feat(auth): preserve continuation through password-reset email links

[altaywtf]

Summary

• Password-reset continuation currently stops when the backend creates the email link.
• Add an optional, schema-validated resetUrl to forgotPassword; legacy one-argument calls continue to send only mail.

Verification

• vp run verify
• Additional targeted checks (vp run test:live, vp run test:compat, single-target live commands):
  • Live verification is deferred until the backend accepts reset_url.

Notes

forgotPassword(mail, { resetUrl }) -> mail=<mail>&reset_url=<resetUrl>

Depends on the matching backend contract; no package was published.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T21:09:14.659953Z	b104b74	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

The README wording contradicts the shown forgotPassword example (one-arg vs two-arg usage) and should be corrected to avoid misleading consumers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an optional continuation URL to password-reset requests by extending the auth.forgotPassword API with a schema-validated options object, enabling the backend to include a caller-provided reset page in password-reset emails while preserving the legacy one-argument call.

Changes:

• Introduce ForgotPasswordOptionsSchema and extend forgotPassword(mail, options?) to send reset_url when provided.
• Update auth-domain tests to cover both the legacy call and the new resetUrl option (including invalid-input rejection).
• Update promise-client adapter tests and public-surface snapshot, plus README documentation.

File summaries

File	Description
src/domains/auth.ts	Adds options schema/type and includes reset_url in the forgot-password form body when present.
src/domains/auth.spec.ts	Tests the new request body behavior and validates rejection of invalid/excess option inputs.
src/core/client.promise.spec.ts	Updates mocked auth adapter and verifies promise client supports the new optional parameter.
src/snapshots/index.spec.ts.snap	Records the new exported schema in the root public surface snapshot.
README.md	Documents the updated forgotPassword usage with the optional resetUrl.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[altaywtf]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: b104b741ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[altaywtf]

Closing after product review. The Auth rollout does not need continuation to survive the password-reset email boundary, so the optional SDK resetUrl parameter is unnecessary. The web-only reset-link redirect remains in putdotio/putio-web#1081.