Auth
import { auth } from '@mindstudio-ai/interface';The platform runs sign-in; the app builds the screen for it. Sending a verification code, checking it, issuing the session cookie, and running the delegated handshake all happen on the platform side. This namespace is the client surface a login page calls into, and it never touches a password or a raw token.
A code flow is two calls: start it with sendEmailCode or sendSmsCode to get a verificationId, then confirm it with verifyEmailCode or verifySmsCode to open the session. For org-owned internal apps, signInWithRemy replaces the code form with a single delegated handshake that handleRemyRedirect completes when the app loads. Read the session through getCurrentUser, isAuthenticated, and authStatus, but drive the UI off onAuthStateChanged so a screen re-renders when a sign-in settles instead of reading a stale value once. Every path resolves to the same AppUser.
Past sign-in, the surface covers the rest of an account's life on the client: changing a verified email or phone, minting and revoking a per-user API key, and the phone and email helpers a verification input is built from. Failures throw an error carrying a code, so you can tell a wrong code from an expired one from a restricted address.