@delopay/sdk 0.3.0 → 0.3.2

package/dist/index.d.cts

@@ -2984,6 +2984,17 @@ declare class Users {
     changePassword(params: ChangePasswordRequest): Promise<UserResponse>;
     rotatePassword(params: ResetPasswordRequest): Promise<UserResponse>;
     forgotPassword(params: ForgotPasswordRequest): Promise<Record<string, unknown>>;
+    /**
+     * Reset a user's password using the single-purpose JWT delivered by the
+     * forgot-password email.
+     *
+     * The backend validates the token **twice**: first by the
+     * `SinglePurposeJWTAuth` middleware (reads `Authorization: Bearer …`),
+     * then by the handler itself (decodes `body.token` as an `EmailToken` and
+     * looks up the user by the embedded email — see
+     * `crates/router/src/core/user.rs:687`). The same JWT satisfies both, so
+     * the SDK sends it in both places. Callers still pass `{ password, token }`.
+     */
     resetPassword(params: ResetPasswordRequest): Promise<Record<string, unknown>>;
     verifyEmail(params: Record<string, unknown>): Promise<AuthResponse>;
     sendVerificationEmail(params: ForgotPasswordRequest): Promise<Record<string, unknown>>;

package/dist/index.d.ts

@@ -2984,6 +2984,17 @@ declare class Users {
     changePassword(params: ChangePasswordRequest): Promise<UserResponse>;
     rotatePassword(params: ResetPasswordRequest): Promise<UserResponse>;
     forgotPassword(params: ForgotPasswordRequest): Promise<Record<string, unknown>>;
+    /**
+     * Reset a user's password using the single-purpose JWT delivered by the
+     * forgot-password email.
+     *
+     * The backend validates the token **twice**: first by the
+     * `SinglePurposeJWTAuth` middleware (reads `Authorization: Bearer …`),
+     * then by the handler itself (decodes `body.token` as an `EmailToken` and
+     * looks up the user by the embedded email — see
+     * `crates/router/src/core/user.rs:687`). The same JWT satisfies both, so
+     * the SDK sends it in both places. Callers still pass `{ password, token }`.
+     */
     resetPassword(params: ResetPasswordRequest): Promise<Record<string, unknown>>;
     verifyEmail(params: Record<string, unknown>): Promise<AuthResponse>;
     sendVerificationEmail(params: ForgotPasswordRequest): Promise<Record<string, unknown>>;

package/dist/index.js

@@ -2029,8 +2029,22 @@ var Users = class {
   async forgotPassword(params) {
     return this.request("POST", "/user/forgot_password", { body: params });
   }
+  /**
+   * Reset a user's password using the single-purpose JWT delivered by the
+   * forgot-password email.
+   *
+   * The backend validates the token **twice**: first by the
+   * `SinglePurposeJWTAuth` middleware (reads `Authorization: Bearer …`),
+   * then by the handler itself (decodes `body.token` as an `EmailToken` and
+   * looks up the user by the embedded email — see
+   * `crates/router/src/core/user.rs:687`). The same JWT satisfies both, so
+   * the SDK sends it in both places. Callers still pass `{ password, token }`.
+   */
   async resetPassword(params) {
-    return this.request("POST", "/user/reset_password", { body: params });
+    return this.request("POST", "/user/reset_password", {
+      body: params,
+      headers: { Authorization: `Bearer ${params.token}` }
+    });
   }
   async verifyEmail(params) {
     return this.request("POST", "/user/verify_email", { body: params });