@buildbase/sdk 0.0.88 → 0.0.90

package/dist/react/index.d.ts

@@ -37,7 +37,463 @@ interface IUser extends IDocument {
     /** Currency code. May be omitted. */
     currency?: string;
     attributes?: Record<string, string | number | boolean>;
+    /**
+     * The user has a confirmed authenticator app, so sign-in asks for a second
+     * step. Read-only: it changes through the two-step sign-in calls on
+     * `WorkspaceApi`, never through `updateUserProfile`. Absent from a server
+     * that predates two-step sign-in.
+     */
+    mfaEnabled?: boolean;
+    /**
+     * The user can change their email address with `requestEmailChange` and
+     * `confirmEmailChange`. Read-only, from the profile. Absent from a server
+     * that predates changing email, which reads as `false`.
+     */
+    canChangeEmail?: boolean;
+    /**
+     * Why `canChangeEmail` is false, when the user should be told. Absent when
+     * the change is allowed or no reason is given.
+     */
+    changeEmailBlockedBy?: ChangeEmailBlockedBy;
+    /**
+     * The user's id in the system they were imported from (`buildbase import`),
+     * so an app can map its own rows to this account. Read-only, from the
+     * profile. Absent for anyone who was not imported.
+     */
+    externalId?: string;
+    /**
+     * The user's phone number, as E.164 (`+14155550123`). Read-only: it changes
+     * through `addPhone`, `confirmPhone` and `removePhone` on `WorkspaceApi`,
+     * never through `updateUserProfile`. Absent until the user adds one, signs
+     * up by phone or is imported with one, and from a server that predates
+     * phone numbers.
+     */
+    phone?: string;
+    /** The phone was proven with a code sent to it. Read-only, from the profile. */
+    phoneVerified?: boolean;
+    /**
+     * The user's username, lower case, while the app has usernames on: `''`
+     * when they have none. Changes through `setUsername` and `removeUsername` on
+     * `WorkspaceApi`. Absent from a server that predates usernames.
+     */
+    username?: string;
+    /**
+     * Custom claims the app owner set for this user, from the console or with
+     * an API token; `{}` when there are none. Read-only to the user, who cannot
+     * change them. The same object reaches the app's backend as `claims` on the
+     * app-token request (`AppTokenRequestClaims.claims`).
+     */
+    claims?: Record<string, unknown>;
+    /**
+     * A guest: someone who continued without an account. Their name is `Guest`
+     * and their email a placeholder ending in `@anonymous.invalid` that must
+     * never be shown. They become a real account, keeping their id and data,
+     * with `requestGuestUpgrade` and `confirmGuestUpgrade`.
+     */
+    isAnonymous?: boolean;
+    /**
+     * When the account deletion the user asked for runs (ISO 8601). Absent
+     * unless one is scheduled; `cancelAccountDeletion` takes it back until then.
+     */
+    deleteAfter?: string;
+    /**
+     * When this session last proved who its person is (ISO 8601): the sign-in,
+     * or the latest re-confirmation. `null` for a session nobody signed in to
+     * (an API-key exchange), which never counts as recent.
+     */
+    authTime?: string | null;
+    /** How this session proved it (`amr`, RFC 8176), such as `['pwd', 'mfa']`. */
+    amr?: string[];
+    /**
+     * Present while an app owner is viewing the app as this person: who, until
+     * when, and whether the session can change anything.
+     */
+    impersonation?: IImpersonation;
+    /**
+     * The person has a password they know, so `changePassword` can work. False
+     * for an account made by social sign-up, a wallet, or a code or link sent
+     * by email or text, which holds a random password nobody knows: they set
+     * one with Forgot password? on the sign-in page. Absent from a server that
+     * predates it.
+     */
+    passwordSet?: boolean;
+    /**
+     * The app this session signed in to offers password sign-in. Absent when
+     * the session names no app, and from a server that predates it.
+     */
+    passwordSignIn?: boolean;
+}
+/**
+ * The `code` on an error from `changePassword`: the server's `reason`, passed
+ * through unchanged.
+ *
+ * `password_not_set` (409): the account has no password the person knows,
+ * so there is none to change; the attempt does not count toward the sign-in
+ * lockout. `invalid` (400): the current password is wrong (it counts toward
+ * the lockout) or the new one was found in a data breach. `locked` (429):
+ * too many wrong passwords, so wait up to 15 minutes, or reset the password,
+ * which lifts it.
+ */
+type PasswordChangeErrorCode = 'password_not_set' | 'invalid' | 'locked';
+/**
+ * An app owner signed in as this person from the console, to see what they
+ * see. Every change in a read-only session is refused with
+ * `read_only_session`, and in any such session a change to how the person
+ * signs in is refused with `impersonation_sign_in_locked`.
+ */
+interface IImpersonation {
+    /** The owner's name, as the console has it. */
+    actorName: string;
+    /** The session can only read. The default; full access needs the owner role. */
+    readOnly: boolean;
+    /** When the session ends (ISO 8601), at most an hour after it began. */
+    expiresAt: string;
 }
+/**
+ * What a re-confirmation can be asked to include beyond signing in: `mfa`,
+ * the user's second step, for someone who has one.
+ */
+type ReverifyFactor = 'mfa';
+/** Where to send the browser to confirm it is still the same person. */
+interface IReverificationStart {
+    /** The hosted sign-in page, bound to this session. */
+    url: string;
+}
+/**
+ * The `code` on an error from `startReverification`.
+ *
+ * `reverify_unavailable` (400): this session cannot be re-confirmed, because
+ * nobody signed in to it (an API-key exchange), an owner is viewing as the
+ * user, or the user is a guest. `invalid_return_url` (400): the return URL is
+ * not one of the auth client's redirect URLs.
+ */
+type ReverifyErrorCode = 'reverify_unavailable' | 'invalid_return_url';
+/**
+ * Refusals any session-authenticated route may answer, beside its own.
+ *
+ * `reauth_required` (403): the change needs a recent sign-in. The error
+ * carries `maxAgeSeconds` (how recent) and, when the change also needs the
+ * user's second step, `factors`. Re-confirm with `requireReverification`;
+ * it is never a reason to sign out. `read_only_session` (403): an app owner
+ * is viewing as the user, read-only, so nothing can change.
+ * `impersonation_sign_in_locked` (403): an app owner is signed in as the
+ * user, read-only or not, and the call would change how the user signs in
+ * (email, phone, username, password, second step, passkeys, linked accounts,
+ * guest upgrade), which stays the user's. Show the server's sentence.
+ */
+type SessionRefusalCode = 'reauth_required' | 'read_only_session' | 'impersonation_sign_in_locked';
+/** A deletion the user asked for. */
+interface IAccountDeletion {
+    /**
+     * When the account is deleted (ISO 8601), unless cancelled first. `null`
+     * when the app deletes at once: the account is already gone.
+     */
+    deleteAfter: string | null;
+    /** The account was deleted now, and this session ended with it. */
+    deleted: boolean;
+}
+/** A workspace that keeps the user from deleting their account, as the refusal names it. */
+interface IOwnedWorkspace {
+    id: string;
+    name: string;
+}
+/**
+ * The `code` on an error from `requestAccountDeletion`: the server's
+ * `reason`, passed through unchanged.
+ *
+ * `owns_workspaces` (409) carries `workspaces` (`IOwnedWorkspace[]`): the
+ * workspaces the user created that have other members or a subscription.
+ * Nothing hands a workspace to someone else, so the way through is to remove
+ * the other members and cancel the subscription, or delete the workspace.
+ */
+type AccountDeletionErrorCode = 'reauth_required' | 'owns_workspaces' | 'read_only_session';
+/** Whether the app has usernames on, from its public auth config. */
+interface IUsernamePolicy {
+    /** Users can have a username and sign in with it. */
+    enabled: boolean;
+    /** Every user must have one: it can be changed, never removed. */
+    required: boolean;
+}
+/**
+ * The `code` on an error from `setUsername` and `removeUsername`.
+ *
+ * `invalid_username` (400), `username_taken` (409), `usernames_off` (400:
+ * the app has usernames off), `username_required` (409, on removing: the app
+ * requires one).
+ */
+type UsernameErrorCode = 'invalid_username' | 'username_taken' | 'usernames_off' | 'username_required';
+/** What a guest gives to become a real account. */
+interface IGuestUpgradeRequest {
+    /** The address the account will have, proven by a code sent to it. */
+    email: string;
+    /** Their name, in place of `Guest`. */
+    name?: string;
+    /** A password to sign in with, at least 8 characters. */
+    password?: string;
+}
+/** A code went to the address; the guest is still a guest. */
+interface IGuestUpgradeStarted {
+    /** Seconds before another code can be sent. */
+    retryAfter: number;
+}
+/**
+ * The `code` on an error from `requestGuestUpgrade` and
+ * `confirmGuestUpgrade`: the server's `reason`, passed through unchanged.
+ */
+type GuestUpgradeErrorCode = 'email_unavailable' | 'not_a_guest' | 'signup_restricted' | 'waitlist_required' | 'signup_closed' | 'disposable_email' | 'breached_password' | 'cooldown' | 'recipient_limit' | 'not_sent' | 'invalid_code' | 'code_expired';
+/** A chain a wallet signs in on. */
+type WalletChain = 'ethereum' | 'solana';
+/** The wallets the app takes, on `getConnectedAccounts().wallet`. */
+interface IWalletOptions {
+    /** EIP-155 chain ids an Ethereum wallet may sign on. Empty: no Ethereum wallets. */
+    ethereumChainIds: number[];
+    /** Solana wallets are taken. */
+    solana: boolean;
+}
+/** What goes into the message a wallet signs to connect to the account. */
+interface IWalletNonce {
+    /** Spent by the first message that names it; lapses after 5 minutes. */
+    nonce: string;
+    /** The host the message names on its first line. */
+    domain: string;
+    /** The page the message names as `URI`. */
+    uri: string;
+    /** When the nonce was issued (ISO 8601), the message's `Issued At`. */
+    issuedAt: string;
+    /** Ethereum only: the chain ids the app takes. */
+    chainIds?: number[];
+}
+/** A signed message that connects a wallet. */
+interface IWalletLinkRequest {
+    chain: WalletChain;
+    /** The EIP-4361 message (or its Solana sibling), exactly as signed. */
+    message: string;
+    /** Hex (`0x`, 65 bytes) for Ethereum, base58 (64 bytes) for Solana. */
+    signature: string;
+}
+/**
+ * The `code` on an error from `requestWalletNonce` and `linkWallet`.
+ *
+ * `nonce_expired` is a 401 that does not end the session: the message was
+ * not signed in time, so start again.
+ */
+type WalletErrorCode = 'method_unavailable' | 'chain_not_allowed' | 'invalid_message' | 'invalid_signature' | 'nonce_expired' | 'link_conflict' | 'guest_account';
+/**
+ * A social sign-in linked to the signed-in user: one row of
+ * `getConnectedAccounts().accounts`.
+ */
+interface IConnectedAccount {
+    /** The link's id, for `unlinkAccount`. */
+    _id: string;
+    /**
+     * The provider's catalog id: `google`, `linkedIn`, `github`, `microsoft` or
+     * `apple`, `custom:<methodId>` for an app's own OIDC provider, or
+     * `ethereum` or `solana` for a wallet.
+     */
+    provider: string;
+    /** What to call it, from the catalog (a custom provider's own label). */
+    label: string;
+    /** An absolute URL to the provider's icon on the BuildBase server. */
+    icon?: string;
+    /** Which one it is, when the label alone does not say: a wallet's short address. */
+    detail?: string;
+    /** When it was linked. */
+    createdAt?: string;
+    /**
+     * False when removing it would leave the user no way to sign in: the
+     * server refuses with `last_sign_in_method`, so the screen says so first.
+     */
+    canUnlink: boolean;
+}
+/** A social sign-in the app offers that the user has not linked yet. */
+interface IAvailableAccountProvider {
+    /** The provider's catalog id, as on `IConnectedAccount.provider`. */
+    provider: string;
+    label: string;
+    icon?: string;
+    /** The sign-in method to pass to `linkAccount`. */
+    methodId: string;
+}
+/** The signed-in user's connected accounts, and what else they can connect. */
+interface IConnectedAccounts {
+    /** The user's live social links and wallets. */
+    accounts: IConnectedAccount[];
+    /** The social methods on this app the user has not linked. */
+    available: IAvailableAccountProvider[];
+    /**
+     * The wallets the app takes, while it offers wallet sign-in: connect one
+     * with `requestWalletNonce` and `linkWallet`. Absent otherwise.
