@movmo_app/react-common 0.13.0 → 0.14.1

package/dist/index.d.ts

@@ -1,12 +1,16 @@
-import { AuthenticationChallengeName } from '@movmo_app/types';
-import { AuthenticationUsernameType } from '@movmo_app/types';
+import { AuthErrorCode } from '@movmo_app/types';
 import * as AvatarPrimitive from '@radix-ui/react-avatar';
 import * as CheckboxPrimitive from '@radix-ui/react-checkbox';
 import { default as default_2 } from 'react';
 import { Gender } from '@movmo_app/types';
 import { JSX as JSX_2 } from 'react/jsx-runtime';
-import { LoginUserResponse } from '@movmo_app/types';
+import { MovmoCodeFlow } from '@movmo_app/types';
+import { MovmoLoginResponse } from '@movmo_app/types';
+import { MovmoVerifyResponse } from '@movmo_app/types';
 import { OTPAction } from '@movmo_app/types';
+import { PasskeyOptionsResponse } from '@movmo_app/types';
+import { PasskeyRegistrationStart } from '@movmo_app/types';
+import { PasskeySummary } from '@movmo_app/types';
 import * as React_2 from 'react';
 import * as SeparatorPrimitive from '@radix-ui/react-separator';
 import { SingleValue } from 'react-select';
@@ -15,6 +19,21 @@ import * as SwitchPrimitive from '@radix-ui/react-switch';
 import * as ToggleGroupPrimitive from '@radix-ui/react-toggle-group';
 import { User } from '@movmo_app/types';
 
+/** Untitled UI `alert-circle`. */
+export declare const AlertCircleIcon: (props: IconProps) => JSX_2.Element;
+
+/** Uniform error every `MovmoAuthApi` method rejects with. */
+export declare class AuthError extends Error {
+    status: number;
+    code: AuthErrorCode | 'network' | 'unknown';
+    retryAfter?: number | undefined;
+    attemptsRemaining?: number | undefined;
+    constructor(status: number, code: AuthErrorCode | 'network' | 'unknown', retryAfter?: number | undefined, attemptsRemaining?: number | undefined);
+}
+
+/** Autofill options live 5 min on the server; refresh at 4½. */
+export declare const AUTOFILL_REFRESH_MS = 270000;
+
 export declare const Avatar: React_2.ForwardRefExoticComponent<AvatarProps & React_2.RefAttributes<HTMLSpanElement>>;
 
 export declare const AvatarFallback: React_2.ForwardRefExoticComponent<Omit<AvatarPrimitive.AvatarFallbackProps & React_2.RefAttributes<HTMLSpanElement>, "ref"> & React_2.RefAttributes<HTMLSpanElement>>;
@@ -53,8 +72,25 @@ export declare const CardHeader: React_2.ForwardRefExoticComponent<React_2.HTMLA
 
 export declare const CardTitle: React_2.ForwardRefExoticComponent<React_2.HTMLAttributes<HTMLDivElement> & React_2.RefAttributes<HTMLDivElement>>;
 
+/**
+ * Guards a single in-flight WebAuthn ceremony at a time. `begin()` aborts
+ * whatever ceremony was previously outstanding (so a stale
+ * `navigator.credentials.get/create` call settles with an `AbortError`
+ * instead of racing a newer one) and hands back a fresh signal; `abort()`
+ * cancels the current ceremony outright (e.g. the user navigated away).
+ */
+export declare class CeremonyGate {
+    private current;
+    begin(): AbortSignal;
+    abort(): void;
+    private abortCurrent;
+}
+
 export declare const Checkbox: React_2.ForwardRefExoticComponent<Omit<CheckboxPrimitive.CheckboxProps & React_2.RefAttributes<HTMLButtonElement>, "ref"> & React_2.RefAttributes<HTMLButtonElement>>;
 
