@w6w/sdk 0.4.0 → 0.6.0

package/dist/src/console/aliases.js

@@ -0,0 +1,113 @@
+/**
+ * `client.console.aliases.*` — account-scoped alias management
+ * (`list`/`get`/`upsert`/`delete`) for the names `run`'s URN dispatch
+ * resolves alongside its four `conn_…`/`wf_…`/`fn_…`/`ep_…` arms
+ * (`src/run.ts`).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded
+ * from `endpoints.json` and from the root barrel (`mod.ts`) — see
+ * `docs/console.md` and HITL-2 in this project's contract. This surface is
+ * **new**: unlike `console.functions`/`console.endpoints`, there is no
+ * pre-existing `studio/src/api/client.ts` alias code being relocated here —
+ * Studio never had alias CRUD before this project. `@w6w/sdk`'s
+ * instance-state mechanism pin still applies here exactly as it does to
+ * every other namespace (`docs/implementation.md` §MECHANISM PIN — instance
+ * state, never globals): this class holds no state of its own beyond the
+ * injected host, so two clients in one process never share a credential.
+ *
+ * **`invoke`/`run` is deliberately NOT modeled here.** The base
+ * `client.run({urn: aliasName, payload})` (already-published surface,
+ * `endpoints.json`-named, exported from the root `mod.ts`) already reaches
+ * an alias's target — an alias name is one of `run`'s runnable `urn` arms,
+ * alongside `conn_…`/`wf_…`/`fn_…`/`ep_…` (`src/run.ts`). Adding a duplicate
+ * `console.aliases.invoke` would give a caller two ways to reach the same
+ * route — the exact anti-duplication defect `console/functions.ts:15-26`
+ * flags for Functions, applied here with alias/`run` substituted for
+ * function/`run`; `console.endpoints`/`console.workflows` follow the same
+ * precedent. No invoke method lives here, and none should be added later
+ * without re-litigating this reasoning.
+ *
+ * @module
+ */
+import { path } from "../http.js";
+import { unwrap } from "../types.js";
+/**
+ * The `console.aliases` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * const aliases = await client.console.aliases.list();
+ * const alias = await client.console.aliases.get(aliases[0].id);
+ * await client.console.aliases.upsert({ ...alias, description: "Send email" });
+ * await client.console.aliases.delete(alias.id);
+ * ```
+ */
+export class AliasesApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * List the caller's aliases.
+     *
+     * @returns The aliases, unwrapped from the `aliases` envelope.
+     */
+    async list() {
+        const res = await this.#host.request({ method: "GET", path: "/aliases" });
+        return unwrap(res, "aliases");
+    }
+    /**
+     * Fetch one alias's stored definition.
+     *
+     * No server-computed field to splice in — unlike
+     * {@linkcode FunctionsApi.get}'s `valid` merge, this returns
+     * `unwrap<AliasDef>(res, "alias")` plainly.
+     *
+     * @param id - The alias's `id`.
+     * @returns The alias definition, unwrapped from the `alias` envelope.
+     * @throws {ApiError} `404 unknown_alias` when there is no such id.
+     */
+    async get(id) {
+        const res = await this.#host.request({ method: "GET", path: path `/aliases/${id}` });
+        return unwrap(res, "alias");
+    }
+    /**
+     * Register (create or overwrite) an alias definition.
+     *
+     * `definition` is the whole definition, sent verbatim as the request body
+     * — not wrapped in an envelope key.
+     *
+     * @param definition - The whole alias definition, forwarded verbatim.
+     * @returns The new/updated alias's id and name.
+     * @throws {ApiError} `400 invalid_alias` — structurally invalid body.
+     * @throws {ApiError} `409 alias_conflict` — another `(tenant,subject)` owns this id.
+     * @throws {ApiError} `409 alias_name_conflict` — another alias already owns this name.
+     * @throws {ApiError} `409 alias_name_immutable` — `name` changed on an already-stored alias (HITL-3).
+     */
+    async upsert(definition) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/aliases",
+            body: definition,
+        });
+        return unwrap(res, "alias");
+    }
+    /**
+     * Delete an alias.
+     *
+     * Returns nothing: the server's `{ok: true}` carries no information a
+     * caller can use, mirroring `console.vault.delete`/`console.projects.delete`
+     * in this same package.
+     *
+     * @param id - The alias's `id`.
+     * @throws {ApiError} `404 unknown_alias` when there is no such id.
+     */
+    async delete(id) {
+        await this.#host.request({ method: "DELETE", path: path `/aliases/${id}` });
+    }
+}
+//# sourceMappingURL=aliases.js.map

