@proveanything/smartlinks-auth-ui 0.6.0 → 0.6.1

package/dist/index.js

@@ -11502,6 +11502,17 @@ class AuthAPI {
             throw error;
         }
     }
+    /**
+     * Complete a password reset OR accept an invite by setting the first password.
+     *
+     * The backend distinguishes the two flows via the token's `metadata.invitedBy`:
+     *  - Plain password reset → returns `{ success, message }` only.
+     *  - Invite acceptance under `verify-auto-login` → returns a full session
+     *    (`token`, `user`, `accountData`, and on native: refresh-token fields)
+     *    so the kit can log the user straight in without bouncing them to /login.
+     *
+     * See: SDK_AUTHKIT_REFRESH_TOKENS / "Invite Auto-Login" spec.
+     */
     async completePasswordReset(token, newPassword) {
         return smartlinks__namespace.authKit.completePasswordReset(this.clientId, token, newPassword);
     }
@@ -15024,9 +15035,22 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         const effectiveRedirectUrl = getRedirectUrl();
         try {
             if (resetToken && confirmPassword) {
-                // Complete password reset with token
-                await api.completePasswordReset(resetToken, emailOrPassword);
-                // Auto-login with the new password if we have the email
+                // Complete password reset (or invite acceptance) with token
+                const completeResponse = await api.completePasswordReset(resetToken, emailOrPassword);
+                // Invite acceptance under verify-auto-login: backend returns a full session.
+                // Adopt it directly — same pattern as verifyEmail / verifyMagicLink — and skip /login.
+                if (completeResponse?.token && completeResponse.user) {
+                    log.log('complete-reset returned a session (invite auto-login), adopting it');
+                    await auth.login(completeResponse.token, completeResponse.user, completeResponse.accountData, true, getExpirationFromResponse(completeResponse), completeResponse.refreshToken, completeResponse.refreshTokenExpiresAt);
+                    setAuthSuccess(true);
+                    setSuccessMessage('Welcome! Your account is ready.');
+                    onAuthSuccess(completeResponse.token, completeResponse.user, completeResponse.accountData);
+                    setResetToken(undefined);
+                    setResetEmail(undefined);
+                    return;
+                }
+                // Plain password reset: no session returned. Try auto-login with the new password
+                // if we have the email on hand.
                 if (resetEmail) {
                     try {
                         log.log('Auto-login after password reset for:', resetEmail);