@dloizides/auth-web 1.12.1 → 1.14.0

package/dist/index.d.mts

@@ -62,7 +62,21 @@ interface AuthThemeTypography {
     title: number;
     /** Form subtitle. */
     subtitle: number;
-    /** Field labels. */
+    /**
+     * Field labels.
+     *
+     * The shared forms contract ("The TWO legitimate label voices", mirrored in
+     * `@dloizides/ui-forms`' `labelVariants.ts`) defines exactly two: `field` —
+     * 13 / 600 / sentence case, a label that is READ — and `control` — 11 / 700 /
+     * uppercase, a label that is SCANNED. Auth field labels are prose addressed to
+     * the person signing in, so they are the `field` voice: **13**.
+     *
+     * Through 1.13.0 this default was 14, which is neither voice — drift. Every
+     * portal that renders `<LoginForm>` inherits this token (all of them reuse
+     * `defaultAuthTheme.typography` verbatim), so the drift was uniform across
+     * zygos, agora, erevna, katalogos and ichnos, and it read against the 13px
+     * `Field` labels those same apps use on every non-auth form.
+     */
     label: number;
     /** Input text and button text. */
     body: number;
@@ -412,6 +426,17 @@ interface DemoCredentialsHintLabels {
     useCredentials: string;
     /** Accessibility hint for that button. */
     useCredentialsHint: string;
+    /**
+     * The collapsed disclosure trigger (e.g. "Try the demo").
+     *
+     * Keep the word "demo" in it. This one line is the ONLY thing an evaluator
+     * scanning the page has to find, so it must be searchable by the word they
+     * are looking for — a coy label like "Just looking?" is discreet at the cost
+     * of being undiscoverable, which defeats the point of shipping a demo.
+     */
+    toggle: string;
+    /** Accessibility hint for the disclosure trigger. */
+    toggleHint: string;
 }
 declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
 
@@ -1286,7 +1311,35 @@ interface PreferredMethodHintProps {
 declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<PreferredMethodHintProps>): ReactElement | null;
 
 /**
- * `<DemoCredentialsHint>` — the public-demo credentials panel.
+ * How `<DemoCredentialsHint>` presents itself on the login surface.
+ *
+ * The two variants answer opposite questions, and the choice is a product
+ * decision rather than a styling one:
+ *
+ *  - `Panel` assumes the page exists FOR the demo — a sales/marketing console
+ *    where every visitor is an evaluator. It advertises loudly.
+ *  - `Disclosure` assumes the page is a real customer's front door that ALSO
+ *    happens to offer a demo. Real account holders outnumber evaluators, so the
+ *    demo collapses behind one quiet line of text and costs them nothing.
+ *
+ * `Disclosure` is the default because the second case is the common one across
+ * the estate: every product login screen is a page paying customers use daily.
+ *
+ * ⚠️ "Discreet" is achieved with SIZE, WEIGHT and POSITION — never by lowering
+ * contrast. Both variants draw their text from `colors.textSecondary`, a token
+ * every app already holds to the WCAG AA 4.5:1 floor. Dimming this further with
+ * opacity would trade an accessibility guarantee for a visual preference; if a
+ * consuming app's `textSecondary` fails AA, that is the app's token to fix.
+ */
+declare const enum DemoCredentialsHintVariant {
+    /** Always-open inset panel with a brand rail. The original presentation. */
+    Panel = "panel",
+    /** One quiet "try the demo" line that expands the credentials on tap. */
+    Disclosure = "disclosure"
+}
+
+/**
+ * `<DemoCredentialsHint>` — the public-demo credentials surface.
  *
  * Mount on the login surface of a product with an OPEN demo account whose
  * credentials are already published (typically on the marketing site). It shows
@@ -1302,9 +1355,42 @@ declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsP
  * Fails closed: no credentials (or a half-configured pair) renders `null` — zero
  * DOM — so a misconfigured env var can never publish an empty demo panel.
  *
- * Compose it as a child of `<AuthScreen>`, above a `chromeless` `<LoginForm>`;
- * `useDemoCredentials` wires the two together. Read-only mode (no `onUse`) drops
- * the button and just displays the credentials.
+ * ## Two variants, and why the default changed in 1.13.0
+ *
+ * Originally this only rendered an always-open panel above the form. That is
+ * right for a page whose whole purpose IS the demo, and wrong for the far more
+ * common case: a login screen paying customers use every day, where an
+ * unmissable "here are some credentials" block is noise at best and a trust
+ * problem at worst.
+ *
+ * `DemoCredentialsHintVariant.Disclosure` — now the default — collapses the
+ * whole thing to one quiet line ("Try the demo") that expands on tap. Pass
+ * `variant={DemoCredentialsHintVariant.Panel}` to keep the original block.
+ *
+ * ⚠️ Two things this deliberately does NOT do to achieve discretion:
+ *
+ *  - **It does not lower contrast.** The trigger uses `colors.textSecondary`,
+ *    the same AA-held token as every other piece of helper copy. Discretion is
+ *    carried by size, placement and the absence of chrome.
+ *  - **It does not hide from assistive tech.** The trigger is a real focusable
+ *    button carrying an explicit `aria-expanded` (plus `accessibilityState` for
+ *    native), so a screen reader announces both that it exists and whether it is
+ *    open. Visually quiet must not mean absent — a demo nobody can find is a demo
+ *    nobody uses.
+ *
+ *    ⚠️ Through 1.13.0 this carried ONLY `accessibilityState={{ expanded }}` and
+ *    therefore announced nothing on web: react-native-web 0.21.2 does not read
+ *    `accessibilityState`, so the rendered button had no `aria-expanded` at all.
+ *    The old unit test asserted the React *prop*, so it passed against the bug.
+ *
+ * ## Layout stability
+ *
+ * The expanded body renders BELOW the trigger, and the component is designed to
+ * sit BELOW `<LoginForm>` (see the zygos login route). Expanding therefore grows
+ * the card downward and never displaces the username or password inputs the
+ * visitor may already be interacting with. Mounting it ABOVE the form would make
+ * every expansion shove the fields down the page — precisely the jarring
+ * behaviour a disclosure exists to avoid.
  */
 
