switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse> {\n    return this.http.post<OtpSentResponse>(\"/auth/login/2fa/switch\", {\n      body: input,\n      skipAuth: true,\n    });\n  }\n\n  /** Exchange a signed Telegram Mini App `initData` payload for a session\n   *  JWT. The server validates the initData HMAC against the deployment's bot\n   *  token, then find-or-creates the end-user. First-time Telegram users are\n   *  auto-provisioned with `user.email_pending === true` — prompt them for a\n   *  real email and call {@link linkEmail}. Stores the JWT on success.\n   *\n   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`\n   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when\n   *  you already hold a configured client. */\n  async exchangeTelegram(input: { initData: string }): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/telegram/exchange\", {\n      body: { init_data: input.initData },\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Attach a real email to the current user (and clear `email_pending`).\n   *  Used after a Telegram exchange to satisfy the email requirement; also\n   *  works for a password user changing their address. 409 if taken. */\n  async linkEmail(input: { email: string }): Promise<User> {\n    return this.http.post<User>(\"/me/email\", { body: { email: input.email } });\n  }\n\n  /** Current user — fails 401 when the stored JWT is expired or\n   *  missing. Useful as a \"do I have a session\" probe on app boot. */\n  async me(): Promise<User> {\n    return this.http.get<User>(\"/auth/me\");\n  }\n\n  /** Local sign-out. The SDK doesn't currently call a server-side\n   *  endpoint (the Takeal API issues stateless JWTs); clearing the\n   *  store is enough. Server-side session invalidation may land\n   *  with a future session table. */\n  async signOut(): Promise<void> {\n    await Promise.resolve(this.tokens.clear());\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/auth.ts"],"names":[],"mappings":";;;AA8HO,IAAM,eAAN,MAAmB;AAAA,EACxB,WAAA,CACmB,MACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA,EAIH,MAAM,MAAM,KAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAoB,aAAA,EAAe;AAAA,MAC9D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,UAAU,KAAA,EAAO;AACxB,MAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,KAAA,EAA4C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,kBAAA,EAAoB;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,UAAU,KAAA,EAA2C;AACzD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,wBAAA,EAA0B;AAAA,MACrE,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAS,KAAA,EAAwC;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAc,gBAAA,EAAkB;AAAA,MAC3D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,KAAA,EAAoD;AAC1E,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAwB,wBAAA,EAA0B;AAAA,MAC7E,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,KAAA,EAAmE;AACtF,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAmC,gBAAA,EAAkB;AAAA,MACpE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,aAAa,KAAA,EAAoD;AACrE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAsB,wBAAA,EAA0B;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,KAAA,EAAiD;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,yBAAA,EAA2B;AAAA,MACtE,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,KAAA,EAAyC;AACvD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa,EAAE,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,EAAG,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA,EAIA,MAAM,EAAA,GAAoB;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAU,UAAU,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AACF","file":"auth.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { TokenStore } from \"../token-store.js\";\n\n/**\n * Auth resource — `client.auth.*`.\n *\n * Covers the end-user-facing staged auth flow: password login\n * with optional TOTP/OTP step-up. The shape mirrors the responses\n * the Takeal API returns from `/auth/login`, `/auth/login/totp`,\n * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.\n *\n * The login methods stash the JWT in the configured `TokenStore` on\n * success so subsequent `client.*` calls authenticate automatically.\n * Step-up responses (TotpRequired / OtpSent) carry their own short-\n * lived challenge token which the caller passes to the next method\n * — those tokens DO NOT go through the TokenStore (they're not the\n * end-state JWT).\n */\n\nexport interface User {\n  id: string;\n  email: string;\n  role: string;\n  is_active: boolean;\n  /** True for users auto-provisioned via the Telegram Mini App who still hold\n   *  a synthetic placeholder email. The client should prompt for a real email\n   *  and attach it via `auth.linkEmail` — this flips the flag to false. */\n  email_pending?: boolean;\n  created_at: string;\n  updated_at: string;\n  /** ISO 4217 code the user's wallet is held in (their own choice, else the\n   *  deployment default). Present on `GET /auth/me`. */\n  wallet_currency?: string;\n}\n\nexport interface LoginInput {\n  email: string;\n  password: string;\n}\n\n/** Discriminated union — `stage` is the discriminator. */\nexport type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;\n\nexport interface JwtIssued {\n  stage: \"jwt\";\n  access_token: string;\n  expires_at: string;\n  user: User;\n  /** True iff the user's role grants `system.view_hub`.