@poly-x/core 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/index.cjs

@@ -715,7 +715,14 @@ const ENDPOINTS = {
 	* password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
 	* the real one. Only succeeds while the account is flagged `mustChangePassword`.
 	*/
-	setPassword: "/v1/auth/set-password"
+	setPassword: "/v1/auth/set-password",
+	/**
+	* Server-mediated self-service reset (poly-x v5 / F040). `forgotPassword` starts it
+	* — always a uniform 202, the token is emailed to the mailbox, never returned.
+	* `resetPassword` redeems that opaque token single-use and sets the new password.
+	*/
+	forgotPassword: "/v1/idp/forgot-password",
+	resetPassword: "/v1/idp/reset-password"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -769,11 +776,17 @@ function parsePasswordOutcome(status, body) {
 	};
 	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
 		type: "password_change_required",
-		userId: b.userId
+		userId: b.userId,
+		ticket: typeof b.ticket === "string" ? b.ticket : void 0
 	};
 	if (status === 403) return { type: "no_access" };
 	return { type: "invalid_credentials" };
 }
+function parseResetOutcome(status, body) {
+	if (status === 200) return "ok";
+	if (asRecord$1(body).status === "weak_password") return "weak_password";
+	return "invalid_or_expired";
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -927,11 +940,45 @@ var AuthClient = class {
 			body: {
 				userId: params.userId,
 				newPassword: params.newPassword,
-				confirmPassword: params.confirmPassword
+				confirmPassword: params.confirmPassword,
+				...params.ticket ? { ticket: params.ticket } : {}
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);
 	}
+	/**
+	* Start a server-mediated self-service reset (F040). POSTs the email + this app's
+	* publishable key; the backend resolves the account, mints a single-use token, and
+	* emails the link ITSELF — nothing comes back but a uniform 202. Resolves on success;
+	* a 4xx (e.g. a misconfigured key) surfaces as a typed error for the developer.
+	*/
+	async requestPasswordReset(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.forgotPassword,
+			body: {
+				email: params.email,
+				client_id: this.config.key.raw
+			}
+		});
+		if (response.status >= 400) throw this.toError(response);
+	}
+	/**
+	* Redeem a reset token (the opaque value from the emailed link) single-use and set
+	* the new password. Returns a typed outcome the UI branches on; only a 5xx throws.
+	*/
+	async resetPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.resetPassword,
+			body: {
+				token: params.token,
+				newPassword: params.newPassword
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parseResetOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -1030,6 +1077,7 @@ exports.normalizeRefresh = normalizeRefresh;
 exports.parseAuthorizeOutcome = parseAuthorizeOutcome;
 exports.parsePasswordOutcome = parsePasswordOutcome;
 exports.parsePolyXKey = parsePolyXKey;
+exports.parseResetOutcome = parseResetOutcome;
 exports.randomState = randomState;
 exports.redactSensitive = redactSensitive;
 exports.reduceSessionState = reduce;

