Permanently deletes the signed-in user's account: the server removes
every session and the auth record, then fires auth.user.deleted
(subscribe a Function to it for app-data cleanup). Unlike logout,
a server failure here rethrows — the account still existing is a
state the app must know about. Local session state is cleared only
after the server confirms.
Dispose of the auth client. Closes the auth state stream and cascades
to AuthApi.dispose which closes the underlying HTTP client iff the
SDK owns it (caller-supplied clients are not closed).
Link a phone number to the currently authenticated user. User must
already be signed in (via email/password or another auth method) and
must have requested an OTP for this phone number first.
Re-send the email-verification link to the current (authenticated but
unverified) user. No-op-safe: if the account is already verified, the
result's ResendVerificationResult.alreadyVerified is true and nothing
is sent. Server-throttled — a 60s cooldown between sends and a daily
cap; the result carries ResendVerificationResult.cooldownUntil so you
can show a countdown. Throws if the cooldown or daily cap is exceeded.
Consume an unlock token from a brute-force unlock email. Apps typically
extract this token from a deep link parameter when the user clicks the
unlock link in their email.
Returns a currently-valid access token for data-plane requests, refreshing
(single-flight) if the cached one is at/near expiry. Returns null when no
user is authenticated or a refresh fails — callers then send the request
api-key-only and the server treats it as having no end-user identity.
Verify the OTP code and complete sign-in. If no user exists with this
phone, one is created. The returned PhoneVerifyResult.isNewUser flag
lets the app route first-time users to onboarding.