@poly-x/core 0.1.0-alpha.0 → 0.1.0-alpha.2

package/dist/index.cjs

@@ -167,11 +167,21 @@ function resolveConfig(input) {
 		}
 		baseUrl = normalizeBaseUrl(input.baseUrl);
 	} else baseUrl = `https://${normalizeBaseUrl(key.host)}`;
+	let signInUrl;
+	if (input.signInUrl !== void 0) {
+		try {
+			new URL(input.signInUrl);
+		} catch {
+			throw new PolyXConfigError("The signInUrl is not a valid URL.", { code: "SIGN_IN_URL_INVALID" });
+		}
+		signInUrl = normalizeBaseUrl(input.signInUrl);
+	}
 	return {
 		key,
 		kind: key.kind,
 		env: key.env,
 		baseUrl,
+		signInUrl,
 		context
 	};
 }
@@ -737,6 +747,27 @@ function parseAuthorizeOutcome(status, body) {
 	if (statusField === "login_required" || b.code === "LOGIN_REQUIRED") return { type: "login_required" };
 	return { type: "login_required" };
 }
+function parsePasswordOutcome(status, body) {
+	const b = asRecord$1(body);
+	const statusField = typeof b.status === "string" ? b.status : void 0;
+	if (statusField === "authorized" && typeof b.code === "string") return {
+		type: "authorized",
+		code: b.code,
+		state: typeof b.state === "string" ? b.state : "",
+		redirectUri: typeof b.redirectUri === "string" ? b.redirectUri : void 0
+	};
+	if (statusField === "select_tenant") return {
+		type: "select_tenant",
+		state: typeof b.state === "string" ? b.state : "",
+		tenants: parseTenants(b.tenants)
+	};
+	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
+		type: "password_change_required",
+		userId: b.userId
+	};
+	if (status === 403) return { type: "no_access" };
+	return { type: "invalid_credentials" };
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -815,10 +846,9 @@ var AuthClient = class {
 		this.transport = options.transport;
 		this.clock = options.clock ?? new SystemClock();
 	}
-	buildAuthorizeUrl(params) {
-		const url = new URL(this.config.baseUrl + ENDPOINTS.authorize);
+	appendAuthorizeParams(url, params) {
 		url.searchParams.set("response_type", "code");
-		url.searchParams.set("client", this.config.key.raw);
+		url.searchParams.set("client_id", this.config.key.raw);
 		url.searchParams.set("redirect_uri", params.redirectUri);
 		url.searchParams.set("state", params.state);
 		url.searchParams.set("code_challenge", params.challenge);
@@ -827,6 +857,20 @@ var AuthClient = class {
 		if (params.prompt) url.searchParams.set("prompt", params.prompt);
 		return url.toString();
 	}
+	/** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
+	buildAuthorizeUrl(params) {
+		return this.appendAuthorizeParams(new URL(this.config.baseUrl + ENDPOINTS.authorize), params);
+	}
+	/**
+	* The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+	* PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+	* to `redirect_uri` with the code. Falls back to the API authorize URL when no
+	* `signInUrl` is configured (deployments where the API host serves the page).
+	*/
+	buildSignInUrl(params) {
+		if (!this.config.signInUrl) return this.buildAuthorizeUrl(params);
+		return this.appendAuthorizeParams(new URL(this.config.signInUrl), params);
+	}
 	/** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
 	async completeAuthorize(params) {
 		const response = await this.transport.request({
@@ -836,6 +880,34 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parseAuthorizeOutcome(response.status, response.body);
 	}
+	/**
+	* The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+	* email/password + PKCE. On `authorized` the caller exchanges the returned
+	* `code` (server-side, via the BFF) for a session — no redirect to a hosted
+	* login page. Creds live only for the duration of this request; the SDK never
+	* stores them. 5xx surfaces as a typed error; every other status is a typed
+	* outcome the UI branches on.
