@palbase/web 7.0.0 → 7.2.0

package/dist/{analytics-facade-CdTK9Y0s.d.ts → analytics-facade-DLfnVVwL.d.ts}

@@ -245,6 +245,15 @@ interface PasswordChangeParams {
     current_password: string;
     new_password: string;
 }
+/**
+ * Body of POST /auth/password/set — a passwordless account's FIRST password.
+ *
+ * No current password on purpose: the accounts this serves (passkey-first,
+ * social-only) do not have one, which is why `changePassword` answers them 401.
+ */
+interface PasswordSetParams {
+    new_password: string;
+}
 interface MFAEnrollParams {
     type: 'totp' | 'email';
 }
@@ -435,6 +444,18 @@ declare class AuthClient {
     changePassword(params: PasswordChangeParams): Promise<PalbaseResponse<{
         success: boolean;
     }>>;
+    /**
+     * Give a PASSWORDLESS account its first password.
+     *
+     * Separate from `changePassword` because that one cannot serve the case: it
+     * sends a current password and palauth answers an account that has none with
+     * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+     * the same gate passkey enrollment carries); an account that already has a
+     * password gets 409 `password_already_set`.
+     */
+    setPassword(params: PasswordSetParams): Promise<PalbaseResponse<{
+        success: boolean;
+    }>>;
     refresh(): Promise<PalbaseResponse<TokenResponse>>;
     getAccessToken(): string | null;
     onTokenChange(callback: (tokens: {
@@ -1826,6 +1847,24 @@ declare class PalbeAuth {
         currentPassword: string;
         newPassword: string;
     }): Promise<void>;
+    /**
+     * Give a passwordless account its FIRST password, in-app.
+     *
+     * For accounts created with a passkey or a social provider: they have no
+     * current password, so `updatePassword` cannot serve them — it sends one and
+     * the server answers 401. Before this existed the only route was the
+     * password-RESET e-mail, which asks someone already signed in to go find
+     * their inbox.
+     *
+     * Requires a RECENT sign-in, not merely a session: a first password is a
+     * credential that outlives the rest, so the server answers 403
+     * `reauthentication_required` on a stale one — the same gate
+     * `registerPasskey` carries. An account that already has a password gets 409
+     * `password_already_set`; change it with `updatePassword` instead.
+     *
+     * The session stays valid — no re-login.
+     */
+    setPassword(newPassword: string): Promise<void>;
     verifyEmail(params: {
         token: string;
     } | {
@@ -1839,6 +1878,29 @@ declare class PalbeAuth {
         provider: string;
         credential: string;
     }): Promise<AuthSuccess>;
+    /**
+     * Sign in with a passkey stored for this Environment. No identifier is typed:
+     * the browser lists the accounts it holds and the user picks one.
+     *
+     * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+     * first and keep a password or e-mail path beside the button.
+     */
+    signInWithPasskey(): Promise<AuthSuccess>;
+    /**
+     * Create an account whose only credential is a passkey — the e-mail is the
+     * identifier, the passkey is the credential, and no password ever exists.
+     */
+    signUpWithPasskey(email: string, displayName?: string): Promise<AuthSuccess>;
+    /**
+     * Add a passkey to the signed-in account, so the next sign-in is one tap.
+     *
+     * Rejects with a 403 `reauthentication_required` when the session is not
+     * recent: a passkey outlives a password reset, so enrolling one takes more
+     * than a valid session.
+     */
+    registerPasskey(name?: string): Promise<void>;
+    /** Whether this browser can run a passkey ceremony at all. */
+    get passkeysSupported(): boolean;
     signInWithOAuth(params: {
         provider: string;
         redirectTo?: string;

