@poly-x/core 0.1.0-alpha.7 → 0.1.0-alpha.9

package/dist/index.cjs

@@ -722,7 +722,13 @@ const ENDPOINTS = {
 	* `resetPassword` redeems that opaque token single-use and sets the new password.
 	*/
 	forgotPassword: "/v1/idp/forgot-password",
-	resetPassword: "/v1/idp/reset-password"
+	resetPassword: "/v1/idp/reset-password",
+	/**
+	* Public, pk_-scoped login-page branding (F037 / FR-BRND). GET with `client_id`
+	* (+ optional `organizationCode`) → the bounded `{ tokens }` set. Never 5xx's /
+	* never blocks login; the SDK falls back to its built-in defaults on any failure.
+	*/
+	branding: "/v1/idp/branding"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -994,6 +1000,27 @@ var AuthClient = class {
 		if (response.status !== 200) throw this.toError(response);
 		return normalizeExchange(response.body, this.clock.now());
 	}
+	/**
+	* Fetch this app's login-page branding (public, pk_-scoped). NEVER throws and never
+	* blocks the sign-in form: any non-200, malformed body, or network failure resolves
+	* to an empty token set so the caller keeps its built-in defaults (FR-BRND-3).
+	*/
+	async fetchBranding(params = {}) {
+		try {
+			const url = new URL(this.config.baseUrl + ENDPOINTS.branding);
+			url.searchParams.set("client_id", this.config.key.raw);
+			if (params.organizationCode) url.searchParams.set("organizationCode", params.organizationCode);
+			const response = await this.transport.request({
+				method: "GET",
+				url: url.toString()
+			});
+			if (response.status !== 200) return {};
+			const tokens = response.body?.tokens;
+			return tokens && typeof tokens === "object" ? tokens : {};
+		} catch {
+			return {};
+		}
+	}
 	/** The `RefreshTokens` function the SessionEngine (F003) injects. */
 	createRefresher() {
 		return async (current) => {

package/dist/index.d.cts

@@ -405,6 +405,12 @@ declare const ENDPOINTS: {
    */
   readonly forgotPassword: "/v1/idp/forgot-password";
   readonly resetPassword: "/v1/idp/reset-password";
+  /**
+   * Public, pk_-scoped login-page branding (F037 / FR-BRND). GET with `client_id`
+   * (+ optional `organizationCode`) → the bounded `{ tokens }` set. Never 5xx's /
+   * never blocks login; the SDK falls back to its built-in defaults on any failure.
+   */
+  readonly branding: "/v1/idp/branding";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -539,6 +545,17 @@ interface AuthorizeWithPasswordParams {
   /** Set on the re-attempt after the user picks a workspace (select_tenant). */
   tenantId?: string;
 }
+/** The bounded login-page branding token set (FR-BRND-1). Every field is optional. */
+interface BrandingTokens {
+  displayName?: string;
+  logoUrl?: string;
+  primaryColor?: string;
+  backgroundColor?: string;
+}
+interface FetchBrandingParams {
+  /** Refine app-level branding with an org's when the org is already known. */
+  organizationCode?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
@@ -590,6 +607,12 @@ declare class AuthClient {
     newPassword: string;
   }): Promise<PasswordResetOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
+  /**
+   * Fetch this app's login-page branding (public, pk_-scoped). NEVER throws and never
+   * blocks the sign-in form: any non-200, malformed body, or network failure resolves
+   * to an empty token set so the caller keeps its built-in defaults (FR-BRND-3).
+   */
+  fetchBranding(params?: FetchBrandingParams): Promise<BrandingTokens>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
   logout(scope?: "device" | "everywhere"): Promise<void>;
@@ -607,4 +630,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BrandingTokens, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, type FetchBrandingParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.d.mts

@@ -405,6 +405,12 @@ declare const ENDPOINTS: {
    */
   readonly forgotPassword: "/v1/idp/forgot-password";
   readonly resetPassword: "/v1/idp/reset-password";
+  /**
+   * Public, pk_-scoped login-page branding (F037 / FR-BRND). GET with `client_id`
+   * (+ optional `organizationCode`) → the bounded `{ tokens }` set. Never 5xx's /
+   * never blocks login; the SDK falls back to its built-in defaults on any failure.
+   */
+  readonly branding: "/v1/idp/branding";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -539,6 +545,17 @@ interface AuthorizeWithPasswordParams {
   /** Set on the re-attempt after the user picks a workspace (select_tenant). */
   tenantId?: string;
 }
+/** The bounded login-page branding token set (FR-BRND-1). Every field is optional. */
+interface BrandingTokens {
+  displayName?: string;
+  logoUrl?: string;
+  primaryColor?: string;
+  backgroundColor?: string;
+}
+interface FetchBrandingParams {
+  /** Refine app-level branding with an org's when the org is already known. */
+  organizationCode?: string;
+}
 declare class AuthClient {
   private readonly config;
   private readonly transport;
@@ -590,6 +607,12 @@ declare class AuthClient {
     newPassword: string;
   }): Promise<PasswordResetOutcome>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
+  /**
+   * Fetch this app's login-page branding (public, pk_-scoped). NEVER throws and never
+   * blocks the sign-in form: any non-200, malformed body, or network failure resolves
+   * to an empty token set so the caller keeps its built-in defaults (FR-BRND-3).
+   */
+  fetchBranding(params?: FetchBrandingParams): Promise<BrandingTokens>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
   logout(scope?: "device" | "everywhere"): Promise<void>;
@@ -607,4 +630,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BrandingTokens, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, type FetchBrandingParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PasswordResetOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, parseResetOutcome, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.mjs

@@ -721,7 +721,13 @@ const ENDPOINTS = {
 	* `resetPassword` redeems that opaque token single-use and sets the new password.
 	*/
 	forgotPassword: "/v1/idp/forgot-password",
-	resetPassword: "/v1/idp/reset-password"
+	resetPassword: "/v1/idp/reset-password",
+	/**
+	* Public, pk_-scoped login-page branding (F037 / FR-BRND). GET with `client_id`
+	* (+ optional `organizationCode`) → the bounded `{ tokens }` set. Never 5xx's /
+	* never blocks login; the SDK falls back to its built-in defaults on any failure.
+	*/
+	branding: "/v1/idp/branding"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -993,6 +999,27 @@ var AuthClient = class {
 		if (response.status !== 200) throw this.toError(response);
 		return normalizeExchange(response.body, this.clock.now());
 	}
+	/**
+	* Fetch this app's login-page branding (public, pk_-scoped). NEVER throws and never
+	* blocks the sign-in form: any non-200, malformed body, or network failure resolves
+	* to an empty token set so the caller keeps its built-in defaults (FR-BRND-3).
+	*/
+	async fetchBranding(params = {}) {
+		try {
+			const url = new URL(this.config.baseUrl + ENDPOINTS.branding);
+			url.searchParams.set("client_id", this.config.key.raw);
+			if (params.organizationCode) url.searchParams.set("organizationCode", params.organizationCode);
+			const response = await this.transport.request({
+				method: "GET",
+				url: url.toString()
+			});
+			if (response.status !== 200) return {};
+			const tokens = response.body?.tokens;
+			return tokens && typeof tokens === "object" ? tokens : {};
+		} catch {
+			return {};
+		}
+	}
 	/** The `RefreshTokens` function the SessionEngine (F003) injects. */
 	createRefresher() {
 		return async (current) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.9",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",