@poly-x/core 0.1.0-alpha.1 → 0.1.0-alpha.3

package/dist/index.cjs

@@ -747,6 +747,27 @@ function parseAuthorizeOutcome(status, body) {
 	if (statusField === "login_required" || b.code === "LOGIN_REQUIRED") return { type: "login_required" };
 	return { type: "login_required" };
 }
+function parsePasswordOutcome(status, body) {
+	const b = asRecord$1(body);
+	const statusField = typeof b.status === "string" ? b.status : void 0;
+	if (statusField === "authorized" && typeof b.code === "string") return {
+		type: "authorized",
+		code: b.code,
+		state: typeof b.state === "string" ? b.state : "",
+		redirectUri: typeof b.redirectUri === "string" ? b.redirectUri : void 0
+	};
+	if (statusField === "select_tenant") return {
+		type: "select_tenant",
+		state: typeof b.state === "string" ? b.state : "",
+		tenants: parseTenants(b.tenants)
+	};
+	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
+		type: "password_change_required",
+		userId: b.userId
+	};
+	if (status === 403) return { type: "no_access" };
+	return { type: "invalid_credentials" };
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -859,6 +880,34 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parseAuthorizeOutcome(response.status, response.body);
 	}
+	/**
+	* The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+	* email/password + PKCE. On `authorized` the caller exchanges the returned
+	* `code` (server-side, via the BFF) for a session — no redirect to a hosted
+	* login page. Creds live only for the duration of this request; the SDK never
+	* stores them. 5xx surfaces as a typed error; every other status is a typed
+	* outcome the UI branches on.
+	*/
+	async authorizeWithPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.authorize,
+			body: {
+				response_type: "code",
+				client_id: this.config.key.raw,
+				redirect_uri: params.redirectUri,
+				state: params.state,
+				code_challenge: params.challenge,
+				code_challenge_method: "S256",
+				email: params.email,
+				password: params.password,
+				...params.organizationCode ? { organizationCode: params.organizationCode } : {},
+				...params.tenantId ? { tenantId: params.tenantId } : {}
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parsePasswordOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -955,6 +1004,7 @@ exports.mapPlatformError = mapPlatformError;
 exports.normalizeExchange = normalizeExchange;
 exports.normalizeRefresh = normalizeRefresh;
 exports.parseAuthorizeOutcome = parseAuthorizeOutcome;
+exports.parsePasswordOutcome = parsePasswordOutcome;
 exports.parsePolyXKey = parsePolyXKey;
 exports.randomState = randomState;
 exports.redactSensitive = redactSensitive;

package/dist/index.d.cts

@@ -421,6 +421,30 @@ type AuthorizeOutcome = {
   type: "login_required";
 };
 declare function parseAuthorizeOutcome(status: number, body: unknown): AuthorizeOutcome;
+/**
+ * Outcome of a PASSWORD authorize (`POST /idp/authorize` with credentials) — the
+ * embedded `<SignIn/>` flow. Distinguishes invalid-credentials and the
+ * must-set-password step from the membership outcomes (the GET warm-hop parser
+ * collapses those into login_required).
+ */
+type PasswordAuthOutcome = {
+  type: "authorized";
+  code: string;
+  state: string;
+  redirectUri?: string;
+} | {
+  type: "select_tenant";
+  state: string;
+  tenants: TenantOption[];
+} | {
+  type: "invalid_credentials";
+} | {
+  type: "password_change_required";
+  userId: string;
+} | {
+  type: "no_access";
+};
+declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -472,6 +496,16 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface AuthorizeWithPasswordParams {
+  email: string;
+  password: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+  organizationCode?: string;
+  /** Set on the re-attempt after the user picks a workspace (select_tenant). */
+  tenantId?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
@@ -489,6 +523,15 @@ declare class AuthClient {
   buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
+  /**
+   * The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+   * email/password + PKCE. On `authorized` the caller exchanges the returned
+   * `code` (server-side, via the BFF) for a session — no redirect to a hosted
+   * login page. Creds live only for the duration of this request; the SDK never
+   * stores them. 5xx surfaces as a typed error; every other status is a typed
+   * outcome the UI branches on.
+   */
+  authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -507,4 +550,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.d.mts