\n   *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */\n  hub_access?: boolean;\n}\n\nexport interface TotpRequired {\n  stage: \"totp_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** Alternate second factors. Pick one with `/2fa/switch`. */\n  available_methods: AvailableMethod[];\n}\n\nexport interface TotpSetupRequired {\n  stage: \"totp_setup_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** OTPAuth URI rendered as a QR by the consumer. */\n  otpauth_url: string;\n  /** Same secret base32-encoded — for manual entry alongside QR. */\n  secret_base32: string;\n}\n\nexport interface AvailableMethod {\n  kind: \"totp\" | \"telegram_otp\" | \"email_otp\";\n  /** Short user-facing hint, e.g. `\"Telegram (@user)\"` or `\"e****@example.com\"`. */\n  hint?: string;\n}\n\nexport interface TotpVerifyInput {\n  challenge_token: string;\n  /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */\n  code: string;\n}\n\nexport interface OtpVerifyInput {\n  challenge_token: string;\n  /** 6-digit one-time code delivered via the selected channel. */\n  code: string;\n}\n\nexport interface SwitchMethodInput {\n  challenge_token: string;\n  method: AvailableMethod[\"kind\"];\n}\n\nexport interface RegisterInput {\n  email: string;\n  password: string;\n  /** ISO 4217 code for the new wallet; must be offered by the deployment. */\n  wallet_currency?: string;\n}\n\n/** A signed-in session without the login `stage` marker — what\n *  `register` returns. */\nexport type Session = Omit<JwtIssued, \"stage\">;\n\nexport interface TotpSetupComplete extends Session {\n  /** Ten one-time `XXXX-XXXX` codes, returned only this once. */\n  backup_codes: string[];\n}\n\nexport interface ChangePasswordInput {\n  current_password: string;\n  /** At least 12 characters with a lower-case letter, an upper-case letter\n   *  and a digit; must differ from the current password. */\n  new_password: string;\n}\n\nexport interface OtpSentResponse {\n  stage: \"otp_sent\";\n  challenge_token: string;\n  expires_at: string;\n  method: AvailableMethod[\"kind\"];\n  hint?: string;\n  available_methods: AvailableMethod[];\n}\n\nexport class AuthResource {\n  constructor(\n    private readonly http: HttpClient,\n    private readonly tokens: TokenStore,\n  ) {}\n\n  /** Password-auth entry. May resolve to a JWT, or to a step-up\n   *  challenge that needs `verifyTotp` / `verifyOtp` next. */\n  async login(input: LoginInput): Promise<LoginResponse> {\n    const resp = await this.http.post<LoginResponse>(\"/auth/login\", {\n      body: input,\n      skipAuth: true,\n    });\n    if (resp.stage === \"jwt\") {\n      await Promise.resolve(this.tokens.set(resp.access_token));\n    }\n    return resp;\n  }\n\n  /** Verify a TOTP code (or XXXX-XXXX backup code) against a\n   *  `totp_required` challenge. On success the JWT is stored. */\n  async verifyTotp(input: TotpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/totp\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Verify a 6-digit OTP code (Telegram / email) against an\n   *  `otp_sent` challenge. */\n  async verifyOtp(input: OtpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/otp/verify\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Create an end-user account and sign it in. The JWT is stored.\n   *  `wallet_currency` must be one the deployment offers; omit it to take\n   *  the deployment default (it can be switched later via `client.wallet`\n   *  while the wallet is empty).\n   *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */\n  async register(input: RegisterInput): Promise<Session> {\n    const resp = await this.http.post<Session>(\"/auth/register\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Finish a `totp_setup_required` login: send the first code from the\n   *  authenticator app. The JWT is stored. The response carries ten\n   *  one-time `backup_codes` that are never returned again, so show them to\n   *  the user right away and don't keep them on the device. */\n  async completeTotpSetup(input: TotpVerifyInput): Promise<TotpSetupComplete> {\n    const resp = await this.http.post<TotpSetupComplete>(\"/auth/login/totp-setup\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Change the signed-in user's password. Every other session of the\n   *  account is signed out; this one stays valid.\n   *  Errors: 400 when the new password fails the policy, 401 when the\n   *  current one is wrong. */\n  async changePassword(input: ChangePasswordInput): Promise<{ revoked_sessions: number }> {\n    return this.http.post<{ revoked_sessions: number }>(\"/auth/password\", {\n      body: input,\n    });\n  }\n\n  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for\n   *  telegram/email; for TOTP it short-circuits back to the challenge. */\n  async switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse> {\n    return this.http.post<OtpSentResponse>(\"/auth/login/2fa/switch\", {\n      body: input,\n      skipAuth: true,\n    });\n  }\n\n  /** Exchange a signed Telegram Mini App `initData` payload for a session\n   *  JWT. The server validates the initData HMAC against the deployment's bot\n   *  token, then find-or-creates the end-user. First-time Telegram users are\n   *  auto-provisioned with `user.email_pending === true` — prompt them for a\n   *  real email and call {@link linkEmail}. Stores the JWT on success.\n   *\n   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`\n   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when\n   *  you already hold a configured client. */\n  async exchangeTelegram(input: { initData: string }): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/telegram/exchange\", {\n      body: { init_data: input.initData },\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Attach a real email to the current user (and clear `email_pending`).\n   *  Used after a Telegram exchange to satisfy the email requirement; also\n   *  works for a password user changing their address. 409 if taken. */\n  async linkEmail(input: { email: string }): Promise<User> {\n    return this.http.post<User>(\"/me/email\", { body: { email: input.email } });\n  }\n\n  /** Current user — fails 401 when the stored JWT is expired or\n   *  missing. Useful as a \"do I have a session\" probe on app boot. */\n  async me(): Promise<User> {\n    return this.http.get<User>(\"/auth/me\");\n  }\n\n  /** Local sign-out: forgets the stored JWT. To end the session on the\n   *  server as well, revoke it first with `client.sessions.revoke(jti)`\n   *  (the current one is marked `current: true` in `client.sessions.list()`). */\n  async signOut(): Promise<void> {\n    await Promise.resolve(this.tokens.clear());\n  }\n}\n"]}