+	*/
+	async authorizeWithPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.authorize,
+			body: {
+				response_type: "code",
+				client_id: this.config.key.raw,
+				redirect_uri: params.redirectUri,
+				state: params.state,
+				code_challenge: params.challenge,
+				code_challenge_method: "S256",
+				email: params.email,
+				password: params.password,
+				...params.organizationCode ? { organizationCode: params.organizationCode } : {},
+				...params.tenantId ? { tenantId: params.tenantId } : {}
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parsePasswordOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -845,7 +917,7 @@ var AuthClient = class {
 				code: params.code,
 				code_verifier: params.codeVerifier,
 				redirect_uri: params.redirectUri,
-				client: this.config.key.raw
+				client_id: this.config.key.raw
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);
@@ -932,6 +1004,7 @@ exports.mapPlatformError = mapPlatformError;
 exports.normalizeExchange = normalizeExchange;
 exports.normalizeRefresh = normalizeRefresh;
 exports.parseAuthorizeOutcome = parseAuthorizeOutcome;
+exports.parsePasswordOutcome = parsePasswordOutcome;
 exports.parsePolyXKey = parsePolyXKey;
 exports.randomState = randomState;
 exports.redactSensitive = redactSensitive;

package/dist/index.d.cts

@@ -27,6 +27,14 @@ interface ResolveConfigInput {
   key: string;
   /** Wins over the key-embedded host. */
   baseUrl?: string;
+  /**
+   * URL of the HOSTED sign-in page (the account portal that renders the login
+   * form) — distinct from the API `baseUrl` the key encodes. The interactive
+   * sign-in popup/redirect targets this; the silent warm-hop probe still hits the
+   * API. When unset, sign-in falls back to the API's `/v1/idp/authorize` (for
+   * deployments where the API host also serves the login page).
+   */
+  signInUrl?: string;
   /** Defaults to runtime auto-detection. */
   context?: RuntimeContext;
 }
@@ -35,6 +43,8 @@ interface ResolvedConfig {
   kind: KeyKind;
   env: KeyEnv;
   baseUrl: string;
+  /** Hosted sign-in page URL (see ResolveConfigInput.signInUrl); undefined = use the API. */
+  signInUrl?: string;
   context: RuntimeContext;
 }
 declare function resolveConfig(input: ResolveConfigInput): ResolvedConfig;
@@ -411,6 +421,30 @@ type AuthorizeOutcome = {
   type: "login_required";
 };
 declare function parseAuthorizeOutcome(status: number, body: unknown): AuthorizeOutcome;
+/**
+ * Outcome of a PASSWORD authorize (`POST /idp/authorize` with credentials) — the
+ * embedded `<SignIn/>` flow. Distinguishes invalid-credentials and the
+ * must-set-password step from the membership outcomes (the GET warm-hop parser
+ * collapses those into login_required).
+ */
+type PasswordAuthOutcome = {
+  type: "authorized";
+  code: string;
+  state: string;
+  redirectUri?: string;
+} | {
+  type: "select_tenant";
+  state: string;
+  tenants: TenantOption[];
+} | {
+  type: "invalid_credentials";
+} | {
+  type: "password_change_required";
+  userId: string;
+} | {
+  type: "no_access";
+};
+declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -462,14 +496,42 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface AuthorizeWithPasswordParams {
+  email: string;
+  password: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+  organizationCode?: string;
+  /** Set on the re-attempt after the user picks a workspace (select_tenant). */
+  tenantId?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
   private readonly clock;
   constructor(options: AuthClientOptions);
+  private appendAuthorizeParams;
+  /** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
   buildAuthorizeUrl(params: BuildAuthorizeUrlParams): string;
+  /**
+   * The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+   * PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+   * to `redirect_uri` with the code. Falls back to the API authorize URL when no
+   * `signInUrl` is configured (deployments where the API host serves the page).
+   */
+  buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
+  /**
+   * The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+   * email/password + PKCE. On `authorized` the caller exchanges the returned
+   * `code` (server-side, via the BFF) for a session — no redirect to a hosted
+   * login page. Creds live only for the duration of this request; the SDK never
+   * stores them. 5xx surfaces as a typed error; every other status is a typed
+   * outcome the UI branches on.
