@vxil/sdk 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -2189,6 +2189,37 @@ export declare class Vxil<S extends VxilSchemaShape = VxilSchemaShape> {
                 }>;
             };
         };
+        /** E-mail CHANGE for a signed-in (non-anonymous) user: a 6-digit code is
+         *  mailed to the NEW address; verify swaps the account's address (both the
+         *  auth row and the shared identity row, in one transaction), marks it
+         *  verified, and revokes every OTHER session of the user (reason
+         *  `email_changed`) — the presenting `token` keeps working. `request` is
+         *  always 202 whether or not the address is taken (no enumeration);
+         *  a taken address surfaces at `verify` as 409 `email_in_use`. A guest
+         *  session is 409 `anonymous_user` — guests use `anonymous.link`. Shares
+         *  the OTP knobs (cooldown → 429 `otp_rate_limited`, attempts, TTL,
+         *  `test_code` for `otp.testRecipients`) but does NOT need `otp.enabled`. */
+        email: {
+            change: {
+                request: (input: {
+                    token: string;
+                    new_email: string;
+                    locale?: string;
+                }) => Promise<{
+                    sent: true;
+                    test_code?: string;
+                }>;
+                verify: (input: {
+                    token: string;
+                    new_email: string;
+                    code: string;
+                }) => Promise<{
+                    user_id: string;
+                    email: string;
+                    verified: true;
+                }>;
+            };
+        };
         /** Step-up re-auth: an OTP challenge on the CURRENT session. On verify the
          *  bearer token ROTATES (the returned session.token replaces the old one —
          *  swap it client-side) and the JWT gains an `elv` claim. */
@@ -2668,6 +2699,21 @@ export declare class Vxil<S extends VxilSchemaShape = VxilSchemaShape> {
                 }>;
                 scanned: number;
             }>;
+            /** SERVER-ONLY (403 server_only in end-user mode). Account merge: move
+             *  every row `from_user_id` owns — across every collection that declares
+             *  an `owner_field`, soft-deleted rows included, the stored owner value
+             *  AND its indexed projection — onto `into_user_id`. ONE bounded page (≤500
+             *  rows) per call: loop while `done` is false. Idempotent (a second pass
+             *  moves 0). Bumps each moved row's `version`. The cms consumer of the
+             *  `auth.user.merged { from, into }` event; auth-v1 calls it after a
+             *  merge, the event is the backstop. Emits one `cms.items.rekeyed`. */
+            reKey: (input: {
+                from_user_id: string;
+                into_user_id: string;
+            }) => Promise<{
+                moved: number;
+                done: boolean;
+            }>;
         };
         /** cms-rel B4 (cms.md §13): atomic multi-collection transaction — 1–5
          *  steps over ≤3 collections, per-step `$where` CAS preconditions (the
@@ -3505,6 +3551,22 @@ export declare class Vxil<S extends VxilSchemaShape = VxilSchemaShape> {
             object_id: string;
             expires_at: string | null;
         }>;
+        /** SERVER-ONLY (403 server_only in end-user mode). Account merge: move
+         *  every object `from_user_id` owns (every status, tombstones included) and
+         *  the shared links minted on them onto `into_user_id`, which must be a
+         *  live tenant user (404 user_not_found otherwise). ONE bounded page (≤500
+         *  objects) per call: loop while `done` is false. Idempotent. An erased
+         *  `from` user's objects are held back for the GDPR byte sweep (moved 0).
+         *  The files consumer of the `auth.user.merged { from, into }` event;
+         *  auth-v1 calls it after a merge, the event is the backstop. Emits one
+         *  `files.objects.rekeyed`. */
+        reKey: (input: {
+            from_user_id: string;
+            into_user_id: string;
+        }) => Promise<{
+            moved: number;
+            done: boolean;
+        }>;
         sharedLinks: {
             /** Public (unauthenticated) URL for the object; revocable. Optional
              *  `max_downloads` (1 = one-time link) and an absolute `expires_at`; the
@@ -3614,7 +3676,8 @@ export declare class Vxil<S extends VxilSchemaShape = VxilSchemaShape> {
      * openrouter) route via BYO keys in tenant_secrets. `images` on the generate
      * inputs takes up to 8 vision refs: a public https:// URL, a
      * data:image/...;base64 URL, or file:<object_id> (a files-feature object) —
-     * fetched images are capped at 4 MiB each / 16 MiB total.
+     * fetched images are capped at 4 MiB each; `documents` (pdf/text, ≤10 MiB
+     * each) share one 20 MiB inline ceiling per request with them.
