@espressif/rainmaker-neo-base-sdk 1.0.0

package/dist/esm/methods/ESPDevice/Provision.js

@@ -0,0 +1,86 @@
+import { ESPDevice } from '../../ESPDevice.js';
+import { ESPProvResponseStatus } from '../../types/provision.js';
+import { ProvisionType, ESPProvProgressMessages, Endpoint } from '../../utils/constants.js';
+import { ESPProvError } from '../../utils/error/ESPProvError.js';
+import { ChallengeResponseHelper } from '../../services/ESPRMNeoHelpers/ChallengeResponseHelper.js';
+import { uint8ArrayToBase64, base64ToUint8Array } from '../../services/ESPRMNeoHelpers/TransformEncoding.js';
+import { waitForNodeOnline, DEFAULT_NODE_ONLINE_TIMEOUT_MS } from '../../utils/waitForNodeOnline.js';
+import { Logger } from '../../utils/logger.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("Provision");
+function reportProgress(onProgress, status, description) {
+    onProgress?.({ status, description });
+}
+function validateProvisionOptions(options) {
+    if (options?.waitForOnline && !options.user) {
+        throw new Error("Provision options: user is required when waitForOnline is true");
+    }
+}
+ESPDevice.prototype.provision = async function (ssid, passphrase, onProgress, groupId, provisionType = ProvisionType.CHAL_RESP, options) {
+    try {
+        if (provisionType !== ProvisionType.CHAL_RESP) {
+            throw new ESPProvError("INVALID_PROVISION_TYPE");
+        }
+        validateProvisionOptions(options);
+        return await runChallengeResponseFlow(this, ssid, passphrase, groupId, onProgress, options);
+    }
+    catch (error) {
+        logger.error("Provision failed", error instanceof Error ? error.message : String(error));
+        throw error;
+    }
+};
+async function runChallengeResponseFlow(device, ssid, passphrase, groupId, onProgress, options) {
+    // 1. INITIATE (Server)
+    reportProgress(onProgress, ESPProvResponseStatus.onProgress, ESPProvProgressMessages.INITIATING_NODE_ASSOCIATION);
+    const initiateResponse = (await device.initiateUserNodeMapping(groupId, {}));
+    const { challenge, request_id: requestId } = initiateResponse;
+    if (!challenge || !requestId) {
+        throw new ESPProvError("INVALID_MAPPING_RESPONSE");
+    }
+    // 2. SEND CHALLENGE TO DEVICE
+    reportProgress(onProgress, ESPProvResponseStatus.onProgress, ESPProvProgressMessages.SENDING_CHALLENGE_TO_DEVICE);
+    const challengePayload = ChallengeResponseHelper.createChallengeRequest(challenge);
+    const base64Payload = uint8ArrayToBase64(challengePayload);
+    const responseStr = await device.sendData(Endpoint.CHALLENGE_RESPONSE, base64Payload);
+    // 3. VALIDATE RESPONSE FORMAT
+    const responseBytes = base64ToUint8Array(responseStr);
+    const deviceResponse = ChallengeResponseHelper.parseDeviceResponse(responseBytes);
+    if (!ChallengeResponseHelper.validateChallengeResponse(deviceResponse)) {
+        logger.error("Invalid device response", deviceResponse);
+        throw new ESPProvError("INVALID_CHALLENGE_RESPONSE_FORMAT");
+    }
+    const { nodeId, signedChallenge } = deviceResponse;
+    logger.debug("Parsed device response", {
+        nodeId,
+        signedChallengeLength: signedChallenge?.length,
+    });
+    // 4. VERIFY (Server)
+    reportProgress(onProgress, ESPProvResponseStatus.onProgress, ESPProvProgressMessages.VERIFYING_NODE_ASSOCIATION);
+    await device.verifyUserNodeMapping(groupId, requestId, {
+        challenge_response: signedChallenge,
+        node_id: nodeId,
+    });
+    // 5. SET NETWORK CREDENTIALS
+    reportProgress(onProgress, ESPProvResponseStatus.onProgress, ESPProvProgressMessages.SETTING_NETWORK_CREDENTIALS);
+    await device.setNetworkCredentials(ssid, passphrase);
+    const resolvedNodeId = nodeId;
+    // 6. Wait for cloud online (optional)
+    if (options?.waitForOnline && options.user) {
+        reportProgress(onProgress, ESPProvResponseStatus.onProgress, ESPProvProgressMessages.WAITING_FOR_ONLINE);
+        await waitForNodeOnline({
+            nodeId: resolvedNodeId,
+            groupId,
+            user: options.user,
+            timeoutMs: options.onlineTimeoutMs ?? DEFAULT_NODE_ONLINE_TIMEOUT_MS,
+        });
+    }
+    // 7. Success
+    reportProgress(onProgress, ESPProvResponseStatus.succeed, resolvedNodeId ?? ESPProvProgressMessages.DEVICE_PROVISIONED);
+    return resolvedNodeId;
+}
+//# sourceMappingURL=Provision.js.map