package/dist/src/console/aliases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aliases.js","sourceRoot":"","sources":["../../../src/console/aliases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA4CrC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,UAAU;IACZ,KAAK,CAAc;IAE5B;;OAEG;IACH,YAAY,IAAiB;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACnF,OAAO,MAAM,CAAiB,GAAG,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAA,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CAAC,UAAoB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAA,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/src/console/api-calls.d.ts

@@ -30,7 +30,7 @@ import type { HttpResponse, RequestOptions } from "../http.ts";
 import type { ApiCallRecord } from "./apps.ts";
 export type { ApiCallRecord } from "./apps.ts";
 /**
- * The slice of `W6wClient` this namespace needs: the transport, and nothing
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
  * else. Structural rather than a concrete client type, so the namespace stays
  * independently constructible in a test and this module never imports the
  * client back — mirrors `VarsHost` in `../vars.ts`.
@@ -54,7 +54,7 @@ export interface ApiCallsFilter {
     limit?: number;
 }
 /**
- * The `console.apiCalls` namespace on a `W6wClient`.
+ * The `console.apiCalls` namespace on a `W6WClient`.
  *
  * @example
  * ```ts

package/dist/src/console/api-calls.js

@@ -28,7 +28,7 @@
  */
 import { unwrap } from "../types.js";
 /**
- * The `console.apiCalls` namespace on a `W6wClient`.
+ * The `console.apiCalls` namespace on a `W6WClient`.
  *
  * @example
  * ```ts

package/dist/src/console/apps.d.ts

@@ -61,7 +61,7 @@
  */
 import { type HttpResponse, type RequestOptions } from "../http.ts";
 /**
- * The slice of `W6wClient` this namespace needs: the transport, and nothing
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
  * else. Structural rather than a concrete client type, so the namespace stays
  * independently constructible in a test and this module never imports the
  * client back — mirrors `VarsHost` in `../vars.ts`.
@@ -446,7 +446,7 @@ export interface UpsertOAuthConfigInput {
     extra?: Record<string, unknown>;
 }
 /**
- * The `console.apps` namespace on a `W6wClient`.
+ * The `console.apps` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
@@ -577,7 +577,7 @@ export declare class AppsApi {
      * URL for the caller to open.
      *
      * No studio-page caller, but this method's shape must exactly match
-     * `W6wApi.startAppOAuthFlow`'s signature on the `@w6w/ui` facade
+     * `W6WApi.startAppOAuthFlow`'s signature on the `@w6w/ui` facade
      * (`packages/ui/src/provider.tsx:110-114`), which calls it.
      *
      * @param appId - The app id.
@@ -639,7 +639,7 @@ export declare class AppsApi {
     /**
      * Invoke one of an app's actions.
      *
-     * This method's shape must exactly match `W6wApi.invokeAction`'s signature on
+     * This method's shape must exactly match `W6WApi.invokeAction`'s signature on
      * the `@w6w/ui` facade (`packages/ui/src/provider.tsx`). It now models the
      * WHOLE of that `opts` — `project` and `state` included.
      *

package/dist/src/console/apps.js

@@ -62,7 +62,7 @@
 import { path } from "../http.js";
 import { unwrap } from "../types.js";
 /**
- * The `console.apps` namespace on a `W6wClient`.
+ * The `console.apps` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
@@ -264,7 +264,7 @@ export class AppsApi {
      * URL for the caller to open.
      *
      * No studio-page caller, but this method's shape must exactly match
-     * `W6wApi.startAppOAuthFlow`'s signature on the `@w6w/ui` facade
+     * `W6WApi.startAppOAuthFlow`'s signature on the `@w6w/ui` facade
      * (`packages/ui/src/provider.tsx:110-114`), which calls it.
      *
      * @param appId - The app id.
@@ -345,7 +345,7 @@ export class AppsApi {
     /**
      * Invoke one of an app's actions.
      *
-     * This method's shape must exactly match `W6wApi.invokeAction`'s signature on
+     * This method's shape must exactly match `W6WApi.invokeAction`'s signature on
      * the `@w6w/ui` facade (`packages/ui/src/provider.tsx`). It now models the
      * WHOLE of that `opts` — `project` and `state` included.
      *