 interface DemoCredentialsHintProps {
@@ -1313,6 +1399,11 @@ interface DemoCredentialsHintProps {
      * username or password — renders nothing at all.
      */
     credentials?: DemoCredentials;
+    /**
+     * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
+     * `Panel` for the original always-open block.
+     */
+    variant?: DemoCredentialsHintVariant;
     /** Explicit theme; overrides any `<AuthThemeProvider>`. */
     theme?: AuthTheme;
     /** Localised copy. Partial — unspecified keys fall back to English defaults. */
@@ -1321,13 +1412,13 @@ interface DemoCredentialsHintProps {
     testIdPrefix?: string;
     /**
      * Called with the resolved credentials when the user taps "use these
-     * credentials". Omit to render the panel read-only (no button) — the values
-     * are still selectable, so a visitor can copy them by hand.
+     * credentials". Omit to render read-only (no button) — the values are still
+     * selectable, so a visitor can copy them by hand.
      */
     onUse?: (credentials: DemoCredentials) => void;
 }
-/** Themeable public-demo credentials panel. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+/** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
+declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1438,6 +1529,7 @@ declare const AuthTestIds: {
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
+    readonly demoCredentialsToggle: "auth-demo-credentials-toggle";
 };
 /** Apply an optional prefix to a base test ID. */
 declare function withTestIdPrefix(baseId: string, prefix?: string): string;
@@ -2255,4 +2347,4 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };

package/dist/index.d.ts

@@ -62,7 +62,21 @@ interface AuthThemeTypography {
     title: number;
     /** Form subtitle. */
     subtitle: number;
-    /** Field labels. */
+    /**
+     * Field labels.
+     *
+     * The shared forms contract ("The TWO legitimate label voices", mirrored in
+     * `@dloizides/ui-forms`' `labelVariants.ts`) defines exactly two: `field` —
+     * 13 / 600 / sentence case, a label that is READ — and `control` — 11 / 700 /
+     * uppercase, a label that is SCANNED. Auth field labels are prose addressed to
+     * the person signing in, so they are the `field` voice: **13**.
+     *
+     * Through 1.13.0 this default was 14, which is neither voice — drift. Every
+     * portal that renders `<LoginForm>` inherits this token (all of them reuse
+     * `defaultAuthTheme.typography` verbatim), so the drift was uniform across
+     * zygos, agora, erevna, katalogos and ichnos, and it read against the 13px
+     * `Field` labels those same apps use on every non-auth form.
+     */
     label: number;
     /** Input text and button text. */
     body: number;
@@ -412,6 +426,17 @@ interface DemoCredentialsHintLabels {
     useCredentials: string;
     /** Accessibility hint for that button. */
     useCredentialsHint: string;
+    /**
+     * The collapsed disclosure trigger (e.g. "Try the demo").
+     *
+     * Keep the word "demo" in it. This one line is the ONLY thing an evaluator
+     * scanning the page has to find, so it must be searchable by the word they
+     * are looking for — a coy label like "Just looking?" is discreet at the cost
+     * of being undiscoverable, which defeats the point of shipping a demo.
+     */
+    toggle: string;
+    /** Accessibility hint for the disclosure trigger. */
+    toggleHint: string;
 }
 declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
 
@@ -1286,7 +1311,35 @@ interface PreferredMethodHintProps {
 declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<PreferredMethodHintProps>): ReactElement | null;
 
