feat: changePassword + useLukkChangePassword

[stsepelin]

Client support for lukk's new POST /auth/password (stsepelin/lukk#27), so the feature isn't server-only.

const { changing, changePassword } = useLukkChangePassword()

await changePassword({
  current_password: current.value,
  password: next.value,
  password_confirmation: confirm.value,
})

ChangePasswordInput deliberately has no token field. The reset flow proves control of an email address; this one proves knowledge of the existing password — and that difference is the entire reason it's safe to expose to a session. A stolen access token alone must not be enough to take an account over permanently.

The composable is thin on purpose

lukk revokes every other session and keeps the current one, so there's no token to swap and nothing to re-login — existing state is already correct afterwards. One test asserts the access state is untouched rather than merely that the call was made, because a composable that cleared state here would log the user out of the tab they just changed their password in.

From review

• Renamed useLukkPassword → useLukkChangePassword. The former reads as an umbrella covering the reset flow too, which would make useLukkPasswordReset look like a subset of it. Free to change now — the changeset is pending, so nothing shipped under the old name.
• The test re-typed the 'lukk:access' literal, which CLAUDE.md explicitly forbids: shared state keys live in runtime/keys.ts so a rename can't silently decouple a test from what it asserts about. Imports ACCESS_KEY now.
• Returns { changing, changePassword } (refs first) to match useLukkPasswordReset's shape — they're read side by side in the docs.

Verification

91 + 338 tests, 100% coverage both packages, lint + typecheck + build clean.

Greptile Summary

Adds authenticated password-change support to the core client and a Nuxt composable that exposes request progress without altering the surviving session state.

• Defines and exports the current-password and new-password input shape.
• Sends authenticated POST /auth/password requests through the core client.
• Adds useLukkChangePassword with loading-state and error propagation behavior.
• Adds client and composable tests plus release changesets.

Confidence Score: 4/5

The overlapping-call loading-state defect should be fixed before merging so duplicate password-change requests cannot re-enable submission while work remains pending.

Each invocation clears the same changing ref independently, allowing an earlier request to report an idle state while another password-change request is still running.

Files Needing Attention: packages/nuxt/src/runtime/composables/useLukkChangePassword.ts

Important Files Changed

Filename	Overview
packages/core/src/client.ts	Adds an authenticated password-change request following existing URL, POST-body, bearer-token, and void-response conventions.
packages/core/src/types.ts	Adds the public three-field ChangePasswordInput contract, exported through the existing wildcard entrypoint.
packages/nuxt/src/runtime/composables/useLukkChangePassword.ts	Adds a thin password-change composable, but its shared boolean loading state becomes inaccurate when calls overlap.
packages/core/test/client.test.ts	Verifies the endpoint URL, method, request body, and bearer authorization.
packages/nuxt/test/change-password.test.ts	Covers success, rejection, and preserved session state, but only for non-overlapping requests.
.changeset/change-password.md	Documents and versions the new core and Nuxt password-change APIs.

Sequence Diagram

sequenceDiagram
  participant UI
  participant Composable as useLukkChangePassword
  participant Client as Lukk Client
  participant API as POST /auth/password
  UI->>Composable: changePassword(input)
  Composable->>Composable: "changing = true"
  Composable->>Client: changePassword(input)
  Client->>API: Authenticated POST
  API-->>Client: Success or error
  Client-->>Composable: Resolve or reject
  Composable->>Composable: "changing = false"
  Composable-->>UI: Resolve or propagate error

Loading

Prompt To Fix All With AI

### Issue 1
packages/nuxt/src/runtime/composables/useLukkChangePassword.ts:22-37
**Overlapping calls clear loading state**

If two password-change calls overlap, the first call to settle sets `changing` to false while the second remains pending, re-enabling bound submission controls and permitting additional duplicate requests.

```suggestion
  /** True while the change is in flight — bind a submit button's disabled state to it. */
  const changing = ref(false)
  let changesInFlight = 0

  /**
   * Change the password. Rejects with a `LukkError` on failure — `422` carries Laravel's validation
   * bag, so {@link useLukkForm} maps it onto your fields.
   */
  async function changePassword(input: ChangePasswordInput): Promise<void> {
    changesInFlight++
    changing.value = true
    try {
      await $lukk.changePassword(input)
    }
    finally {
      changesInFlight--
      changing.value = changesInFlight > 0
    }
  }
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "refactor: rename to useLukkChangePasswor..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.