+   */
+  authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -488,4 +550,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.d.mts

@@ -27,6 +27,14 @@ interface ResolveConfigInput {
   key: string;
   /** Wins over the key-embedded host. */
   baseUrl?: string;
+  /**
+   * URL of the HOSTED sign-in page (the account portal that renders the login
+   * form) — distinct from the API `baseUrl` the key encodes. The interactive
+   * sign-in popup/redirect targets this; the silent warm-hop probe still hits the
+   * API. When unset, sign-in falls back to the API's `/v1/idp/authorize` (for
+   * deployments where the API host also serves the login page).
+   */
+  signInUrl?: string;
   /** Defaults to runtime auto-detection. */
   context?: RuntimeContext;
 }
@@ -35,6 +43,8 @@ interface ResolvedConfig {
   kind: KeyKind;
   env: KeyEnv;
   baseUrl: string;
+  /** Hosted sign-in page URL (see ResolveConfigInput.signInUrl); undefined = use the API. */
+  signInUrl?: string;
   context: RuntimeContext;
 }
 declare function resolveConfig(input: ResolveConfigInput): ResolvedConfig;
@@ -411,6 +421,30 @@ type AuthorizeOutcome = {
   type: "login_required";
 };
 declare function parseAuthorizeOutcome(status: number, body: unknown): AuthorizeOutcome;
+/**
+ * Outcome of a PASSWORD authorize (`POST /idp/authorize` with credentials) — the
+ * embedded `<SignIn/>` flow. Distinguishes invalid-credentials and the
+ * must-set-password step from the membership outcomes (the GET warm-hop parser
+ * collapses those into login_required).
+ */
+type PasswordAuthOutcome = {
+  type: "authorized";
+  code: string;
+  state: string;
+  redirectUri?: string;
+} | {
+  type: "select_tenant";
+  state: string;
+  tenants: TenantOption[];
+} | {
+  type: "invalid_credentials";
+} | {
+  type: "password_change_required";
+  userId: string;
+} | {
+  type: "no_access";
+};
+declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -462,14 +496,42 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface AuthorizeWithPasswordParams {
+  email: string;
+  password: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+  organizationCode?: string;
+  /** Set on the re-attempt after the user picks a workspace (select_tenant). */
+  tenantId?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
   private readonly clock;
   constructor(options: AuthClientOptions);
+  private appendAuthorizeParams;
+  /** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
   buildAuthorizeUrl(params: BuildAuthorizeUrlParams): string;
+  /**
+   * The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+   * PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+   * to `redirect_uri` with the code. Falls back to the API authorize URL when no
+   * `signInUrl` is configured (deployments where the API host serves the page).
+   */
+  buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
+  /**
+   * The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+   * email/password + PKCE. On `authorized` the caller exchanges the returned
+   * `code` (server-side, via the BFF) for a session — no redirect to a hosted
+   * login page. Creds live only for the duration of this request; the SDK never
+   * stores them. 5xx surfaces as a typed error; every other status is a typed
+   * outcome the UI branches on.
+   */
+  authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -488,4 +550,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.mjs

@@ -166,11 +166,21 @@ function resolveConfig(input) {
 		}
 		baseUrl = normalizeBaseUrl(input.baseUrl);
 	} else baseUrl = `https://${normalizeBaseUrl(key.host)}`;
+	let signInUrl;
+	if (input.signInUrl !== void 0) {
+		try {
+			new URL(input.signInUrl);
+		} catch {
+			throw new PolyXConfigError("The signInUrl is not a valid URL.", { code: "SIGN_IN_URL_INVALID" });
+		}
+		signInUrl = normalizeBaseUrl(input.signInUrl);
+	}
 	return {
 		key,
 		kind: key.kind,
 		env: key.env,
 		baseUrl,
+		signInUrl,
 		context
 	};
 }
@@ -736,6 +746,27 @@ function parseAuthorizeOutcome(status, body) {
 	if (statusField === "login_required" || b.code === "LOGIN_REQUIRED") return { type: "login_required" };
 	return { type: "login_required" };
 }
+function parsePasswordOutcome(status, body) {
+	const b = asRecord$1(body);
+	const statusField = typeof b.status === "string" ? b.status : void 0;
+	if (statusField === "authorized" && typeof b.code === "string") return {
+		type: "authorized",
+		code: b.code,
+		state: typeof b.state === "string" ? b.state : "",
+		redirectUri: typeof b.redirectUri === "string" ? b.redirectUri : void 0
+	};
+	if (statusField === "select_tenant") return {
+		type: "select_tenant",
+		state: typeof b.state === "string" ? b.state : "",
+		tenants: parseTenants(b.tenants)
+	};
+	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
+		type: "password_change_required",
+		userId: b.userId
+	};
+	if (status === 403) return { type: "no_access" };
+	return { type: "invalid_credentials" };
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -814,10 +845,9 @@ var AuthClient = class {
 		this.transport = options.transport;
 		this.clock = options.clock ?? new SystemClock();
 	}
-	buildAuthorizeUrl(params) {
-		const url = new URL(this.config.baseUrl + ENDPOINTS.authorize);
+	appendAuthorizeParams(url, params) {
 		url.searchParams.set("response_type", "code");
-		url.searchParams.set("client", this.config.key.raw);
+		url.searchParams.set("client_id", this.config.key.raw);
 		url.searchParams.set("redirect_uri", params.redirectUri);
 		url.searchParams.set("state", params.state);
 		url.searchParams.set("code_challenge", params.challenge);
@@ -826,6 +856,20 @@ var AuthClient = class {
 		if (params.prompt) url.searchParams.set("prompt", params.prompt);
 		return url.toString();
 	}
+	/** The API `GET /v1/idp/authorize` URL — used for the silent warm-hop probe. */
+	buildAuthorizeUrl(params) {
+		return this.appendAuthorizeParams(new URL(this.config.baseUrl + ENDPOINTS.authorize), params);
+	}
+	/**
+	* The URL the interactive sign-in popup/redirect opens. Targets the HOSTED login
+	* PAGE (`config.signInUrl`) — which renders the form, POSTs the API, and redirects
+	* to `redirect_uri` with the code. Falls back to the API authorize URL when no
+	* `signInUrl` is configured (deployments where the API host serves the page).
+	*/
+	buildSignInUrl(params) {
+		if (!this.config.signInUrl) return this.buildAuthorizeUrl(params);
+		return this.appendAuthorizeParams(new URL(this.config.signInUrl), params);
+	}
 	/** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
 	async completeAuthorize(params) {
 		const response = await this.transport.request({
@@ -835,6 +879,34 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parseAuthorizeOutcome(response.status, response.body);
 	}
+	/**
+	* The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+	* email/password + PKCE. On `authorized` the caller exchanges the returned
+	* `code` (server-side, via the BFF) for a session — no redirect to a hosted
+	* login page. Creds live only for the duration of this request; the SDK never
+	* stores them. 5xx surfaces as a typed error; every other status is a typed
+	* outcome the UI branches on.
+	*/
+	async authorizeWithPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.authorize,
+			body: {
+				response_type: "code",
+				client_id: this.config.key.raw,
+				redirect_uri: params.redirectUri,
+				state: params.state,
+				code_challenge: params.challenge,
+				code_challenge_method: "S256",
+				email: params.email,
+				password: params.password,
+				...params.organizationCode ? { organizationCode: params.organizationCode } : {},
+				...params.tenantId ? { tenantId: params.tenantId } : {}
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parsePasswordOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -844,7 +916,7 @@ var AuthClient = class {
 				code: params.code,
 				code_verifier: params.codeVerifier,
 				redirect_uri: params.redirectUri,
-				client: this.config.key.raw
+				client_id: this.config.key.raw
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);
@@ -899,4 +971,4 @@ var AuthClient = class {
 const PACKAGE_NAME = "@poly-x/core";
 const version = "0.0.0";
 //#endregion
-export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.2",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",