+     */
+    wallet?: IWalletOptions;
+    /**
+     * How many ways the user can sign in: live links, passkeys, a password they
+     * set themselves while the app offers password sign-in, and a verified email
+     * while it offers magic links or email codes.
+     */
+    signInWays: number;
+    /**
+     * This session proved who its person is in the last 10 minutes. Removing a
+     * connected account needs that; otherwise the server answers
+     * `reauth_required`.
+     */
+    recentSignIn: boolean;
+}
+/** Where to send the browser to link a provider. */
+interface IAccountLinkStart {
+    url: string;
+}
+/**
+ * The `code` on an error from `getConnectedAccounts`, `linkAccount` and
+ * `unlinkAccount`: the server's `reason`, passed through unchanged.
+ *
+ * `reauth_required` (403) is a refusal, not a dead session: the SDK does not
+ * sign the user out for it. Only a 401 does.
+ */
+type ConnectedAccountErrorCode = 'reauth_required' | 'last_sign_in_method' | 'already_linked' | 'method_unavailable';
+/**
+ * Why linking failed, as the server says on the way back from the provider:
+ * the `reason` query parameter beside `error`.
+ *
+ * The provider: `provider_error` (cancelled or refused there),
+ * `provider_failed` (its answer could not be used), `no_verified_email` (the
+ * provider account has no verified address, as GitHub's can). The link:
+ * `link_conflict` (that provider account belongs to another user here),
+ * `session_ended`. A guest connecting a provider becomes that account, so
+ * its address is checked as a sign-up's: `email_unverified`,
+ * `email_unavailable`, `disposable_email`, `signup_closed`,
+ * `signup_restricted`, `waitlist_required`, and `not_a_guest` when the guest
+ * became an account in another tab meanwhile.
+ */
+type AccountLinkErrorReason = 'link_conflict' | 'provider_error' | 'provider_failed' | 'session_ended' | 'no_verified_email' | 'email_unverified' | 'email_unavailable' | 'disposable_email' | 'signup_closed' | 'signup_restricted' | 'waitlist_required' | 'not_a_guest';
+/**
+ * Why the signed-in user cannot change their email address.
+ *
+ * `linked_social_account`: the account signs in with Google or another
+ * provider, which finds the account by its email address, so changing it would
+ * create a second account at the next such sign-in. Only an older server says
+ * so: social sign-in now finds the account by the provider's own ID, and a
+ * current server always answers `canChangeEmail: true`.
+ */
+type ChangeEmailBlockedBy = 'linked_social_account';
+/** A code went to the new address; the email has not changed yet. */
+interface IEmailChangeRequest {
+    /** Seconds before another code can be sent. */
+    retryAfter: number;
+}
+/** The email change went through. */
+interface IEmailChangeResult {
+    /** The address the account has now, verified. */
+    email: string;
+}
+/**
+ * The `code` on an error from `requestEmailChange` and `confirmEmailChange`:
+ * the server's `reason`, passed through unchanged.
+ */
+type EmailChangeErrorCode = 'email_unavailable' | 'linked_social_account' | 'guest_account' | 'cooldown' | 'disposable_email' | 'invalid_code' | 'code_expired';
+/** Who has to use two-step sign-in in an app, as its organization set it. */
+type MfaEnforcement = 'off' | 'optional' | 'required';
+/**
+ * A second-step method the app allows: an authenticator app (`totp`), or a
+ * code sent by text message to the user's verified phone (`sms`). An app never
+ * allows `sms` alone.
+ */
+type MfaFactorType = 'totp' | 'sms';
+/** The signed-in user's two-step sign-in, and what the app allows. */
+interface IMfaStatus {
+    /** An authenticator app is set up and confirmed. */
+    enabled: boolean;
+    /**
+     * `optional` lets each user choose, `required` asks everyone. `off` asks
+     * nobody for a second step and nothing new can be set up, but what a user
+     * set up before can still be removed.
+     */
+    enforcement: MfaEnforcement;
+    allowedFactors: MfaFactorType[];
+    /** When the authenticator app was confirmed. Only while `enabled`. */
+    confirmedAt?: string;
+    /** When a code from it, or a backup code, last passed. Only while `enabled`. */
+    lastUsedAt?: string;
+    /** Unused backup codes. Only while `enabled`. */
+    backupCodesRemaining?: number;
+    /** Text messages as a second step. Absent from a server that predates them. */
+    sms?: IMfaSmsStatus;
+}
+/**
+ * Text messages as a second step, for the signed-in user. Weaker than an
+ * authenticator app: a phone number can be moved to someone else's SIM card.
+ */
+interface IMfaSmsStatus {
+    /**
+     * The user may turn it on: the app's factors include `sms`, an SMS provider
+     * is connected, and the app's plan serves phone codes.
+     */
+    allowed: boolean;
+    /** The user has it on. */
+    enrolled: boolean;
+    /** The number codes go to, masked (`+1 ••• ••• 0123`). Only while `enrolled`. */
+    phone?: string;
+}
+/** How a phone code is delivered. A call that names none gets a text message. */
+type PhoneChannel = 'sms' | 'whatsapp' | 'voice';
+/** A code went to a phone; nothing has changed yet. */
+interface IPhoneCodeSent {
+    /** Seconds before another code can be sent. */
+    retryAfter: number;
+    /**
+     * The number the code went to, as the server shows it (masked for the
+     * second step). Only when the server says.
+     */
+    phone?: string;
+}
+/** The code was right: the number is the account's, verified. */
+interface IPhoneConfirmed {
+    /** The number, as E.164. */
+    phone: string;
+    phoneVerified: true;
+}
+/** Text messages are on as a second step. */
+interface ISmsEnrollmentResult {
+    /**
+     * Backup codes, when the server issued them with this factor. Shown once,
+     * like the authenticator app's.
+     */
+    backupCodes?: string[];
+}
+/**
+ * The `code` on an error from the phone calls (`addPhone`, `confirmPhone`,
+ * `removePhone`) and the text-message factor (`startSmsEnrollment`,
+ * `confirmSmsEnrollment`, `disableSms`): the server's `reason`, passed through
+ * unchanged.
+ *
+ * `reauth_required` (403) and `code_expired` (410) are refusals, not a dead
+ * session: the SDK does not sign the user out for them. Only a 401 does.
+ * `method_unavailable` (400, from `addPhone`): the app does not send codes
+ * the way asked for, such as by text message.
+ */
+type PhoneErrorCode = 'invalid_phone' | 'method_unavailable' | 'phone_unavailable' | 'cooldown' | 'rate_limited' | 'number_refused' | 'sms_unavailable' | 'invalid_code' | 'code_expired' | 'reauth_required' | 'last_sign_in_method' | 'mfa_sms_enrolled' | 'phone_required' | 'factor_not_allowed';
+/**
+ * A started authenticator-app setup. Pending until `confirmTotpEnrollment`
+ * accepts a first code; starting again replaces it.
+ */
+interface ITotpEnrollment {
+    /** Base32 secret, for typing into an app that cannot scan. */
+    secret: string;
+    /** The `otpauth://` URL the QR code encodes. */
+    otpauthUrl: string;
+    /** The QR code as an SVG document, rendered by the server. Show it as an image, never as markup. */
+    qrSvg: string;
+}
+/** Single-use backup codes. The server returns them once and keeps only hashes. */
+interface IMfaBackupCodes {
+    backupCodes: string[];
+}
+/**
+ * The `code` on an error from the two-step sign-in calls: the server's
+ * `reason`, passed through unchanged.
+ */
+type MfaErrorCode = 'mfa-off' | 'already-enrolled' | 'not-enrolling' | 'not-enrolled' | 'invalid-code' | 'required-by-org' | 'locked'
+/** A guest, who creates an account before setting up a second step (409). */
+ | 'guest_account';
 /** A registered passkey (WebAuthn credential) — no key material exposed. */
 interface IPasskeySummary {
     id: string;
@@ -1061,6 +1517,10 @@ interface AuthUser {
     id: string;
     name: string;
     org: string;
+    /**
+     * The user's email address. Empty for a guest (`isAnonymous`), whose
+     * placeholder address is never shown or passed on.
+     */
     email: string;
     emailVerified: boolean;
     clientId: string;
@@ -1075,15 +1535,90 @@ interface AuthUser {
      * person twice when they sign up on one device and open the app on another.
      */
     firstAuthAt?: string;
+    /**
+     * The user has a second step: a confirmed authenticator app, or text
+     * message codes. From the profile at sign-in; the Security screen keeps it
+     * current when the user turns either on or off there. `false` when the
+     * server predates two-step sign-in.
+     */
+    mfaEnabled: boolean;
+    /**
+     * The user can change their email address, which the Profile screen offers.
+     * From the profile at sign-in. `false` when the server predates changing
+     * email.
+     */
+    canChangeEmail: boolean;
+    /** Why `canChangeEmail` is false, when the user should be told. */
+    changeEmailBlockedBy?: ChangeEmailBlockedBy;
+    /**
+     * The user's id in the system they were imported from (`buildbase import`),
+     * from the profile at sign-in. Absent for anyone who was not imported.
+     */
+    externalId?: string;
+    /**
+     * The user's phone number, as E.164 (`+14155550123`), from the profile at
+     * sign-in. The Security screen keeps it current when the user adds, verifies
+     * or removes it there. Absent when the user has none, and from a server that
+     * predates phone numbers.
+     */
+    phone?: string;
+    /** The phone was proven with a code sent to it. Present only with `phone`. */
+    phoneVerified?: boolean;
+    /**
+     * The user's username, lower case, while the app has usernames on and they
+     * set one. The Profile screen keeps it current. Absent otherwise.
+     */
+    username?: string;
+    /**
+     * Custom claims the app owner set for this user, from the profile at
+     * sign-in: `{}` when there are none, and from a server that predates them.
+     * Read-only to the user.
+     */
+    claims: Record<string, unknown>;
+    /**
+     * A guest, who continued without an account: their `email` is empty, and
+     * they become a real account with `useGuestUpgrade`. `false` for everyone
+     * else.
+     */
+    isAnonymous: boolean;
+    /**
+     * When the account deletion the user asked for runs (ISO 8601), while one
+     * is scheduled. The Security screen keeps it current, and the settings
+     * dialog shows it at the top of every screen, with Cancel deletion.
+     */
+    deleteAfter?: string;
 }
 interface AuthSession {
     user: AuthUser;
     sessionId: string;
     expires: string;
+    /**
+     * When this session last proved who its person is (ISO 8601): the sign-in,
+     * or the latest re-confirmation (`requireReverification`). Absent when it
+     * never has (an API-key exchange), and from a server that predates it.
+     */
+    authTime?: string;
+    /** How it proved it (`amr`, RFC 8176), such as `['pwd', 'mfa']`. */
+    amr?: string[];
+    /**
+     * Present while an app owner is viewing the app as this person. A
+     * read-only one refuses every change with `read_only_session`, and any one
+     * refuses a change to how the person signs in with
+     * `impersonation_sign_in_locked`; the SDK shows a banner for as long as it
+     * lasts.
+     */
+    impersonation?: IImpersonation;
 }
 interface IAuthConfig {
     clientId: string;
     redirectUrl: string;
+    /**
+     * The language the hosted sign-in page opens in, one of the SDK's eight
+     * (`SUPPORTED_LOCALES`; a regional tag such as `es-MX` is narrowed to
+     * `es`). Defaults to the provider's `locale` when that is set; with
+     * neither, the page goes by the person's own choice and their browser.
+     */
+    locale?: string;
     callbacks?: IAuthCallbacks;
 }
 interface IAuthCallbacks {
@@ -1276,6 +1811,16 @@ interface IBaseApiConfig {
     /** Custom fetch implementation. */
     fetch?: typeof globalThis.fetch;
 }
+/** Per-request options that are not part of fetch's own `RequestInit`. */
+interface IRequestOptions {
+    /**
+     * Leave a 401 to the caller instead of calling `onUnauthorized`, which ends
+     * the session. For a route that answers 401 for a refusal of its own (an
+     * expired code) while the session is fine: the caller reads the body and
+     * calls `notifyUnauthorized()` for any 401 that is not that refusal.