package/dist/index.d.cts

@@ -398,6 +398,13 @@ declare const ENDPOINTS: {
    * the real one. Only succeeds while the account is flagged `mustChangePassword`.
    */
   readonly setPassword: "/v1/auth/set-password";
+  /**
+   * Server-mediated self-service reset (poly-x v5 / F040). `forgotPassword` starts it
+   * — always a uniform 202, the token is emailed to the mailbox, never returned.
+   * `resetPassword` redeems that opaque token single-use and sets the new password.
+   */
+  readonly forgotPassword: "/v1/idp/forgot-password";
+  readonly resetPassword: "/v1/idp/reset-password";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -447,10 +454,19 @@ type PasswordAuthOutcome = {
 } | {
   type: "password_change_required";
   userId: string;
+  ticket?: string;
 } | {
   type: "no_access";
 };
 declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
+/**
+ * The outcome of redeeming a reset token (`POST /idp/reset-password`, F040):
+ * `ok` on success, `weak_password` when it fails the platform floor, and a
+ * uniform `invalid_or_expired` for an unknown/used/expired token (the backend
+ * does not distinguish unknown from expired to the caller).
+ */
+type PasswordResetOutcome = "ok" | "weak_password" | "invalid_or_expired";
+declare function parseResetOutcome(status: number, body: unknown): PasswordResetOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -506,6 +522,12 @@ interface SetPasswordParams {
   userId: string;
   newPassword: string;
   confirmPassword: string;
+  /**
+   * Single-use proof-of-possession ticket from the `password_change_required`
+   * outcome. When present the platform trusts the ticket over `userId`; when the
+   * backend enforces tickets, it's required. Omit against older backends.
+   */
+  ticket?: string;
 }
 interface AuthorizeWithPasswordParams {
   email: string;
@@ -550,6 +572,23 @@ declare class AuthClient {
    * the proof the caller knows the temporary password.
    */
   setPassword(params: SetPasswordParams): Promise<void>;
+  /**
+   * Start a server-mediated self-service reset (F040). POSTs the email + this app's
+   * publishable key; the backend resolves the account, mints a single-use token, and
+   * emails the link ITSELF — nothing comes back but a uniform 202. Resolves on success;
+   * a 4xx (e.g. a misconfigured key) surfaces as a typed error for the developer.
+   */
+  requestPasswordReset(params: {
+    email: string;
+  }): Promise<void>;
+  /**
+   * Redeem a reset token (the opaque value from the emailed link) single-use and set
+   * the new password. Returns a typed outcome the UI branches on; only a 5xx throws.
+   */
+  resetPassword(params: {
+    token: string;
+    newPassword: string;
+  }): Promise<PasswordResetOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -568,4 +607,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.d.mts

@@ -398,6 +398,13 @@ declare const ENDPOINTS: {
    * the real one. Only succeeds while the account is flagged `mustChangePassword`.
    */
   readonly setPassword: "/v1/auth/set-password";
+  /**
+   * Server-mediated self-service reset (poly-x v5 / F040). `forgotPassword` starts it
+   * — always a uniform 202, the token is emailed to the mailbox, never returned.
+   * `resetPassword` redeems that opaque token single-use and sets the new password.
+   */
+  readonly forgotPassword: "/v1/idp/forgot-password";
+  readonly resetPassword: "/v1/idp/reset-password";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -447,10 +454,19 @@ type PasswordAuthOutcome = {
 } | {
   type: "password_change_required";
   userId: string;
+  ticket?: string;
 } | {
   type: "no_access";
 };
 declare function parsePasswordOutcome(status: number, body: unknown): PasswordAuthOutcome;
+/**
+ * The outcome of redeeming a reset token (`POST /idp/reset-password`, F040):
+ * `ok` on success, `weak_password` when it fails the platform floor, and a
+ * uniform `invalid_or_expired` for an unknown/used/expired token (the backend
+ * does not distinguish unknown from expired to the caller).
+ */
+type PasswordResetOutcome = "ok" | "weak_password" | "invalid_or_expired";
+declare function parseResetOutcome(status: number, body: unknown): PasswordResetOutcome;
 //#endregion
 //#region src/auth/normalize.d.ts
 declare function decodeJwtExp(token: string): number | null;
@@ -506,6 +522,12 @@ interface SetPasswordParams {
   userId: string;
   newPassword: string;
   confirmPassword: string;
+  /**
+   * Single-use proof-of-possession ticket from the `password_change_required`
+   * outcome. When present the platform trusts the ticket over `userId`; when the
+   * backend enforces tickets, it's required. Omit against older backends.
+   */
+  ticket?: string;
 }
 interface AuthorizeWithPasswordParams {
   email: string;
@@ -550,6 +572,23 @@ declare class AuthClient {
    * the proof the caller knows the temporary password.
    */
   setPassword(params: SetPasswordParams): Promise<void>;
+  /**
+   * Start a server-mediated self-service reset (F040). POSTs the email + this app's
+   * publishable key; the backend resolves the account, mints a single-use token, and
+   * emails the link ITSELF — nothing comes back but a uniform 202. Resolves on success;
+   * a 4xx (e.g. a misconfigured key) surfaces as a typed error for the developer.
+   */
+  requestPasswordReset(params: {
+    email: string;
+  }): Promise<void>;
+  /**
+   * Redeem a reset token (the opaque value from the emailed link) single-use and set
+   * the new password. Returns a typed outcome the UI branches on; only a 5xx throws.
+   */
+  resetPassword(params: {
+    token: string;
+    newPassword: string;
+  }): Promise<PasswordResetOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -568,4 +607,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.mjs