@@ -421,6 +421,30 @@ type AuthorizeOutcome = {
   type: "login_required";
 };
 declare function parseAuthorizeOutcome(status: number, body: unknown): AuthorizeOutcome;
+/**
+ * Outcome of a PASSWORD authorize (`POST /idp/authorize` with credentials) — the
+ * embedded `<SignIn/>` flow. Distinguishes invalid-credentials and the
+ * must-set-password step from the membership outcomes (the GET warm-hop parser
+ * collapses those into login_required).
+ */
+type PasswordAuthOutcome = {
+  type: "authorized";
+  code: string;
+  state: string;
+  redirectUri?: string;
+} | {
+  type: "select_tenant";
+  state: string;
+  tenants: TenantOption[];
+} | {
+  type: "invalid_credentials";
+} | {
+  type: "password_change_required";
+  userId: string;
+} | {
+  type: "no_access";
+};
+declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -472,6 +496,16 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface AuthorizeWithPasswordParams {
+  email: string;
+  password: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+  organizationCode?: string;
+  /** Set on the re-attempt after the user picks a workspace (select_tenant). */
+  tenantId?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
@@ -489,6 +523,15 @@ declare class AuthClient {
   buildSignInUrl(params: BuildAuthorizeUrlParams): string;
   /** Probe the warm hop (GET /idp/authorize) and return the typed outcome. */
   completeAuthorize(params: BuildAuthorizeUrlParams): Promise<AuthorizeOutcome>;
+  /**
+   * The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+   * email/password + PKCE. On `authorized` the caller exchanges the returned
+   * `code` (server-side, via the BFF) for a session — no redirect to a hosted
+   * login page. Creds live only for the duration of this request; the SDK never
+   * stores them. 5xx surfaces as a typed error; every other status is a typed
+   * outcome the UI branches on.
+   */
+  authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -507,4 +550,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.mjs

@@ -746,6 +746,27 @@ function parseAuthorizeOutcome(status, body) {
 	if (statusField === "login_required" || b.code === "LOGIN_REQUIRED") return { type: "login_required" };
 	return { type: "login_required" };
 }
+function parsePasswordOutcome(status, body) {
+	const b = asRecord$1(body);
+	const statusField = typeof b.status === "string" ? b.status : void 0;
+	if (statusField === "authorized" && typeof b.code === "string") return {
+		type: "authorized",
+		code: b.code,
+		state: typeof b.state === "string" ? b.state : "",
+		redirectUri: typeof b.redirectUri === "string" ? b.redirectUri : void 0
+	};
+	if (statusField === "select_tenant") return {
+		type: "select_tenant",
+		state: typeof b.state === "string" ? b.state : "",
+		tenants: parseTenants(b.tenants)
+	};
+	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
+		type: "password_change_required",
+		userId: b.userId
+	};
+	if (status === 403) return { type: "no_access" };
+	return { type: "invalid_credentials" };
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -858,6 +879,34 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parseAuthorizeOutcome(response.status, response.body);
 	}
+	/**
+	* The embedded `<SignIn/>` credential flow (D2b): POST `/idp/authorize` with
+	* email/password + PKCE. On `authorized` the caller exchanges the returned
+	* `code` (server-side, via the BFF) for a session — no redirect to a hosted
+	* login page. Creds live only for the duration of this request; the SDK never
+	* stores them. 5xx surfaces as a typed error; every other status is a typed
+	* outcome the UI branches on.
+	*/
+	async authorizeWithPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.authorize,
+			body: {
+				response_type: "code",
+				client_id: this.config.key.raw,
+				redirect_uri: params.redirectUri,
+				state: params.state,
+				code_challenge: params.challenge,
+				code_challenge_method: "S256",
+				email: params.email,
+				password: params.password,
+				...params.organizationCode ? { organizationCode: params.organizationCode } : {},
+				...params.tenantId ? { tenantId: params.tenantId } : {}
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parsePasswordOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -922,4 +971,4 @@ var AuthClient = class {
 const PACKAGE_NAME = "@poly-x/core";
 const version = "0.0.0";
 //#endregion
-export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.3",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",