+     */
+    deferUnauthorized?: boolean;
+}
 /**
  * Base class for SDK API clients.
  * Provides:
@@ -1318,6 +1863,12 @@ declare abstract class BaseApi {
     private reportError;
     /** Execute fetch with timeout, retries, debug logging, and error callback. */
     private executeFetch;
+    /**
+     * Tell the app the session is dead (`onUnauthorized`). Only for a caller
+     * that set `deferUnauthorized` and found a 401 that is not its route's own
+     * refusal; every other 401 already does this.
+     */
+    protected notifyUnauthorized(): void;
     /** Backoff sleep that ends early (with an AbortError) when the signal fires. */
     private static delay;
     /** Internal: execute fetch against a resolved URL with timeout, retries, debug logging, and error callback. */
@@ -1331,7 +1882,7 @@ declare abstract class BaseApi {
      * Execute request and return raw Response (for custom parsing or error handling).
      * Caller is responsible for checking response.ok and parsing body.
      */
-    protected fetchResponse(path: string, init?: RequestInit): Promise<Response>;
+    protected fetchResponse(path: string, init?: RequestInit, options?: IRequestOptions): Promise<Response>;
     /**
      * Execute request, throw a parsed error on !response.ok, and unwrap the
      * `{ success, data }` envelope. Shorthand for the common
@@ -1454,6 +2005,13 @@ interface AuthRequestParams {
      * Populated automatically from the parked invitation when there is one.
      */
     invitationToken?: string;
+    /**
+     * The language the hosted sign-in page opens in: one of the SDK's eight
+     * (`SUPPORTED_LOCALES`). Without it the page goes by the person's own
+     * choice, then their browser, then the app's default. `signIn` sends the
+     * app's `auth.locale`, else the provider's `locale`, when either is set.
+     */
+    locale?: string;
 }
 /**
  * Unwrapped payload of a successful auth request.
@@ -1477,6 +2035,20 @@ declare class AuthApi extends BaseApi {
      * envelopes with `success: false` both throw a structured Error.
      */
     requestAuth(params: AuthRequestParams): Promise<AuthRequestResponse>;
+    /**
+     * Whether the app has usernames on, from its public auth config
+     * (`GET /api/v1/auth/config?org=`). Both false when it has them off, and
+     * from a server that predates usernames.
+     */
+    getUsernamePolicy(orgId: string, signal?: AbortSignal): Promise<IUsernamePolicy>;
+    /**
+     * Days between a person asking to delete their account and the account
+     * going, from the app's public auth config (`security.accountDeletionGraceDays`).
+     * 0 means at once. Read by the server's own rule: anything that is not a
+     * number, which includes a server that predates account deletion, is the
+     * default of 7, and the rest is held to 0 to 30.
+     */
+    getAccountDeletionGraceDays(orgId: string, signal?: AbortSignal): Promise<number>;
     /** Fetch user profile with the given session ID (used after OAuth redirect or from storage). */
     getProfile(sessionId: string, signal?: AbortSignal): Promise<IUser>;
     /**
@@ -2109,9 +2681,286 @@ declare class WorkspaceApi extends BaseApi {
     getWorkspace(workspaceId: string, signal?: AbortSignal): Promise<IWorkspace>;
     getProfile(signal?: AbortSignal): Promise<IUser>;
     updateUserProfile(config: Partial<IUser>, signal?: AbortSignal): Promise<IUser>;
+    /**
+     * Change the signed-in user's password.
+     *
+     * A wrong `currentPassword` counts toward the account's sign-in lockout (10
+     * failures in 15 minutes), after which the server answers 429 (`locked`)
+     * until the window passes or the password is reset. A wrong one, or a new
+     * one found in a known data breach, is 400 (`invalid`). On success every
+     * other session for the user ends and this one stays.
+     *
+     * An account made by social sign-up, a wallet, or a code or link has no
+     * password the person knows (the profile's `passwordSet` is false). The
+     * server refuses it with 409 `password_not_set`, without counting toward
+     * the lockout; the person sets one with Forgot password? on the sign-in
+     * page. The error carries the server's sentence and `code`
+     * (`PasswordChangeErrorCode`).
+     */
+    changePassword(currentPassword: string, newPassword: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * Run a call whose refusals are `{ success: false, message, reason?,
+     * retryAfter? }`: two-step sign-in, changing email, connected accounts,
+     * the phone, re-confirming, deleting the account, the username, a guest's
+     * upgrade, wallets and passkeys. The error keeps the server's sentence as its message
+     * and carries `status`, the reason as `code` (an `MfaErrorCode`, an
+     * `EmailChangeErrorCode`, a `ConnectedAccountErrorCode`, a
+     * `PhoneErrorCode`, a `SessionRefusalCode` and the rest), on a cooldown
+     * `retryAfter` in seconds, on `reauth_required` `maxAgeSeconds` and the
+     * `factors` it asks for, and on `owns_workspaces` the `workspaces`, so a
+     * screen can act on the refusal without parsing the sentence.
+     *
+     * `reasons401` lists the reasons this route answers with a 401 while the
+     * session is fine (an expired code). A 401 carrying one of them is only a
+     * refusal; any other 401 still ends the session, as it does everywhere.
+     */
+    private fetchWithReason;
+    /** A code as typed or pasted: authenticator apps often show `123 456`. */
+    private static compactCode;
+    /**
+     * Send a 6-digit code to `newEmail`. Nothing changes until
+     * `confirmEmailChange` accepts the code. Resolves with `retryAfter`, the
+     * seconds before another code can be sent.
+     *
+     * Refused with `email_unavailable` (409) for an address this app cannot
+     * use, whether it is taken or invalid, `cooldown` (429, carrying
+     * `retryAfter`) inside the resend window, `disposable_email` (400) when the
+     * app blocks disposable addresses, and `guest_account` (409) for a guest,
+     * who creates an account instead.
+     */
+    requestEmailChange(newEmail: string, signal?: AbortSignal): Promise<IEmailChangeRequest>;
+    /**
+     * Change the email to the address the code went to. Spaces in the code are
+     * dropped. Resolves with the new address, which is verified; the old one is
+     * mailed a notice, and every session stays signed in.
+     *
+     * Refused with `invalid_code` (400), and `code_expired` (410) when no code is
+     * pending, it lapsed, or it used its tries, so the user asks for a new one.
+     * A 401 that names `code_expired` (from a server before the status moved to
+     * 410) is read the same way and does not sign the user out; any other 401
+     * on this route still means the session is over.
+     */
+    confirmEmailChange(code: string, signal?: AbortSignal): Promise<IEmailChangeResult>;
+    /**
+     * Send a code to `phone` (E.164), the number the user wants on their
+     * account. Nothing changes until `confirmPhone` accepts the code. Resolves
+     * with `retryAfter`, the seconds before another code can be sent. `channel`
+     * asks for WhatsApp or a voice call where the app offers them; without it
+     * the code is a text message.
+     *
+     * Refused with `invalid_phone` (400), `method_unavailable` (400) when the
+     * app does not send codes that way, `phone_unavailable` (409) for a number
+     * on another account, `cooldown` (429, carrying `retryAfter`) and
+     * `rate_limited` (429), `number_refused` (422) when the provider will not
+     * send to it, and `sms_unavailable` (503) when codes cannot be sent.
+     */
+    addPhone(phone: string, channel?: PhoneChannel, signal?: AbortSignal): Promise<IPhoneCodeSent>;
+    /**
+     * Make the number the code went to the account's, verified. Spaces in the
+     * code are dropped. Resolves with the number.
+     *
+     * Refused with `invalid_code` (400), and `code_expired` (410) when no code
+     * is pending, it lapsed or it used its tries, so the user asks for a new one.
+     */
+    confirmPhone(code: string, signal?: AbortSignal): Promise<IPhoneConfirmed>;
+    /**
+     * Take the phone number off the account.
+     *
+     * Refused with `reauth_required` (403) when this session started more than
+     * 10 minutes ago, so the user signs in again first; this does not sign them
+     * out. `last_sign_in_method` (409) when it is the only way they can sign in,
+     * and `mfa_sms_enrolled` (409) while text-message codes for two-step sign-in
+     * go to it.
+     */
+    removePhone(signal?: AbortSignal): Promise<void>;
+    /** The signed-in user's two-step sign-in, and what the app allows. */
+    getMfaStatus(signal?: AbortSignal): Promise<IMfaStatus>;
+    /**
+     * Start adding an authenticator app: a fresh secret, its `otpauth://` URL
+     * and a QR code the server rendered as SVG. Nothing is on until
+     * `confirmTotpEnrollment` accepts a first code, and starting again replaces
+     * a pending setup.
+     *
+     * Refused with `mfa-off` (403) when the app has two-step sign-in turned off,
+     * and `already-enrolled` (409) when an authenticator app is already set up.
+     */
+    startTotpEnrollment(signal?: AbortSignal): Promise<ITotpEnrollment>;
+    /**
+     * Confirm the pending authenticator app with the 6-digit code it shows,
+     * which turns two-step sign-in on. Spaces in the code are dropped. Resolves
+     * with the backup codes, which the server returns this once and never again.
+     *
+     * Refused with `invalid-code` (400), and `not-enrolling` (409) when no setup
+     * is pending, so the user starts again.
+     */
+    confirmTotpEnrollment(code: string, signal?: AbortSignal): Promise<IMfaBackupCodes>;
+    /**
+     * Turn two-step sign-in off by removing the authenticator app. Needs a
+     * current 6-digit code or an unused backup code; a wrong one counts toward
+     * the account's lockout. Every device that remembered the second step
+     * forgets it.
+     *
+     * Refused with `required-by-org` (403) while the app requires two-step
+     * sign-in, `invalid-code` (400), `not-enrolled` (404), and `locked` (429)
+     * after too many wrong codes.
+     */
+    disableTotp(code: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * Replace the backup codes. Needs a current code or an unused backup code,
+     * with the same refusals as `disableTotp` apart from `required-by-org`. The
+     * old codes stop working; the new ones are returned this once.
+     */
+    regenerateBackupCodes(code: string, signal?: AbortSignal): Promise<IMfaBackupCodes>;
+    /**
+     * Send a code to the account's verified phone to turn text-message codes
+     * on. Resolves with `retryAfter`, and the masked number when the server
+     * says which.
+     *
+     * Refused with `phone_required` (409) when the account has no verified
+     * phone, so the user adds one first; `factor_not_allowed` (403) when the app
+     * does not allow it; and the sending refusals of `addPhone` (`cooldown`,
+     * `rate_limited`, `number_refused`, `sms_unavailable`).
+     */
+    startSmsEnrollment(signal?: AbortSignal): Promise<IPhoneCodeSent>;
+    /**
+     * Turn text-message codes on with the code `startSmsEnrollment` sent. Spaces
+     * in the code are dropped. Resolves with backup codes when the server issued
+     * them, which it returns this once.
+     *
+     * Refused with `invalid_code` (400) and `code_expired` (410).
+     */
+    confirmSmsEnrollment(code: string, signal?: AbortSignal): Promise<ISmsEnrollmentResult>;
+    /**
+     * Turn text-message codes off.
+     *
+     * Refused with `reauth_required` (403) when this session started more than
+     * 10 minutes ago, so the user signs in again first; this does not sign them
+     * out.
+     */
+    disableSms(signal?: AbortSignal): Promise<void>;
     getPasskeys(signal?: AbortSignal): Promise<IPasskeySummary[]>;
     renamePasskey(passkeyId: string, name: string, signal?: AbortSignal): Promise<void>;
     deletePasskey(passkeyId: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * The user's linked social sign-ins (`accounts`), the ones the app offers
+     * that they have not linked (`available`), how many ways they can sign in,
+     * and whether this session is recent enough to remove one.
+     */
+    getConnectedAccounts(signal?: AbortSignal): Promise<IConnectedAccounts>;
+    /**
+     * Start linking a provider: resolves with the `url` to send the browser to.
+     * The person signs in there and comes back to `redirect`, which must be on
+     * an origin the app registered for sign-in, with `?linked=<provider>` on
+     * success, or `?error=...&reason=...` (an `AccountLinkErrorReason`) when it
+     * failed.