package/dist/esm/methods/ESPDevice/Provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Provision.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/methods/ESPDevice/ScanWifiList.js

@@ -0,0 +1,11 @@
+import { ESPDevice } from '../../ESPDevice.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ESPDevice.prototype.scanWifiList = async function () {
+    return await this.ESPProvisionAdapter.scanWifiList(this.name);
+};
+//# sourceMappingURL=ScanWifiList.js.map

package/dist/esm/methods/ESPDevice/ScanWifiList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScanWifiList.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/esm/methods/ESPDevice/SendData.js

@@ -0,0 +1,11 @@
+import { ESPDevice } from '../../ESPDevice.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ESPDevice.prototype.sendData = async function (endPoint, data) {
+    return await this.ESPProvisionAdapter.sendData(this.name, endPoint, data);
+};
+//# sourceMappingURL=SendData.js.map

package/dist/esm/methods/ESPDevice/SendData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SendData.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/esm/methods/ESPDevice/SetNetworkCredentials.js

@@ -0,0 +1,11 @@
+import { ESPDevice } from '../../ESPDevice.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ESPDevice.prototype.setNetworkCredentials = async function (ssid, passphrase) {
+    return this.ESPProvisionAdapter.provision(this.name, ssid, passphrase);
+};
+//# sourceMappingURL=SetNetworkCredentials.js.map

package/dist/esm/methods/ESPDevice/SetNetworkCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetNetworkCredentials.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/esm/methods/ESPDevice/SetProofOfPossession.js

@@ -0,0 +1,11 @@
+import { ESPDevice } from '../../ESPDevice.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ESPDevice.prototype.setProofOfPossession = async function (proofOfPossession) {
+    return await this.ESPProvisionAdapter.setProofOfPossession(this.name, proofOfPossession);
+};
+//# sourceMappingURL=SetProofOfPossession.js.map

package/dist/esm/methods/ESPDevice/SetProofOfPossession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetProofOfPossession.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/esm/methods/ESPDevice/StartAssistedClaiming.js