+/** Untitled UI `check-circle`. */
+export declare const CheckCircleIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const Chip: React_2.ForwardRefExoticComponent<ChipProps & React_2.RefAttributes<HTMLSpanElement>>;
 
 declare interface ChipProps extends React_2.HTMLAttributes<HTMLSpanElement> {
@@ -62,6 +98,28 @@ declare interface ChipProps extends React_2.HTMLAttributes<HTMLSpanElement> {
     onRemove?: () => void;
 }
 
+/**
+ * Classifies a thrown WebAuthn error by its `DOMException` name:
+ * `NotAllowedError` → cancelled, `AbortError` → aborted,
+ * `InvalidStateError` → exists (credential already registered),
+ * `NotSupportedError` → unsupported, `SecurityError` → security.
+ * Anything else (including non-`DOMException` values) → unknown.
+ */
+export declare function classifyWebAuthnError(e: unknown): WebAuthnFailure;
+
+/** Untitled UI `cloud-01`. */
+export declare const CloudIcon: (props: IconProps) => JSX_2.Element;
+
+/**
+ * The `Domain` attribute value for a prompt-cookie write on this host, or
+ * `undefined` for a host-only cookie: `localhost`, any bare hostname (fewer
+ * than two labels), an IPv4 dotted quad, or anything containing `:` (IPv6 —
+ * literal or bracketed). Otherwise `.` + the last two labels, so every
+ * `*.movmo.io` host (including white-label `*.app.movmo.io` airline hosts)
+ * shares the same cookie.
+ */
+export declare function cookieDomain(host: string): string | undefined;
+
 /**
  * Full ISO 3166-1 alpha-2 country list as SelectDropdownOption[].
  * US, CA, GB, AU are pinned at the top for quick access.
@@ -69,6 +127,44 @@ declare interface ChipProps extends React_2.HTMLAttributes<HTMLSpanElement> {
  */
 export declare const COUNTRY_OPTIONS: SelectDropdownOption[];
 
+/**
+ * Builds a `MovmoAuthApi` over a caller-supplied `HttpClient`. `opts.locale`
+ * is read at call time (not cached), defaulting to `'en-US'`.
+ */
+export declare function createMovmoAuthApi(client: HttpClient, opts?: {
+    locale?: () => string;
+}): MovmoAuthApi;
+
+/**
+ * Runs a `navigator.credentials.create` ceremony (registration).
+ * `securityKey: true` sets `publicKey.hints = ['security-key']` and
+ * `publicKey.authenticatorSelection.authenticatorAttachment =
+ * 'cross-platform'` on a clone of the caller's options — `o` itself, and
+ * any nested object on it, is never mutated.
+ */
+export declare function createPasskey(o: WebAuthnOptionsLike, a: {
+    signal: AbortSignal;
+    securityKey?: boolean;
+}): Promise<CredentialJSON>;
+
+/**
+ * Browser-level WebAuthn helpers (MOVMO-685, task 4.2).
+ *
+ * Wraps `navigator.credentials.get`/`create` plus the newer JSON conversion
+ * helpers (`PublicKeyCredential.parseRequestOptionsFromJSON`,
+ * `parseCreationOptionsFromJSON`, and the instance `toJSON()`), which are not
+ * yet part of TypeScript's `lib.dom` (TS 5.6). Those are feature-detected at
+ * runtime and declared locally below so the extra surface never leaks into
+ * consumers' global types. When unavailable, options/credentials are
+ * converted by hand using base64url.
+ *
+ * `@movmo_app/types` doesn't yet publish WebAuthn option/credential types
+ * (pending 1.21.0), so `CredentialJSON`/`WebAuthnOptionsLike` are defined
+ * here — structurally identical to what that package will eventually export.
+ */
+/** A WebAuthn credential serialized to its JSON-friendly (base64url) shape. */
+export declare type CredentialJSON = Record<string, unknown>;
+
 export declare const CURRENCY_OPTIONS: CurrencyOption[];
 
 export declare const CurrencyModal: default_2.FC<CurrencyModalProps>;
@@ -114,14 +210,50 @@ export declare interface DateDropdownsProps {
 
 export declare const DEFAULT_LOCALE: LocaleOption;
 