+     *
+     * Refused with `method_unavailable` (404) when `methodId` is not a social
+     * sign-in on this app, `already_linked` (409) when the user already has
+     * that provider, and 400 for a missing or unregistered `redirect`. A POST,
+     * so it is never retried.
+     */
+    linkAccount(methodId: string, redirect: string, signal?: AbortSignal): Promise<IAccountLinkStart>;
+    /**
+     * Remove one linked sign-in, by its `_id` from `getConnectedAccounts`.
+     *
+     * Refused with `reauth_required` (403) when this session started more than
+     * 10 minutes ago, so the user signs in again first; this does not sign
+     * them out. `last_sign_in_method` (409) when it is the only way they can
+     * sign in (`canUnlink` is false), and 404 when the link is not theirs.
+     */
+    unlinkAccount(accountId: string, signal?: AbortSignal): Promise<void>;
+    /**
+     * A nonce for the message that connects a wallet on `chain`, with the
+     * domain, URI and time the message must carry (`buildWalletMessage` lays it
+     * out). The wallet signs it and `linkWallet` sends it, within 5 minutes.
+     *
+     * Refused with `method_unavailable` (403) when the app offers no wallet
+     * sign-in, and `chain_not_allowed` (400) for a kind of wallet it does not
+     * take.
+     */
+    requestWalletNonce(chain: WalletChain, signal?: AbortSignal): Promise<IWalletNonce>;
+    /**
+     * Connect the wallet that signed `message` (exactly as signed) with
+     * `signature`: hex for Ethereum, base58 for Solana. Resolves with its row
+     * in the connected accounts, the short address as `detail`; read the list
+     * again for whether it can be removed.
+     *
+     * Refused with `link_conflict` (409) when the wallet is on another account,
+     * `invalid_signature` (400), `invalid_message` (400) for a message this page
+     * did not make, `chain_not_allowed` (400), `guest_account` (409) for a guest,
+     * who creates an account first, and `nonce_expired` (401) when the nonce
+     * lapsed or was spent. That 401 is a refusal, not a dead session: it does
+     * not sign the user out, and connecting starts again.
+     */
+    linkWallet(input: IWalletLinkRequest, signal?: AbortSignal): Promise<IConnectedAccount>;
+    /**
+     * Start re-confirming who the user is. Resolves with the hosted sign-in
+     * page to send the browser to; signing in there as the same person brings
+     * it back to `returnUrl` with `?reverified=1`. `factors: ['mfa']` asks for
+     * the second step too, for someone who has one. `returnUrl` must be one of
+     * the auth client's redirect URLs. `requireReverification` on
+     * `useSaaSAuth()` does all of this, coming back to the page it was on.
+     *
+     * Refused with `reverify_unavailable` (400) for a session nobody signed in
+     * to, one an owner holds as the user, or a guest's, and
+     * `invalid_return_url` (400).
+     */
+    startReverification(options: {
+        returnUrl: string;
+        factors?: ReverifyFactor[];
+    }, signal?: AbortSignal): Promise<IReverificationStart>;
+    /**
+     * Ask for the account to be deleted. After the app's grace period it is,
+     * with its personal data; until then `cancelAccountDeletion` takes it back,
+     * and the profile carries `deleteAfter`. Every other session ends now and
+     * this one stays. An app with no grace period deletes at once: `deleted` is
+     * true and this session has ended too.
+     *
+     * Refused with `reauth_required` (403, carrying `maxAgeSeconds`) unless the
+     * user signed in recently, and `owns_workspaces` (409, carrying
+     * `workspaces`) while they created a workspace that has other members or a
+     * subscription. A POST, never retried.
+     */
+    requestAccountDeletion(signal?: AbortSignal): Promise<IAccountDeletion>;
+    /**
+     * Take back a scheduled deletion. `cancelled` is false when none was
+     * scheduled, which is not a refusal.
+     */
+    cancelAccountDeletion(signal?: AbortSignal): Promise<{
+        cancelled: boolean;
+    }>;
+    /**
+     * Set or change the username, while the app has usernames on. The server
+     * stores it lower case; `isValidUsername` checks the same rules first.
+     *
+     * Refused with `invalid_username` (400), `username_taken` (409) and
+     * `usernames_off` (400).
+     */
+    setUsername(username: string, signal?: AbortSignal): Promise<{
+        username: string;
+    }>;
+    /** Remove the username. Refused with `username_required` (409) while the app requires one. */
+    removeUsername(signal?: AbortSignal): Promise<void>;
+    /**
+     * Check the address (and the password, when one is given) and mail a code
+     * to it. Nothing changes until `confirmGuestUpgrade` accepts the code.
+     * Resolves with `retryAfter`, the seconds before another code can be sent.
+     *
+     * Refused with `email_unavailable` (409), `not_a_guest` (409),
+     * `signup_restricted`, `waitlist_required` or `signup_closed` (403),
+     * `disposable_email` and `breached_password` (400), and `cooldown` (429,
+     * carrying `retryAfter`). A POST, never retried.
+     */
+    requestGuestUpgrade(input: IGuestUpgradeRequest, signal?: AbortSignal): Promise<IGuestUpgradeStarted>;
+    /**
+     * Become a real account with the code `requestGuestUpgrade` mailed. Spaces
+     * in the code are dropped. Resolves with the profile: the same user id, the
+     * address verified, `isAnonymous` false.
+     *
+     * Refused with `invalid_code` (400), and `code_expired` (410) when no code
+     * is pending, it lapsed or it used its tries.
+     */
+    confirmGuestUpgrade(code: string, signal?: AbortSignal): Promise<IUser>;
     /**
      * Get current subscription for a workspace
      * Returns subscription details including plan, plan version, and group information
@@ -2550,6 +3399,7 @@ declare const BBScreen: {
     readonly Usage: "usage";
     readonly Users: "users";
     readonly Profile: "profile";
+    readonly Security: "security";
     readonly General: "general";
     readonly Features: "features";
     readonly Notifications: "notifications";
@@ -3106,6 +3956,10 @@ interface SDKMessages {
         connectedAgentsGranted: string;
         connectedAgentsLoadFailed: string;
         connectedAgentsRevokeFailed: string;
+        connectedAgentsConfirmTitle: string;
+        connectedAgentsConfirmBody: string;
+        connectedAgentsCancel: string;
+        connectedAgentsDisconnected: string;
         mcpConnectAction: string;
         mcpGuideTitle: string;
         mcpGuideDescription: string;
@@ -3135,6 +3989,147 @@ interface SDKMessages {
         renamePlaceholder: string;
         lastUsed: string;
         added: string;
+        passwordTitle: string;
+        passwordDescription: string;
+        currentPassword: string;
+        newPassword: string;
+        passwordRequired: string;
+        passwordMinLength: string;
+        changePassword: string;
+        passwordChanged: string;
+        passwordSocialHint: string;
+        passwordNone: string;
+        passwordNoneHint: string;
+        twoStepTitle: string;
+        twoStepDescription: string;
+        twoStepSetUp: string;
+        twoStepRequiredSetup: string;
+        twoStepScan: string;
+        twoStepQrAlt: string;
+        twoStepManualKey: string;
+        twoStepCodeLabel: string;
+        twoStepCodeInvalid: string;
+        twoStepTurnOn: string;
+        twoStepEnabled: string;
+        twoStepBackupTitle: string;
+        twoStepBackupDescription: string;
+        twoStepCopy: string;
+        twoStepCopied: string;
+        twoStepDone: string;
+        twoStepAppName: string;
+        twoStepBackupLeft: string;
+        twoStepNewCodes: string;
+        twoStepTurnOff: string;
+        twoStepRequiredNote: string;
+        twoStepCurrentCodeLabel: string;
+        twoStepCurrentCodeRequired: string;
+        twoStepTurnOffHint: string;
+        twoStepNewCodesHint: string;
+        twoStepDisabled: string;
+        twoStepCodesRegenerated: string;
+        twoStepOffDescription: string;
+        twoStepRemoveHint: string;
+        twoStepRemoved: string;
+        connectedAccountsTitle: string;
+        connectedAccountsDescription: string;
+        connectedAccountsEmpty: string;
+        connectedAccountsAvailable: string;
+        connectedAccountsConnect: string;
+        connectedAccountsLastWay: string;
+        connectedAccountsRemoveTitle: string;
+        connectedAccountsRemoveDescription: string;
+        connectedAccountsRemoved: string;
+        connectedAccountsLinked: string;
+        connectedAccountsLinkedGeneric: string;
+        connectedAccountsReauth: string;
+        connectedAccountsSignInAgain: string;
+        connectedAccountsLinkConflict: string;
+        connectedAccountsProviderError: string;
+        connectedAccountsProviderFailed: string;
+        connectedAccountsSessionEnded: string;
+        connectedAccountsNoVerifiedEmail: string;
+        connectedAccountsEmailUnverified: string;
+        connectedAccountsEmailUnavailable: string;
+        connectedAccountsDisposableEmail: string;
+        connectedAccountsSignupClosed: string;
+        connectedAccountsSignupRestricted: string;
+        connectedAccountsWaitlistRequired: string;
+        connectedAccountsNotAGuest: string;
+        twoStepGuest: string;
+        phoneTitle: string;
+        phoneDescription: string;
+        phoneEmpty: string;
+        phoneAdd: string;
+        phoneChange: string;
+        phoneCountryLabel: string;
+        phoneNumberHint: string;
+        phoneNumberInvalid: string;
+        phoneSendCode: string;
+        phoneSentTo: string;
+        phoneCodeLabel: string;
+        phoneCodeInvalid: string;
+        phoneResend: string;
+        phoneResendIn: string;
+        phoneWait: string;
+        phoneResent: string;
+        phoneVerify: string;
+        phoneVerified: string;
+        phoneNotVerified: string;
+        phoneSaved: string;
+        phoneRemoveTitle: string;
+        phoneRemoveDescription: string;
+        phoneRemoved: string;
+        phoneReauth: string;
+        phoneLastWay: string;
+        phoneUsedForTwoStep: string;
+        phoneSmsUnavailable: string;
+        phoneCheckUnavailable: string;
+        phoneTextUnavailable: string;
+        twoStepSmsName: string;
+        twoStepSmsWeaker: string;
+        twoStepSmsTo: string;
+        twoStepSmsNeedsPhone: string;
+        twoStepSmsGoToPhone: string;
+        twoStepSmsSentGeneric: string;
+        twoStepSmsEnabled: string;
+        twoStepSmsDisabled: string;
+        twoStepSmsTurnOffTitle: string;
+        twoStepSmsTurnOffDescription: string;
+        twoStepSmsReauth: string;
+        reauthConfirm: string;
+        reauthConfirmed: string;
+        /** Confirm it's you, pressed while an app owner is signed in as the person. */
+        reauthImpersonating: string;
+        deleteAccountTitle: string;
+        deleteAccountDescription: string;
+        deleteAccountWarning: string;
+        deleteAccountWarningNow: string;
+        deleteAccountWarningDays: string;
+        deleteAccountTypeLabel: string;
+        deleteAccountWord: string;
+        deleteAccountConfirm: string;
+        deleteAccountScheduled: string;
+        /** The notice at the top of every settings screen while a deletion is scheduled. */
+        deleteAccountNotice: string;
+        deleteAccountCancel: string;
+        deleteAccountCancelled: string;
+        deleteAccountReauth: string;
+        deleteAccountOwnsWorkspaces: string;
+        impersonationReadOnly: string;
+        impersonationFull: string;
+        /** Under the full-access line: sign-in changes stay locked in such a session. */
+        impersonationSignInLocked: string;
+        impersonationExit: string;
+        impersonationRegion: string;
+        walletConnectEthereum: string;
+        walletConnectSolana: string;
+        walletNotFound: string;
+        walletRejected: string;
+        walletBusy: string;
+        walletWrongNetwork: string;
+        walletNoAccount: string;
+        walletFailed: string;
+        walletHint: string;
         devicesTitle: string;
         devicesDescription: string;
         devicesEmpty: string;
@@ -3542,6 +4537,31 @@ interface SDKMessages {
         nameMinLength: string;
         save: string;
         reset: string;
+        changeEmail: string;
+        changeEmailNewLabel: string;
+        changeEmailNewHint: string;
+        changeEmailInvalid: string;
+        changeEmailSame: string;
+        changeEmailSend: string;
+        changeEmailSentTo: string;
+        changeEmailCodeLabel: string;
+        changeEmailCodeInvalid: string;
+        changeEmailConfirm: string;
+        changeEmailResend: string;
+        changeEmailResendIn: string;
+        changeEmailResent: string;
+        changeEmailChanged: string;
+        changeEmailBlockedSocial: string;
+        username: string;
+        usernameHint: string;
+        usernameInvalid: string;
+        usernameSave: string;
+        usernameRemove: string;
+        usernameSaved: string;
+        usernameRemoved: string;
+        usernameRequiredNote: string;
+        /** The profile could not be read; the screen offers Retry. */
+        loadFailed: string;
     };
     general: {
         ownerOnly: string;
@@ -3838,6 +4858,25 @@ interface SDKMessages {
         insufficientCredits: string;
         insufficientDetail: string;
     };
+    guest: {
+        title: string;
+        description: string;
+        emailLabel: string;
+        nameLabel: string;
+        passwordLabel: string;
+        passwordHint: string;
+        emailInvalid: string;
+        passwordMinLength: string;
+        send: string;
+        sentTo: string;
+        codeLabel: string;
+        codeInvalid: string;
+        resend: string;
+        resendIn: string;
+        resent: string;
+        confirm: string;
+        done: string;
+    };
     loading: {
         restoringSession: string;
         redirecting: string;
@@ -3847,6 +4886,8 @@ interface SDKMessages {
     };
     errors: {
         networkError: string;
+        /** No answer from the server: offline, or a proxy or gateway failed. */
+        unreachable: string;
         unauthorized: string;
         notFound: string;
         generic: string;
@@ -3874,6 +4915,60 @@ interface SDKMessages {
         fetchExpiringCredits: string;
         fetchWorkspaces: string;
     };
+    /**
+     * Plain-language help the settings screens open from a "?" button
+     * (`FieldHelp`): what a thing is, what it does, and what happens next.