@@ -0,0 +1,258 @@
+import { ESPDevice } from '../../ESPDevice.js';
+import { ESPClaimStatus } from '../../types/provision.js';
+import { ClaimProgressMessages, Endpoint, ClaimErrorCodes, CLAIM_CSR_MAX_CHUNKS, CLAIM_MAX_FRAGMENT_SIZE, CLAIM_DEVICE_MAC_KEYS, CLAIM_DEVICE_CSR_KEYS } from '../../utils/constants.js';
+import { ESPClaimError } from '../../utils/error/ESPClaimError.js';
+import { ClaimingHelper } from '../../services/ESPRMNeoHelpers/ClaimingHelper.js';
+import { ClaimingProtoHelper } from '../../proto/esp_rmaker_claim.js';
+import { uint8ArrayToBase64, base64ToUint8Array } from '../../services/ESPRMNeoHelpers/TransformEncoding.js';
+import { Logger } from '../../utils/logger.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("StartAssistedClaiming");
+function reportProgress(onProgress, status, message, error) {
+    onProgress?.({ status, message, ...(error !== undefined ? { error } : {}) });
+}
+/** Correlation id so a single claim attempt can be stitched together in logs. */
+function buildClaimId(deviceName) {
+    return `${deviceName}-${Date.now()}`;
+}
+/** Parses a device payload as JSON, or null when it is not a JSON object. */
+function parseDevicePayload(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object"
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads the first of `keys` present in `payload` as a non-empty string. */
+function readFirstString(payload, keys) {
+    if (!payload) {
+        return undefined;
+    }
+    for (const key of keys) {
+        const value = payload[key];
+        if (typeof value === "string" && value.trim()) {
+            return value.trim();
+        }
+    }
+    return undefined;
+}
+/**
+ * Reads the device's claim-start payload. The MAC is returned separately because
+ * the claiming service keys its reservation on it; the payload is returned whole
+ * so every field the firmware sent is forwarded rather than cherry-picked.
+ */
+function readDeviceStartPayload(deviceInfo, claimId) {
+    const payload = parseDevicePayload(deviceInfo);
+    const macAddress = readFirstString(payload, CLAIM_DEVICE_MAC_KEYS);
+    if (!macAddress) {
+        logger.error("no MAC in device claim start response", {
+            claimId,
+            payloadKeys: payload ? Object.keys(payload) : null,
+        });
+        throw new ESPClaimError(ClaimErrorCodes.DEVICE_MAC_UNAVAILABLE);
+    }
+    return { macAddress, payload: payload ?? {} };
+}
+/**
+ * Reads the device's claim payload for verify, accepting either a JSON wrapper
+ * or a bare PEM block. Returned whole: the firmware sends request flags of its
+ * own alongside the CSR, and extracting only `csr` would drop them.
+ */
+function readDeviceCsrPayload(csrData, claimId) {
+    const parsed = parseDevicePayload(csrData);
+    const payload = parsed ?? { csr: csrData.trim() };
+    const csr = readFirstString(payload, CLAIM_DEVICE_CSR_KEYS);
+    if (!csr) {
+        logger.error("no CSR in device claim payload", {
+            claimId,
+            payloadKeys: Object.keys(payload),
+        });
+        throw new ESPClaimError(ClaimErrorCodes.CSR_RETRIEVAL_FAILED);
+    }
+    // `csr` is set explicitly so a spelling variant still satisfies the contract,
+    // while every other field the firmware sent is preserved.
+    return { ...payload, csr };
+}
+/** Step 1 — ask the device to start claiming and return its device-info payload. */
+async function requestDeviceInfo(device, claimId) {
+    const request = ClaimingProtoHelper.createClaimStartRequest();
+    const response = await device.sendData(Endpoint.RM_CLAIM, uint8ArrayToBase64(request));
+    const parsed = ClaimingProtoHelper.parseClaimResponse(base64ToUint8Array(response));
+    if (!ClaimingProtoHelper.isSuccess(parsed)) {
+        logger.error("ClaimStart rejected by device", {
+            claimId,
+            status: ClaimingProtoHelper.getStatus(parsed),
+        });
+        throw new ESPClaimError(ClaimErrorCodes.CLAIM_START_FAILED);
+    }