package/dist/src/console/auth.d.ts

@@ -43,11 +43,29 @@
  * handlers, not assumed) — every method here returns `res.body` directly and
  * never calls this package's `unwrap()` helper.
  *
+ * **T1.1.4's seven `/me/*` methods added here (profile, contact
+ * change-and-confirm, promote, remove, password).** Registered BELOW the auth
+ * guard (`packages/server/packages/api/data/me.ts`'s own doc comment) — every
+ * one of the seven is AUTHENTICATED, the default `requireAuth`, unlike
+ * `login`/`signup`/`checkAccountSlug` above. `removeContact` and
+ * `promoteContact` are not in this task's pinned method list but are added
+ * per HITL-7 ("if T1.1.4 ships routes for adding / removing / promoting a
+ * secondary contact, they get methods here too") — both routes exist on the
+ * merged branch (`data/me.ts:135-154`).
+ *
+ * **`UserProfile.hasPassword` is a RENAME of the wire's `passwordSet`, not an
+ * invented field.** `GET /me/profile` answers `passwordSet` (`data/me.ts:9`,
+ * `packages/bll/signup.ts:555`, derived server-side from
+ * `password_hash !== null` — the hash itself never appears). HITL-10 needs
+ * this fact under a name Studio's "Set a password"/"Change password" fork
+ * reads directly; `toUserProfile()` below performs the rename from the exact
+ * value the wire sent, never a default and never computed from anything else.
+ *
  * @module
  */
-import type { HttpResponse, RequestOptions } from "../http.ts";
+import { type HttpResponse, type RequestOptions } from "../http.ts";
 /**
- * The slice of `W6wClient` this namespace needs: the transport, and nothing
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
  * else. Structural rather than a concrete client type, so the namespace stays
  * independently constructible in a test and this module never imports the
  * client back — mirrors `ReliabilityHost` in `./reliability.ts`.
@@ -153,11 +171,103 @@ export interface ConsoleMe {
     versions?: Record<string, string>;
 }
 /**
- * The `console.auth` namespace on a `W6wClient`.
+ * One of the caller's own contact addresses (email or phone), as `GET /me/profile`
+ * lists it (`packages/bll/signup.ts`'s `ProfileContact`, `data/me.ts:9-12`).
+ */
+export interface ProfileContact {
+    id: string;
+    kind: "email" | "phone";
+    value: string;
+    /** ISO-8601 timestamp, or `null` while unverified. */
+    verifiedAt: string | null;
+}
+/** One of the caller's registered login methods (`data/me.ts:9-12`). */
+export interface ProfileLoginMethod {
+    id: string;
+    /** e.g. `"password"`, `"passkey"`. */
+    kind: string;
+    label: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+    /** ISO-8601 timestamp, or `null` if never used. */
+    lastUsedAt: string | null;
+}
+/** A pending, unconfirmed contact-change request (`data/me.ts:9-12`). */
+export interface ProfilePendingChange {
+    id: string;
+    method: "email" | "phone";
+    value: string;
+    /** ISO-8601 timestamp; the pending row is unusable past this point. */
+    expiresAt: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+}
+/**
+ * The `users` row and its dependent state, as `GET`/`PATCH /me/profile`,
+ * `POST /me/contacts/confirm` and `POST /me/contacts/:id/primary` all return
+ * it (`data/me.ts:6-19`). Every method on this namespace that returns a
+ * profile returns THIS shape, mapped from the wire's `passwordSet` — see this
+ * module's header for why {@linkcode UserProfile.hasPassword} is a rename,
+ * not an invented field.
+ */
+export interface UserProfile {
+    userId: string;
+    tenant: string;
+    displayName: string;
+    email: string | null;
+    emailVerified: boolean;
+    /**
+     * Whether the caller already has a local password. Read straight off the
+     * wire's `passwordSet` (`packages/bll/signup.ts:555`) — never defaulted,
+     * never computed client-side. Drives HITL-10's "Set a password" (`false`)
+     * vs "Change password" (`true`) fork.
+     */
+    hasPassword: boolean;
+    contacts: ProfileContact[];
+    loginMethods: ProfileLoginMethod[];
+    pending: ProfilePendingChange[];
+}
+/** The body `updateProfile` sends (`PATCH /me/profile`, `data/me.ts:53-71`). */
+export interface UpdateProfileInput {
+    displayName: string;
+}
+/**
+ * The body `requestContactChange` sends (`POST /me/contacts/change`,
+ * `data/me.ts:73-98`). Parks a pending change; does not confirm it.
+ */
+export interface RequestContactChangeInput {
+    method: "email" | "phone";
+    value: string;
+}
+/**
+ * The body `confirmContactChange` sends (`POST /me/contacts/confirm`,
+ * `data/me.ts:100-133`). Consumes the code sent to `requestContactChange`'s
+ * `value`.
+ */
+export interface ConfirmContactChangeInput {
+    method: "email" | "phone";
+    code: string;
+    /** Promote the newly-confirmed contact to primary in the same call (D3). */
+    promote?: boolean;
+}
+/**
+ * The body `setPassword` sends (`POST /me/password`, `data/me.ts:156-184`).
+ * One method for HITL-10's set-and-change: `currentPassword` is a field, not
+ * a second method, because the merged route is the single `POST /me/password`
+ * — not two routes.
+ */
+export interface SetPasswordInput {
+    newPassword: string;
+    /** Required by the server when the caller already has a password (`hasPassword: true`); omit
+     * for the first-time "set a password" case. */
+    currentPassword?: string;
+}
+/**
+ * The `console.auth` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
- * const { token } = await client.console.auth.login("user", "pass");
+ * const { token } = await client.console.auth.login("user@example.com", "pass");
  * const me = await client.console.auth.getMe();
  * if (me.tenantAdmin) { // tenant-admin surface
  * }
@@ -175,12 +285,15 @@ export declare class AuthApi {
      * PUBLIC — sends no bearer, even on a client that already holds one
      * (`requireAuth: false`).
      *
-     * @param username - The account username.
+     * @param identifier - The login identifier, normally the account's email. The
+     *   platform operator credential (`AUTH_USERNAME`) is NOT email-shaped and is a
+     *   legitimate value here — never validate this as an email (DECISIONS.md HITL-1).
+     *   It is sent as the `email` key: the server resolves `body.email ?? body.username`.
      * @param password - The account password.
      * @returns The token, the caller's identity, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `401` for invalid credentials.
      */
-    login(username: string, password: string): Promise<LoginResponse>;
+    login(identifier: string, password: string): Promise<LoginResponse>;
     /**
      * Self-serve signup: creates the user and mints a `role: "user"` session.
      *
@@ -237,5 +350,90 @@ export declare class AuthApi {
      * @throws {ApiError} On any non-2xx, e.g. `401` when the bearer is missing or expired.
      */
     getMe(): Promise<ConsoleMe>;
+    /**
+     * Read the caller's own profile — the real `users` row, including
+     * {@linkcode UserProfile.hasPassword}. Distinct from `getMe()`, which reads
+     * session claims: this reads the actual database row (`data/me.ts:43-51`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's profile.
+     * @throws {ApiError} `404 no_user_profile` when there is no `users` row for this principal.
+     */
+    getProfile(): Promise<UserProfile>;
+    /**
+     * Patch the caller's display name.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new display name.
+     * @returns The updated profile (`data/me.ts:53-71`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_display_name`.
+     */
+    updateProfile(input: UpdateProfileInput): Promise<UserProfile>;
+    /**
+     * Park a pending email/phone change and send its confirmation code. Does
+     * NOT confirm the change — see {@linkcode confirmContactChange}.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method and the new value.
+     * @returns Nothing: the server answers `202` with `{ok: true}`, which carries no information a
+     *   caller can use (`data/me.ts:73-98`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_email`, `409 email_taken`.
+     */
+    requestContactChange(input: RequestContactChangeInput): Promise<void>;
+    /**
+     * Consume the code from {@linkcode requestContactChange} and confirm the
+     * pending change. Optionally promotes the newly-confirmed contact to
+     * primary in the same call (D3).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method, the code, and an optional promote flag.
+     * @returns The updated profile (`data/me.ts:100-133`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_code`, `404 contact_not_found`.
+     */
+    confirmContactChange(input: ConfirmContactChangeInput): Promise<UserProfile>;
+    /**
+     * Remove one of the caller's own (non-primary) contacts. Added per HITL-7
+     * — `DELETE /me/contacts/:id` exists on the merged branch (`data/me.ts:135-144`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use, mirroring `console.projects.delete`/`console.schedules.delete` in this same package.
+     * @throws {ApiError} `404 contact_not_found`.
+     */
+    removeContact(id: string): Promise<void>;
+    /**
+     * Promote one of the caller's own secondary contacts to primary. Added per
+     * HITL-7 — `POST /me/contacts/:id/primary` exists on the merged branch
+     * (`data/me.ts:146-154`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns The updated profile.
+     * @throws {ApiError} `404 contact_not_found`, `403 contact_not_verified`.
+     */
+    promoteContact(id: string): Promise<UserProfile>;
+    /**
+     * Set or change the caller's password (HITL-10) — one method, since the
+     * merged route is the single `POST /me/password`, not two. Omit
+     * `currentPassword` for the first-time "set a password" case
+     * (`hasPassword: false`); the server requires it once a password already
+     * exists.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new password, plus the current one when required.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use (`data/me.ts:156-184`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_password`/`current_password_required`,
+     *   `403 invalid_current_password`.
+     */
+    setPassword(input: SetPasswordInput): Promise<void>;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/console/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;4FAC4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;yCACyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,OAAO;;IAGlB;;OAEG;gBACS,IAAI,EAAE,QAAQ;IAI1B;;;;;;;;;;OAUG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUvE;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAUzD;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAUvE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS/E;;;;;;;;;;;;;;;;OAgBG;IACG,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC;CAOlC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;4FAC4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;yCACyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB;mDAC+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,OAAO;;IAGlB;;OAEG;gBACS,IAAI,EAAE,QAAQ;IAI1B;;;;;;;;;;;;;OAaG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUzE;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAUzD;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAUvE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS/E;;;;;;;;;;;;;;;;OAgBG;IACG,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC;IAQjC;;;;;;;;;OASG;IACG,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC;IAKxC;;;;;;;;OAQG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;IASpE;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3E;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IASlF;;;;;;;;;;OAUG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;;;;;;;;;OAUG;IACG,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAStD;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAO1D"}