package/dist/resources/auth.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpClient, T as TokenStore } from '../http-BkZZZI8K.cjs';
+import { H as HttpClient, T as TokenStore } from '../http-BkCfOCR0.cjs';
 
 /**
  * Auth resource — `client.auth.*`.
@@ -26,6 +26,9 @@ interface User {
     email_pending?: boolean;
     created_at: string;
     updated_at: string;
+    /** ISO 4217 code the user's wallet is held in (their own choice, else the
+     *  deployment default). Present on `GET /auth/me`. */
+    wallet_currency?: string;
 }
 interface LoginInput {
     email: string;
@@ -77,6 +80,25 @@ interface SwitchMethodInput {
     challenge_token: string;
     method: AvailableMethod["kind"];
 }
+interface RegisterInput {
+    email: string;
+    password: string;
+    /** ISO 4217 code for the new wallet; must be offered by the deployment. */
+    wallet_currency?: string;
+}
+/** A signed-in session without the login `stage` marker — what
+ *  `register` returns. */
+type Session = Omit<JwtIssued, "stage">;
+interface TotpSetupComplete extends Session {
+    /** Ten one-time `XXXX-XXXX` codes, returned only this once. */
+    backup_codes: string[];
+}
+interface ChangePasswordInput {
+    current_password: string;
+    /** At least 12 characters with a lower-case letter, an upper-case letter
+     *  and a digit; must differ from the current password. */
+    new_password: string;
+}
 interface OtpSentResponse {
     stage: "otp_sent";
     challenge_token: string;
@@ -98,6 +120,24 @@ declare class AuthResource {
     /** Verify a 6-digit OTP code (Telegram / email) against an
      *  `otp_sent` challenge. */
     verifyOtp(input: OtpVerifyInput): Promise<JwtIssued>;
+    /** Create an end-user account and sign it in. The JWT is stored.
+     *  `wallet_currency` must be one the deployment offers; omit it to take
+     *  the deployment default (it can be switched later via `client.wallet`
+     *  while the wallet is empty).
+     *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */
+    register(input: RegisterInput): Promise<Session>;
+    /** Finish a `totp_setup_required` login: send the first code from the
+     *  authenticator app. The JWT is stored. The response carries ten
+     *  one-time `backup_codes` that are never returned again, so show them to
+     *  the user right away and don't keep them on the device. */
+    completeTotpSetup(input: TotpVerifyInput): Promise<TotpSetupComplete>;
+    /** Change the signed-in user's password. Every other session of the
+     *  account is signed out; this one stays valid.
+     *  Errors: 400 when the new password fails the policy, 401 when the
+     *  current one is wrong. */
+    changePassword(input: ChangePasswordInput): Promise<{
+        revoked_sessions: number;
+    }>;
     /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
      *  telegram/email; for TOTP it short-circuits back to the challenge. */
     switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse>;
@@ -122,11 +162,10 @@ declare class AuthResource {
     /** Current user — fails 401 when the stored JWT is expired or
      *  missing. Useful as a "do I have a session" probe on app boot. */
     me(): Promise<User>;
-    /** Local sign-out. The SDK doesn't currently call a server-side
-     *  endpoint (the Takeal API issues stateless JWTs); clearing the
-     *  store is enough. Server-side session invalidation may land
-     *  with a future session table. */
+    /** Local sign-out: forgets the stored JWT. To end the session on the
+     *  server as well, revoke it first with `client.sessions.revoke(jti)`
+     *  (the current one is marked `current: true` in `client.sessions.list()`). */
     signOut(): Promise<void>;
 }
 
-export { AuthResource, type AvailableMethod, type JwtIssued, type LoginInput, type LoginResponse, type OtpSentResponse, type OtpVerifyInput, type SwitchMethodInput, type TotpRequired, type TotpSetupRequired, type TotpVerifyInput, type User };
+export { AuthResource, type AvailableMethod, type ChangePasswordInput, type JwtIssued, type LoginInput, type LoginResponse, type OtpSentResponse, type OtpVerifyInput, type RegisterInput, type Session, type SwitchMethodInput, type TotpRequired, type TotpSetupComplete, type TotpSetupRequired, type TotpVerifyInput, type User };

package/dist/resources/auth.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpClient, T as TokenStore } from '../http-BkZZZI8K.js';
+import { H as HttpClient, T as TokenStore } from '../http-BkCfOCR0.js';
 
 /**
  * Auth resource — `client.auth.*`.
@@ -26,6 +26,9 @@ interface User {
     email_pending?: boolean;
     created_at: string;
     updated_at: string;
+    /** ISO 4217 code the user's wallet is held in (their own choice, else the
+     *  deployment default). Present on `GET /auth/me`. */
+    wallet_currency?: string;
 }
 interface LoginInput {
     email: string;
@@ -77,6 +80,25 @@ interface SwitchMethodInput {
     challenge_token: string;
     method: AvailableMethod["kind"];
 }
+interface RegisterInput {
+    email: string;
+    password: string;
+    /** ISO 4217 code for the new wallet; must be offered by the deployment. */
+    wallet_currency?: string;
+}
+/** A signed-in session without the login `stage` marker — what
+ *  `register` returns. */
+type Session = Omit<JwtIssued, "stage">;
+interface TotpSetupComplete extends Session {
+    /** Ten one-time `XXXX-XXXX` codes, returned only this once. */
+    backup_codes: string[];
+}
+interface ChangePasswordInput {
+    current_password: string;
+    /** At least 12 characters with a lower-case letter, an upper-case letter
+     *  and a digit; must differ from the current password. */
+    new_password: string;
+}
 interface OtpSentResponse {
     stage: "otp_sent";
     challenge_token: string;
@@ -98,6 +120,24 @@ declare class AuthResource {
     /** Verify a 6-digit OTP code (Telegram / email) against an
      *  `otp_sent` challenge. */
     verifyOtp(input: OtpVerifyInput): Promise<JwtIssued>;
+    /** Create an end-user account and sign it in. The JWT is stored.
+     *  `wallet_currency` must be one the deployment offers; omit it to take
+     *  the deployment default (it can be switched later via `client.wallet`
+     *  while the wallet is empty).
+     *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */
+    register(input: RegisterInput): Promise<Session>;
+    /** Finish a `totp_setup_required` login: send the first code from the
+     *  authenticator app. The JWT is stored. The response carries ten
+     *  one-time `backup_codes` that are never returned again, so show them to
+     *  the user right away and don't keep them on the device. */
+    completeTotpSetup(input: TotpVerifyInput): Promise<TotpSetupComplete>;
+    /** Change the signed-in user's password. Every other session of the
+     *  account is signed out; this one stays valid.
+     *  Errors: 400 when the new password fails the policy, 401 when the
+     *  current one is wrong. */
+    changePassword(input: ChangePasswordInput): Promise<{
+        revoked_sessions: number;
+    }>;
     /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
      *  telegram/email; for TOTP it short-circuits back to the challenge. */
     switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse>;
@@ -122,11 +162,10 @@ declare class AuthResource {
     /** Current user — fails 401 when the stored JWT is expired or
      *  missing. Useful as a "do I have a session" probe on app boot. */
     me(): Promise<User>;
-    /** Local sign-out. The SDK doesn't currently call a server-side
-     *  endpoint (the Takeal API issues stateless JWTs); clearing the
-     *  store is enough. Server-side session invalidation may land
-     *  with a future session table. */
+    /** Local sign-out: forgets the stored JWT. To end the session on the
+     *  server as well, revoke it first with `client.sessions.revoke(jti)`
+     *  (the current one is marked `current: true` in `client.sessions.list()`). */
     signOut(): Promise<void>;
 }
 