+export declare function detectSupport(): Promise<WebAuthnSupport>;
+
+/** Records that the traveler dismissed the prompt ("Not now") today (epoch days), resetting the sign-in count. */
+export declare function dismissPrompt(now?: number): void;
+
+/** Untitled UI `face-id`. */
+export declare const FaceIdIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const findCurrencyOption: (code: string) => CurrencyOption;
 
 export declare const findLocaleOption: (languageCode: string, regionCode: string) => LocaleOption;
 
+/** Untitled UI `fingerprint-04`. */
+export declare const FingerprintIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const getCurrencyDisplayText: (option: CurrencyOption) => string;
 
 export declare const getLanguageDisplayName: (option: LocaleOption) => string;
 
+/**
+ * Runs a `navigator.credentials.get` ceremony (sign-in). `conditional: true`
+ * requests autofill-UI mediation; the caller's `o` is never mutated.
+ */
+export declare function getPasskey(o: WebAuthnOptionsLike, a: {
+    signal: AbortSignal;
+    conditional?: boolean;
+}): Promise<CredentialJSON>;
+
+/** Minimal HTTP surface `createMovmoAuthApi` needs from a caller's client. */
+export declare interface HttpClient {
+    get<T = unknown>(url: string): Promise<{
+        status: number;
+        data: T;
+    }>;
+    post<T = unknown>(url: string, body?: unknown): Promise<{
+        status: number;
+        data: T;
+    }>;
+    delete<T = unknown>(url: string): Promise<{
+        status: number;
+        data: T;
+    }>;
+}
+
 export declare const IconButton: React_2.ForwardRefExoticComponent<IconButtonProps & React_2.RefAttributes<HTMLButtonElement>>;
 
 declare interface IconButtonProps extends React_2.ButtonHTMLAttributes<HTMLButtonElement> {
@@ -129,10 +261,29 @@ declare interface IconButtonProps extends React_2.ButtonHTMLAttributes<HTMLButto
     size?: 'sm' | 'md' | 'lg';
 }
 
+export declare type IconProps = React_2.SVGProps<SVGSVGElement> & {
+    /** Width/height in px. Defaults to 20. */
+    size?: number;
+    /**
+     * Accessible name. When set, the icon renders `role="img"` with a `<title>`
+     * instead of being hidden from assistive tech.
+     */
+    title?: string;
+};
+
+/** "Incorrect code. N attempts left." (singular "1 attempt left."). */
+export declare function incorrectCode(attemptsRemaining?: number): string;
+
 export declare const Input: React_2.ForwardRefExoticComponent<Omit<React_2.ClassAttributes<HTMLInputElement> & React_2.InputHTMLAttributes<HTMLInputElement> & {
     required?: boolean;
 }, "ref"> & React_2.RefAttributes<HTMLInputElement>>;
 
+/** Untitled UI `key-01`. */
+export declare const KeyIcon: (props: IconProps) => JSX_2.Element;
+
+/** Untitled UI `laptop-01`. */
+export declare const LaptopIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const LOCALE_OPTIONS: LocaleOption[];
 
 export declare const LOCALE_STORAGE_KEY = "movmo_locale_preferences";
@@ -156,22 +307,119 @@ export declare interface LocaleOption {
     regionDisplay: string;
 }
 