package/dist/{analytics-facade-TB-D4ww8.d.cts → analytics-facade-jyXv7Cu4.d.cts}

@@ -245,6 +245,15 @@ interface PasswordChangeParams {
     current_password: string;
     new_password: string;
 }
+/**
+ * Body of POST /auth/password/set — a passwordless account's FIRST password.
+ *
+ * No current password on purpose: the accounts this serves (passkey-first,
+ * social-only) do not have one, which is why `changePassword` answers them 401.
+ */
+interface PasswordSetParams {
+    new_password: string;
+}
 interface MFAEnrollParams {
     type: 'totp' | 'email';
 }
@@ -435,6 +444,18 @@ declare class AuthClient {
     changePassword(params: PasswordChangeParams): Promise<PalbaseResponse<{
         success: boolean;
     }>>;
+    /**
+     * Give a PASSWORDLESS account its first password.
+     *
+     * Separate from `changePassword` because that one cannot serve the case: it
+     * sends a current password and palauth answers an account that has none with
+     * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+     * the same gate passkey enrollment carries); an account that already has a
+     * password gets 409 `password_already_set`.
+     */
+    setPassword(params: PasswordSetParams): Promise<PalbaseResponse<{
+        success: boolean;
+    }>>;
     refresh(): Promise<PalbaseResponse<TokenResponse>>;
     getAccessToken(): string | null;
     onTokenChange(callback: (tokens: {
@@ -1826,6 +1847,24 @@ declare class PalbeAuth {
         currentPassword: string;
         newPassword: string;
     }): Promise<void>;
+    /**
+     * Give a passwordless account its FIRST password, in-app.
+     *
+     * For accounts created with a passkey or a social provider: they have no
+     * current password, so `updatePassword` cannot serve them — it sends one and
+     * the server answers 401. Before this existed the only route was the
+     * password-RESET e-mail, which asks someone already signed in to go find
+     * their inbox.
+     *
+     * Requires a RECENT sign-in, not merely a session: a first password is a
+     * credential that outlives the rest, so the server answers 403
+     * `reauthentication_required` on a stale one — the same gate
+     * `registerPasskey` carries. An account that already has a password gets 409
+     * `password_already_set`; change it with `updatePassword` instead.
+     *
+     * The session stays valid — no re-login.
+     */
+    setPassword(newPassword: string): Promise<void>;
     verifyEmail(params: {
         token: string;
     } | {
@@ -1839,6 +1878,29 @@ declare class PalbeAuth {
         provider: string;
         credential: string;
     }): Promise<AuthSuccess>;
+    /**
+     * Sign in with a passkey stored for this Environment. No identifier is typed:
+     * the browser lists the accounts it holds and the user picks one.
+     *
+     * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+     * first and keep a password or e-mail path beside the button.
+     */
+    signInWithPasskey(): Promise<AuthSuccess>;
+    /**
+     * Create an account whose only credential is a passkey — the e-mail is the
+     * identifier, the passkey is the credential, and no password ever exists.
+     */
+    signUpWithPasskey(email: string, displayName?: string): Promise<AuthSuccess>;
+    /**
+     * Add a passkey to the signed-in account, so the next sign-in is one tap.
+     *
+     * Rejects with a 403 `reauthentication_required` when the session is not
+     * recent: a passkey outlives a password reset, so enrolling one takes more
+     * than a valid session.
+     */
+    registerPasskey(name?: string): Promise<void>;
+    /** Whether this browser can run a passkey ceremony at all. */
+    get passkeysSupported(): boolean;
     signInWithOAuth(params: {
         provider: string;
         redirectTo?: string;

package/dist/{chunk-7SNSLY5M.js → chunk-VXQUBBHG.js}

@@ -512,6 +512,20 @@ var AuthClient = class {
       body: params
     });
   }
+  /**
+   * Give a PASSWORDLESS account its first password.
+   *
+   * Separate from `changePassword` because that one cannot serve the case: it
+   * sends a current password and palauth answers an account that has none with
+   * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+   * the same gate passkey enrollment carries); an account that already has a
+   * password gets 409 `password_already_set`.
+   */
+  async setPassword(params) {
+    return this.httpClient.request("POST", "/auth/password/set", {
+      body: params
+    });
+  }
   // ── Token ───────────────────────────────────────────────
   async refresh() {
     const refreshToken = this.tokenManager.getRefreshToken();
@@ -1048,6 +1062,162 @@ function asWireAuthResult(raw) {
   return raw;
 }
 
+// src/passkey.ts
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded.padEnd(padded.length + (4 - padded.length % 4) % 4, "="));
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function bytesToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function requireString(source, key) {
+  const value = source[key];
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`passkey options are missing ${key}`);
+  }
+  return value;
+}
+function toCreationOptions(publicKey) {
+  const rp = publicKey.rp;
+  const user = publicKey.user;
+  if (!user?.id) {
+    throw new Error("passkey options carry no user id \u2014 the credential would be unusable");
+  }
+  const excludeCredentials = Array.isArray(publicKey.excludeCredentials) ? publicKey.excludeCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rp: { id: rp?.id, name: rp?.name ?? rp?.id ?? "" },
+    user: {
+      id: base64UrlToBytes(user.id),
+      name: user.name ?? "",
+      displayName: user.displayName ?? user.name ?? ""
+    },
+    pubKeyCredParams: publicKey.pubKeyCredParams ?? [],
+    authenticatorSelection: publicKey.authenticatorSelection,
+    timeout: publicKey.timeout,
+    attestation: publicKey.attestation,
+    excludeCredentials
+  };
+}
+function toRequestOptions(publicKey) {
+  const allowCredentials = Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rpId: publicKey.rpId,
+    timeout: publicKey.timeout,
+    userVerification: publicKey.userVerification,
+    allowCredentials
+  };
+}
+function attestationToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      attestationObject: bytesToBase64Url(response.attestationObject)
+    }
+  };
+}
+function assertionToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      authenticatorData: bytesToBase64Url(response.authenticatorData),
+      signature: bytesToBase64Url(response.signature),
+      // The user handle is how palauth resolves WHO signed in on a discoverable
+      // login — there is no identifier in the request.
+      userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null
+    }
+  };
+}
+function isPasskeySupported() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && navigator.credentials !== void 0;
+}
+function ensureSupported() {
+  if (!isPasskeySupported()) {
+    throw new Error("This browser cannot use passkeys \u2014 offer a password or e-mail sign-in");
+  }
+}
+async function createCredential(publicKey) {
+  const credential = await navigator.credentials.create({
+    publicKey: toCreationOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function getCredential(publicKey) {
+  const credential = await navigator.credentials.get({
+    publicKey: toRequestOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function passkeySignIn(rt) {
+  ensureSupported();
+  const envelope = await palbeRequest(rt, "POST", "/auth/webauthn/login/begin", {
+    body: {}
+  });
+  const credential = await getCredential(envelope.options.publicKey);
+  const raw = await palbeRequest(rt, "POST", "/auth/webauthn/login/finish", {
+    body: assertionToJSON(credential)
+  });
+  const result = asWireAuthResult(raw);
+  if (result === null) {
+    throw new Error("passkey sign-in returned an unusable session");
+  }
+  return result;
+}
+async function passkeySignUp(rt, email, displayName) {
+  ensureSupported();
+  const begun = await palbeRequest(rt, "POST", "/auth/webauthn/signup/begin", {
+    body: { email, user_name: displayName }
+  });
+  const credential = await createCredential(begun.options.publicKey);
+  await palbeRequest(
+    rt,
+    "POST",
+    `/auth/webauthn/signup/finish?user_id=${encodeURIComponent(begun.user_id)}`,
+    { body: attestationToJSON(credential) }
+  );
+  return await passkeySignIn(rt);
+}
+async function passkeyRegister(rt, name) {
+  ensureSupported();
+  const envelope = await palbeRequest(
+    rt,
+    "POST",
+    "/auth/webauthn/register/begin",
+    { body: { name } }
+  );
+  const credential = await createCredential(envelope.options.publicKey);
+  await palbeRequest(rt, "POST", "/auth/webauthn/register/finish", {
+    body: attestationToJSON(credential)
+  });
+}
+
 // src/auth-facade.ts
 function mapWireUser(raw) {
   return {
@@ -1379,6 +1549,26 @@ var PalbeAuth = class {
       })
     );
   }
+  /**
+   * Give a passwordless account its FIRST password, in-app.
+   *
+   * For accounts created with a passkey or a social provider: they have no
+   * current password, so `updatePassword` cannot serve them — it sends one and
+   * the server answers 401. Before this existed the only route was the
+   * password-RESET e-mail, which asks someone already signed in to go find
+   * their inbox.
+   *
+   * Requires a RECENT sign-in, not merely a session: a first password is a
+   * credential that outlives the rest, so the server answers 403
+   * `reauthentication_required` on a stale one — the same gate
+   * `registerPasskey` carries. An account that already has a password gets 409
+   * `password_already_set`; change it with `updatePassword` instead.
+   *
+   * The session stays valid — no re-login.
+   */
+  async setPassword(newPassword) {
+    unwrap(await this.rt.authClient.setPassword({ new_password: newPassword }));
+  }
   async verifyEmail(params) {
     unwrap(await this.rt.authClient.verifyEmail(params));
   }
@@ -1402,6 +1592,39 @@ var PalbeAuth = class {
       return this.adopt(data);
     });
   }
+  /**
+   * Sign in with a passkey stored for this Environment. No identifier is typed:
+   * the browser lists the accounts it holds and the user picks one.
+   *
+   * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+   * first and keep a password or e-mail path beside the button.
+   */
+  async signInWithPasskey() {
+    return this.withSigningIn(async () => this.adoptWire(await passkeySignIn(this.rt)));
+  }
+  /**
+   * Create an account whose only credential is a passkey — the e-mail is the
+   * identifier, the passkey is the credential, and no password ever exists.
+   */
+  async signUpWithPasskey(email, displayName) {
+    return this.withSigningIn(
+      async () => this.adoptWire(await passkeySignUp(this.rt, email, displayName))
+    );
+  }
+  /**
+   * Add a passkey to the signed-in account, so the next sign-in is one tap.
+   *
+   * Rejects with a 403 `reauthentication_required` when the session is not
+   * recent: a passkey outlives a password reset, so enrolling one takes more
+   * than a valid session.
+   */
+  async registerPasskey(name) {
+    await passkeyRegister(this.rt, name);
+  }
+  /** Whether this browser can run a passkey ceremony at all. */
+  get passkeysSupported() {
+    return isPasskeySupported();
+  }
   async signInWithOAuth(params) {
     const { redirect = true, ...opts } = params;
     const { url } = unwrap(await this.rt.authClient.getOAuthURL(opts));
@@ -8650,7 +8873,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "7.0.0";
+var VERSION = "7.2.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9075,4 +9298,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-7SNSLY5M.js.map
+//# sourceMappingURL=chunk-VXQUBBHG.js.map