Auth

Read the project's auth audit log (newest first). Bearer, project-scoped.

auditLog(input?: { email?: string; event?: AuthAuditEventName; limit?: number; }): Promise<{ entries: AuthAuditEntry[]; }>;

force(input: { token: string; }): Promise<{ deleted: boolean; reason?: "invalid" | "used" | "expired"; }>;

Queue a user for deletion (30-day grace) + send the deletion email.

requestDeletion(input: { userId: string; }): Promise<{ scheduledFor: string; }>;

undo(input: { token: string; }): Promise<{ undone: boolean; reason?: "invalid" | "used" | "expired"; }>;

On success returns a session token — user is immediately signed in.

confirmEmailVerify(input: { token: string; }): Promise<EmailVerifyConfirmResult>;

Always returns { sent: true } — never reveals whether the token mapped to a real user or whether the rate-limit was tripped (anti-enumeration).

resendEmailVerify(input: { token: string; }): Promise<{ sent: true; }>;

Resend the verify mail BY EMAIL (no token) — powers a "resend confirmation" action on an `email_not_verified` login. Always { sent: true } (anti-enum).

resendVerifyByEmail(input: { email: string; }): Promise<{ sent: true; }>;

Confirm an email change with the token from the new-address email. PUBLIC.

changeConfirm(input: { token: string; }): Promise<{ changed: boolean; email?: string; reason?: "invalid" | "used" | "expired" | "email_taken"; }>;

Request an email change — verifies the current password (step-up) and mails a confirm-link to the NEW address. Session-gated.

changeRequest(input: { sessionToken: string; currentPassword: string; newEmail: string; }): Promise<{ sent: true; }>;

Throws 403 `email_not_verified` if the user hasn't confirmed yet.

login(input: { email: string; password: string; }): Promise<LoginResult>;

logout(input: { sessionToken: string; }): Promise<LogoutResult>;

Public — no Bearer. On success issues a session; does NOT revoke other sessions (magic-link is an alternative sign-in, not credential rotation).

confirmMagicLink(input: { token: string; }): Promise<MagicLinkConfirmResult>;

Auto-signup: if the email is unknown, a passwordless account is created (password_hash=null). Returns 429 with retry-after when rate-limited (1/min + 5/h per (email, project)).

requestMagicLink(input: { email: string; }): Promise<{ sent: true; }>;

resendMagicLink(input: { token: string; }): Promise<{ sent: true; }>;

me(input: { sessionToken: string; }): Promise<MeResult>;

confirm(input: { sessionToken: string; code: string; }): Promise<{ ok: true; recoveryCodes: string[]; }>;

disable(input: { sessionToken: string; code: string; }): Promise<{ ok: true; }>;

enroll(input: { sessionToken: string; }): Promise<{ secret: string; otpauthUri: string; }>;

status(input: { sessionToken: string; }): Promise<{ enabled: boolean; recoveryCodesRemaining: number; }>;

Finish a two-step login. `code` may be a TOTP code or a recovery code.

verify(input: { challengeToken: string; code: string; }): Promise<SessionResult>;

ADRI-97 — headless onboarding: creates the user AND mints its initial api-token in ONE call, returning the credential ONCE. The token is dormant until the owner verifies their email (a verify-mail is sent).

onboard(input: { email: string; password: string; tokenName?: string; env?: "live" | "test"; }): Promise<OnboardResult>;

get(): Promise<PasskeyConfigGetResult>;

One-time per project: set the Relying Party id + allowed origins.

set(input: { rpId: string; rpName?: string; origins: string[]; }): Promise<{ ok: true; }>;

Delete a passkey (session). 409 `would_lock_out` if it's the last one and the user has no password (the always-≥1-method invariant).

delete(input: { sessionToken: string; passkeyId: string; }): Promise<{ ok: true; }>;

List the logged-in user's passkeys (session).

list(input: { sessionToken: string; }): Promise<{ passkeys: PasskeyInfo[]; }>;

Finish — verifies the assertion + issues a session. No extra MFA step (a passkey is already strong auth). Blocks (403) if the email isn't verified.

finish(input: { assertionResponse: PasskeyCeremonyResponse; }): Promise<SessionResult>;

Begin usernameless login — returns request options for startAuthentication().

start(): Promise<{ options: PasskeyCeremonyOptions; }>;

finish(input: { sessionToken: string; attestationResponse: PasskeyCeremonyResponse; name?: string; }): Promise<{ ok: true; passkeyId: string; }>;

Begin registering an extra passkey on the logged-in user (session).

start(input: { sessionToken: string; }): Promise<{ options: PasskeyCeremonyOptions; }>;

On success: password updated, ALL existing sessions revoked, a fresh one is issued on this device. Also marks email as verified if it was not.

confirmPasswordReset(input: { token: string; newPassword: string; }): Promise<PasswordResetConfirmResult>;

Always returns { sent: true } regardless of whether the email is on file.

requestPasswordReset(input: { email: string; }): Promise<{ sent: true; }>;

resendPasswordReset(input: { token: string; }): Promise<{ sent: true; }>;

Change the password with step-up: requires the CURRENT password. 403 `invalid_current_password` if it's wrong; 409 `no_password` if the account has none yet (use set()).

change(input: { sessionToken: string; currentPassword: string; newPassword: string; }): Promise<{ ok: true; }>;

Remove the password (become passwordless). 409 `would_lock_out` if the user has no passkey (the always-≥1-method invariant).

clear(input: { sessionToken: string; }): Promise<{ ok: true; }>;

Set (or change) the logged-in user's password — lets a passkey-only user add a password.

set(input: { sessionToken: string; newPassword: string; }): Promise<{ ok: true; }>;

Read the EFFECTIVE policy for a scope (falls back to the global default when the scope has no explicit policy yet).

get(input?: { scope?: string; }): Promise<{ policy: AuthPolicy; }>;

Upsert the policy for a scope (partial — only supplied fields change). Rejects 400 `would_lock_out` if it would disable every login method, and 400 `invalid_session_duration` for an out-of-range duration.

set(input: { scope?: string; } & AuthPolicyUpdate): Promise<{ policy: AuthPolicy; }>;

Creates the user (email_verified_at=null) and triggers a verify email. NO session is returned — login is blocked until the user verifies.

signup(input: { email: string; password: string; }): Promise<SignupResult>;

Finish — creates the passwordless user + sends a verify email. NO session (login stays blocked until the email is verified, like password signup).

finish(input: { email: string; attestationResponse: PasskeyCeremonyResponse; }): Promise<SignupResult>;

Begin passwordless signup — returns creation options for startRegistration().

start(input: { email: string; }): Promise<{ options: PasskeyCeremonyOptions; }>;

Resolve one of your own project's users to its Adrifact userId by email. Throws 404 if not found. Project-scoped (Bearer).

findUserIdByEmail(input: { email: string; }): Promise<{ userId: string; email: string; }>;

validateSession(input: { sessionToken: string; }): Promise<ValidateSessionResult>;