client SDK `auth.*` family: bind the 14 `return res.json()` methods (auth 7 · sessions 3 · twoFactor 3 · accounts.unlink 1) to their better-auth wire shapes — #12104 family card 2 of 3

[os-trump]

Blocked-by: #14312

Filed by the domain:cli execution PM seat (#6024), session session_016yfqQh2dBgPAymYd7xipza, R65 — one of the three family cards the maintainer's ruling on #12104 ordered this lane to file. Part of #12104 (the family head). ⛔ domain:* / type left to triage; the lane is fixed by the parent. Family order: SECOND — after the oauth.* card MERGES (hot-file serial), before the organizations.* card.

Ruling (verbatim, 2026-08-31, maintainer, comment 5472614711 on #12104 — ⛔ 不译)

裁定:SDK 绑定的时间戳声明为线上真发的 ISO string,⛔ 不声明 Date、不建运行时复活层。 理由即本仓的第一戒律:声明一个运行时不兑现的能力(类型说 Date,运行时给 string,.getTime() 即炸)正是要结构性禁止的形状;wire 契约是唯一事实源,better-auth 的 Date 是序列化前的服务端形状,不是 wire 事实。JSDoc 注明 ISO-8601;branded 别名(IsoDateTimeString)可作后续增强,⛔ 不作本族工作的先决。

执行形状:按族三张卡 —— organizations 19 / auth 14 / oauth 5,由 domain:cli 车道立卡派发;packages/client/src/index.ts 是实测硬串行热点,三卡跨轮串行;每卡 Clause-② yes(收窄已发布返回类型),PR 建立时挂 needs:contract-review 走复审链;changeset 的 BREAKING 记号照 #13080 的类别(该门禁卡独立,⛔ 不在本族顺手做)。

Scope — the 14 methods (from #12104's census; re-locate on current main)

• auth.* (7): updateUser · changePassword · setInitialPassword · changeEmail · sendVerificationEmail · verifyEmail · deleteUser
• auth.sessions.* (3): revoke · revokeOthers · revokeAll
• auth.twoFactor.* (3): verifyTotp · disable · verifyBackupCode
• auth.accounts.unlink (1)

Each is an exported callable of @objectstack/client with no return annotation that ends return res.json(), so its published type is Promise< any > from lib.dom. ⛔ Grep cannot count this class — use pnpm --filter @objectstack/client check:exported-any-returns.

Constraints that bind

• Clause-② yes (narrows a published return type). Hang needs:contract-review on the PR at creation (double carrier); the dispatching seat runs the in-seat at-tier review before any landing.
• Source of truth for each shape is the wire body. Drive at least one route of this family end to end against a real server and read the body; better-auth's own exported return types are the starting point (measured: every endpoint has a concrete better-auth return type). Every Date-typed field is declared as ISO string with a JSDoc ISO-8601 note. ⛔ No Date, ⛔ no runtime revival layer, ⛔ no any. ⚠️ Several of these return sensitive-shaped bodies (session tokens, backup codes) — bind what the wire sends, and say in the PR body which fields are secrets so the review can check nothing is widened.
• check:exported-any-returns is shrink-only: delete exactly this family's ledger entries in the same PR — no others.
• Changeset states the narrowing and the exact reads that stop compiling; the **BREAKING** token follows the client SDK drops the precise spec types at its boundary: 32 methods return Promise< any > on a package that already depends on @objectstack/spec #8140 / A fifth client-SDK erasure spelling no grep in #8140's census counted: 38 methods with NO return annotation, typed from unwrapResponse< …any… > #11925 / client.packages declares envelopes two mounted surfaces do not emit: get diverges between them, and install/enable/disable declare { package } where the only serving surface sends the bare row #12034 disposition until [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 lands (⛔ not solved here).
• Hot file: packages/client/src/index.ts — HARD SERIAL across the three family cards, released on MERGE, ⛔ never two in flight.
• Angle brackets in GitHub prose must be spaced (Promise< any >).

Re-check

pnpm --filter @objectstack/client check:exported-any-returns    # 42 ledgered sites at filing
git grep -n "revokeOthers\|verifyBackupCode\|setInitialPassword" -- packages/client/src/index.ts

Positive control: automation.trigger was bound by PR #13082 and must NOT appear in the ledger.

Refs: #12104 (family head, ruling) · PR #13082 (precedent) · #13080 (BREAKING-token category) · #13079 (envelope convention, ⛔ not this family's question).

---

Triage housekeeping (R+98): Blocked-by: #14312 written into this body and pm:queue → pm:blocked. The family's HARD SERIAL on packages/client/src/index.ts existed only as prose in the three card bodies — all three sat in pm:queue, so nothing in the state machine stopped two of them being dispatched at once onto a file the ruling calls a measured hard-serial hot spot. The chain is now #14312 → #14313 → #14314, with pm:blocking on the two upstream cards. needs:contract-review applied to the issue as well, per this card's own "double carrier" instruction.

Generated by Claude Code

[huangyiirene]

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): domain:cli · priority:p2 · type Task added; pm:queue stands (sweep disjunction ②: a queue card without domain:* is invisible to lane queries). Lane fixed by the parent #12104 and the quoted 2026-08-31 ruling; Clause-② yes; family order second — after #14312 merges (hot-file serial on packages/client/src/index.ts). The card's own note on sensitive-shaped bodies (session tokens, backup codes) is a review input: the PR body names which bound fields are secrets so the at-tier review can confirm nothing is widened.

---

Generated by Claude Code