@authyon/auth 0.2.0-beta.16 → 0.2.0-beta.19

package/README.md

@@ -216,14 +216,15 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 
 ### `authyon.user`
 
-| Método                                          | Endpoint                            |
-| ----------------------------------------------- | ----------------------------------- |
-| `user.me()`                                     | `GET /auth/me`                      |
-| `user.sessions()`                               | `GET /auth/sessions`                |
-| `user.revokeSession(sessionId)`                 | `DELETE /auth/sessions/{id}`        |
-| `user.activities(params?)`                      | `GET /auth/me/activities`           |
-| `user.requestPasswordReset(email)`              | `POST /auth/password-reset/request` |
-| `user.confirmPasswordReset(token, newPassword)` | `POST /auth/password-reset/confirm` |
+| Método                                          | Endpoint                             |
+| ----------------------------------------------- | ------------------------------------ |
+| `user.me()`                                     | `GET /auth/me`                       |
+| `user.sessions()`                               | `GET /auth/sessions`                 |
+| `user.revokeSession(sessionId)`                 | `DELETE /auth/sessions/{id}`         |
+| `user.activities(params?)`                      | `GET /auth/me/activities`            |
+| `user.requestPasswordReset(email, options?)`    | `POST /auth/password-reset/request`  |
+| `user.validatePasswordReset(token)`             | `POST /auth/password-reset/validate` |
+| `user.confirmPasswordReset(token, newPassword)` | `POST /auth/password-reset/confirm`  |
 
 ### `authyon.organization`
 

package/dist/{ability-Cp8ir5Gr.d.cts → ability-BTcayvkM.d.cts}

@@ -164,10 +164,20 @@ interface PaginationOptions {
     skip?: number;
     take?: number;
 }
+/**
+ * The envelope every paged endpoint answers with.
+ *
+ * `page` is the 1-based current page and `perPage` is how many items a page
+ * holds — the same sense `take` has on the way in. Up to Authyon API
+ * 2026-10-21 the two were named `perPage` (holding the page number) and
+ * `pageSize` (holding the limit), so reading them by their names gave the
+ * wrong value without failing. Clients on the older API see `page` undefined
+ * and `perPage` holding a page number.
+ */
 interface Paged<T> {
     data: T[];
-    perPage?: number;
-    pageSize: number;
+    page: number;
+    perPage: number;
     total: number;
     pages: number;
     hasNext: boolean;
@@ -281,6 +291,29 @@ interface OrganizationInvitePreview {
     /** Where the issuer asked to send the invitee after accepting, or `null`. */
     redirectUri: string | null;
 }
+/** Options for POST /auth/password-reset/request. */
+interface PasswordResetRequestOptions {
+    /**
+     * Where to send the person after they change the password. Must be
+     * registered exactly in the environment's redirect URIs (the same list SSO
+     * and magic link use); otherwise the request fails with
+     * `user.password_reset.redirect_uri.not_allowed`. Comes back on
+     * `validatePasswordReset` and `confirmPasswordReset`.
+     */
+    redirectUri?: string;
+}
+/** POST /auth/password-reset/validate — what a live reset token is for. */
+interface PasswordResetPreview {
+    email: string;
+    expiresAt: string;
+    /** Where the reset was asked to end, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/password-reset/confirm — the password is changed. */
+interface PasswordResetCompleted {
+    /** Where the reset was asked to end, or `null`. Navigating there is up to you. */
+    redirectUri: string | null;
+}
 /** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
 interface AcceptOrganizationInviteInput {
     token: string;
@@ -616,10 +649,27 @@ declare class AuthyonClient {
          * the endpoint differs, override via a raw call to your own backend.
          */
         revokeSession: (sessionId: string) => Promise<void>;
-        /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-        requestPasswordReset: (email: string) => Promise<void>;
-        /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-        confirmPasswordReset: (token: string, newPassword: string) => Promise<void>;
+        /**
+         * POST /auth/password-reset/request — resolves whether or not the address
+         * has an account (no account enumeration). `redirectUri` is where the
+         * person lands after changing the password; it must be one of the
+         * environment's registered redirect URIs, or the call rejects with
+         * `user.password_reset.redirect_uri.not_allowed`.
+         */
+        requestPasswordReset: (email: string, options?: PasswordResetRequestOptions) => Promise<void>;
+        /**
+         * POST /auth/password-reset/validate — checks a reset token without
+         * spending it, so the reset page can refuse a dead link before asking for
+         * a password. Rejects with `user.password_reset.invalid` (401) when the
+         * token is unknown, used or expired.
+         */
+        validatePasswordReset: (token: string) => Promise<PasswordResetPreview>;
+        /**
+         * POST /auth/password-reset/confirm — sets a new password and revokes all
+         * refresh tokens. Resolves with the `redirectUri` the reset was requested
+         * with (`null` when there was none); following it is up to the caller.
+         */
+        confirmPasswordReset: (token: string, newPassword: string) => Promise<PasswordResetCompleted>;
     };
     readonly organization: {
         /** GET /auth/tenants — filterable list of organization memberships. */
@@ -878,4 +928,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };
+export { type SecurityMethods as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PasswordResetCompleted as V, type PasswordResetPreview as W, type PasswordResetRequestOptions as X, type PermissionGroup as Y, type RegisterInput as Z, type Role as _, type HttpLoggerOptions as a, type Session as a0, type SessionControllerOptions as a1, type SessionInfo as a2, type SessionSnapshot as a3, type SessionSnapshotListener as a4, type SessionStatus as a5, type SsoProvider as a6, type SubjectApprovals as a7, type SubjectSecurity as a8, type TwoFactorChallenge as a9, type TwoFactorMethod as aa, type TwoFactorStatus as ab, type User as ac, type ValidateResult as ad, type VerifyTwoFactorInput as ae, type WebAuthnAssertion as af, type WebAuthnCeremonyStart as ag, type WebAuthnCredential as ah, createAuthyonAbility as ai, createAuthyonRules as aj, createClient as ak, hasPermission as al, hasPermissionGroup as am, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/{ability-Cp8ir5Gr.d.ts → ability-BTcayvkM.d.ts}