-export { AuthResource, type AvailableMethod, type JwtIssued, type LoginInput, type LoginResponse, type OtpSentResponse, type OtpVerifyInput, type SwitchMethodInput, type TotpRequired, type TotpSetupRequired, type TotpVerifyInput, type User };
+export { AuthResource, type AvailableMethod, type ChangePasswordInput, type JwtIssued, type LoginInput, type LoginResponse, type OtpSentResponse, type OtpVerifyInput, type RegisterInput, type Session, type SwitchMethodInput, type TotpRequired, type TotpSetupComplete, type TotpSetupRequired, type TotpVerifyInput, type User };

package/dist/resources/auth.js

@@ -36,6 +36,40 @@ var AuthResource = class {
     await Promise.resolve(this.tokens.set(resp.access_token));
     return resp;
   }
+  /** Create an end-user account and sign it in. The JWT is stored.
+   *  `wallet_currency` must be one the deployment offers; omit it to take
+   *  the deployment default (it can be switched later via `client.wallet`
+   *  while the wallet is empty).
+   *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */
+  async register(input) {
+    const resp = await this.http.post("/auth/register", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Finish a `totp_setup_required` login: send the first code from the
+   *  authenticator app. The JWT is stored. The response carries ten
+   *  one-time `backup_codes` that are never returned again, so show them to
+   *  the user right away and don't keep them on the device. */
+  async completeTotpSetup(input) {
+    const resp = await this.http.post("/auth/login/totp-setup", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Change the signed-in user's password. Every other session of the
+   *  account is signed out; this one stays valid.
+   *  Errors: 400 when the new password fails the policy, 401 when the
+   *  current one is wrong. */
+  async changePassword(input) {
+    return this.http.post("/auth/password", {
+      body: input
+    });
+  }
   /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
    *  telegram/email; for TOTP it short-circuits back to the challenge. */
   async switchMethod(input) {
@@ -72,10 +106,9 @@ var AuthResource = class {
   async me() {
     return this.http.get("/auth/me");
   }
-  /** Local sign-out. The SDK doesn't currently call a server-side
-   *  endpoint (the Takeal API issues stateless JWTs); clearing the
-   *  store is enough. Server-side session invalidation may land
-   *  with a future session table. */
+  /** Local sign-out: forgets the stored JWT. To end the session on the
+   *  server as well, revoke it first with `client.sessions.revoke(jti)`
+   *  (the current one is marked `current: true` in `client.sessions.list()`). */
   async signOut() {
     await Promise.resolve(this.tokens.clear());
   }

package/dist/resources/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/auth.ts"],"names":[],"mappings":";AAoGO,IAAM,eAAN,MAAmB;AAAA,EACxB,WAAA,CACmB,MACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA,EAIH,MAAM,MAAM,KAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAoB,aAAA,EAAe;AAAA,MAC9D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,UAAU,KAAA,EAAO;AACxB,MAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,KAAA,EAA4C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,kBAAA,EAAoB;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,UAAU,KAAA,EAA2C;AACzD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,wBAAA,EAA0B;AAAA,MACrE,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,aAAa,KAAA,EAAoD;AACrE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAsB,wBAAA,EAA0B;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,KAAA,EAAiD;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,yBAAA,EAA2B;AAAA,MACtE,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,KAAA,EAAyC;AACvD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa,EAAE,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,EAAG,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA,EAIA,MAAM,EAAA,GAAoB;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAU,UAAU,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AACF","file":"auth.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { TokenStore } from \"../token-store.js\";\n\n/**\n * Auth resource — `client.auth.*`.\n *\n * Covers the end-user-facing staged auth flow: password login\n * with optional TOTP/OTP step-up. The shape mirrors the responses\n * the Takeal API returns from `/auth/login`, `/auth/login/totp`,\n * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.\n *\n * The login methods stash the JWT in the configured `TokenStore` on\n * success so subsequent `client.*` calls authenticate automatically.\n * Step-up responses (TotpRequired / OtpSent) carry their own short-\n * lived challenge token which the caller passes to the next method\n * — those tokens DO NOT go through the TokenStore (they're not the\n * end-state JWT).\n */\n\nexport interface User {\n  id: string;\n  email: string;\n  role: string;\n  is_active: boolean;\n  /** True for users auto-provisioned via the Telegram Mini App who still hold\n   *  a synthetic placeholder email. The client should prompt for a real email\n   *  and attach it via `auth.linkEmail` — this flips the flag to false. */\n  email_pending?: boolean;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface LoginInput {\n  email: string;\n  password: string;\n}\n\n/** Discriminated union — `stage` is the discriminator. */\nexport type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;\n\nexport interface JwtIssued {\n  stage: \"jwt\";\n  access_token: string;\n  expires_at: string;\n  user: User;\n  /** True iff the user's role grants `system.view_hub`.\n   *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */\n  hub_access?: boolean;\n}\n\nexport interface TotpRequired {\n  stage: \"totp_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** Alternate second factors. Pick one with `/2fa/switch`. */\n  available_methods: AvailableMethod[];\n}\n\nexport interface TotpSetupRequired {\n  stage: \"totp_setup_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** OTPAuth URI rendered as a QR by the consumer. */\n  otpauth_url: string;\n  /** Same secret base32-encoded — for manual entry alongside QR. */\n  secret_base32: string;\n}\n\nexport interface AvailableMethod {\n  kind: \"totp\" | \"telegram_otp\" | \"email_otp\";\n  /** Short user-facing hint, e.g. `\"Telegram (@user)\"` or `\"e****@example.com\"`. */\n  hint?: string;\n}\n\nexport interface TotpVerifyInput {\n  challenge_token: string;\n  /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */\n  code: string;\n}\n\nexport interface OtpVerifyInput {\n  challenge_token: string;\n  /** 6-digit one-time code delivered via the selected channel. */\n  code: string;\n}\n\nexport interface SwitchMethodInput {\n  challenge_token: string;\n  method: AvailableMethod[\"kind\"];\n}\n\nexport interface OtpSentResponse {\n  stage: \"otp_sent\";\n  challenge_token: string;\n  expires_at: string;\n  method: AvailableMethod[\"kind\"];\n  hint?: string;\n  available_methods: AvailableMethod[];\n}\n\nexport class AuthResource {\n  constructor(\n    private readonly http: HttpClient,\n    private readonly tokens: TokenStore,\n  ) {}\n\n  /** Password-auth entry. May resolve to a JWT, or to a step-up\n   *  challenge that needs `verifyTotp` / `verifyOtp` next. */\n  async login(input: LoginInput): Promise<LoginResponse> {\n    const resp = await this.http.post<LoginResponse>(\"/auth/login\", {\n      body: input,\n      skipAuth: true,\n    });\n    if (resp.stage === \"jwt\") {\n      await Promise.resolve(this.tokens.set(resp.access_token));\n    }\n    return resp;\n  }\n\n  /** Verify a TOTP code (or XXXX-XXXX backup code) against a\n   *  `totp_required` challenge. On success the JWT is stored. */\n  async verifyTotp(input: TotpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/totp\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Verify a 6-digit OTP code (Telegram / email) against an\n   *  `otp_sent` challenge. */\n  async verifyOtp(input: OtpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/otp/verify\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for\n   *  telegram/email; for TOTP it short-circuits back to the challenge. */\n  async switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse> {\n    return this.http.post<OtpSentResponse>(\"/auth/login/2fa/switch\", {\n      body: input,\n      skipAuth: true,\n    });\n  }\n\n  /** Exchange a signed Telegram Mini App `initData` payload for a session\n   *  JWT. The server validates the initData HMAC against the deployment's bot\n   *  token, then find-or-creates the end-user. First-time Telegram users are\n   *  auto-provisioned with `user.email_pending === true` — prompt them for a\n   *  real email and call {@link linkEmail}. Stores the JWT on success.\n   *\n   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`\n   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when\n   *  you already hold a configured client. */\n  async exchangeTelegram(input: { initData: string }): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/telegram/exchange\", {\n      body: { init_data: input.initData },\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Attach a real email to the current user (and clear `email_pending`).\n   *  Used after a Telegram exchange to satisfy the email requirement; also\n   *  works for a password user changing their address. 409 if taken. */\n  async linkEmail(input: { email: string }): Promise<User> {\n    return this.http.post<User>(\"/me/email\", { body: { email: input.email } });\n  }\n\n  /** Current user — fails 401 when the stored JWT is expired or\n   *  missing. Useful as a \"do I have a session\" probe on app boot. */\n  async me(): Promise<User> {\n    return this.http.get<User>(\"/auth/me\");\n  }\n\n  /** Local sign-out. The SDK doesn't currently call a server-side\n   *  endpoint (the Takeal API issues stateless JWTs); clearing the\n   *  store is enough. Server-side session invalidation may land\n   *  with a future session table. */\n  async signOut(): Promise<void> {\n    await Promise.resolve(this.tokens.clear());\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/auth.ts"],"names":[],"mappings":";AA8HO,IAAM,eAAN,MAAmB;AAAA,EACxB,WAAA,CACmB,MACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA,EAIH,MAAM,MAAM,KAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAoB,aAAA,EAAe;AAAA,MAC9D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,UAAU,KAAA,EAAO;AACxB,MAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,KAAA,EAA4C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,kBAAA,EAAoB;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,UAAU,KAAA,EAA2C;AACzD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,wBAAA,EAA0B;AAAA,MACrE,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAS,KAAA,EAAwC;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAc,gBAAA,EAAkB;AAAA,MAC3D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,KAAA,EAAoD;AAC1E,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAwB,wBAAA,EAA0B;AAAA,MAC7E,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,KAAA,EAAmE;AACtF,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAmC,gBAAA,EAAkB;AAAA,MACpE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,aAAa,KAAA,EAAoD;AACrE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAsB,wBAAA,EAA0B;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,KAAA,EAAiD;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,yBAAA,EAA2B;AAAA,MACtE,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,KAAA,EAAyC;AACvD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa,EAAE,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,EAAG,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA,EAIA,MAAM,EAAA,GAAoB;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAU,UAAU,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AACF","file":"auth.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { TokenStore } from \"../token-store.js\";\n\n/**\n * Auth resource — `client.auth.*`.\n *\n * Covers the end-user-facing staged auth flow: password login\n * with optional TOTP/OTP step-up. The shape mirrors the responses\n * the Takeal API returns from `/auth/login`, `/auth/login/totp`,\n * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.\n *\n * The login methods stash the JWT in the configured `TokenStore` on\n * success so subsequent `client.*` calls authenticate automatically.\n * Step-up responses (TotpRequired / OtpSent) carry their own short-\n * lived challenge token which the caller passes to the next method\n * — those tokens DO NOT go through the TokenStore (they're not the\n * end-state JWT).\n */\n\nexport interface User {\n  id: string;\n  email: string;\n  role: string;\n  is_active: boolean;\n  /** True for users auto-provisioned via the Telegram Mini App who still hold\n   *  a synthetic placeholder email. The client should prompt for a real email\n   *  and attach it via `auth.linkEmail` — this flips the flag to false. */\n  email_pending?: boolean;\n  created_at: string;\n  updated_at: string;\n  /** ISO 4217 code the user's wallet is held in (their own choice, else the\n   *  deployment default). Present on `GET /auth/me`. */\n  wallet_currency?: string;\n}\n\nexport interface LoginInput {\n  email: string;\n  password: string;\n}\n\n/** Discriminated union — `stage` is the discriminator. */\nexport type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;\n\nexport interface JwtIssued {\n  stage: \"jwt\";\n  access_token: string;\n  expires_at: string;\n  user: User;\n  /** True iff the user's role grants `system.view_hub`.\n   *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */\n  hub_access?: boolean;\n}\n\nexport interface TotpRequired {\n  stage: \"totp_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** Alternate second factors. Pick one with `/2fa/switch`. */\n  available_methods: AvailableMethod[];\n}\n\nexport interface TotpSetupRequired {\n  stage: \"totp_setup_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** OTPAuth URI rendered as a QR by the consumer. */\n  otpauth_url: string;\n  /** Same secret base32-encoded — for manual entry alongside QR. */\n  secret_base32: string;\n}\n\nexport interface AvailableMethod {\n  kind: \"totp\" | \"telegram_otp\" | \"email_otp\";\n  /** Short user-facing hint, e.g. `\"Telegram (@user)\"` or `\"e****@example.com\"`. */\n  hint?: string;\n}\n\nexport interface TotpVerifyInput {\n  challenge_token: string;\n  /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */\n  code: string;\n}\n\nexport interface OtpVerifyInput {\n  challenge_token: string;\n  /** 6-digit one-time code delivered via the selected channel. */\n  code: string;\n}\n\nexport interface SwitchMethodInput {\n  challenge_token: string;\n  method: AvailableMethod[\"kind\"];\n}\n\nexport interface RegisterInput {\n  email: string;\n  password: string;\n  /** ISO 4217 code for the new wallet; must be offered by the deployment. */\n  wallet_currency?: string;\n}\n\n/** A signed-in session without the login `stage` marker — what\n *  `register` returns. */\nexport type Session = Omit<JwtIssued, \"stage\">;\n\nexport interface TotpSetupComplete extends Session {\n  /** Ten one-time `XXXX-XXXX` codes, returned only this once. */\n  backup_codes: string[];\n}\n\nexport interface ChangePasswordInput {\n  current_password: string;\n  /** At least 12 characters with a lower-case letter, an upper-case letter\n   *  and a digit; must differ from the current password. */\n  new_password: string;\n}\n\nexport interface OtpSentResponse {\n  stage: \"otp_sent\";\n  challenge_token: string;\n  expires_at: string;\n  method: AvailableMethod[\"kind\"];\n  hint?: string;\n  available_methods: AvailableMethod[];\n}\n\nexport class AuthResource {\n  constructor(\n    private readonly http: HttpClient,\n    private readonly tokens: TokenStore,\n  ) {}\n\n  /** Password-auth entry. May resolve to a JWT, or to a step-up\n   *  challenge that needs `verifyTotp` / `verifyOtp` next. */\n  async login(input: LoginInput): Promise<LoginResponse> {\n    const resp = await this.http.post<LoginResponse>(\"/auth/login\", {\n      body: input,\n      skipAuth: true,\n    });\n    if (resp.stage === \"jwt\") {\n      await Promise.resolve(this.tokens.set(resp.access_token));\n    }\n    return resp;\n  }\n\n  /** Verify a TOTP code (or XXXX-XXXX backup code) against a\n   *  `totp_required` challenge. On success the JWT is stored. */\n  async verifyTotp(input: TotpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/totp\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Verify a 6-digit OTP code (Telegram / email) against an\n   *  `otp_sent` challenge. */\n  async verifyOtp(input: OtpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/otp/verify\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Create an end-user account and sign it in. The JWT is stored.\n   *  `wallet_currency` must be one the deployment offers; omit it to take\n   *  the deployment default (it can be switched later via `client.wallet`\n   *  while the wallet is empty).\n   *  Errors: 400 `validation` / `currency_not_allowed`, 409 email taken. */\n  async register(input: RegisterInput): Promise<Session> {\n    const resp = await this.http.post<Session>(\"/auth/register\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Finish a `totp_setup_required` login: send the first code from the\n   *  authenticator app. The JWT is stored. The response carries ten\n   *  one-time `backup_codes` that are never returned again, so show them to\n   *  the user right away and don't keep them on the device. */\n  async completeTotpSetup(input: TotpVerifyInput): Promise<TotpSetupComplete> {\n    const resp = await this.http.post<TotpSetupComplete>(\"/auth/login/totp-setup\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Change the signed-in user's password. Every other session of the\n   *  account is signed out; this one stays valid.\n   *  Errors: 400 when the new password fails the policy, 401 when the\n   *  current one is wrong. */\n  async changePassword(input: ChangePasswordInput): Promise<{ revoked_sessions: number }> {\n    return this.http.post<{ revoked_sessions: number }>(\"/auth/password\", {\n      body: input,\n    });\n  }\n\n  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for\n   *  telegram/email; for TOTP it short-circuits back to the challenge. */\n  async switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse> {\n    return this.http.post<OtpSentResponse>(\"/auth/login/2fa/switch\", {\n      body: input,\n      skipAuth: true,\n    });\n  }\n\n  /** Exchange a signed Telegram Mini App `initData` payload for a session\n   *  JWT. The server validates the initData HMAC against the deployment's bot\n   *  token, then find-or-creates the end-user. First-time Telegram users are\n   *  auto-provisioned with `user.email_pending === true` — prompt them for a\n   *  real email and call {@link linkEmail}. Stores the JWT on success.\n   *\n   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`\n   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when\n   *  you already hold a configured client. */\n  async exchangeTelegram(input: { initData: string }): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/telegram/exchange\", {\n      body: { init_data: input.initData },\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Attach a real email to the current user (and clear `email_pending`).\n   *  Used after a Telegram exchange to satisfy the email requirement; also\n   *  works for a password user changing their address. 409 if taken. */\n  async linkEmail(input: { email: string }): Promise<User> {\n    return this.http.post<User>(\"/me/email\", { body: { email: input.email } });\n  }\n\n  /** Current user — fails 401 when the stored JWT is expired or\n   *  missing. Useful as a \"do I have a session\" probe on app boot. */\n  async me(): Promise<User> {\n    return this.http.get<User>(\"/auth/me\");\n  }\n\n  /** Local sign-out: forgets the stored JWT. To end the session on the\n   *  server as well, revoke it first with `client.sessions.revoke(jti)`\n   *  (the current one is marked `current: true` in `client.sessions.list()`). */\n  async signOut(): Promise<void> {\n    await Promise.resolve(this.tokens.clear());\n  }\n}\n"]}

package/dist/resources/balance.cjs

@@ -6,11 +6,12 @@ var BalanceResource = class {
     this.http = http;
   }
   /**
-   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
-   * Required — the ledger holds a separate balance per currency, so there is
-   * no "total" without one.
+   * Fetch the user's wallet balance. Omit `currency` for the wallet's own
+   * currency; pass an ISO 4217 code (e.g. `"USD"`) to read another one —
+   * the ledger holds a separate balance per currency.
    */
   async get(currency) {
+    if (!currency) return this.http.get("/me/balance");
     const q = new URLSearchParams({ currency }).toString();
     return this.http.get(`/me/balance?${q}`);
   }

package/dist/resources/balance.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";;;AAiBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAoC;AAC5C,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors\n * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:\n * the endpoint requires a `currency` query param and returns the amount held\n * in that currency.\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `\"USD\"`).\n   * Required — the ledger holds a separate balance per currency, so there is\n   * no \"total\" without one.\n   */\n  async get(currency: string): Promise<Balance> {\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";;;AAgBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAqC;AAC7C,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,IAAA,CAAK,IAAA,CAAK,IAAa,aAAa,CAAA;AAC1D,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors the Takeal API's\n * `GET /me/balance[?currency=<code>]` route. Balances are per-currency; with\n * no `currency` the wallet's own currency is returned (see `client.wallet`).\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance. Omit `currency` for the wallet's own\n   * currency; pass an ISO 4217 code (e.g. `\"USD\"`) to read another one —\n   * the ledger holds a separate balance per currency.\n   */\n  async get(currency?: string): Promise<Balance> {\n    if (!currency) return this.http.get<Balance>(\"/me/balance\");\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}

package/dist/resources/balance.d.cts

@@ -1,12 +1,11 @@
-import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+import { H as HttpClient } from '../http-BkCfOCR0.cjs';
 
 /**
  * Balance resource — `client.balance.*`.
  *
- * The user's wallet balance, tracked in the ledger. Mirrors
- * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:
- * the endpoint requires a `currency` query param and returns the amount held
- * in that currency.
+ * The user's wallet balance, tracked in the ledger. Mirrors the Takeal API's
+ * `GET /me/balance[?currency=<code>]` route. Balances are per-currency; with
+ * no `currency` the wallet's own currency is returned (see `client.wallet`).
  */
 /** Wallet balance for one currency. `amount` is a decimal string. */
 interface Balance {
@@ -17,11 +16,11 @@ declare class BalanceResource {
     private readonly http;
     constructor(http: HttpClient);
     /**
-     * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
-     * Required — the ledger holds a separate balance per currency, so there is
-     * no "total" without one.
+     * Fetch the user's wallet balance. Omit `currency` for the wallet's own
+     * currency; pass an ISO 4217 code (e.g. `"USD"`) to read another one —
+     * the ledger holds a separate balance per currency.
      */
-    get(currency: string): Promise<Balance>;
+    get(currency?: string): Promise<Balance>;
 }
 
 export { type Balance, BalanceResource };

package/dist/resources/balance.d.ts

@@ -1,12 +1,11 @@
-import { H as HttpClient } from '../http-BkZZZI8K.js';
+import { H as HttpClient } from '../http-BkCfOCR0.js';
 
 /**
  * Balance resource — `client.balance.*`.
  *
- * The user's wallet balance, tracked in the ledger. Mirrors
- * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:
- * the endpoint requires a `currency` query param and returns the amount held
- * in that currency.
+ * The user's wallet balance, tracked in the ledger. Mirrors the Takeal API's
+ * `GET /me/balance[?currency=<code>]` route. Balances are per-currency; with
+ * no `currency` the wallet's own currency is returned (see `client.wallet`).
  */
 /** Wallet balance for one currency. `amount` is a decimal string. */
 interface Balance {
@@ -17,11 +16,11 @@ declare class BalanceResource {
     private readonly http;
     constructor(http: HttpClient);
     /**
-     * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
-     * Required — the ledger holds a separate balance per currency, so there is
-     * no "total" without one.
+     * Fetch the user's wallet balance. Omit `currency` for the wallet's own
+     * currency; pass an ISO 4217 code (e.g. `"USD"`) to read another one —
+     * the ledger holds a separate balance per currency.
      */
-    get(currency: string): Promise<Balance>;
+    get(currency?: string): Promise<Balance>;
 }
 
 export { type Balance, BalanceResource };

package/dist/resources/balance.js

@@ -4,11 +4,12 @@ var BalanceResource = class {
     this.http = http;
   }
   /**
-   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
-   * Required — the ledger holds a separate balance per currency, so there is
-   * no "total" without one.
+   * Fetch the user's wallet balance. Omit `currency` for the wallet's own
+   * currency; pass an ISO 4217 code (e.g. `"USD"`) to read another one —
+   * the ledger holds a separate balance per currency.
    */
   async get(currency) {
+    if (!currency) return this.http.get("/me/balance");
     const q = new URLSearchParams({ currency }).toString();
     return this.http.get(`/me/balance?${q}`);
   }

package/dist/resources/balance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";AAiBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAoC;AAC5C,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors\n * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:\n * the endpoint requires a `currency` query param and returns the amount held\n * in that currency.\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `\"USD\"`).\n   * Required — the ledger holds a separate balance per currency, so there is\n   * no \"total\" without one.\n   */\n  async get(currency: string): Promise<Balance> {\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";AAgBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAqC;AAC7C,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,IAAA,CAAK,IAAA,CAAK,IAAa,aAAa,CAAA;AAC1D,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors the Takeal API's\n * `GET /me/balance[?currency=<code>]` route. Balances are per-currency; with\n * no `currency` the wallet's own currency is returned (see `client.wallet`).\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance. Omit `currency` for the wallet's own\n   * currency; pass an ISO 4217 code (e.g. `\"USD\"`) to read another one —\n   * the ledger holds a separate balance per currency.\n   */\n  async get(currency?: string): Promise<Balance> {\n    if (!currency) return this.http.get<Balance>(\"/me/balance\");\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}

package/dist/resources/blog.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+import { H as HttpClient } from '../http-BkCfOCR0.cjs';
 
 /**
  * Blog resource — `client.blog.*`.

package/dist/resources/blog.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpClient } from '../http-BkZZZI8K.js';
+import { H as HttpClient } from '../http-BkCfOCR0.js';
 
 /**
  * Blog resource — `client.blog.*`.

package/dist/resources/branding.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";;;AA2BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";;;AAiCO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon, brand colours and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n  /** Primary brand colour as `#rrggbb`. Empty → client default palette. */\n  primary_color: string;\n  /** Secondary brand colour as `#rrggbb`. Empty → client default palette. */\n  secondary_color: string;\n  /** Accent colour as `#rrggbb`. Empty → client default palette. */\n  accent_color: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}

package/dist/resources/branding.d.cts

@@ -1,11 +1,11 @@
-import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+import { H as HttpClient } from '../http-BkCfOCR0.cjs';
 
 /**
  * Branding resource — `client.branding.*`.
  *
  * Runtime white-label config published by the deployment at `GET /branding`
  * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform
- * name, logo, favicon and the label used for the end-user's balance — without
+ * name, logo, favicon, brand colours and the label used for the end-user's balance — without
  * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values
  * win whenever both are present.
  */
@@ -22,6 +22,12 @@ interface Branding {
     /** User-facing name of the balance, e.g. `"Wallet"` or `"Acme Wallet"`.
      *  Display-only: the `balance` API shape never changes with it. */
     wallet_label: string;
+    /** Primary brand colour as `#rrggbb`. Empty → client default palette. */
+    primary_color: string;
+    /** Secondary brand colour as `#rrggbb`. Empty → client default palette. */
+    secondary_color: string;
+    /** Accent colour as `#rrggbb`. Empty → client default palette. */
+    accent_color: string;
 }
 declare class BrandingResource {
     private readonly http;

package/dist/resources/branding.d.ts

@@ -1,11 +1,11 @@
-import { H as HttpClient } from '../http-BkZZZI8K.js';
+import { H as HttpClient } from '../http-BkCfOCR0.js';
 
 /**
  * Branding resource — `client.branding.*`.
  *
  * Runtime white-label config published by the deployment at `GET /branding`
  * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform
- * name, logo, favicon and the label used for the end-user's balance — without
+ * name, logo, favicon, brand colours and the label used for the end-user's balance — without
  * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values
  * win whenever both are present.
  */
@@ -22,6 +22,12 @@ interface Branding {
     /** User-facing name of the balance, e.g. `"Wallet"` or `"Acme Wallet"`.
      *  Display-only: the `balance` API shape never changes with it. */
     wallet_label: string;
+    /** Primary brand colour as `#rrggbb`. Empty → client default palette. */
+    primary_color: string;
+    /** Secondary brand colour as `#rrggbb`. Empty → client default palette. */
+    secondary_color: string;
+    /** Accent colour as `#rrggbb`. Empty → client default palette. */
+    accent_color: string;
 }
 declare class BrandingResource {
     private readonly http;

package/dist/resources/branding.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";AA2BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}
+{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";AAiCO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon, brand colours and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n  /** Primary brand colour as `#rrggbb`. Empty → client default palette. */\n  primary_color: string;\n  /** Secondary brand colour as `#rrggbb`. Empty → client default palette. */\n  secondary_color: string;\n  /** Accent colour as `#rrggbb`. Empty → client default palette. */\n  accent_color: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}

package/dist/resources/cards.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+import { H as HttpClient } from '../http-BkCfOCR0.cjs';
 import { C as CustomerInfo } from '../customer-CoxPwe5o.cjs';
 
 /**

package/dist/resources/cards.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpClient } from '../http-BkZZZI8K.js';
+import { H as HttpClient } from '../http-BkCfOCR0.js';
 import { C as CustomerInfo } from '../customer-CoxPwe5o.js';
 
 /**