      */
     readonly ai: {
         templates: {

package/dist/index.js

@@ -664,6 +664,22 @@ export class Vxil {
                 verify: async (input) => (await this.call('POST', '/v1/auth/anonymous/link/verify', input)).data,
             },
         },
+        /** E-mail CHANGE for a signed-in (non-anonymous) user: a 6-digit code is
+         *  mailed to the NEW address; verify swaps the account's address (both the
+         *  auth row and the shared identity row, in one transaction), marks it
+         *  verified, and revokes every OTHER session of the user (reason
+         *  `email_changed`) — the presenting `token` keeps working. `request` is
+         *  always 202 whether or not the address is taken (no enumeration);
+         *  a taken address surfaces at `verify` as 409 `email_in_use`. A guest
+         *  session is 409 `anonymous_user` — guests use `anonymous.link`. Shares
+         *  the OTP knobs (cooldown → 429 `otp_rate_limited`, attempts, TTL,
+         *  `test_code` for `otp.testRecipients`) but does NOT need `otp.enabled`. */
+        email: {
+            change: {
+                request: async (input) => (await this.call('POST', '/v1/auth/email/change/request', input)).data,
+                verify: async (input) => (await this.call('POST', '/v1/auth/email/change/verify', input)).data,
+            },
+        },
         /** Step-up re-auth: an OTP challenge on the CURRENT session. On verify the
          *  bearer token ROTATES (the returned session.token replaces the old one —
          *  swap it client-side) and the JWT gains an `elv` claim. */
@@ -983,6 +999,15 @@ export class Vxil {
              *  row_number|rank|percent_rank, computed over ≤500 aggregated groups
              *  (never raw rows), optional partitionBy. Same scan cap as aggregate. */
             rank: async (collection, body) => (await this.call('POST', `/v1/cms/items/${encodeURIComponent(collection)}/rank`, body)).data,
+            /** SERVER-ONLY (403 server_only in end-user mode). Account merge: move
+             *  every row `from_user_id` owns — across every collection that declares
+             *  an `owner_field`, soft-deleted rows included, the stored owner value
+             *  AND its indexed projection — onto `into_user_id`. ONE bounded page (≤500
+             *  rows) per call: loop while `done` is false. Idempotent (a second pass
+             *  moves 0). Bumps each moved row's `version`. The cms consumer of the
+             *  `auth.user.merged { from, into }` event; auth-v1 calls it after a
+             *  merge, the event is the backstop. Emits one `cms.items.rekeyed`. */
+            reKey: async (input) => (await this.call('POST', '/v1/cms/items/re-key', input)).data,
         },
         /** cms-rel B4 (cms.md §13): atomic multi-collection transaction — 1–5
          *  steps over ≤3 collections, per-step `$where` CAS preconditions (the
@@ -1365,6 +1390,16 @@ export class Vxil {
         /** Set / extend / clear an object's TTL. `expiresInSeconds: null` clears it
          *  (else a future auto-delete after the given seconds; minimum 60). */
         setTtl: async (objectId, expiresInSeconds) => (await this.call('PUT', `/v1/files/${encodeURIComponent(objectId)}/ttl`, { expiresInSeconds })).data,
+        /** SERVER-ONLY (403 server_only in end-user mode). Account merge: move
+         *  every object `from_user_id` owns (every status, tombstones included) and
+         *  the shared links minted on them onto `into_user_id`, which must be a
+         *  live tenant user (404 user_not_found otherwise). ONE bounded page (≤500
+         *  objects) per call: loop while `done` is false. Idempotent. An erased
+         *  `from` user's objects are held back for the GDPR byte sweep (moved 0).
+         *  The files consumer of the `auth.user.merged { from, into }` event;
+         *  auth-v1 calls it after a merge, the event is the backstop. Emits one
+         *  `files.objects.rekeyed`. */
+        reKey: async (input) => (await this.call('POST', '/v1/files/objects/re-key', input)).data,
         sharedLinks: {
             /** Public (unauthenticated) URL for the object; revocable. Optional
              *  `max_downloads` (1 = one-time link) and an absolute `expires_at`; the
@@ -1432,7 +1467,8 @@ export class Vxil {
      * openrouter) route via BYO keys in tenant_secrets. `images` on the generate
      * inputs takes up to 8 vision refs: a public https:// URL, a
      * data:image/...;base64 URL, or file:<object_id> (a files-feature object) —
-     * fetched images are capped at 4 MiB each / 16 MiB total.
+     * fetched images are capped at 4 MiB each; `documents` (pdf/text, ≤10 MiB
+     * each) share one 20 MiB inline ceiling per request with them.
      */
     ai = {
         templates: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/sdk",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "private": false,
   "type": "module",
   "description": "Typed client for the Vxil REST API (notifications, auth, jobs, files, cms, comments, webhooks, realtime, orgs, rate-limits).",