@@ -164,10 +164,20 @@ interface PaginationOptions {
     skip?: number;
     take?: number;
 }
+/**
+ * The envelope every paged endpoint answers with.
+ *
+ * `page` is the 1-based current page and `perPage` is how many items a page
+ * holds — the same sense `take` has on the way in. Up to Authyon API
+ * 2026-10-21 the two were named `perPage` (holding the page number) and
+ * `pageSize` (holding the limit), so reading them by their names gave the
+ * wrong value without failing. Clients on the older API see `page` undefined
+ * and `perPage` holding a page number.
+ */
 interface Paged<T> {
     data: T[];
-    perPage?: number;
-    pageSize: number;
+    page: number;
+    perPage: number;
     total: number;
     pages: number;
     hasNext: boolean;
@@ -281,6 +291,29 @@ interface OrganizationInvitePreview {
     /** Where the issuer asked to send the invitee after accepting, or `null`. */
     redirectUri: string | null;
 }
+/** Options for POST /auth/password-reset/request. */
+interface PasswordResetRequestOptions {
+    /**
+     * Where to send the person after they change the password. Must be
+     * registered exactly in the environment's redirect URIs (the same list SSO
+     * and magic link use); otherwise the request fails with
+     * `user.password_reset.redirect_uri.not_allowed`. Comes back on
+     * `validatePasswordReset` and `confirmPasswordReset`.
+     */
+    redirectUri?: string;
+}
+/** POST /auth/password-reset/validate — what a live reset token is for. */
+interface PasswordResetPreview {
+    email: string;
+    expiresAt: string;
+    /** Where the reset was asked to end, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/password-reset/confirm — the password is changed. */
+interface PasswordResetCompleted {
+    /** Where the reset was asked to end, or `null`. Navigating there is up to you. */
+    redirectUri: string | null;
+}
 /** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
 interface AcceptOrganizationInviteInput {
     token: string;
@@ -616,10 +649,27 @@ declare class AuthyonClient {
          * the endpoint differs, override via a raw call to your own backend.
          */
         revokeSession: (sessionId: string) => Promise<void>;
-        /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-        requestPasswordReset: (email: string) => Promise<void>;
-        /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-        confirmPasswordReset: (token: string, newPassword: string) => Promise<void>;
+        /**
+         * POST /auth/password-reset/request — resolves whether or not the address
+         * has an account (no account enumeration). `redirectUri` is where the
+         * person lands after changing the password; it must be one of the
+         * environment's registered redirect URIs, or the call rejects with
+         * `user.password_reset.redirect_uri.not_allowed`.
+         */
+        requestPasswordReset: (email: string, options?: PasswordResetRequestOptions) => Promise<void>;
+        /**
+         * POST /auth/password-reset/validate — checks a reset token without
+         * spending it, so the reset page can refuse a dead link before asking for
+         * a password. Rejects with `user.password_reset.invalid` (401) when the
+         * token is unknown, used or expired.
+         */
+        validatePasswordReset: (token: string) => Promise<PasswordResetPreview>;
+        /**
+         * POST /auth/password-reset/confirm — sets a new password and revokes all
+         * refresh tokens. Resolves with the `redirectUri` the reset was requested
+         * with (`null` when there was none); following it is up to the caller.
+         */
+        confirmPasswordReset: (token: string, newPassword: string) => Promise<PasswordResetCompleted>;
     };
     readonly organization: {
         /** GET /auth/tenants — filterable list of organization memberships. */
@@ -878,4 +928,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };
+export { type SecurityMethods as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PasswordResetCompleted as V, type PasswordResetPreview as W, type PasswordResetRequestOptions as X, type PermissionGroup as Y, type RegisterInput as Z, type Role as _, type HttpLoggerOptions as a, type Session as a0, type SessionControllerOptions as a1, type SessionInfo as a2, type SessionSnapshot as a3, type SessionSnapshotListener as a4, type SessionStatus as a5, type SsoProvider as a6, type SubjectApprovals as a7, type SubjectSecurity as a8, type TwoFactorChallenge as a9, type TwoFactorMethod as aa, type TwoFactorStatus as ab, type User as ac, type ValidateResult as ad, type VerifyTwoFactorInput as ae, type WebAuthnAssertion as af, type WebAuthnCeremonyStart as ag, type WebAuthnCredential as ah, createAuthyonAbility as ai, createAuthyonRules as aj, createClient as ak, hasPermission as al, hasPermissionGroup as am, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/index.cjs