 /**
- * `<DemoCredentialsHint>` — the public-demo credentials panel.
+ * How `<DemoCredentialsHint>` presents itself on the login surface.
+ *
+ * The two variants answer opposite questions, and the choice is a product
+ * decision rather than a styling one:
+ *
+ *  - `Panel` assumes the page exists FOR the demo — a sales/marketing console
+ *    where every visitor is an evaluator. It advertises loudly.
+ *  - `Disclosure` assumes the page is a real customer's front door that ALSO
+ *    happens to offer a demo. Real account holders outnumber evaluators, so the
+ *    demo collapses behind one quiet line of text and costs them nothing.
+ *
+ * `Disclosure` is the default because the second case is the common one across
+ * the estate: every product login screen is a page paying customers use daily.
+ *
+ * ⚠️ "Discreet" is achieved with SIZE, WEIGHT and POSITION — never by lowering
+ * contrast. Both variants draw their text from `colors.textSecondary`, a token
+ * every app already holds to the WCAG AA 4.5:1 floor. Dimming this further with
+ * opacity would trade an accessibility guarantee for a visual preference; if a
+ * consuming app's `textSecondary` fails AA, that is the app's token to fix.
+ */
+declare const enum DemoCredentialsHintVariant {
+    /** Always-open inset panel with a brand rail. The original presentation. */
+    Panel = "panel",
+    /** One quiet "try the demo" line that expands the credentials on tap. */
+    Disclosure = "disclosure"
+}
+
+/**
+ * `<DemoCredentialsHint>` — the public-demo credentials surface.
  *
  * Mount on the login surface of a product with an OPEN demo account whose
  * credentials are already published (typically on the marketing site). It shows
@@ -1302,9 +1355,42 @@ declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsP
  * Fails closed: no credentials (or a half-configured pair) renders `null` — zero
  * DOM — so a misconfigured env var can never publish an empty demo panel.
  *
- * Compose it as a child of `<AuthScreen>`, above a `chromeless` `<LoginForm>`;
- * `useDemoCredentials` wires the two together. Read-only mode (no `onUse`) drops
- * the button and just displays the credentials.
+ * ## Two variants, and why the default changed in 1.13.0
+ *
+ * Originally this only rendered an always-open panel above the form. That is
+ * right for a page whose whole purpose IS the demo, and wrong for the far more
+ * common case: a login screen paying customers use every day, where an
+ * unmissable "here are some credentials" block is noise at best and a trust
+ * problem at worst.
+ *
+ * `DemoCredentialsHintVariant.Disclosure` — now the default — collapses the
+ * whole thing to one quiet line ("Try the demo") that expands on tap. Pass
+ * `variant={DemoCredentialsHintVariant.Panel}` to keep the original block.
+ *
+ * ⚠️ Two things this deliberately does NOT do to achieve discretion:
+ *
+ *  - **It does not lower contrast.** The trigger uses `colors.textSecondary`,
+ *    the same AA-held token as every other piece of helper copy. Discretion is
+ *    carried by size, placement and the absence of chrome.
+ *  - **It does not hide from assistive tech.** The trigger is a real focusable
+ *    button carrying an explicit `aria-expanded` (plus `accessibilityState` for
+ *    native), so a screen reader announces both that it exists and whether it is
+ *    open. Visually quiet must not mean absent — a demo nobody can find is a demo
+ *    nobody uses.
+ *
+ *    ⚠️ Through 1.13.0 this carried ONLY `accessibilityState={{ expanded }}` and
+ *    therefore announced nothing on web: react-native-web 0.21.2 does not read
+ *    `accessibilityState`, so the rendered button had no `aria-expanded` at all.
+ *    The old unit test asserted the React *prop*, so it passed against the bug.
+ *
+ * ## Layout stability
+ *
+ * The expanded body renders BELOW the trigger, and the component is designed to
+ * sit BELOW `<LoginForm>` (see the zygos login route). Expanding therefore grows
+ * the card downward and never displaces the username or password inputs the
+ * visitor may already be interacting with. Mounting it ABOVE the form would make
+ * every expansion shove the fields down the page — precisely the jarring
+ * behaviour a disclosure exists to avoid.
  */
 
 interface DemoCredentialsHintProps {
@@ -1313,6 +1399,11 @@ interface DemoCredentialsHintProps {
      * username or password — renders nothing at all.
      */
     credentials?: DemoCredentials;
+    /**
+     * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
+     * `Panel` for the original always-open block.
+     */
+    variant?: DemoCredentialsHintVariant;
     /** Explicit theme; overrides any `<AuthThemeProvider>`. */
     theme?: AuthTheme;
     /** Localised copy. Partial — unspecified keys fall back to English defaults. */
@@ -1321,13 +1412,13 @@ interface DemoCredentialsHintProps {
     testIdPrefix?: string;
     /**
      * Called with the resolved credentials when the user taps "use these
-     * credentials". Omit to render the panel read-only (no button) — the values
-     * are still selectable, so a visitor can copy them by hand.
+     * credentials". Omit to render read-only (no button) — the values are still
+     * selectable, so a visitor can copy them by hand.
      */
     onUse?: (credentials: DemoCredentials) => void;
 }
-/** Themeable public-demo credentials panel. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+/** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
+declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1438,6 +1529,7 @@ declare const AuthTestIds: {
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
+    readonly demoCredentialsToggle: "auth-demo-credentials-toggle";
 };
 /** Apply an optional prefix to a base test ID. */
 declare function withTestIdPrefix(baseId: string, prefix?: string): string;
@@ -2255,4 +2347,4 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };