@dloizides/auth-web 1.12.0 → 1.13.0

package/dist/index.d.mts

@@ -129,18 +129,6 @@ interface AuthScreenProps {
 /** The screen-level auth composition: one centered card the controls share. */
 declare function AuthScreen({ children, theme: themeProp, testID, cardTestID, maxWidth, title, subtitle, footer, }: Readonly<AuthScreenProps>): ReactElement;
 
-/**
- * Label bags for the auth components.
- *
- * `@dloizides/auth-web` ships **no** translation framework — it is i18n-agnostic
- * by design (each app already owns its own i18n). Every user-facing string a
- * component renders is supplied by the consuming app through a typed `labels`
- * prop. The app passes strings it has already localised with `FM()` / `t()`.
- *
- * Each bag has a `DEFAULT_*` constant (English) so a component renders sensibly
- * with no `labels` prop and a consuming app can spread-override only the keys
- * it wants to change.
- */
 /** Strings rendered by `<LoginForm>`. */
 interface LoginFormLabels {
     title: string;
@@ -162,6 +150,8 @@ interface LoginFormLabels {
     /** Shown when one or both fields are empty on submit. */
     missingFields: string;
 }
+declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
+
 /** Strings rendered by `<ForgotPasswordForm>`. */
 interface ForgotPasswordFormLabels {
     title: string;
@@ -189,6 +179,9 @@ interface ForgotPasswordFieldsLabels extends ForgotPasswordFormLabels {
     /** The "close" button shown on the success state. */
     close: string;
 }
+declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
+declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
+
 /** Strings rendered by `<OtpForm>` — the two-step email-OTP login form. */
 interface OtpFormLabels {
     /** Title shown on the request-a-code step. */
@@ -224,6 +217,8 @@ interface OtpFormLabels {
     /** The "use a different email" link text — returns to step 1. */
     changeEmail: string;
 }
+declare const DEFAULT_OTP_LABELS: OtpFormLabels;
+
 /** Strings rendered by `<PinForm>` — the single-step event-PIN login form. */
 interface PinFormLabels {
     /** Title shown above the PIN field. */
@@ -241,6 +236,8 @@ interface PinFormLabels {
     /** Generic "that PIN was wrong / expired / locked out" message. */
     invalidPin: string;
 }
+declare const DEFAULT_PIN_LABELS: PinFormLabels;
+
 /**
  * Strings rendered by `<DevicePinUnlockScreen>` — the returning-device unlock
  * gate. `{name}` / `{count}` placeholders are substituted by the component.
@@ -336,6 +333,10 @@ interface DevicePinSettingsLabels {
     /** Error shown when disabling fails. */
     disableFailed: string;
 }
+declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
+declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
+declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
+
 /** Strings rendered by `<PasskeyLoginButton>` — the login-surface passkey CTA. */
 interface PasskeyLoginLabels {
     /** The "sign in with a passkey" button. */
@@ -365,6 +366,9 @@ interface PasskeySettingsLabels {
     /** Success line shown after returning from a registration. */
     registeredSuccess: string;
 }
+declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
+declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
+
 /** Strings rendered by `<PreferredMethodSettingsCard>` — the cross-device default-method picker. */
 interface PreferredMethodSettingsLabels {
     title: string;
@@ -391,6 +395,9 @@ interface PreferredMethodHintLabels {
     /** Full sentence shown when the cached preference is passkey. */
     passkey: string;
 }
+declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
+declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
+
 /** Strings rendered by `<DemoCredentialsHint>` — the public-demo credentials panel. */
 interface DemoCredentialsHintLabels {
     /** Panel heading (e.g. "Demo access"). */
@@ -405,7 +412,20 @@ interface DemoCredentialsHintLabels {
     useCredentials: string;
     /** Accessibility hint for that button. */
     useCredentialsHint: string;
+    /**
+     * The collapsed disclosure trigger (e.g. "Try the demo").
+     *
+     * Keep the word "demo" in it. This one line is the ONLY thing an evaluator
+     * scanning the page has to find, so it must be searchable by the word they
+     * are looking for — a coy label like "Just looking?" is discreet at the cost
+     * of being undiscoverable, which defeats the point of shipping a demo.
+     */
+    toggle: string;
+    /** Accessibility hint for the disclosure trigger. */
+    toggleHint: string;
 }
+declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
+
 /** Strings rendered by `<ResetPasswordForm>`. */
 interface ResetPasswordFormLabels {
     title: string;
@@ -427,19 +447,6 @@ interface ResetPasswordFormLabels {
     /** Error: a network / 5xx failure. */
     errorNetwork: string;
 }
-declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
-declare const DEFAULT_OTP_LABELS: OtpFormLabels;
-declare const DEFAULT_PIN_LABELS: PinFormLabels;
-declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
-declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
-declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
-declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
-declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
-declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
 declare const DEFAULT_RESET_PASSWORD_LABELS: ResetPasswordFormLabels;
 
 /**
@@ -464,17 +471,8 @@ declare const enum PrefillIntent {
 }
 
 /**
- * `<LoginForm>` — the ready-made, themeable password-login form.
- *
- * The "themeable component" half of the package design: drop it in, pass a
- * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
- * `labels` bag, and you have a branded login surface. It is built on the
- * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
- * one code path.
- *
- * The package ships no router and no i18n. `onSuccess` hands the signed-in
- * `BffUser` back to the app, which decides where to navigate (typically via
- * `resolvePostLoginRoute`). All copy comes from `labels`.
+ * Props for `<LoginForm>`, split out of the component file to keep the render
+ * body under the component size limit. Purely a type module — no runtime code.
  */
 
 interface LoginFormProps {
@@ -531,6 +529,21 @@ interface LoginFormProps {
      */
     prefillIntent?: PrefillIntent;
 }
+
+/**
+ * `<LoginForm>` — the ready-made, themeable password-login form.
+ *
+ * The "themeable component" half of the package design: drop it in, pass a
+ * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
+ * `labels` bag, and you have a branded login surface. It is built on the
+ * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
+ * one code path.
+ *
+ * The package ships no router and no i18n. `onSuccess` hands the signed-in
+ * `BffUser` back to the app, which decides where to navigate (typically via
+ * `resolvePostLoginRoute`). All copy comes from `labels`.
+ */
+
 /** Themeable password-login form built on `useBffAuth`. */
 declare function LoginForm({ client, theme: themeProp, labels: labelsProp, onSuccess, onForgotPassword, onSignUp, testIdPrefix, chromeless, initialUsername, initialPassword, prefillNonce, prefillIntent, }: Readonly<LoginFormProps>): ReactElement;
 
@@ -1284,7 +1297,35 @@ interface PreferredMethodHintProps {
 declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<PreferredMethodHintProps>): ReactElement | null;
 
 /**
- * `<DemoCredentialsHint>` — the public-demo credentials panel.
+ * How `<DemoCredentialsHint>` presents itself on the login surface.
+ *
+ * The two variants answer opposite questions, and the choice is a product
+ * decision rather than a styling one:
+ *
+ *  - `Panel` assumes the page exists FOR the demo — a sales/marketing console
+ *    where every visitor is an evaluator. It advertises loudly.
+ *  - `Disclosure` assumes the page is a real customer's front door that ALSO
+ *    happens to offer a demo. Real account holders outnumber evaluators, so the
+ *    demo collapses behind one quiet line of text and costs them nothing.
+ *
+ * `Disclosure` is the default because the second case is the common one across
+ * the estate: every product login screen is a page paying customers use daily.
+ *
+ * ⚠️ "Discreet" is achieved with SIZE, WEIGHT and POSITION — never by lowering
+ * contrast. Both variants draw their text from `colors.textSecondary`, a token
+ * every app already holds to the WCAG AA 4.5:1 floor. Dimming this further with
+ * opacity would trade an accessibility guarantee for a visual preference; if a
+ * consuming app's `textSecondary` fails AA, that is the app's token to fix.
+ */
+declare const enum DemoCredentialsHintVariant {
+    /** Always-open inset panel with a brand rail. The original presentation. */
+    Panel = "panel",
+    /** One quiet "try the demo" line that expands the credentials on tap. */
+    Disclosure = "disclosure"
+}
+
+/**
+ * `<DemoCredentialsHint>` — the public-demo credentials surface.
  *
  * Mount on the login surface of a product with an OPEN demo account whose
  * credentials are already published (typically on the marketing site). It shows
@@ -1300,9 +1341,36 @@ declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsP
  * Fails closed: no credentials (or a half-configured pair) renders `null` — zero
  * DOM — so a misconfigured env var can never publish an empty demo panel.
  *
- * Compose it as a child of `<AuthScreen>`, above a `chromeless` `<LoginForm>`;
- * `useDemoCredentials` wires the two together. Read-only mode (no `onUse`) drops
- * the button and just displays the credentials.
+ * ## Two variants, and why the default changed in 1.13.0
+ *
+ * Originally this only rendered an always-open panel above the form. That is
+ * right for a page whose whole purpose IS the demo, and wrong for the far more
+ * common case: a login screen paying customers use every day, where an
+ * unmissable "here are some credentials" block is noise at best and a trust
+ * problem at worst.
+ *
+ * `DemoCredentialsHintVariant.Disclosure` — now the default — collapses the
+ * whole thing to one quiet line ("Try the demo") that expands on tap. Pass
+ * `variant={DemoCredentialsHintVariant.Panel}` to keep the original block.
+ *
+ * ⚠️ Two things this deliberately does NOT do to achieve discretion:
+ *
+ *  - **It does not lower contrast.** The trigger uses `colors.textSecondary`,
+ *    the same AA-held token as every other piece of helper copy. Discretion is
+ *    carried by size, placement and the absence of chrome.
+ *  - **It does not hide from assistive tech.** The trigger is a real focusable
+ *    button carrying `accessibilityState.expanded`, so a screen reader
+ *    announces both that it exists and whether it is open. Visually quiet must
+ *    not mean absent — a demo nobody can find is a demo nobody uses.
+ *
+ * ## Layout stability
+ *
+ * The expanded body renders BELOW the trigger, and the component is designed to
+ * sit BELOW `<LoginForm>` (see the zygos login route). Expanding therefore grows
+ * the card downward and never displaces the username or password inputs the
+ * visitor may already be interacting with. Mounting it ABOVE the form would make
+ * every expansion shove the fields down the page — precisely the jarring
+ * behaviour a disclosure exists to avoid.
  */
 
 interface DemoCredentialsHintProps {
@@ -1311,6 +1379,11 @@ interface DemoCredentialsHintProps {
      * username or password — renders nothing at all.
      */
     credentials?: DemoCredentials;
+    /**
+     * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
+     * `Panel` for the original always-open block.
+     */
+    variant?: DemoCredentialsHintVariant;
     /** Explicit theme; overrides any `<AuthThemeProvider>`. */
     theme?: AuthTheme;
     /** Localised copy. Partial — unspecified keys fall back to English defaults. */
@@ -1319,13 +1392,13 @@ interface DemoCredentialsHintProps {
     testIdPrefix?: string;
     /**
      * Called with the resolved credentials when the user taps "use these
-     * credentials". Omit to render the panel read-only (no button) — the values
-     * are still selectable, so a visitor can copy them by hand.
+     * credentials". Omit to render read-only (no button) — the values are still
+     * selectable, so a visitor can copy them by hand.
      */
     onUse?: (credentials: DemoCredentials) => void;
 }
-/** Themeable public-demo credentials panel. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+/** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
+declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1436,6 +1509,7 @@ declare const AuthTestIds: {
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
+    readonly demoCredentialsToggle: "auth-demo-credentials-toggle";
 };
 /** Apply an optional prefix to a base test ID. */
 declare function withTestIdPrefix(baseId: string, prefix?: string): string;
@@ -2253,4 +2327,4 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };

package/dist/index.d.ts

@@ -129,18 +129,6 @@ interface AuthScreenProps {
 /** The screen-level auth composition: one centered card the controls share. */
 declare function AuthScreen({ children, theme: themeProp, testID, cardTestID, maxWidth, title, subtitle, footer, }: Readonly<AuthScreenProps>): ReactElement;
 
-/**
- * Label bags for the auth components.
- *
- * `@dloizides/auth-web` ships **no** translation framework — it is i18n-agnostic
- * by design (each app already owns its own i18n). Every user-facing string a
- * component renders is supplied by the consuming app through a typed `labels`
- * prop. The app passes strings it has already localised with `FM()` / `t()`.
- *
- * Each bag has a `DEFAULT_*` constant (English) so a component renders sensibly
- * with no `labels` prop and a consuming app can spread-override only the keys
- * it wants to change.
- */
 /** Strings rendered by `<LoginForm>`. */
 interface LoginFormLabels {
     title: string;
@@ -162,6 +150,8 @@ interface LoginFormLabels {
     /** Shown when one or both fields are empty on submit. */
     missingFields: string;
 }
+declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
+
 /** Strings rendered by `<ForgotPasswordForm>`. */
 interface ForgotPasswordFormLabels {
     title: string;
@@ -189,6 +179,9 @@ interface ForgotPasswordFieldsLabels extends ForgotPasswordFormLabels {
     /** The "close" button shown on the success state. */
     close: string;
 }
+declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
+declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
+
 /** Strings rendered by `<OtpForm>` — the two-step email-OTP login form. */
 interface OtpFormLabels {
     /** Title shown on the request-a-code step. */
@@ -224,6 +217,8 @@ interface OtpFormLabels {
     /** The "use a different email" link text — returns to step 1. */
     changeEmail: string;
 }
+declare const DEFAULT_OTP_LABELS: OtpFormLabels;
+
 /** Strings rendered by `<PinForm>` — the single-step event-PIN login form. */
 interface PinFormLabels {
     /** Title shown above the PIN field. */
@@ -241,6 +236,8 @@ interface PinFormLabels {
     /** Generic "that PIN was wrong / expired / locked out" message. */
     invalidPin: string;
 }
+declare const DEFAULT_PIN_LABELS: PinFormLabels;
+
 /**
  * Strings rendered by `<DevicePinUnlockScreen>` — the returning-device unlock
  * gate. `{name}` / `{count}` placeholders are substituted by the component.
@@ -336,6 +333,10 @@ interface DevicePinSettingsLabels {
     /** Error shown when disabling fails. */
     disableFailed: string;
 }
+declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
+declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
+declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
+
 /** Strings rendered by `<PasskeyLoginButton>` — the login-surface passkey CTA. */
 interface PasskeyLoginLabels {
     /** The "sign in with a passkey" button. */
@@ -365,6 +366,9 @@ interface PasskeySettingsLabels {
     /** Success line shown after returning from a registration. */
     registeredSuccess: string;
 }
+declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
+declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
+
 /** Strings rendered by `<PreferredMethodSettingsCard>` — the cross-device default-method picker. */
 interface PreferredMethodSettingsLabels {
     title: string;
@@ -391,6 +395,9 @@ interface PreferredMethodHintLabels {
     /** Full sentence shown when the cached preference is passkey. */
     passkey: string;
 }
+declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
+declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
+
 /** Strings rendered by `<DemoCredentialsHint>` — the public-demo credentials panel. */
 interface DemoCredentialsHintLabels {
     /** Panel heading (e.g. "Demo access"). */
@@ -405,7 +412,20 @@ interface DemoCredentialsHintLabels {
     useCredentials: string;
     /** Accessibility hint for that button. */
     useCredentialsHint: string;
+    /**
+     * The collapsed disclosure trigger (e.g. "Try the demo").
+     *
+     * Keep the word "demo" in it. This one line is the ONLY thing an evaluator
+     * scanning the page has to find, so it must be searchable by the word they
+     * are looking for — a coy label like "Just looking?" is discreet at the cost
+     * of being undiscoverable, which defeats the point of shipping a demo.
+     */
+    toggle: string;
+    /** Accessibility hint for the disclosure trigger. */
+    toggleHint: string;
 }
+declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
+
 /** Strings rendered by `<ResetPasswordForm>`. */
 interface ResetPasswordFormLabels {
     title: string;
@@ -427,19 +447,6 @@ interface ResetPasswordFormLabels {
     /** Error: a network / 5xx failure. */
     errorNetwork: string;
 }
-declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
-declare const DEFAULT_OTP_LABELS: OtpFormLabels;
-declare const DEFAULT_PIN_LABELS: PinFormLabels;
-declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
-declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
-declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
-declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
-declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
-declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
 declare const DEFAULT_RESET_PASSWORD_LABELS: ResetPasswordFormLabels;
 
 /**
@@ -464,17 +471,8 @@ declare const enum PrefillIntent {
 }
 
 /**
- * `<LoginForm>` — the ready-made, themeable password-login form.
- *
- * The "themeable component" half of the package design: drop it in, pass a
- * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
- * `labels` bag, and you have a branded login surface. It is built on the
- * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
- * one code path.
- *
- * The package ships no router and no i18n. `onSuccess` hands the signed-in
- * `BffUser` back to the app, which decides where to navigate (typically via
- * `resolvePostLoginRoute`). All copy comes from `labels`.
+ * Props for `<LoginForm>`, split out of the component file to keep the render
+ * body under the component size limit. Purely a type module — no runtime code.
  */
 
 interface LoginFormProps {
@@ -531,6 +529,21 @@ interface LoginFormProps {
      */
     prefillIntent?: PrefillIntent;
 }
+
+/**
+ * `<LoginForm>` — the ready-made, themeable password-login form.
+ *
+ * The "themeable component" half of the package design: drop it in, pass a
+ * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
+ * `labels` bag, and you have a branded login surface. It is built on the
+ * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
+ * one code path.
+ *
+ * The package ships no router and no i18n. `onSuccess` hands the signed-in
+ * `BffUser` back to the app, which decides where to navigate (typically via
+ * `resolvePostLoginRoute`). All copy comes from `labels`.
+ */
+
 /** Themeable password-login form built on `useBffAuth`. */
 declare function LoginForm({ client, theme: themeProp, labels: labelsProp, onSuccess, onForgotPassword, onSignUp, testIdPrefix, chromeless, initialUsername, initialPassword, prefillNonce, prefillIntent, }: Readonly<LoginFormProps>): ReactElement;
 
@@ -1284,7 +1297,35 @@ interface PreferredMethodHintProps {
 declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<PreferredMethodHintProps>): ReactElement | null;
 
 /**
- * `<DemoCredentialsHint>` — the public-demo credentials panel.
+ * How `<DemoCredentialsHint>` presents itself on the login surface.
+ *
+ * The two variants answer opposite questions, and the choice is a product
+ * decision rather than a styling one:
+ *
+ *  - `Panel` assumes the page exists FOR the demo — a sales/marketing console
+ *    where every visitor is an evaluator. It advertises loudly.
+ *  - `Disclosure` assumes the page is a real customer's front door that ALSO
+ *    happens to offer a demo. Real account holders outnumber evaluators, so the
+ *    demo collapses behind one quiet line of text and costs them nothing.
+ *
+ * `Disclosure` is the default because the second case is the common one across
+ * the estate: every product login screen is a page paying customers use daily.
+ *
+ * ⚠️ "Discreet" is achieved with SIZE, WEIGHT and POSITION — never by lowering
+ * contrast. Both variants draw their text from `colors.textSecondary`, a token
+ * every app already holds to the WCAG AA 4.5:1 floor. Dimming this further with
+ * opacity would trade an accessibility guarantee for a visual preference; if a
+ * consuming app's `textSecondary` fails AA, that is the app's token to fix.
+ */
+declare const enum DemoCredentialsHintVariant {
+    /** Always-open inset panel with a brand rail. The original presentation. */
+    Panel = "panel",
+    /** One quiet "try the demo" line that expands the credentials on tap. */
+    Disclosure = "disclosure"
+}
+
+/**
+ * `<DemoCredentialsHint>` — the public-demo credentials surface.
  *
  * Mount on the login surface of a product with an OPEN demo account whose
  * credentials are already published (typically on the marketing site). It shows
@@ -1300,9 +1341,36 @@ declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsP
  * Fails closed: no credentials (or a half-configured pair) renders `null` — zero
  * DOM — so a misconfigured env var can never publish an empty demo panel.
  *
- * Compose it as a child of `<AuthScreen>`, above a `chromeless` `<LoginForm>`;
- * `useDemoCredentials` wires the two together. Read-only mode (no `onUse`) drops
- * the button and just displays the credentials.
+ * ## Two variants, and why the default changed in 1.13.0
+ *
+ * Originally this only rendered an always-open panel above the form. That is
+ * right for a page whose whole purpose IS the demo, and wrong for the far more
+ * common case: a login screen paying customers use every day, where an
+ * unmissable "here are some credentials" block is noise at best and a trust
+ * problem at worst.
+ *
+ * `DemoCredentialsHintVariant.Disclosure` — now the default — collapses the
+ * whole thing to one quiet line ("Try the demo") that expands on tap. Pass
+ * `variant={DemoCredentialsHintVariant.Panel}` to keep the original block.
+ *
+ * ⚠️ Two things this deliberately does NOT do to achieve discretion:
+ *
+ *  - **It does not lower contrast.** The trigger uses `colors.textSecondary`,
+ *    the same AA-held token as every other piece of helper copy. Discretion is
+ *    carried by size, placement and the absence of chrome.
+ *  - **It does not hide from assistive tech.** The trigger is a real focusable
+ *    button carrying `accessibilityState.expanded`, so a screen reader
+ *    announces both that it exists and whether it is open. Visually quiet must
+ *    not mean absent — a demo nobody can find is a demo nobody uses.
+ *
+ * ## Layout stability
+ *
+ * The expanded body renders BELOW the trigger, and the component is designed to
+ * sit BELOW `<LoginForm>` (see the zygos login route). Expanding therefore grows
+ * the card downward and never displaces the username or password inputs the
+ * visitor may already be interacting with. Mounting it ABOVE the form would make
+ * every expansion shove the fields down the page — precisely the jarring
+ * behaviour a disclosure exists to avoid.
  */
 
 interface DemoCredentialsHintProps {
@@ -1311,6 +1379,11 @@ interface DemoCredentialsHintProps {
      * username or password — renders nothing at all.
      */
     credentials?: DemoCredentials;
+    /**
+     * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
+     * `Panel` for the original always-open block.
+     */
+    variant?: DemoCredentialsHintVariant;
     /** Explicit theme; overrides any `<AuthThemeProvider>`. */
     theme?: AuthTheme;
     /** Localised copy. Partial — unspecified keys fall back to English defaults. */
@@ -1319,13 +1392,13 @@ interface DemoCredentialsHintProps {
     testIdPrefix?: string;
     /**
      * Called with the resolved credentials when the user taps "use these
-     * credentials". Omit to render the panel read-only (no button) — the values
-     * are still selectable, so a visitor can copy them by hand.
+     * credentials". Omit to render read-only (no button) — the values are still
+     * selectable, so a visitor can copy them by hand.
      */
     onUse?: (credentials: DemoCredentials) => void;
 }
-/** Themeable public-demo credentials panel. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+/** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
+declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1436,6 +1509,7 @@ declare const AuthTestIds: {
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
+    readonly demoCredentialsToggle: "auth-demo-credentials-toggle";
 };
 /** Apply an optional prefix to a base test ID. */
 declare function withTestIdPrefix(baseId: string, prefix?: string): string;
@@ -2253,4 +2327,4 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };