@palbase/web 7.1.0 → 7.2.1

package/dist/{analytics-facade-CZIwbsvG.d.ts → analytics-facade-DLfnVVwL.d.ts}

@@ -245,6 +245,15 @@ interface PasswordChangeParams {
     current_password: string;
     new_password: string;
 }
+/**
+ * Body of POST /auth/password/set — a passwordless account's FIRST password.
+ *
+ * No current password on purpose: the accounts this serves (passkey-first,
+ * social-only) do not have one, which is why `changePassword` answers them 401.
+ */
+interface PasswordSetParams {
+    new_password: string;
+}
 interface MFAEnrollParams {
     type: 'totp' | 'email';
 }
@@ -435,6 +444,18 @@ declare class AuthClient {
     changePassword(params: PasswordChangeParams): Promise<PalbaseResponse<{
         success: boolean;
     }>>;
+    /**
+     * Give a PASSWORDLESS account its first password.
+     *
+     * Separate from `changePassword` because that one cannot serve the case: it
+     * sends a current password and palauth answers an account that has none with
+     * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+     * the same gate passkey enrollment carries); an account that already has a
+     * password gets 409 `password_already_set`.
+     */
+    setPassword(params: PasswordSetParams): Promise<PalbaseResponse<{
+        success: boolean;
+    }>>;
     refresh(): Promise<PalbaseResponse<TokenResponse>>;
     getAccessToken(): string | null;
     onTokenChange(callback: (tokens: {
@@ -1826,6 +1847,24 @@ declare class PalbeAuth {
         currentPassword: string;
         newPassword: string;
     }): Promise<void>;
+    /**
+     * Give a passwordless account its FIRST password, in-app.
+     *
+     * For accounts created with a passkey or a social provider: they have no
+     * current password, so `updatePassword` cannot serve them — it sends one and
+     * the server answers 401. Before this existed the only route was the
+     * password-RESET e-mail, which asks someone already signed in to go find
+     * their inbox.
+     *
+     * Requires a RECENT sign-in, not merely a session: a first password is a
+     * credential that outlives the rest, so the server answers 403
+     * `reauthentication_required` on a stale one — the same gate
+     * `registerPasskey` carries. An account that already has a password gets 409
+     * `password_already_set`; change it with `updatePassword` instead.
+     *
+     * The session stays valid — no re-login.
+     */
+    setPassword(newPassword: string): Promise<void>;
     verifyEmail(params: {
         token: string;
     } | {

package/dist/{analytics-facade-esr6cOBN.d.cts → analytics-facade-jyXv7Cu4.d.cts}

@@ -245,6 +245,15 @@ interface PasswordChangeParams {
     current_password: string;
     new_password: string;
 }
+/**
+ * Body of POST /auth/password/set — a passwordless account's FIRST password.
+ *
+ * No current password on purpose: the accounts this serves (passkey-first,
+ * social-only) do not have one, which is why `changePassword` answers them 401.
+ */
+interface PasswordSetParams {
+    new_password: string;
+}
 interface MFAEnrollParams {
     type: 'totp' | 'email';
 }
@@ -435,6 +444,18 @@ declare class AuthClient {
     changePassword(params: PasswordChangeParams): Promise<PalbaseResponse<{
         success: boolean;
     }>>;
+    /**
+     * Give a PASSWORDLESS account its first password.
+     *
+     * Separate from `changePassword` because that one cannot serve the case: it
+     * sends a current password and palauth answers an account that has none with
+     * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+     * the same gate passkey enrollment carries); an account that already has a
+     * password gets 409 `password_already_set`.
+     */
+    setPassword(params: PasswordSetParams): Promise<PalbaseResponse<{
+        success: boolean;
+    }>>;
     refresh(): Promise<PalbaseResponse<TokenResponse>>;
     getAccessToken(): string | null;
     onTokenChange(callback: (tokens: {
@@ -1826,6 +1847,24 @@ declare class PalbeAuth {
         currentPassword: string;
         newPassword: string;
     }): Promise<void>;
+    /**
+     * Give a passwordless account its FIRST password, in-app.
+     *
+     * For accounts created with a passkey or a social provider: they have no
+     * current password, so `updatePassword` cannot serve them — it sends one and
+     * the server answers 401. Before this existed the only route was the
+     * password-RESET e-mail, which asks someone already signed in to go find
+     * their inbox.
+     *
+     * Requires a RECENT sign-in, not merely a session: a first password is a
+     * credential that outlives the rest, so the server answers 403
+     * `reauthentication_required` on a stale one — the same gate
+     * `registerPasskey` carries. An account that already has a password gets 409
+     * `password_already_set`; change it with `updatePassword` instead.
+     *
+     * The session stays valid — no re-login.
+     */
+    setPassword(newPassword: string): Promise<void>;
     verifyEmail(params: {
         token: string;
     } | {

package/dist/{chunk-P6TWUWZC.js → chunk-GITHW5JK.js}

@@ -512,6 +512,20 @@ var AuthClient = class {
       body: params
     });
   }
+  /**
+   * Give a PASSWORDLESS account its first password.
+   *
+   * Separate from `changePassword` because that one cannot serve the case: it
+   * sends a current password and palauth answers an account that has none with
+   * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+   * the same gate passkey enrollment carries); an account that already has a
+   * password gets 409 `password_already_set`.
+   */
+  async setPassword(params) {
+    return this.httpClient.request("POST", "/auth/password/set", {
+      body: params
+    });
+  }
   // ── Token ───────────────────────────────────────────────
   async refresh() {
     const refreshToken = this.tokenManager.getRefreshToken();
@@ -1535,6 +1549,26 @@ var PalbeAuth = class {
       })
     );
   }
+  /**
+   * Give a passwordless account its FIRST password, in-app.
+   *
+   * For accounts created with a passkey or a social provider: they have no
+   * current password, so `updatePassword` cannot serve them — it sends one and
+   * the server answers 401. Before this existed the only route was the
+   * password-RESET e-mail, which asks someone already signed in to go find
+   * their inbox.
+   *
+   * Requires a RECENT sign-in, not merely a session: a first password is a
+   * credential that outlives the rest, so the server answers 403
+   * `reauthentication_required` on a stale one — the same gate
+   * `registerPasskey` carries. An account that already has a password gets 409
+   * `password_already_set`; change it with `updatePassword` instead.
+   *
+   * The session stays valid — no re-login.
+   */
+  async setPassword(newPassword) {
+    unwrap(await this.rt.authClient.setPassword({ new_password: newPassword }));
+  }
   async verifyEmail(params) {
     unwrap(await this.rt.authClient.verifyEmail(params));
   }
@@ -8839,7 +8873,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "7.1.0";
+var VERSION = "7.2.1";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9264,4 +9298,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-P6TWUWZC.js.map
+//# sourceMappingURL=chunk-GITHW5JK.js.map