package/dist/src/console/auth.js

@@ -43,14 +43,38 @@
  * handlers, not assumed) — every method here returns `res.body` directly and
  * never calls this package's `unwrap()` helper.
  *
+ * **T1.1.4's seven `/me/*` methods added here (profile, contact
+ * change-and-confirm, promote, remove, password).** Registered BELOW the auth
+ * guard (`packages/server/packages/api/data/me.ts`'s own doc comment) — every
+ * one of the seven is AUTHENTICATED, the default `requireAuth`, unlike
+ * `login`/`signup`/`checkAccountSlug` above. `removeContact` and
+ * `promoteContact` are not in this task's pinned method list but are added
+ * per HITL-7 ("if T1.1.4 ships routes for adding / removing / promoting a
+ * secondary contact, they get methods here too") — both routes exist on the
+ * merged branch (`data/me.ts:135-154`).
+ *
+ * **`UserProfile.hasPassword` is a RENAME of the wire's `passwordSet`, not an
+ * invented field.** `GET /me/profile` answers `passwordSet` (`data/me.ts:9`,
+ * `packages/bll/signup.ts:555`, derived server-side from
+ * `password_hash !== null` — the hash itself never appears). HITL-10 needs
+ * this fact under a name Studio's "Set a password"/"Change password" fork
+ * reads directly; `toUserProfile()` below performs the rename from the exact
+ * value the wire sent, never a default and never computed from anything else.
+ *
  * @module
  */
+import { path } from "../http.js";
+/** `passwordSet` → `hasPassword`. The one hop between the wire and {@linkcode UserProfile}. */
+function toUserProfile(wire) {
+    const { passwordSet, ...rest } = wire;
+    return { ...rest, hasPassword: passwordSet };
+}
 /**
- * The `console.auth` namespace on a `W6wClient`.
+ * The `console.auth` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
- * const { token } = await client.console.auth.login("user", "pass");
+ * const { token } = await client.console.auth.login("user@example.com", "pass");
  * const me = await client.console.auth.getMe();
  * if (me.tenantAdmin) { // tenant-admin surface
  * }
@@ -70,16 +94,19 @@ export class AuthApi {
      * PUBLIC — sends no bearer, even on a client that already holds one
      * (`requireAuth: false`).
      *
-     * @param username - The account username.
+     * @param identifier - The login identifier, normally the account's email. The
+     *   platform operator credential (`AUTH_USERNAME`) is NOT email-shaped and is a
+     *   legitimate value here — never validate this as an email (DECISIONS.md HITL-1).
+     *   It is sent as the `email` key: the server resolves `body.email ?? body.username`.
      * @param password - The account password.
      * @returns The token, the caller's identity, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `401` for invalid credentials.
      */
-    async login(username, password) {
+    async login(identifier, password) {
         const res = await this.#host.request({
             method: "POST",
             path: "/auth/login",
-            body: { username, password },
+            body: { email: identifier, password },
             requireAuth: false,
         });
         return res.body;
@@ -169,5 +196,128 @@ export class AuthApi {
         });
         return res.body;
     }
+    /**
+     * Read the caller's own profile — the real `users` row, including
+     * {@linkcode UserProfile.hasPassword}. Distinct from `getMe()`, which reads
+     * session claims: this reads the actual database row (`data/me.ts:43-51`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's profile.
+     * @throws {ApiError} `404 no_user_profile` when there is no `users` row for this principal.
+     */
+    async getProfile() {
+        const res = await this.#host.request({ method: "GET", path: "/me/profile" });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Patch the caller's display name.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new display name.
+     * @returns The updated profile (`data/me.ts:53-71`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_display_name`.
+     */
+    async updateProfile(input) {
+        const res = await this.#host.request({
+            method: "PATCH",
+            path: "/me/profile",
+            body: input,
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Park a pending email/phone change and send its confirmation code. Does
+     * NOT confirm the change — see {@linkcode confirmContactChange}.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method and the new value.
+     * @returns Nothing: the server answers `202` with `{ok: true}`, which carries no information a
+     *   caller can use (`data/me.ts:73-98`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_email`, `409 email_taken`.
+     */
+    async requestContactChange(input) {
+        await this.#host.request({
+            method: "POST",
+            path: "/me/contacts/change",
+            body: input,
+        });
+    }
+    /**
+     * Consume the code from {@linkcode requestContactChange} and confirm the
+     * pending change. Optionally promotes the newly-confirmed contact to
+     * primary in the same call (D3).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method, the code, and an optional promote flag.
+     * @returns The updated profile (`data/me.ts:100-133`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_code`, `404 contact_not_found`.
+     */
+    async confirmContactChange(input) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/me/contacts/confirm",
+            body: input,
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Remove one of the caller's own (non-primary) contacts. Added per HITL-7
+     * — `DELETE /me/contacts/:id` exists on the merged branch (`data/me.ts:135-144`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use, mirroring `console.projects.delete`/`console.schedules.delete` in this same package.
+     * @throws {ApiError} `404 contact_not_found`.
+     */
+    async removeContact(id) {
+        await this.#host.request({ method: "DELETE", path: path `/me/contacts/${id}` });
+    }
+    /**
+     * Promote one of the caller's own secondary contacts to primary. Added per
+     * HITL-7 — `POST /me/contacts/:id/primary` exists on the merged branch
+     * (`data/me.ts:146-154`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns The updated profile.
+     * @throws {ApiError} `404 contact_not_found`, `403 contact_not_verified`.
+     */
+    async promoteContact(id) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: path `/me/contacts/${id}/primary`,
+            body: {},
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Set or change the caller's password (HITL-10) — one method, since the
+     * merged route is the single `POST /me/password`, not two. Omit
+     * `currentPassword` for the first-time "set a password" case
+     * (`hasPassword: false`); the server requires it once a password already
+     * exists.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new password, plus the current one when required.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use (`data/me.ts:156-184`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_password`/`current_password_required`,
+     *   `403 invalid_current_password`.
+     */
+    async setPassword(input) {
+        await this.#host.request({
+            method: "POST",
+            path: "/me/password",
+            body: input,
+        });
+    }
 }
 //# sourceMappingURL=auth.js.map