+    const deviceInfo = ClaimingProtoHelper.extractPayloadString(parsed);
+    if (!deviceInfo) {
+        logger.error("ClaimStart returned empty device info", { claimId });
+        throw new ESPClaimError(ClaimErrorCodes.CLAIM_START_FAILED);
+    }
+    return deviceInfo;
+}
+/**
+ * Steps 3–4 — push the cloud init payload and reassemble the chunked CSR.
+ *
+ * The device owns `totalLen`; an empty ClaimInit means "send the next chunk".
+ * Bounded by {@link CLAIM_CSR_MAX_CHUNKS} and a no-progress check so firmware
+ * that reports Success without advancing cannot spin forever.
+ */
+async function retrieveCsr(device, cloudInitResponse, claimId) {
+    const initRequest = ClaimingProtoHelper.createClaimInitRequest(cloudInitResponse);
+    let currentResponse = await device.sendData(Endpoint.RM_CLAIM, uint8ArrayToBase64(initRequest));
+    let csrData = "";
+    let deviceChunkSize = 0;
+    let iterations = 0;
+    for (;;) {
+        iterations += 1;
+        if (iterations > CLAIM_CSR_MAX_CHUNKS) {
+            logger.error("CSR retrieval exceeded chunk budget", {
+                claimId,
+                iterations,
+                received: csrData.length,
+            });
+            throw new ESPClaimError(ClaimErrorCodes.CSR_STALLED);
+        }
+        const parsed = ClaimingProtoHelper.parseClaimResponse(base64ToUint8Array(currentResponse));
+        if (!ClaimingProtoHelper.isSuccess(parsed)) {
+            logger.error("device rejected CSR request", {
+                claimId,
+                iterations,
+                status: ClaimingProtoHelper.getStatus(parsed),
+            });
+            throw new ESPClaimError(ClaimErrorCodes.CSR_RETRIEVAL_FAILED);
+        }
+        const chunk = ClaimingProtoHelper.extractPayloadString(parsed);
+        const offset = ClaimingProtoHelper.getOffset(parsed);
+        const totalLen = ClaimingProtoHelper.getTotalLen(parsed);
+        if (offset === 0) {
+            csrData = chunk;
+            deviceChunkSize = chunk.length;
+        }
+        else {
+            csrData += chunk;
+        }
+        // `totalLen` 0 with a non-empty chunk is the legitimate single-fragment case,
+        // so completion is checked first and an actually-empty CSR is rejected rather
+        // than POSTed to the cloud.
+        if (csrData.length >= totalLen) {
+            if (!csrData) {
+                logger.error("device reported CSR complete but sent no data", {
+                    claimId,
+                    totalLen,
+                });
+                throw new ESPClaimError(ClaimErrorCodes.CSR_RETRIEVAL_FAILED);
+            }
+            return { csrData, deviceChunkSize };
+        }
+        // No forward progress means the device will never complete the transfer.
+        if (!chunk.length) {
+            logger.error("device returned an empty CSR chunk before completion", {
+                claimId,
+                accumulated: csrData.length,
+                totalLen,
+            });
+            throw new ESPClaimError(ClaimErrorCodes.CSR_STALLED);
+        }
+        currentResponse = await device.sendData(Endpoint.RM_CLAIM, uint8ArrayToBase64(ClaimingProtoHelper.createClaimInitContinueRequest()));
+    }
+}
+/** Step 6 — stream the certificate response back to the device in fragments. */
+async function sendCertificate(device, certificateData, deviceChunkSize, claimId) {
+    if (!certificateData) {
+        logger.error("no certificate data to send", { claimId });
+        throw new ESPClaimError(ClaimErrorCodes.CERTIFICATE_SEND_FAILED);
+    }
+    // 200 bytes is the protocol's fragment ceiling, not a hint: the device answers
+    // an oversized fragment with NoMemory. A smaller device fragment size wins.
+    const chunkSize = deviceChunkSize > 0
+        ? Math.min(deviceChunkSize, CLAIM_MAX_FRAGMENT_SIZE)
+        : CLAIM_MAX_FRAGMENT_SIZE;
+    for (let offset = 0; offset < certificateData.length; offset += chunkSize) {
+        const request = ClaimingProtoHelper.createClaimVerifyRequest(certificateData, offset, chunkSize);
+        const response = await device.sendData(Endpoint.RM_CLAIM, uint8ArrayToBase64(request));
+        const parsed = ClaimingProtoHelper.parseClaimResponse(base64ToUint8Array(response));
+        if (!ClaimingProtoHelper.isSuccess(parsed)) {
+            // The device validates the reassembled payload only on the final fragment,
+            // so a rejection here can mean the payload was bad rather than the transfer.
+            logger.error("device rejected certificate fragment", {
+                claimId,
+                status: ClaimingProtoHelper.getStatus(parsed),
+                offset,
+                chunkSize,
+                totalBytes: certificateData.length,
+            });
+            throw new ESPClaimError(ClaimErrorCodes.CERTIFICATE_SEND_FAILED);
+        }
+    }
+}
+/** Best-effort abort so the device does not stay parked in a claiming session. */
+async function abortClaiming(device, claimId) {
+    try {
+        await device.sendData(Endpoint.RM_CLAIM, uint8ArrayToBase64(ClaimingProtoHelper.createClaimAbortRequest()));
+    }
+    catch (error) {
+        logger.warn("claim abort failed", {
+            claimId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+ESPDevice.prototype.startAssistedClaiming = async function (onProgress, claimCapability) {
+    const claimId = buildClaimId(this.name);
+    const startedAt = Date.now();
+    try {
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CLAIM_STARTING);
+        const deviceInfo = await requestDeviceInfo(this, claimId);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.DEVICE_INFO_RECEIVED);
+        // Reserve a node ID for this device's MAC. Idempotent, so a retry or a
+        // factory-erased device resolves to the same node.
+        const { macAddress, payload: startPayload } = readDeviceStartPayload(deviceInfo, claimId);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CLAIM_INIT_API);
+        const initiateResponse = await ClaimingHelper.initiateClaim(macAddress, startPayload, claimId);
+        // Forwarded whole; the device reads `node_id` from it.
+        const cloudInitResponse = JSON.stringify(initiateResponse);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CSR_RETRIEVING);
+        const { csrData, deviceChunkSize } = await retrieveCsr(this, cloudInitResponse, claimId);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CSR_RECEIVED);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CLAIM_VERIFY_API);
+        const verifyResponse = await ClaimingHelper.verifyClaim(macAddress, readDeviceCsrPayload(csrData, claimId), claimCapability, claimId);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CERTIFICATE_RECEIVED);
+        // Forwarded whole, so the device also gets `mqtt_host` and `ca_certificate`
+        // alongside its leaf certificate.
+        const certificateData = JSON.stringify(verifyResponse);
+        reportProgress(onProgress, ESPClaimStatus.inProgress, ClaimProgressMessages.CERTIFICATE_SENDING);
+        await sendCertificate(this, certificateData, deviceChunkSize, claimId);
+        logger.info("assisted claiming succeeded", {
+            claimId,
+            nodeId: verifyResponse.node_id,
+            mqttHost: verifyResponse.mqtt_host,
+            elapsedMs: Date.now() - startedAt,
+        });
+        reportProgress(onProgress, ESPClaimStatus.success, ClaimProgressMessages.CLAIM_SUCCESS);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error("assisted claiming failed", {
+            claimId,
+            code: error instanceof ESPClaimError ? error.code : undefined,
+            elapsedMs: Date.now() - startedAt,
+            error: message,
+        });
+        await abortClaiming(this, claimId);
+        reportProgress(onProgress, ESPClaimStatus.failed, ClaimProgressMessages.CLAIM_FAILED, message);
+        throw error;
+    }
+};
+//# sourceMappingURL=StartAssistedClaiming.js.map