+     */
+    help: {
+        /** The "?" button's name, `{label}` the thing it explains. */
+        button: string;
+        /** A help link's name, `{link}` its words. */
+        linkNewTab: string;
+        twoStep: string;
+        twoStepApp: string;
+        twoStepSms: string;
+        twoStepLostPhone: string;
+        /** Shown under the setup key: it is a secret. */
+        twoStepKeyPrivate: string;
+        backupCodesLabel: string;
+        backupCodes: string;
+        backupCodesKeep: string;
+        backupCodesNew: string;
+        passkeys: string;
+        passkeysWhere: string;
+        passkeysRemove: string;
+        /** `{label}`: the "This device" badge. */
+        devicesThis: string;
+        /** `{label}`: the "Trusted" badge. */
+        devicesTrusted: string;
+        /** `{label}`: the device's Sign out button. */
+        devicesSignOut: string;
+        /** `{label}`: the device's Remove button. */
+        devicesRemove: string;
+        sessionsWhat: string;
+        /** `{label}`: the "This one" badge. */
+        sessionsThis: string;
+        /** `{label}`: the session's Sign out button. */
+        sessionsSignOut: string;
+        sessionsEverywhere: string;
+        connectedAccounts: string;
+        connectedAccountsRemove: string;
+        connectedAccountsLastWay: string;
+        phone: string;
+        phoneCheck: string;
+        reauth: string;
+        reauthHow: string;
+        email: string;
+        emailChange: string;
+        password: string;
+        passwordLeaks: string;
+        passwordForgot: string;
+        /** `{days}`: the app's grace period; `{cancel}`: the Cancel deletion button. */
+        deleteAccountDays: string;
+        deleteAccountNow: string;
+        /** `{cancel}`: the Cancel deletion button. */
+        deleteAccountRange: string;
+    };
 }
 /** Supported locale codes */
 type SDKLocale = 'en' | 'es' | 'fr' | 'de' | 'ja' | 'zh' | 'hi' | 'ar';
@@ -3882,7 +4977,7 @@ type DeepPartialMessages<T> = {
     [K in keyof T]?: T[K] extends string ? string : DeepPartialMessages<T[K]>;
 };
 /**
- * Per-key overrides for SDK UI strings — any subset of the SDKMessages tree.
+ * Per-key overrides for SDK UI strings: any subset of the SDKMessages tree.
  * Deep-merged over the active locale bundle by the translation provider.
  */
 type PartialSDKMessages = DeepPartialMessages<SDKMessages>;
@@ -3914,6 +5009,216 @@ type Level4 = {
 /** Union of all valid translation key paths (e.g. "settings.titles.profile") */
 type TranslationKey = Level2 | Level3 | Level4;
 
+/**
+ * Re-confirm before sensitive actions,
+ * kept apart from React so every step is testable without a DOM.
+ *
+ * A change that needs a recent sign-in answers 403 `reauth_required`. The
+ * person confirms it is still them on the hosted sign-in page, which brings
+ * the browser back with `?reverified=1` and the same session, now recent: no
+ * new session and no code to exchange.
+ *
+ * The server takes a return URL only when it is one of the auth client's
+ * redirect URLs, matched exactly (or by a wildcard the owner registered). The
+ * page a person is on rarely is, so this asks for the page first and, when
+ * the server refuses it with `invalid_return_url`, comes back through the
+ * app's registered `auth.redirectUrl` instead, with the page parked as the
+ * auth intent: the provider continues to it after the hop, as it does after
+ * signing in.
+ */
+
+/** What `requireReverification` takes. */
+interface RequireReverificationOptions {
+    /**
+     * Where to come back to afterwards. Defaults to the page the person is on.
+     * It must be on this app's origin.
+     */
+    returnUrl?: string;
+    /** Ask for the second step too (`['mfa']`), for someone who has one. */
+    factors?: ReverifyFactor[];
+    /**
+     * Go ahead without leaving the page when this session proved who its
+     * person is within this many seconds (and with `factors`, when asked).
+     * Without it the person is always sent to confirm.
+     */
+    maxAgeSeconds?: number;
+}
+/**
+ * `recent`: the session is recent enough, so go ahead now. `redirecting`: the
+ * browser is on its way to the hosted page and the promise's caller should
+ * do nothing more; the page comes back to `returnUrl`.
+ */
+type ReverificationOutcome = 'recent' | 'redirecting';
+/** An error the server answered with `reauth_required`, as the SDK throws it. */
+interface ReauthRequiredError extends Error {
+    status: 403;
+    code: 'reauth_required';
+    /** How recent a sign-in the change needs, in seconds. */
+    maxAgeSeconds?: number;
+    /** What the confirmation must include beyond signing in. */
+    factors?: ReverifyFactor[];
+}
+/**
+ * Whether an error from an SDK call is the server asking for a recent
+ * sign-in. It is never a reason to sign out: re-confirm with
+ * `requireReverification({ factors: error.factors })` and try again.
+ */
+declare function isReauthRequired(error: unknown): error is ReauthRequiredError;
+/**
+ * Whether an error is the server refusing a change because an app owner is
+ * viewing as the user, read-only. Its message says so; show it.
+ */
+declare function isReadOnlySession(error: unknown): boolean;
+/**
+ * Whether an error is the server refusing a sign-in change (email, phone,
+ * username, password, second step, passkeys, linked accounts, guest upgrade)
+ * because an app owner is signed in as the user from the console, with full
+ * access or read-only. Such a change would outlive the session, so it stays
+ * the user's. Its message says so; show it. Never a reason to sign out or to
+ * ask the user to confirm it's them.
+ */
+declare function isImpersonationSignInLocked(error: unknown): boolean;
+
+/**
+ * A typed username as the server stores it (trimmed, lower case), or null
+ * when it is not one: the wrong length or characters, two dots in a row, or
+ * reserved.
+ */
+declare function normaliseUsername(input: unknown): string | null;
+/** Whether `input` is a username the server would take, before asking it. */
+declare function isValidUsername(input: unknown): boolean;
+
+/**
+ * Connecting a crypto wallet to the signed-in account, dependency-free and testable without a browser: the
+ * wallets are passed in, so a test hands over a fake.
+ *
+ * Injected wallets only: an EIP-1193 provider (`window.ethereum`) for
+ * Ethereum and a Phantom-style `window.solana` for Solana. The wallet signs a
+ * Sign-In with Ethereum message (EIP-4361), or its Solana sibling, built from
+ * the nonce, domain, URI and time the server gave; the server checks all of
+ * them, and the signature, before the wallet becomes a way in.
+ */
+
+/**
+ * EIP-55: the address with its checksum casing, or null if it is not an
+ * address. The server checksums the address in the message itself, so this
+ * is for the message to read as wallets expect, not for the server.
+ */
+declare function toChecksumAddress(address: unknown): string | null;
+/**
+ * What the wallet is asked to agree to, as the message's statement line.
+ * English on purpose: EIP-4361 allows only ASCII letters, digits, spaces and
+ * a few marks there, so it cannot carry a translation.
+ */
+declare const WALLET_LINK_STATEMENT = "Connect this wallet to your account.";
+/** What goes into the message, besides what the nonce answer gave. */
+interface WalletMessageInput {
+    chain: WalletChain;
+    /** From the nonce answer: the host the message is for. */
+    domain: string;
+    /** EIP-55 for Ethereum, base58 for Solana. */
+    address: string;
+    /** One line, ASCII. Defaults to `WALLET_LINK_STATEMENT`. */
+    statement?: string;
+    /** From the nonce answer. */
+    uri: string;
+    /** The EIP-155 chain id for Ethereum, the cluster (`mainnet`) for Solana. */
+    chainId: number | string;
+    /** From the nonce answer. */
+    nonce: string;
+    /** From the nonce answer. */
+    issuedAt: string;
+}
+/**
+ * The EIP-4361 message (or its Solana sibling, which only says "Solana
+ * account" on the first line), laid out exactly as the server reads it:
+ *
+ * ```
+ * {domain} wants you to sign in with your Ethereum account:
+ * {address}
+ *
+ * {statement}
+ *
+ * URI: {uri}
+ * Version: 1
+ * Chain ID: {chainId}
+ * Nonce: {nonce}
+ * Issued At: {issuedAt}
+ * ```
+ *
+ * The statement is always there: without one the standard's two blank lines
+ * read as an empty statement to some parsers. A line break in any field would
+ * make it a different message, so one is refused.
+ */
+declare function buildWalletMessage(input: WalletMessageInput): string;
+/** An EIP-1193 provider, as wallets inject it at `window.ethereum`. */
+interface Eip1193Provider {
+    request(args: {
+        method: string;
+        params?: unknown[] | Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** A Solana wallet as Phantom (and wallets copying it) inject it at `window.solana`. */
+interface InjectedSolanaWallet {
+    publicKey?: {
+        toString(): string;
+    } | null;
+    connect(): Promise<{
+        publicKey?: {
+            toString(): string;
+        } | null;
+    } | void>;
+    signMessage(message: Uint8Array, display?: 'utf8' | 'hex'): Promise<{
+        signature: Uint8Array;
+    } | Uint8Array>;
+}
+/**
+ * Why connecting stopped on this side, before or instead of the server
+ * answering. `no_wallet`: nothing injected for that chain. `rejected`: the
+ * person said no in their wallet. `wallet_busy`: the wallet is already asking
+ * them something. `wrong_network`: the wallet is on a chain the app does not
+ * take and would not switch. `no_account`: the wallet gave no usable address.
+ * `wallet_failed`: anything else the wallet did.
+ */
+type WalletFlowErrorCode = 'no_wallet' | 'rejected' | 'wallet_busy' | 'wrong_network' | 'no_account' | 'wallet_failed';
+declare class WalletFlowError extends Error {
+    readonly code: WalletFlowErrorCode;
+    constructor(code: WalletFlowErrorCode, message: string);
+}
+/** The calls on `WorkspaceApi` that connecting a wallet makes. */
+interface WalletLinkApi {
+    requestWalletNonce(chain: WalletChain): Promise<IWalletNonce>;
+    linkWallet(input: IWalletLinkRequest): Promise<IConnectedAccount>;
+}
+/** What connecting a wallet needs. */
+interface ConnectWalletOptions {
+    api: WalletLinkApi;
+    /** The Ethereum wallet; defaults to the one the browser injected. */
+    ethereum?: Eip1193Provider | null;
+    /** The Solana wallet; defaults to the one the browser injected. */
+    solana?: InjectedSolanaWallet | null;
+    /**
+     * The chain ids the app takes, from `getConnectedAccounts().wallet`, for a
+     * nonce answer that does not list them.
+     */
+    ethereumChainIds?: number[];
+    /** The message's statement line. Defaults to `WALLET_LINK_STATEMENT`. */
+    statement?: string;
+}
+/**
+ * Connect a wallet on `chain` to the signed-in account: ask the wallet for
+ * its address, get a nonce, build the message from the nonce answer, have
+ * the wallet sign it (moving an Ethereum wallet to a network the app takes
+ * first, if it is on another), and send it. Resolves with the new row of
+ * connected accounts.
+ *
+ * Throws a `WalletFlowError` when the wallet stops it (none injected, the
+ * person said no, a network the app does not take), and the server's refusal
+ * otherwise (`link_conflict`, `invalid_signature`, `nonce_expired` and the
+ * rest of `WalletErrorCode`).
+ */
+declare function connectWallet(chain: WalletChain, options: ConnectWalletOptions): Promise<IConnectedAccount>;
+
 /**
  * The error an invitation call throws. A plain `Error` (so every existing
  * `catch (err) { err.message }` keeps working) carrying the server's fields
@@ -4161,15 +5466,61 @@ interface SDKUIConfig {
          * ```
          */
         sections?: Partial<Record<WorkspaceSettingsSection, boolean>>;
-        /** Profile screen — hide individual preference fields. */
+        /** Profile screen: hide individual preference fields, or the change of email. */
         profile?: {
             language?: boolean;
             country?: boolean;
             currency?: boolean;
             timezone?: boolean;
+            /**
+             * The Change action on the email, and the note saying why it cannot be
+             * changed. The change is also offered only while the server allows it
+             * for the user.
+             */
+            changeEmail?: boolean;
+            /**
+             * The username field. It shows only while the app has usernames on or
+             * the user has one, and never for a guest.
+             */
+            username?: boolean;
         };
-        /** Security screen — hide passkey row actions. */
+        /**
+         * Security screen: hide passkey row actions, the password, the phone
+         * number, the two-step sign-in, the connected accounts (or only Connect a
+         * wallet) or the Delete account section.
+         */
         security?: {
+            /** The change-password form. Hide it for an app without password sign-in. */
+            password?: boolean;
+            /**
+             * The phone number section: add a number with a code, see it, remove it.
+             * Hide it for an app without phone sign-in or text message codes. It
+             * also hides itself against a server that predates phone numbers.
+             */
+            phone?: boolean;
+            /**
+             * The two-step sign-in (authenticator app) section. It also hides itself
+             * while the app's organization has two-step sign-in turned off.
+             */
+            twoStep?: boolean;
+            /**
+             * The connected accounts section: the social sign-ins and wallets linked
+             * to the user, with Remove, and a Connect button for each one the app
+             * offers. It also hides itself while there is nothing to list or connect.
+             */
+            connectedAccounts?: boolean;
+            /**
+             * Connect a wallet, inside the connected accounts section, while the app
+             * offers wallet sign-in. Wallets already connected are still listed.
+             */
+            wallets?: boolean;
+            /**
+             * The Delete account section: ask for the account to be deleted, and
+             * cancel while it is scheduled. Also the notice at the top of every
+             * screen of the dialog that says when a scheduled deletion runs, with
+             * Cancel deletion.
+             */
+            deleteAccount?: boolean;
             passkeyRename?: boolean;
             passkeyDelete?: boolean;
         };
@@ -4225,6 +5576,12 @@ interface SDKUIConfig {
             pushToggles?: boolean;
         };
     };
+    /**
+     * The bar the provider pins to the bottom of the window while an app owner
+     * is viewing the app as the signed-in person (default true). Set false to
+     * place `<ImpersonationBanner fixed={false} />` in your own layout instead.
+     */
+    impersonationBanner?: boolean;
     /** Workspace switcher dialog (client-side; ANDed with server settings). */
     workspaceSwitcher?: {
         /** Overrides `settings.workspace.showSwitcher` to hide the switcher UI. */
@@ -4238,7 +5595,9 @@ interface SDKUIConfig {
     behavior?: {
         /**
          * Auto-open the plan picker dialog when a workspace has no
-         * subscription. Default true (current behavior).
+         * subscription, and open Plan & Billing after `createWorkspace()`.
+         * Default true. `false` turns both off; an explicit `selectPlan` deep
+         * link still opens the picker.
          */
         autoOpenPlanDialog?: boolean;
         /** Default `daysThreshold` for `WhenTrialEnding` (default 3). */
@@ -4294,7 +5653,7 @@ declare const SUPPORTED_LOCALES: SDKLocale[];
  * ```tsx
  * const { t } = useTranslation();
  *
- * // Simple lookup — autocomplete and compile-time typo checking
+ * // Simple lookup: autocomplete and compile-time typo checking
  * t('settings.common.refresh')  // → 'Refresh'
  *
  * // ICU interpolation with placeholders
@@ -4767,6 +6126,7 @@ type SignOutArg = SignOutOptions | {
 declare function useSaaSAuth(): {
     signIn: (returnUrl?: string) => Promise<void>;
     signOut: (options?: SignOutArg) => Promise<void>;
+    requireReverification: (options?: RequireReverificationOptions) => Promise<ReverificationOutcome>;
     openWorkspaceSettings: (section?: WorkspaceSettingsSection) => void;
     openCreditStore: () => void;
     openPlanPicker: () => void;
@@ -4778,6 +6138,135 @@ declare function useSaaSAuth(): {
     status: AuthStatus;
 };
 
+interface GuestUpgradeProps {
+    /** Extra classes for the root element. */
+    className?: string;
+    /** Heading text. Defaults to the translated title; set to null to hide. */
+    title?: string | null;
+    /** Sub-heading under the title. Defaults to the translated description; set to null to hide. */
+    description?: string | null;
+    /**
+     * Called once the guest is an account: the profile the server answered, and
+     * the address the account now has.
+     */
+    onUpgraded?: (result: {
+        profile: IUser | null;
+        email: string;
+    }) => void;
+}
+/**
+ * "Create your account" for a guest: the address (a name and a password are
+ * optional), then the 6-digit code mailed to it. The guest keeps their id,
+ * their data and this session, and `useSaaSAuth().user` is the account as
+ * soon as the code is accepted. Renders nothing for someone who is not a
+ * guest, apart from the confirmation right after they stopped being one.
+ *
+ * The Profile and Security screens show it in place of the email and the
+ * password for a guest. For a custom UI, use `useGuestUpgrade()`.
+ */
+declare function GuestUpgrade({ className, title, description, onUpgraded }: GuestUpgradeProps): React$1.JSX.Element | null;
+
+interface ImpersonationBannerProps {
+    /** Extra classes for the bar. */
+    className?: string;
+    /**
+     * Pin the bar to the bottom of the window (the default, as the provider
+     * renders it). False renders it in place, for an app that puts it in its
+     * own layout.
+     */
+    fixed?: boolean;
+}
+/**
+ * Says, for as long as it lasts, that an app owner is viewing the app as the
+ * signed-in person: "You are viewing as Ada. Grace signed in as this person,
+ * read-only until 3:15 PM." Exit signs out of that session. Renders nothing
+ * in any other session.
+ *
+ * `SaaSOSProvider` renders it already, pinned to the bottom of the window;
+ * hide that one with `ui.impersonationBanner: false` and place this yourself.
+ */
+declare function ImpersonationBanner({ className, fixed }: ImpersonationBannerProps): React$1.JSX.Element | null;
+
+/**
+ * A guest becoming a real account, as
+ * pure steps so `useGuestUpgrade` is testable without React: each step takes
+ * the state and answers the next one, and never throws.
+ *
+ * Two steps, as changing email is: the address (with a name and a password
+ * when given), then the 6-digit code mailed to it. The user id and everything
+ * on it stay, and so does the session.
+ */
+
+/** Where the upgrade is: asking for the details, waiting for the code, or done. */
+type GuestUpgradeStep = 'details' | 'code' | 'done';
+/** A refusal, as the server worded it. */
+interface GuestUpgradeFailure {
+    /**
+     * The server's sentence, written to be shown. `useGuestUpgrade` gives a
+     * translated one in its place when there is none, and when the server
+     * could not be reached (`unreachable`).
+     */
+    message: string;
+    status?: number;
+    /** The server's reason: a `GuestUpgradeErrorCode`, or another refusal. */
+    code?: string;
+    /** The server never answered: offline, a proxy or gateway failed, or a timeout. */
+    unreachable?: true;
+}
+
+/** What `useGuestUpgrade` returns. */
+interface UseGuestUpgrade {
+    /** The signed-in user is a guest (`useSaaSAuth().user.isAnonymous`). */
+    isGuest: boolean;
+    /** `details`: ask for the address. `code`: a code went to `email`. `done`: an account now. */
+    step: GuestUpgradeStep;
+    /** Where the code went, from the code step on. */
+    email: string | null;
+    /** The account the server answered, once `step` is `done`. */
+    profile: IUser | null;
+    /** What is in flight, for a button's progress. */
+    pending: 'send' | 'resend' | 'confirm' | null;
+    /**
+     * The last refusal, with the server's sentence, or a translated one when
+     * the server could not be reached or said nothing. Cleared by the next try.
+     */
+    error: GuestUpgradeFailure | null;
+    /** Seconds before another code can be sent, counting down. */
+    waitSeconds: number;
+    /** The last code was a resend. */
+    resent: boolean;
+    /** Send a code to `input.email`. Resolves true when it went. */
+    start: (input: IGuestUpgradeRequest) => Promise<boolean>;
+    /** Send the code again, for the same details. */
+    resend: () => Promise<boolean>;
+    /** Become an account with the code. Resolves true when the user is one. */
+    confirm: (code: string) => Promise<boolean>;
+    /** Back to the details step. */
+    reset: () => void;
+}
+/**
+ * Turn a guest into a real account, keeping their id, data and session: the
+ * address (with a name and a password, both optional), then the 6-digit code
+ * mailed to it. On success `useSaaSAuth().user` is the account at once:
+ * `isAnonymous` false, the address verified.
+ *
+ * Refusals keep the server's sentence (`email_unavailable`,
+ * `signup_restricted`, `waitlist_required`, `signup_closed`,
+ * `disposable_email`, `breached_password`, `cooldown` with a countdown,
+ * `invalid_code`, `code_expired`); none of them signs the guest out.
+ * `<GuestUpgrade />` is the ready-made form on top of this.
+ *
+ * @example
+ * ```tsx
+ * const upgrade = useGuestUpgrade();
+ * if (!upgrade.isGuest) return null;
+ * if (upgrade.step === 'details') {
+ *   return <button onClick={() => upgrade.start({ email })}>Send code</button>;
+ * }
+ * ```
+ */
+declare function useGuestUpgrade(): UseGuestUpgrade;
+
 type BuildBaseBadgeVariant = 'built-with' | 'powered-by' | 'mark';
 type BuildBaseBadgeTheme = 'auto' | 'light' | 'neutral' | 'dark';
 type BuildBaseBadgeSize = 'sm' | 'md' | 'lg';
@@ -5056,8 +6545,11 @@ interface UseConnectedAgents {
     revoking: string | null;
     /** Re-fetch the list. */
     refresh: () => Promise<void>;
-    /** Disconnect an agent, then optimistically drop it from the list. */
-    revoke: (clientId: string) => Promise<void>;
+    /**
+     * Disconnect an agent, then drop it from the list. Resolves true once it is
+     * disconnected, false when it was not (the reason is in `error`).
+     */
+    revoke: (clientId: string) => Promise<boolean>;
 }
 /**
  * Headless data + actions for a "Connected agents" screen. Session-authed and
@@ -7723,6 +9215,11 @@ interface SectionHeaderProps {
     description?: string | null;
     /** Optional element aligned to the end of the title row (e.g. a badge or button). */
     actions?: React$1.ReactNode;
+    /**
+     * A help button (`FieldHelp`) right beside the title, or beside the
+     * description when there is no title.
+     */
+    help?: React$1.ReactNode;
     className?: string;
     /** Extra classes for the title, e.g. `text-destructive` for danger sections. */
     titleClassName?: string;
@@ -7732,7 +9229,7 @@ interface SectionHeaderProps {
  * `h3 text-sm font-medium` title + muted `text-sm` description.
  * Renders nothing when both title and description are empty.
  */
-declare function SectionHeader({ title, description, actions, className, titleClassName, }: SectionHeaderProps): React$1.JSX.Element | null;
+declare function SectionHeader({ title, description, actions, help, className, titleClassName, }: SectionHeaderProps): React$1.JSX.Element | null;
 
 interface SidebarNavSectionProps {
     /** Uppercase group label shown above the items. */
@@ -7763,8 +9260,12 @@ interface StatusBannerProps {
     variant: StatusBannerVariant;
     /** Bold first line, e.g. "Error loading subscription data". */
     title?: string;
-    /** Body text under the title (or standalone when there is no title). */
-    message?: string;
+    /**
+     * Body text under the title (or standalone when there is no title). Usually
+     * a string; a node for text that needs its own semantics, such as a
+     * countdown inside `role="timer"`, which is not read out on every tick.
+     */
+    message?: React$1.ReactNode;
     /** Small hint line under the message, e.g. "Retrying may resolve this." */
     description?: string;
     /** Optional leading icon, e.g. `<CheckCircle2 className="h-4 w-4 shrink-0" />`. */
@@ -7773,6 +9274,8 @@ interface StatusBannerProps {
     actionLabel?: string;
     onAction?: () => void;
     actionDisabled?: boolean;
+    /** Shows the action as pending, with a spinner, and disables it while true. */
+    actionProgress?: boolean;
     className?: string;
 }
 /**
@@ -7780,7 +9283,7 @@ interface StatusBannerProps {
  * with an optional Retry/Dismiss action. Use for every inline status box
  * so all screens share the same look.
  */
-declare function StatusBanner({ variant, title, message, description, icon, actionLabel, onAction, actionDisabled, className, }: StatusBannerProps): React$1.JSX.Element;
+declare function StatusBanner({ variant, title, message, description, icon, actionLabel, onAction, actionDisabled, actionProgress, className, }: StatusBannerProps): React$1.JSX.Element;
 
 declare function WorkspaceSwitcher(props: {
     trigger: (isLoading: boolean, currentWorkspace: IWorkspace | null) => ReactNode;
@@ -7889,5 +9392,5 @@ declare class WorkspaceSettingsManager {
 }
 declare const workspaceSettingsManager: WorkspaceSettingsManager;
 
-export { APP_PERMISSION_FALLBACK_GROUP, ApiVersion, AuthApi, AuthStatus, BBAction, BBScreen, BBStatus, BB_PARAM, BaseApi, BetaForm, BillingIntervals, BuildBaseBadge, SaaSOSProvider as BuildBaseProvider, CURRENCY_DISPLAY, CURRENCY_FLAG, ConnectMcpGuide, ConnectedAgents, ConnectedAgentsApi, CreditActionsProvider, CreditBalance, CreditBalanceContextProvider, CreditBucketSource, CreditBucketStatus, CreditStorePage, CreditTransactionType, DEFAULT_ROLE_PERMISSIONS, Devices, DevicesApi, DunningState, EmptyState, EventEmitter, FALLBACK_WORKSPACE_ROLE, FullScreenLoader, INVITATION_ERROR_CODE, InvoiceStatuses, LoadingState, NotificationBell, NotificationInbox, NotificationsApi, PLAN_CURRENCY_CODES, PLAN_CURRENCY_OPTIONS, PUSH_SERVICE_WORKER_SCRIPT, PendingInvitations, Permission, PricingPage, PushApi, PushNotificationProvider, QuotaUsageContextProvider, SDKEvent, SETTINGS_SCREENS, SUPPORTED_LOCALES, SaaSOSProvider, SectionHeader, Sessions, SessionsApi, SettingsApi, SettingsScreen, SidebarNavItem, SidebarNavSection, StatusBanner, SubscriptionContextProvider, SubscriptionItemType, SubscriptionStatus, UPLOAD_ACCEPT, UPLOAD_MAX_BYTES, UploadsApi, UserApi, WhenAuthenticated, WhenCreditsAvailable, WhenCreditsExhausted, WhenCreditsLow, WhenNoSubscription, WhenNotTrialing, WhenPendingInvitations, WhenPermission, WhenQuotaAvailable, WhenQuotaExhausted, WhenQuotaOverage, WhenQuotaThreshold, WhenRoles, WhenSubscription, WhenSubscriptionToPlans, WhenTrialEnding, WhenTrialing, WhenUnauthenticated, WhenUserFeatureDisabled, WhenUserFeatureEnabled, WhenWorkspaceFeatureDisabled, WhenWorkspaceFeatureEnabled, WhenWorkspaceRoles, WorkspaceApi, WorkspaceSwitcher, actionableInvitations, appPermissionCatalogue, calculateBillableSeats, calculateSeatOverageCents, calculateTotalSubscriptionCents, cleanBBParams, clearAuthIntent, clearPendingInvite, coerceBadgeRef, consumeAuthIntent, createBBUrl, createCheckoutRedirectUrls, createCreditPurchaseRedirectUrls, eventEmitter, fillMcpTemplate, formatCents, formatMinorAmountIntl, formatOverageRate, formatOverageRateWithLabel, formatQuotaIncludedOverage, formatQuotaWithPrice, formatUploadLimit, getAvailableBillingIntervals, getAvailableCurrenciesFromPlans, getBasePriceCents, getBillingIntervalAndCurrencyFromPriceId, getCurrencyDecimals, getCurrencyFlag, getCurrencySymbol, getDisplayCurrency, getPerSeatPriceCents, getPricingVariant, getQuotaDisplayValue, getQuotaDisplayWithVariant, getQuotaOverageCents, getQuotaUnitLabelFromName, getSeatPricing, getStripePriceIdForInterval, hasPermission, invalidateCreditBalance, invalidateQuotaUsage, invalidateSubscription, inviterNameOf, isInvitationActionable, isInvitationError, isInvitationLapsed, isZeroDecimalCurrency, mcpServerKey, mergeUIConfig, minorAmountToDisplay, parkPendingInvite, pickDefaultRole, preflightUpload, readBBParams, readPendingInvite, resendCooldownSeconds, resolveMaxUsers, resolvePermissions, resolveRolePermissions, safeRedirect, saveAuthIntent, sortInvitations, uploadFailureOf, uploadPolicyOf, useAllQuotaUsage, useBillingPortal, useCancelSubscription, useConnectedAgents, useConnectedAgentsApi, useConsumeCredits, useCreateCheckoutSession, useCreditBalance, useCreditBalanceContext, useCreditPackages, useCreditTransactions, useDevices, useDevicesApi, useExpiringCredits, useFullScreenLoader, useInvoice, useInvoices, useMcpConnection, useMyInvitations, useNotifications, useNotificationsApi, usePermissions, usePlanGroup, usePlanGroupVersions, usePublicCreditPackages, usePublicPlanGroupVersion, usePublicPlans, usePurchaseCredits, usePushNotifications, useQuotaUsageContext, useQuotaUsageStatus, useRecordUsage, useResumeSubscription, useSaaSAuth, useSaaSOs, useSaaSSettings, useSaaSWorkspaces, useSeatStatus, useSessions, useSessionsApi, useSubscription, useSubscriptionContext, useSubscriptionManagement, useTranslation, useTrialStatus, useUIConfig, useUIVisibility, useUpdateSubscription, useUpload, useUploadsApi, useUsageLogs, useUserAttributes, useUserFeatures, useWorkspaceInvitations, validateInvite, validateRedirectUrl, workspaceIdOf, workspaceNameOf, workspaceSettingsManager };
-export type { BBActionType, BBScreenType, BBStatusType, BadgeHrefOptions, BetaFormData, BetaFormResponse, BillingInterval, BuildBaseBadgeProps, BuildBaseBadgeSize, BuildBaseBadgeTheme, BuildBaseBadgeVariant, SaaSOSProviderProps as BuildBaseProviderProps, CheckoutResult, ConnectMcpGuideProps, ConnectedAgentsProps, CreditActionsDetails, CreditBalanceContextValue, CreditBalanceDetails, CreditBucketSourceType, CreditBucketStatusType, CreditStorePageDetails, CreditTransactionTypeValue, DevicesProps, DunningStateType, EmptyStateProps, EventData, EventType, FormatQuotaWithPriceOptions, FullScreenLoaderProps, GetCheckoutStripeParams, IAllQuotaUsageResponse, IBaseApiConfig, IBasePricing, IBetaConfig, ICheckoutSessionRequest, ICheckoutSessionResponse, ICheckoutStripeOptions, IConnectedAgent, IConsumeCreditsRequest, IConsumeCreditsResponse, ICreditBalance, ICreditBucket, ICreditBucketsQuery, ICreditBucketsResponse, ICreditPackage, ICreditPackagePricingVariant, ICreditPurchaseRequest, ICreditPurchaseResponse, ICreditTransaction, ICreditTransactionsQuery, ICreditTransactionsResponse, IDeviceView, IEventCallbacks, IExpiringCreditsResponse, IInvoice, IInvoiceListResponse, IInvoiceResponse, IIpInfoLite, INotificationItem, IOsConfig, IOsState, IPlan, IPlanGroup, IPlanGroupInfo, IPlanGroupLatestVersion, IPlanGroupResponse, IPlanGroupVersion, IPlanGroupVersionWithPlans, IPlanGroupVersionsResponse, IPlanVersion, IPlanVersionSummary, IPlanVersionWithPlan, IPricingVariant, IPublicCreditPackage, IPublicCreditPackagesResponse, IPublicPlanItem, IPublicPlanItemCategory, IPublicPlanVersion, IPublicPlansResponse, IQuotaByInterval, IQuotaIntervalValue, IQuotaOveragePriceIdsByInterval, IQuotaOveragesByInterval, IQuotaUsageStatus, IQuotaUsageStatusResponse, IRecordUsageRequest, IRecordUsageResponse, ISessionView, ISettings, IStripePricesByInterval, ISubscription, ISubscriptionItem, ISubscriptionResponse, ISubscriptionUpdateRequest, ISubscriptionUpdateResponse, IUploadedFile, IUsageLogEntry, IUsageLogsQuery, IUsageLogsResponse, IUser, IWorkspace, IWorkspaceInvitation, IWorkspaceInvitationPreview, IWorkspaceInvitationStatus, InvitationError, InvitationErrorCode, InvitationErrorFields, InviteBlockReason, InviteValidation, InvoiceStatus, InvoiceStatusType, LoadingProps, LoadingStateProps, MaxUsersConfig, McpClientGuide, McpConnectionConfig, MyNotificationPreferences, NotificationBellProps, NotificationChannelPreference, NotificationCounts, NotificationData, NotificationEvent, NotificationInboxProps, NotificationListParams, NotificationPage, NotificationResult, NotificationScope, OnWorkspaceChangeParams, PartialSDKMessages, PendingInvitationsProps, PermissionContext, PermissionKey, PlanVersionWithPricingVariants, PricingPageDetails, PricingPageProps, QuotaDisplayValue, QuotaDisplayWithOverage, QuotaUsageContextValue, RedirectValidationOptions, Region, RolePermissionMap, SDKLocale, SDKMessages, SDKUIConfig, SaaSOSProviderProps, SeatStatus, SectionHeaderProps, SessionsProps, SettingsManagerState, SidebarNavItemProps, SidebarNavSectionProps, SignOutOptions, StatusBannerProps, StatusBannerVariant, SubscriptionContextValue, SubscriptionItemTypeValue, SubscriptionStatusType, TranslationKey, TrialStatus, UploadFailure, UploadOptions, UploadPolicy, UploadPurpose, UseConnectedAgents, UseDevices, UseMyInvitations, UseNotifications, UseNotificationsOptions, UseSessions, UseUpload, UseWorkspaceInvitations, UserCreatedEventData, UserUpdatedEventData, WorkspaceChangedEventData, WorkspaceCreatedEventData, WorkspaceDeletedEventData, WorkspaceInvitationAcceptedEventData, WorkspaceInvitationDeclinedEventData, WorkspaceInvitationRevokedEventData, WorkspaceInvitationSentEventData, WorkspaceMemberPermissions, WorkspaceNotificationDefault, WorkspacePermissionDefinition, WorkspaceSettingsSection, WorkspaceUpdatedEventData, WorkspaceUserAddedEventData, WorkspaceUserRemovedEventData, WorkspaceUserRoleChangedEventData };
+export { APP_PERMISSION_FALLBACK_GROUP, ApiVersion, AuthApi, AuthStatus, BBAction, BBScreen, BBStatus, BB_PARAM, BaseApi, BetaForm, BillingIntervals, BuildBaseBadge, SaaSOSProvider as BuildBaseProvider, CURRENCY_DISPLAY, CURRENCY_FLAG, ConnectMcpGuide, ConnectedAgents, ConnectedAgentsApi, CreditActionsProvider, CreditBalance, CreditBalanceContextProvider, CreditBucketSource, CreditBucketStatus, CreditStorePage, CreditTransactionType, DEFAULT_ROLE_PERMISSIONS, Devices, DevicesApi, DunningState, EmptyState, EventEmitter, FALLBACK_WORKSPACE_ROLE, FullScreenLoader, GuestUpgrade, INVITATION_ERROR_CODE, ImpersonationBanner, InvoiceStatuses, LoadingState, NotificationBell, NotificationInbox, NotificationsApi, PLAN_CURRENCY_CODES, PLAN_CURRENCY_OPTIONS, PUSH_SERVICE_WORKER_SCRIPT, PendingInvitations, Permission, PricingPage, PushApi, PushNotificationProvider, QuotaUsageContextProvider, SDKEvent, SETTINGS_SCREENS, SUPPORTED_LOCALES, SaaSOSProvider, SectionHeader, Sessions, SessionsApi, SettingsApi, SettingsScreen, SidebarNavItem, SidebarNavSection, StatusBanner, SubscriptionContextProvider, SubscriptionItemType, SubscriptionStatus, UPLOAD_ACCEPT, UPLOAD_MAX_BYTES, UploadsApi, UserApi, WALLET_LINK_STATEMENT, WalletFlowError, WhenAuthenticated, WhenCreditsAvailable, WhenCreditsExhausted, WhenCreditsLow, WhenNoSubscription, WhenNotTrialing, WhenPendingInvitations, WhenPermission, WhenQuotaAvailable, WhenQuotaExhausted, WhenQuotaOverage, WhenQuotaThreshold, WhenRoles, WhenSubscription, WhenSubscriptionToPlans, WhenTrialEnding, WhenTrialing, WhenUnauthenticated, WhenUserFeatureDisabled, WhenUserFeatureEnabled, WhenWorkspaceFeatureDisabled, WhenWorkspaceFeatureEnabled, WhenWorkspaceRoles, WorkspaceApi, WorkspaceSwitcher, actionableInvitations, appPermissionCatalogue, buildWalletMessage, calculateBillableSeats, calculateSeatOverageCents, calculateTotalSubscriptionCents, cleanBBParams, clearAuthIntent, clearPendingInvite, coerceBadgeRef, connectWallet, consumeAuthIntent, createBBUrl, createCheckoutRedirectUrls, createCreditPurchaseRedirectUrls, eventEmitter, fillMcpTemplate, formatCents, formatMinorAmountIntl, formatOverageRate, formatOverageRateWithLabel, formatQuotaIncludedOverage, formatQuotaWithPrice, formatUploadLimit, getAvailableBillingIntervals, getAvailableCurrenciesFromPlans, getBasePriceCents, getBillingIntervalAndCurrencyFromPriceId, getCurrencyDecimals, getCurrencyFlag, getCurrencySymbol, getDisplayCurrency, getPerSeatPriceCents, getPricingVariant, getQuotaDisplayValue, getQuotaDisplayWithVariant, getQuotaOverageCents, getQuotaUnitLabelFromName, getSeatPricing, getStripePriceIdForInterval, hasPermission, invalidateCreditBalance, invalidateQuotaUsage, invalidateSubscription, inviterNameOf, isImpersonationSignInLocked, isInvitationActionable, isInvitationError, isInvitationLapsed, isReadOnlySession, isReauthRequired, isValidUsername, isZeroDecimalCurrency, mcpServerKey, mergeUIConfig, minorAmountToDisplay, normaliseUsername, parkPendingInvite, pickDefaultRole, preflightUpload, readBBParams, readPendingInvite, resendCooldownSeconds, resolveMaxUsers, resolvePermissions, resolveRolePermissions, safeRedirect, saveAuthIntent, sortInvitations, toChecksumAddress, uploadFailureOf, uploadPolicyOf, useAllQuotaUsage, useBillingPortal, useCancelSubscription, useConnectedAgents, useConnectedAgentsApi, useConsumeCredits, useCreateCheckoutSession, useCreditBalance, useCreditBalanceContext, useCreditPackages, useCreditTransactions, useDevices, useDevicesApi, useExpiringCredits, useFullScreenLoader, useGuestUpgrade, useInvoice, useInvoices, useMcpConnection, useMyInvitations, useNotifications, useNotificationsApi, usePermissions, usePlanGroup, usePlanGroupVersions, usePublicCreditPackages, usePublicPlanGroupVersion, usePublicPlans, usePurchaseCredits, usePushNotifications, useQuotaUsageContext, useQuotaUsageStatus, useRecordUsage, useResumeSubscription, useSaaSAuth, useSaaSOs, useSaaSSettings, useSaaSWorkspaces, useSeatStatus, useSessions, useSessionsApi, useSubscription, useSubscriptionContext, useSubscriptionManagement, useTranslation, useTrialStatus, useUIConfig, useUIVisibility, useUpdateSubscription, useUpload, useUploadsApi, useUsageLogs, useUserAttributes, useUserFeatures, useWorkspaceInvitations, validateInvite, validateRedirectUrl, workspaceIdOf, workspaceNameOf, workspaceSettingsManager };
+export type { AccountDeletionErrorCode, AccountLinkErrorReason, BBActionType, BBScreenType, BBStatusType, BadgeHrefOptions, BetaFormData, BetaFormResponse, BillingInterval, BuildBaseBadgeProps, BuildBaseBadgeSize, BuildBaseBadgeTheme, BuildBaseBadgeVariant, SaaSOSProviderProps as BuildBaseProviderProps, ChangeEmailBlockedBy, CheckoutResult, ConnectMcpGuideProps, ConnectWalletOptions, ConnectedAccountErrorCode, ConnectedAgentsProps, CreditActionsDetails, CreditBalanceContextValue, CreditBalanceDetails, CreditBucketSourceType, CreditBucketStatusType, CreditStorePageDetails, CreditTransactionTypeValue, DevicesProps, DunningStateType, Eip1193Provider, EmailChangeErrorCode, EmptyStateProps, EventData, EventType, FormatQuotaWithPriceOptions, FullScreenLoaderProps, GetCheckoutStripeParams, GuestUpgradeErrorCode, GuestUpgradeFailure, GuestUpgradeProps, GuestUpgradeStep, IAccountDeletion, IAccountLinkStart, IAllQuotaUsageResponse, IAvailableAccountProvider, IBaseApiConfig, IBasePricing, IBetaConfig, ICheckoutSessionRequest, ICheckoutSessionResponse, ICheckoutStripeOptions, IConnectedAccount, IConnectedAccounts, IConnectedAgent, IConsumeCreditsRequest, IConsumeCreditsResponse, ICreditBalance, ICreditBucket, ICreditBucketsQuery, ICreditBucketsResponse, ICreditPackage, ICreditPackagePricingVariant, ICreditPurchaseRequest, ICreditPurchaseResponse, ICreditTransaction, ICreditTransactionsQuery, ICreditTransactionsResponse, IDeviceView, IEmailChangeRequest, IEmailChangeResult, IEventCallbacks, IExpiringCreditsResponse, IGuestUpgradeRequest, IGuestUpgradeStarted, IImpersonation, IInvoice, IInvoiceListResponse, IInvoiceResponse, IIpInfoLite, IMfaBackupCodes, IMfaSmsStatus, IMfaStatus, INotificationItem, IOsConfig, IOsState, IOwnedWorkspace, IPhoneCodeSent, IPhoneConfirmed, IPlan, IPlanGroup, IPlanGroupInfo, IPlanGroupLatestVersion, IPlanGroupResponse, IPlanGroupVersion, IPlanGroupVersionWithPlans, IPlanGroupVersionsResponse, IPlanVersion, IPlanVersionSummary, IPlanVersionWithPlan, IPricingVariant, IPublicCreditPackage, IPublicCreditPackagesResponse, IPublicPlanItem, IPublicPlanItemCategory, IPublicPlanVersion, IPublicPlansResponse, IQuotaByInterval, IQuotaIntervalValue, IQuotaOveragePriceIdsByInterval, IQuotaOveragesByInterval, IQuotaUsageStatus, IQuotaUsageStatusResponse, IRecordUsageRequest, IRecordUsageResponse, IRequestOptions, IReverificationStart, ISessionView, ISettings, ISmsEnrollmentResult, IStripePricesByInterval, ISubscription, ISubscriptionItem, ISubscriptionResponse, ISubscriptionUpdateRequest, ISubscriptionUpdateResponse, ITotpEnrollment, IUploadedFile, IUsageLogEntry, IUsageLogsQuery, IUsageLogsResponse, IUser, IUsernamePolicy, IWalletLinkRequest, IWalletNonce, IWalletOptions, IWorkspace, IWorkspaceInvitation, IWorkspaceInvitationPreview, IWorkspaceInvitationStatus, ImpersonationBannerProps, InjectedSolanaWallet, InvitationError, InvitationErrorCode, InvitationErrorFields, InviteBlockReason, InviteValidation, InvoiceStatus, InvoiceStatusType, LoadingProps, LoadingStateProps, MaxUsersConfig, McpClientGuide, McpConnectionConfig, MfaEnforcement, MfaErrorCode, MfaFactorType, MyNotificationPreferences, NotificationBellProps, NotificationChannelPreference, NotificationCounts, NotificationData, NotificationEvent, NotificationInboxProps, NotificationListParams, NotificationPage, NotificationResult, NotificationScope, OnWorkspaceChangeParams, PartialSDKMessages, PasswordChangeErrorCode, PendingInvitationsProps, PermissionContext, PermissionKey, PhoneChannel, PhoneErrorCode, PlanVersionWithPricingVariants, PricingPageDetails, PricingPageProps, QuotaDisplayValue, QuotaDisplayWithOverage, QuotaUsageContextValue, ReauthRequiredError, RedirectValidationOptions, Region, RequireReverificationOptions, ReverificationOutcome, ReverifyErrorCode, ReverifyFactor, RolePermissionMap, SDKLocale, SDKMessages, SDKUIConfig, SaaSOSProviderProps, SeatStatus, SectionHeaderProps, SessionRefusalCode, SessionsProps, SettingsManagerState, SidebarNavItemProps, SidebarNavSectionProps, SignOutOptions, StatusBannerProps, StatusBannerVariant, SubscriptionContextValue, SubscriptionItemTypeValue, SubscriptionStatusType, TranslationKey, TrialStatus, UploadFailure, UploadOptions, UploadPolicy, UploadPurpose, UseConnectedAgents, UseDevices, UseGuestUpgrade, UseMyInvitations, UseNotifications, UseNotificationsOptions, UseSessions, UseUpload, UseWorkspaceInvitations, UserCreatedEventData, UserUpdatedEventData, UsernameErrorCode, WalletChain, WalletErrorCode, WalletFlowErrorCode, WalletLinkApi, WalletMessageInput, WorkspaceChangedEventData, WorkspaceCreatedEventData, WorkspaceDeletedEventData, WorkspaceInvitationAcceptedEventData, WorkspaceInvitationDeclinedEventData, WorkspaceInvitationRevokedEventData, WorkspaceInvitationSentEventData, WorkspaceMemberPermissions, WorkspaceNotificationDefault, WorkspacePermissionDefinition, WorkspaceSettingsSection, WorkspaceUpdatedEventData, WorkspaceUserAddedEventData, WorkspaceUserRemovedEventData, WorkspaceUserRoleChangedEventData };