@poly-x/core 0.1.0-alpha.0 → 0.1.0-alpha.1

package/dist/index.cjs

@@ -167,11 +167,21 @@ function resolveConfig(input) {
 		}
 		baseUrl = normalizeBaseUrl(input.baseUrl);
 	} else baseUrl = `https://${normalizeBaseUrl(key.host)}`;
+	let signInUrl;
+	if (input.signInUrl !== void 0) {
+		try {
+			new URL(input.signInUrl);
+		} catch {
+			throw new PolyXConfigError("The signInUrl is not a valid URL.", { code: "SIGN_IN_URL_INVALID" });
+		}
+		signInUrl = normalizeBaseUrl(input.signInUrl);
+	}
 	return {
 		key,
 		kind: key.kind,
 		env: key.env,
 		baseUrl,
+		signInUrl,
 		context
 	};
 }
@@ -815,10 +825,9 @@ var AuthClient = class {
 		this.transport = options.transport;
 		this.clock = options.clock ?? new SystemClock();
 	}
-	buildAuthorizeUrl(params) {
-		const url = new URL(this.config.baseUrl + ENDPOINTS.authorize);
+	appendAuthorizeParams(url, params) {
 		url.searchParams.set("response_type", "code");
-		url.searchParams.set("client", this.config.key.raw);
+		url.searchParams.set("client_id", this.config.key.raw);
 		url.searchParams.set("redirect_uri", params.redirectUri);
 		url.searchParams.set("state", params.state);
 		url.searchParams.set("code_challenge", params.challenge);
@@ -827,6 +836,20 @@ var AuthClient = class {
 		if (params.prompt) url.searchParams.set("prompt", params.prompt);
 		return url.toString();
 	}
+	/** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
+	buildAuthorizeUrl(params) {
+		return this.appendAuthorizeParams(new URL(this.config.baseUrl + ENDPOINTS.authorize), params);
+	}
+	/**
+	* The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+	* PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+	* to `redirect_uri` with the code. Falls back to the API authorize URL when no
+	* `signInUrl` is configured (deployments where the API host serves the page).
+	*/
+	buildSignInUrl(params) {
+		if (!this.config.signInUrl) return this.buildAuthorizeUrl(params);
+		return this.appendAuthorizeParams(new URL(this.config.signInUrl), params);
+	}
 	/** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
 	async completeAuthorize(params) {
 		const response = await this.transport.request({
@@ -845,7 +868,7 @@ var AuthClient = class {
 				code: params.code,
 				code_verifier: params.codeVerifier,
 				redirect_uri: params.redirectUri,
-				client: this.config.key.raw
+				client_id: this.config.key.raw
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);

package/dist/index.d.cts

@@ -27,6 +27,14 @@ interface ResolveConfigInput {
   key: string;
   /** Wins over the key-embedded host. */
   baseUrl?: string;
+  /**
+   * URL of the HOSTED sign-in page (the account portal that renders the login
+   * form) — distinct from the API `baseUrl` the key encodes. The interactive
+   * sign-in popup/redirect targets this; the silent warm-hop probe still hits the
+   * API. When unset, sign-in falls back to the API's `/v1/idp/authorize` (for
+   * deployments where the API host also serves the login page).
+   */
+  signInUrl?: string;
   /** Defaults to runtime auto-detection. */
   context?: RuntimeContext;
 }
@@ -35,6 +43,8 @@ interface ResolvedConfig {
   kind: KeyKind;
   env: KeyEnv;
   baseUrl: string;
+  /** Hosted sign-in page URL (see ResolveConfigInput.signInUrl); undefined = use the API. */
+  signInUrl?: string;
   context: RuntimeContext;
 }
 declare function resolveConfig(input: ResolveConfigInput): ResolvedConfig;
@@ -467,7 +477,16 @@ declare class AuthClient {
   private readonly transport;
   private readonly clock;
   constructor(options: AuthClientOptions);
+  private appendAuthorizeParams;
+  /** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
   buildAuthorizeUrl(params: BuildAuthorizeUrlParams): string;
+  /**
+   * The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+   * PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+   * to `redirect_uri` with the code. Falls back to the API authorize URL when no
+   * `signInUrl` is configured (deployments where the API host serves the page).
+   */
+  buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;