package/dist/esm/methods/ESPDevice/StartAssistedClaiming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StartAssistedClaiming.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/methods/ESPDevice/VerifyUserNodeMapping.js

@@ -0,0 +1,12 @@
+import { ESPDevice } from '../../ESPDevice.js';
+import { NodeMappingHelper } from '../../services/ESPRMNeoHelpers/NodeMappingHelper.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ESPDevice.prototype.verifyUserNodeMapping = async function (groupId, requestId, requestBody = {}) {
+    return NodeMappingHelper.verifyUserNodeMapping(groupId, requestId, requestBody);
+};
+//# sourceMappingURL=VerifyUserNodeMapping.js.map

package/dist/esm/methods/ESPDevice/VerifyUserNodeMapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerifyUserNodeMapping.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}

package/dist/esm/methods/ESPRMNeoAuth/ChangePassword.js

@@ -0,0 +1,44 @@
+import { ESPRMNeoAuth } from '../../ESPRMNeoAuth.js';
+import { StorageKeys, AuthErrorCodes, APIPathV1, AuthSuccessMessages } from '../../utils/constants.js';
+import { authErrorMessages } from '../../utils/error/errorMessages.js';
+import { ESPRMNeoAPIManager } from '../../services/ESPRMNeoAPIManager.js';
+import { ESPRMNeoStorage } from '../../services/ESPRMNeoStorage/ESPRMNeoStorage.js';
+import { Logger } from '../../utils/logger.js';
+import { normalizeApiResponse } from '../../utils/normalizeApiResponse.js';
+import { ESPAuthError } from '../../utils/error/ESPAuthError.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("ChangePassword");
+ESPRMNeoAuth.prototype.changePassword = async function (oldPassword, newPassword) {
+    try {
+        const accessToken = await ESPRMNeoStorage.getItem(StorageKeys.ACCESSTOKEN);
+        if (!accessToken) {
+            throw new ESPAuthError(AuthErrorCodes.NOT_LOGGED_IN, authErrorMessages.NOT_LOGGED_IN);
+        }
+        const api = ESPRMNeoAPIManager.getInstance();
+        logger.debug(`changePassword → POST ${APIPathV1.USER_AUTH_PASSWORD} (Cognito Bearer)`);
+        const requestBody = {
+            access_token: accessToken,
+            old_password: oldPassword,
+            new_password: newPassword,
+        };
+        const apiResponse = await api.postUserApiWithBearer(APIPathV1.USER_AUTH_PASSWORD, requestBody, accessToken);
+        return normalizeApiResponse(apiResponse, {
+            message: AuthSuccessMessages.PASSWORD_CHANGED,
+        });
+    }
+    catch (err) {
+        if (err instanceof ESPAuthError)
+            throw err;
+        const message = err instanceof Error
+            ? err.message
+            : authErrorMessages.CHANGE_PASSWORD_FAILED;
+        logger.debug("changePassword → Error:", message);
+        throw new ESPAuthError(AuthErrorCodes.CHANGE_PASSWORD_FAILED, message, err);
+    }
+};
+//# sourceMappingURL=ChangePassword.js.map

package/dist/esm/methods/ESPRMNeoAuth/ChangePassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangePassword.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/methods/ESPRMNeoAuth/ConfirmSignUp.js

@@ -0,0 +1,39 @@
+import { ESPRMNeoAuth } from '../../ESPRMNeoAuth.js';
+import { APIPathV1, AuthSuccessMessages, AuthErrorCodes } from '../../utils/constants.js';
+import { ESPRMNeoAPIManager } from '../../services/ESPRMNeoAPIManager.js';
+import { Logger } from '../../utils/logger.js';
+import { normalizeApiResponse } from '../../utils/normalizeApiResponse.js';
+import { authErrorMessages } from '../../utils/error/errorMessages.js';
+import { signupIdentityFromUsername } from '../../utils/authUtils.js';
+import { ESPAuthError } from '../../utils/error/ESPAuthError.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("ConfirmSignUp");
+ESPRMNeoAuth.prototype.confirmSignUp = async function (username, verificationCode) {
+    try {
+        const requestBody = {
+            code: verificationCode,
+            ...signupIdentityFromUsername(username),
+        };
+        const api = ESPRMNeoAPIManager.getInstance();
+        logger.debug(`confirmSignUp → POST ${APIPathV1.USER_AUTH_SIGNUP_VERIFY}`);
+        const apiResponse = await api.postUserApi(APIPathV1.USER_AUTH_SIGNUP_VERIFY, requestBody);
+        return normalizeApiResponse(apiResponse, {
+            message: AuthSuccessMessages.USER_CONFIRMED,
+        });
+    }
+    catch (err) {
+        if (err instanceof ESPAuthError)
+            throw err;
+        const message = err instanceof Error
+            ? err.message
+            : authErrorMessages.CONFIRM_SIGNUP_FAILED;
+        logger.debug("confirmSignUp → Error:", message);
+        throw new ESPAuthError(AuthErrorCodes.CONFIRM_SIGNUP_FAILED, message, err);
+    }
+};
+//# sourceMappingURL=ConfirmSignUp.js.map

package/dist/esm/methods/ESPRMNeoAuth/ConfirmSignUp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfirmSignUp.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/methods/ESPRMNeoAuth/ForgotPassword.js