@@ -714,7 +714,14 @@ const ENDPOINTS = {
 	* password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
 	* the real one. Only succeeds while the account is flagged `mustChangePassword`.
 	*/
-	setPassword: "/v1/auth/set-password"
+	setPassword: "/v1/auth/set-password",
+	/**
+	* Server-mediated self-service reset (poly-x v5 / F040). `forgotPassword` starts it
+	* — always a uniform 202, the token is emailed to the mailbox, never returned.
+	* `resetPassword` redeems that opaque token single-use and sets the new password.
+	*/
+	forgotPassword: "/v1/idp/forgot-password",
+	resetPassword: "/v1/idp/reset-password"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -768,11 +775,17 @@ function parsePasswordOutcome(status, body) {
 	};
 	if (status === 403 && b.userPasswordSet === true && typeof b.userId === "string") return {
 		type: "password_change_required",
-		userId: b.userId
+		userId: b.userId,
+		ticket: typeof b.ticket === "string" ? b.ticket : void 0
 	};
 	if (status === 403) return { type: "no_access" };
 	return { type: "invalid_credentials" };
 }
+function parseResetOutcome(status, body) {
+	if (status === 200) return "ok";
+	if (asRecord$1(body).status === "weak_password") return "weak_password";
+	return "invalid_or_expired";
+}
 //#endregion
 //#region src/auth/normalize.ts
 const FALLBACK_TTL_MS = 5 * 6e4;
@@ -926,11 +939,45 @@ var AuthClient = class {
 			body: {
 				userId: params.userId,
 				newPassword: params.newPassword,
-				confirmPassword: params.confirmPassword
+				confirmPassword: params.confirmPassword,
+				...params.ticket ? { ticket: params.ticket } : {}
 			}
 		});
 		if (response.status !== 200) throw this.toError(response);
 	}
+	/**
+	* Start a server-mediated self-service reset (F040). POSTs the email + this app's
+	* publishable key; the backend resolves the account, mints a single-use token, and
+	* emails the link ITSELF — nothing comes back but a uniform 202. Resolves on success;
+	* a 4xx (e.g. a misconfigured key) surfaces as a typed error for the developer.
+	*/
+	async requestPasswordReset(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.forgotPassword,
+			body: {
+				email: params.email,
+				client_id: this.config.key.raw
+			}
+		});
+		if (response.status >= 400) throw this.toError(response);
+	}
+	/**
+	* Redeem a reset token (the opaque value from the emailed link) single-use and set
+	* the new password. Returns a typed outcome the UI branches on; only a 5xx throws.
+	*/
+	async resetPassword(params) {
+		const response = await this.transport.request({
+			method: "POST",
+			url: this.config.baseUrl + ENDPOINTS.resetPassword,
+			body: {
+				token: params.token,
+				newPassword: params.newPassword
+			}
+		});
+		if (response.status >= 500) throw this.toError(response);
+		return parseResetOutcome(response.status, response.body);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",
@@ -995,4 +1042,4 @@ var AuthClient = class {
 const PACKAGE_NAME = "@poly-x/core";
 const version = "0.0.0";
 //#endregion
-export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, FetchTransport, ForbiddenError, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, MockTransport, PACKAGE_NAME, PolyXConfigError, PolyXError, RateLimitedError, SessionEngine, SessionExpiredError, SessionRevokedError, SystemClock, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.7",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",