package/dist/index.d.mts

@@ -27,6 +27,14 @@ interface ResolveConfigInput {
   key: string;
   /** Wins over the key-embedded host. */
   baseUrl?: string;
+  /**
+   * URL of the HOSTED sign-in page (the account portal that renders the login
+   * form) — distinct from the API `baseUrl` the key encodes. The interactive
+   * sign-in popup/redirect targets this; the silent warm-hop probe still hits the
+   * API. When unset, sign-in falls back to the API's `/v1/idp/authorize` (for
+   * deployments where the API host also serves the login page).
+   */
+  signInUrl?: string;
   /** Defaults to runtime auto-detection. */
   context?: RuntimeContext;
 }
@@ -35,6 +43,8 @@ interface ResolvedConfig {
   kind: KeyKind;
   env: KeyEnv;
   baseUrl: string;
+  /** Hosted sign-in page URL (see ResolveConfigInput.signInUrl); undefined = use the API. */
+  signInUrl?: string;
   context: RuntimeContext;
 }
 declare function resolveConfig(input: ResolveConfigInput): ResolvedConfig;
@@ -467,7 +477,16 @@ declare class AuthClient {
   private readonly transport;
   private readonly clock;
   constructor(options: AuthClientOptions);
+  private appendAuthorizeParams;
+  /** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
   buildAuthorizeUrl(params: BuildAuthorizeUrlParams): string;
+  /**
+   * The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+   * PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+   * to `redirect_uri` with the code. Falls back to the API authorize URL when no
+   * `signInUrl` is configured (deployments where the API host serves the page).
+   */
+  buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;

package/dist/index.mjs

@@ -166,11 +166,21 @@ function resolveConfig(input) {
 		}
 		baseUrl = normalizeBaseUrl(input.baseUrl);
 	} else baseUrl = `https://${normalizeBaseUrl(key.host)}`;
+	let signInUrl;
+	if (input.signInUrl !== void 0) {
+		try {
+			new URL(input.signInUrl);
+		} catch {
+			throw new PolyXConfigError("The signInUrl is not a valid URL.", { code: "SIGN_IN_URL_INVALID" });
+		}
+		signInUrl = normalizeBaseUrl(input.signInUrl);
+	}
 	return {
 		key,
 		kind: key.kind,
 		env: key.env,
 		baseUrl,
+		signInUrl,
 		context
 	};
 }
@@ -814,10 +824,9 @@ var AuthClient = class {
 		this.transport = options.transport;
 		this.clock = options.clock ?? new SystemClock();
 	}
-	buildAuthorizeUrl(params) {
-		const url = new URL(this.config.baseUrl + ENDPOINTS.authorize);
+	appendAuthorizeParams(url, params) {
 		url.searchParams.set("response_type", "code");
-		url.searchParams.set("client", this.config.key.raw);
+		url.searchParams.set("client_id", this.config.key.raw);
 		url.searchParams.set("redirect_uri", params.redirectUri);
 		url.searchParams.set("state", params.state);
 		url.searchParams.set("code_challenge", params.challenge);
@@ -826,6 +835,20 @@ var AuthClient = class {
 		if (params.prompt) url.searchParams.set("prompt", params.prompt);
 		return url.toString();
 	}
+	/** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
+	buildAuthorizeUrl(params) {
+		return this.appendAuthorizeParams(new URL(this.config.baseUrl + ENDPOINTS.authorize), params);
+	}
+	/**
+	* The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+	* PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+	* to `redirect_uri` with the code. Falls back to the API authorize URL when no
+	* `signInUrl` is configured (deployments where the API host serves the page).
+	*/
+	buildSignInUrl(params) {
+		if (!this.config.signInUrl) return this.buildAuthorizeUrl(params);
+		return this.appendAuthorizeParams(new URL(this.config.signInUrl), params);
+	}
 	/** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
 	async completeAuthorize(params) {
 		const response = await this.transport.request({
@@ -844,7 +867,7 @@ var AuthClient = class {
 				code: params.code,
 				code_verifier: params.codeVerifier,
 				redirect_uri: params.redirectUri,
-				client: this.config.key.raw
+				client_id: this.config.key.raw
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.1",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",