@@ -0,0 +1,37 @@
+import { ESPRMNeoAuth } from '../../ESPRMNeoAuth.js';
+import { APIPathV1, AuthErrorCodes } from '../../utils/constants.js';
+import { authErrorMessages } from '../../utils/error/errorMessages.js';
+import { ESPRMNeoAPIManager } from '../../services/ESPRMNeoAPIManager.js';
+import { Logger } from '../../utils/logger.js';
+import { ESPAuthError } from '../../utils/error/ESPAuthError.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("ForgotPassword");
+function toForgotPasswordResponse(apiResponse) {
+    return {
+        message: apiResponse?.message,
+    };
+}
+ESPRMNeoAuth.prototype.forgotPassword = async function (username) {
+    try {
+        const requestBody = { username };
+        const api = ESPRMNeoAPIManager.getInstance();
+        logger.debug(`forgotPassword → POST ${APIPathV1.USER_AUTH_PASSWORD_RECOVERY}`);
+        const apiResponse = await api.postUserApi(APIPathV1.USER_AUTH_PASSWORD_RECOVERY, requestBody);
+        return toForgotPasswordResponse(apiResponse);
+    }
+    catch (err) {
+        if (err instanceof ESPAuthError)
+            throw err;
+        const message = err instanceof Error
+            ? err.message
+            : authErrorMessages.FORGOT_PASSWORD_FAILED;
+        logger.debug("forgotPassword → Error:", message);
+        throw new ESPAuthError(AuthErrorCodes.FORGOT_PASSWORD_FAILED, message, err);
+    }
+};
+//# sourceMappingURL=ForgotPassword.js.map

package/dist/esm/methods/ESPRMNeoAuth/ForgotPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForgotPassword.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/methods/ESPRMNeoAuth/GetLoggedInUser.js

@@ -0,0 +1,54 @@
+import { ESPRMNeoAuth } from '../../ESPRMNeoAuth.js';
+import { ESPRMNeoUser } from '../../ESPRMNeoUser.js';
+import { ESPRMNeoStorage } from '../../services/ESPRMNeoStorage/ESPRMNeoStorage.js';
+import { isTokenExpired } from '../../services/ESPRMNeoHelpers/CheckTokenExpiry.js';
+import { AuthErrorCodes, StorageKeys } from '../../utils/constants.js';
+import { authErrorMessages } from '../../utils/error/errorMessages.js';
+import { Logger } from '../../utils/logger.js';
+import { ESPAuthError } from '../../utils/error/ESPAuthError.js';
+
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = new Logger("GetLoggedInUser");
+/**
+ * Loads access, id, and refresh tokens from storage in one round-trip.
+ * @returns Tokens if all three exist, otherwise null.
+ */
+async function getStoredTokens() {
+    const [accessToken, idToken, refreshToken] = await Promise.all([
+        ESPRMNeoStorage.getItem(StorageKeys.ACCESSTOKEN),
+        ESPRMNeoStorage.getItem(StorageKeys.IDTOKEN),
+        ESPRMNeoStorage.getItem(StorageKeys.REFRESHTOKEN),
+    ]);
+    if (!accessToken || !idToken || !refreshToken)
+        return null;
+    return { accessToken, idToken, refreshToken };
+}
+ESPRMNeoAuth.prototype.getLoggedInUser =
+    async function () {
+        try {
+            let tokens = await getStoredTokens();
+            if (!tokens)
+                return null;
+            if (isTokenExpired(tokens.accessToken)) {
+                await ESPRMNeoUser.extendSession(tokens.refreshToken);
+                tokens = await getStoredTokens();
+                if (!tokens)
+                    return null;
+            }
+            return new ESPRMNeoUser(tokens);
+        }
+        catch (err) {
+            if (err instanceof ESPAuthError)
+                throw err;
+            const message = err instanceof Error
+                ? err.message
+                : authErrorMessages.GET_LOGGED_IN_USER_FAILED;
+            logger.debug("getLoggedInUser → Error:", message);
+            throw new ESPAuthError(AuthErrorCodes.GET_LOGGED_IN_USER_FAILED, message, err);
+        }
+    };
+//# sourceMappingURL=GetLoggedInUser.js.map

package/dist/esm/methods/ESPRMNeoAuth/GetLoggedInUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GetLoggedInUser.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}