@@ -565,13 +565,36 @@ var AuthyonClient = class {
         method: "DELETE",
         bearer: true
       }),
-      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
-      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+      /**
+       * POST /auth/password-reset/request — resolves whether or not the address
+       * has an account (no account enumeration). `redirectUri` is where the
+       * person lands after changing the password; it must be one of the
+       * environment's registered redirect URIs, or the call rejects with
+       * `user.password_reset.redirect_uri.not_allowed`.
+       */
+      requestPasswordReset: (email, options = {}) => this.request("/auth/password-reset/request", {
         method: "POST",
-        body: { token, newPassword }
-      })
+        body: { email, ...options }
+      }),
+      /**
+       * POST /auth/password-reset/validate — checks a reset token without
+       * spending it, so the reset page can refuse a dead link before asking for
+       * a password. Rejects with `user.password_reset.invalid` (401) when the
+       * token is unknown, used or expired.
+       */
+      validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+      /**
+       * POST /auth/password-reset/confirm — sets a new password and revokes all
+       * refresh tokens. Resolves with the `redirectUri` the reset was requested
+       * with (`null` when there was none); following it is up to the caller.
+       */
+      confirmPasswordReset: async (token, newPassword) => {
+        const done = await this.request(
+          "/auth/password-reset/confirm",
+          { method: "POST", body: { token, newPassword } }
+        );
+        return { redirectUri: done?.redirectUri ?? null };
+      }
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.cjs';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-BTcayvkM.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PasswordResetCompleted, W as PasswordResetPreview, X as PasswordResetRequestOptions, Y as PermissionGroup, Z as RegisterInput, _ as Role, $ as SecurityMethods, a0 as Session, a1 as SessionControllerOptions, a2 as SessionInfo, a3 as SessionSnapshot, a4 as SessionSnapshotListener, a5 as SessionStatus, a6 as SsoProvider, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TwoFactorChallenge, aa as TwoFactorMethod, ab as TwoFactorStatus, ac as User, ad as ValidateResult, ae as VerifyTwoFactorInput, af as WebAuthnAssertion, ag as WebAuthnCeremonyStart, ah as WebAuthnCredential, ai as createAuthyonAbility, aj as createAuthyonRules, ak as createClient, al as hasPermission, am as hasPermissionGroup } from './ability-BTcayvkM.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-BTcayvkM.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PasswordResetCompleted, W as PasswordResetPreview, X as PasswordResetRequestOptions, Y as PermissionGroup, Z as RegisterInput, _ as Role, $ as SecurityMethods, a0 as Session, a1 as SessionControllerOptions, a2 as SessionInfo, a3 as SessionSnapshot, a4 as SessionSnapshotListener, a5 as SessionStatus, a6 as SsoProvider, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TwoFactorChallenge, aa as TwoFactorMethod, ab as TwoFactorStatus, ac as User, ad as ValidateResult, ae as VerifyTwoFactorInput, af as WebAuthnAssertion, ag as WebAuthnCeremonyStart, ah as WebAuthnCredential, ai as createAuthyonAbility, aj as createAuthyonRules, ak as createClient, al as hasPermission, am as hasPermissionGroup } from './ability-BTcayvkM.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";

package/dist/index.js

@@ -533,13 +533,36 @@ var AuthyonClient = class {
         method: "DELETE",
         bearer: true
       }),
-      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
-      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+      /**
+       * POST /auth/password-reset/request — resolves whether or not the address
+       * has an account (no account enumeration). `redirectUri` is where the
+       * person lands after changing the password; it must be one of the
+       * environment's registered redirect URIs, or the call rejects with
+       * `user.password_reset.redirect_uri.not_allowed`.
+       */
+      requestPasswordReset: (email, options = {}) => this.request("/auth/password-reset/request", {
         method: "POST",
-        body: { token, newPassword }
-      })
+        body: { email, ...options }
+      }),
+      /**
+       * POST /auth/password-reset/validate — checks a reset token without
+       * spending it, so the reset page can refuse a dead link before asking for
+       * a password. Rejects with `user.password_reset.invalid` (401) when the
+       * token is unknown, used or expired.
+       */
+      validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+      /**
+       * POST /auth/password-reset/confirm — sets a new password and revokes all
+       * refresh tokens. Resolves with the `redirectUri` the reset was requested
+       * with (`null` when there was none); following it is up to the caller.
+       */
+      confirmPasswordReset: async (token, newPassword) => {
+        const done = await this.request(
+          "/auth/password-reset/confirm",
+          { method: "POST", body: { token, newPassword } }
+        );
+        return { redirectUri: done?.redirectUri ?? null };
+      }
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.cjs';
-export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.cjs';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.cjs';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.js';
-export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.js';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.js';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.16",
+  "version": "0.2.0-beta.19",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",