+/** Untitled UI `log-in-01`. */
+export declare const LogInIcon: (props: IconProps) => JSX_2.Element;
+
+/** Untitled UI `mail-01`. */
+export declare const MailIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const Modal: default_2.FC<ModalProps>;
 
 export declare interface ModalProps {
     isOpen: boolean;
     onClose: () => void;
+    /**
+     * Header title. With `header="none"` it isn't rendered; a string title then
+     * becomes the dialog's accessible name (`aria-label`).
+     */
     title: default_2.ReactNode;
     children: default_2.ReactNode;
     footer?: default_2.ReactNode;
     maxWidth?: string;
     maxWidthPx?: number;
     footerHasBorder?: boolean;
+    /** Hides the X and disables backdrop click and Escape: the dialog can't be dismissed. */
     hideCloseButton?: boolean;
     allowOverflow?: boolean;
+    /**
+     * `'bar'` (default): the bordered header with the X on the left and the
+     * centered title. `'none'`: no header; the X sits at the panel's top right
+     * and the content supplies its own heading (the MOVMO-685 sign-in dialogs).
+     */
+    header?: 'bar' | 'none';
+}
+
+/** Typed client for every Movmo sign-in and passkey-management call. */
+export declare interface MovmoAuthApi {
+    login(email: string): Promise<MovmoLoginResponse>;
+    sendCode(flowId: string): Promise<MovmoCodeFlow>;
+    passkeyOptions(): Promise<PasskeyOptionsResponse>;
+    verifyCode(flowId: string, code: string): Promise<MovmoVerifyResponse>;
+    verifyPasskey(flowId: string, credential: CredentialJSON): Promise<MovmoVerifyResponse>;
+    listPasskeys(): Promise<PasskeySummary[]>;
+    startRegistration(): Promise<PasskeyRegistrationStart>;
+    completeRegistration(flowId: string, credential: CredentialJSON): Promise<PasskeySummary>;
+    /** Rejects an id that isn't base64url (1–512 chars) with `invalid_request`, before any request. */
+    deletePasskey(id: string): Promise<void>;
+    /**
+     * `POST /v1/auth/logout {}`: ends this browser's Movmo session. Never
+     * rejects: a failure is normalized and swallowed, so a failed logout can't
+     * throw into the UI (the sign-in flow calls it on `account_mismatch`).
+     */
+    logout(): Promise<void>;
+}
+
+export declare interface MovmoSignIn {
+    step: SignInStep;
+    email: string;
+    setEmail(v: string): void;
+    busy: boolean;
+    /** User-facing copy (copy.ts), never a raw code. */
+    error: string | null;
+    errorCode: SignInErrorCode | null;
+    codeLength: number;
+    resendIn: number;
+    attemptsRemaining?: number;
+    canUsePasskeyButton: boolean;
+    /** Passkey step: the last ceremony failed; offer Try again (`retryPasskey`). */
+    passkeyFailed: boolean;
+    liveMessage: string;
+    submitEmail(): void;
+    signInWithPasskey(): void;
+    retryPasskey(): void;
+    useCodeInstead(): void;
+    /** Passkey/code step: back to email with the email kept. */
+    changeEmail(): void;
+    submitCode(code: string): void;
+    resendCode(): void;
+    acceptEnrollment(): void;
+    declineEnrollment(): void;
+    /** 'enrolled' → 'done', then `onSignedIn`. */
+    finish(): void;
+    /**
+     * During 'enroll' = decline, then finish (so `onSignedIn` fires); at
+     * 'enrolled' = finish; otherwise aborts any ceremony.
+     */
+    close(): void;
+}
+
+/** Whether the traveler has permanently opted out of the passkey prompt. */
+export declare function neverAsk(): boolean;
+
+/**
+ * The per-digit code boxes shared by `OTPModal` and `SignInFlow`: type, paste,
+ * backspace, one-time-code autofill, and auto-submit on the last digit. The
+ * look is the MOVMO-685 spec's "today's OTPModal" boxes (no brand color).
+ * Box ids are `otp-input-${i}`, so render one instance per page.
+ */
+export declare const OtpCodeInput: ({ length, onComplete, onChange, disabled, autoFocus, }: OtpCodeInputProps) => JSX_2.Element;
+
+export declare interface OtpCodeInputProps {
+    /** Number of boxes (the code length). */
+    length: number;
+    /**
+     * Called once per completed code (typed, pasted or autofilled). A re-render
+     * doesn't call it again; clearing a digit and retyping it does.
+     */
+    onComplete: (code: string) => void;
+    /** Called on every edit with the digits entered so far. Not called while `disabled`. */
+    onChange?: (code: string) => void;
+    disabled?: boolean;
+    /** Focus the first box on mount (through `safeFocus`, MOVMO-437). */
+    autoFocus?: boolean;
 }
 
-export declare const OTPModal: ({ email, phone, otpLength, otpAction, onVerify, onClose, externalError, externalErrorVariant, disabled, title, description, onOtpChange, }: OTPModalProps) => JSX_2.Element;
+export declare const OTPModal: ({ email, phone, otpLength, otpAction, onVerify, onClose, externalError, externalErrorVariant, disabled, title, description, onOtpChange, onResend, resendAfter, attemptsRemaining, }: OTPModalProps) => JSX_2.Element;
 
 export declare interface OTPModalProps {
     email: string;
@@ -184,6 +432,7 @@ export declare interface OTPModalProps {
     externalErrorVariant?: 'error' | 'warning';
     disabled?: boolean;
     title?: string;
+    /** Replaces "Enter the code we sent to" and hides the email/phone line below it. */
     description?: string;
     /**
      * Fires when the user edits the OTP (type, paste, backspace). Use to clear
@@ -191,6 +440,16 @@ export declare interface OTPModalProps {
      * as the user starts correcting their input. Not fired while `disabled`.
      */
     onOtpChange?: (otp: string) => void;
+    /** Shows the resend row ("Didn't get it? Resend code"). */
+    onResend?: () => void;
+    /**
+     * Seconds before a resend is allowed. The modal counts it down itself
+     * ("Resend code in 0:SS") and restarts it when this value changes or the
+     * traveler resends.
+     */
+    resendAfter?: number;
+    /** Shown under the boxes as "N attempts left.". */
+    attemptsRemaining?: number;
 }
 
 export declare const Pagination: React_2.FC<PaginationProps>;
@@ -202,6 +461,9 @@ declare interface PaginationProps {
     className?: string;
 }
 
+/** Untitled UI `passcode`. */
+export declare const PasscodeIcon: (props: IconProps) => JSX_2.Element;
+
 export declare const PassengerForm: default_2.FC<PassengerFormProps>;
 
 export declare interface PassengerFormProps {
@@ -248,6 +510,69 @@ export declare interface PassengerFormSkeletonProps {
     showFooter?: boolean;
 }
 
+/**
+ * "Skip the code next time" — offered after a traveler's first code sign-in.
+ * Not a modal itself: the sign-in flow renders this inside its own
+ * modal/popup body.
+ */
+export declare const PasskeyEnrollPrompt: ({ status, onAccept, onDecline, onDone, busy, error, }: PasskeyEnrollPromptProps) => JSX_2.Element;
+
+export declare interface PasskeyEnrollPromptProps {
+    /**
+     * `'prompt'` (default) offers to set up a passkey. `'added'` shows the
+     * post-registration confirmation.
+     */
+    status?: 'prompt' | 'added';
+    /** Runs registration. Called from the primary button in `'prompt'` status. */
+    onAccept: () => void;
+    /** Records the dismissal. Called from the secondary button in `'prompt'` status. */
+    onDecline: () => void;
+    /** Called from the primary button in `'added'` status. */
+    onDone?: () => void;
+    /** Disables + `aria-busy`s the primary button while registration is in flight. */
+    busy?: boolean;
+    /**
+     * Shown as an alert above the buttons. The prompt never blocks on an
+     * error — `onDecline` (Not now) stays enabled.
+     */
+    error?: string | null;
+}
+
+/**
+ * The Security page's Passkeys card body (MOVMO-718): list, add a passkey or a
+ * security key, remove with a confirm, and re-authenticate in place when the
+ * server asks (`403 reauth_required`). The app renders it inside its own card
+ * header ("Passkeys" / subtitle).
+ *
+ * In a framed window it only renders "Manage passkeys on the Movmo Security
+ * page.": no list request and no WebAuthn call.
+ *
+ * Every add goes through `registerPasskey` (ruling P4). One add or remove at a
+ * time: the buttons disable while one is in flight, and a second click is
+ * ignored. After a successful re-authentication the pending action retries
+ * exactly once; if that retried add's `create()` is cancelled (Safari may
+ * refuse it without a fresh click) an info notice asks for one more click.
+ */
+export declare const PasskeyList: (props: PasskeyListProps) => JSX_2.Element;
+
+export declare interface PasskeyListProps {
+    api: MovmoAuthApi;
+    /** The signed-in account; re-authentication must sign this same account in. */
+    account: {
+        id: string;
+        email: string;
+    };
+    getCurrentUser: () => Promise<User>;
+    /** `403 movmo_session_required` (a legacy session): open the normal sign-in. */
+    onSessionRequired: () => void;
+    /**
+     * A different account signed in during re-authentication. The server session
+     * has already been ended by the package; clear local auth state and prompt
+     * sign-in.
+     */
+    onAccountMismatch: () => void;
+}
+
 export declare const PhoneInput: default_2.FC<PhoneInputProps>;
 
 export declare interface PhoneInputProps {
@@ -265,6 +590,100 @@ export declare interface PhoneInputProps {
     autoComplete?: string;
 }
 
+/** Untitled UI `plus`. */
+export declare const PlusIcon: (props: IconProps) => JSX_2.Element;
+
+/**
+ * `movmo_pk_prompt` — the passkey-enrollment prompt cookie (MOVMO-685, task
+ * 4.3, D4).
+ *
+ * Records whether this browser has already been offered passkey enrollment,
+ * so a traveler who taps "Not now" isn't re-prompted on every code sign-in.
+ * State lives in a single parent-domain cookie (`Domain=.movmo.io`) rather
+ * than per-host storage so the dismissal is honored across every Movmo host
+ * — including white-label `*.app.movmo.io` airline hosts — not just the one
+ * the traveler happened to dismiss it on. `localhost`/IP hosts (local dev)
+ * fall back to a host-only cookie (no `Domain` attribute).
+ *
+ * A functional cookie that holds no identifier, at day precision: it records
+ * only whether this browser has been asked, never who or exactly when.
+ *
+ * Cookie payload: `{ v: 1, d, n, x }`
+ *   - `d` — epoch DAYS (UTC, `floor(ms / 86_400_000)`) of the last dismissal
+ *     (0 = never dismissed)
+ *   - `n` — code sign-ins completed since that dismissal (capped at 99)
+ *   - `x` — 1 once the traveler has opted out of ever being asked again
+ *
+ * The prompt is offered again once BOTH 14 days have passed since dismissal
+ * AND the traveler has completed at least 3 more code sign-ins — never on
+ * `x: 1`. A value that can't be right (a `d` in the future, or two
+ * `movmo_pk_prompt` cookies, e.g. host-only and `.movmo.io`) reads as no
+ * state, so the prompt is offered.
+ */
+export declare const PROMPT_COOKIE = "movmo_pk_prompt";
+
+export declare type PromptState = {
+    v: 1;
+    d: number;
+    n: number;
+    x: 0 | 1;
+};
+
+/** "Too many requests. Try again in M minutes." with M = ceil(retryAfter/60), at least 1. */
+export declare function rateLimited(retryAfterSeconds?: number): string;
+
+/**
+ * Parses the prompt cookie out of a `document.cookie`-shaped string. Never
+ * throws; `null` (no state, so the prompt is offered) when it's absent,
+ * malformed, present more than once, or dated after today (`now`).
+ */
+export declare function readPromptState(cookie?: string, now?: number): PromptState | null;
+
+/**
+ * "Confirm it's you" (MOVMO-718): the Security page asks for a fresh sign-in
+ * when adding or removing a passkey answers `403 reauth_required`.
+ *
+ * The sign-in flow runs email-first only, with the account's email locked,
+ * and continues at once (`autoContinue`): the login's `allowCredentials` limit
+ * a passkey choice to this account, and **Use a code instead** stays
+ * available. No autofill, no discoverable "Sign in with passkey", no
+ * enrollment prompt. The flow is single-use and is mounted only while open,
+ * so every open starts fresh. In a framed window it only says "Manage
+ * passkeys on the Movmo Security page." and makes no sign-in or WebAuthn call.
+ */
+export declare const ReauthDialog: ({ isOpen, ...props }: ReauthDialogProps) => JSX_2.Element | null;
+
+export declare interface ReauthDialogProps {
+    isOpen: boolean;
+    /** Picks the description: "…to add a passkey." or "…to remove this passkey." */
+    action: 'add' | 'remove';
+    /** The signed-in account. Its email is locked; its id must match whoever signs in. */
+    account: {
+        id: string;
+        email: string;
+    };
+    api: MovmoAuthApi;
+    getCurrentUser: () => Promise<User>;
+    /** The same account signed in again. Retry the pending action once. */
+    onConfirmed: () => void;
+    /** Cancel, the X, the backdrop or Escape. Drop the pending action. */
+    onCancel: () => void;
+    /**
+     * A different account signed in. The package has already ended that
+     * session (`api.logout()`) when this fires; clear local auth state and
+     * prompt sign-in. Never retry the pending action.
+     */
+    onMismatch: () => void;
+}
+
+/** Records a completed code sign-in, advancing the count toward re-offering the prompt — but only while a dismissal is pending. */
+export declare function recordCodeSignIn(): void;
+
+export declare function registerPasskey(api: MovmoAuthApi, opts: {
+    securityKey?: boolean;
+    signal: AbortSignal;
+}): Promise<PasskeySummary>;
+
 /**
  * Programmatically focuses `el`, swallowing only the cross-origin `SecurityError` that
  * browsers throw when focus would cross a cross-origin iframe boundary. Any other error is
@@ -308,49 +727,122 @@ declare interface SeparatorProps extends React_2.ComponentPropsWithoutRef<typeof
     text?: string;
 }
 
+/** Sets (or clears) the permanent opt-out, keeping any existing `d`/`n`. */
+export declare function setNeverAsk(never: boolean): void;
+
+/** Untitled UI `shield-tick`. */
+export declare const ShieldTickIcon: (props: IconProps) => JSX_2.Element;
+
+/**
+ * Whether the passkey-enrollment prompt should be offered: no state at all,
+ * or never dismissed (`d === 0`) → true. Opted out (`x === 1`) → false.
+ * Otherwise true once 14 days have elapsed since the last dismissal AND at
+ * least 3 code sign-ins have completed since then.
+ */
+export declare function shouldOfferPasskey(now?: number, s?: PromptState | null): boolean;
+
+/**
+ * User-facing copy for the sign-in state machine (`useMovmoSignIn`).
+ * English only (D3); strings are verbatim from the MOVMO-685/718 design
+ * spec wherever it gives them. Components render these, never raw codes.
+ */
+export declare const signInCopy: {
+    readonly passkeyNotRecognized: "That passkey isn't recognized. We've sent you a code instead.";
+    readonly tooManyAttempts: "Too many attempts. Start again.";
+    readonly flowExpired: "That took too long. Start again.";
+    readonly codeSent: "Code sent";
+    readonly signedIn: "Signed in";
+    readonly generic: "Something went wrong. Try again.";
+    readonly accountMismatch: "That's a different account. Sign in with the account you're using.";
+    /** Security page copy (spec "Add results"), reused by the enrollment prompt. */
+    readonly passkeyExists: "This passkey is already on your account.";
+    readonly enrollExpired: "That took too long. Try again.";
+    readonly invalidEmail: "Enter a valid email address.";
+    readonly passkeyUnavailable: "This browser couldn't use a passkey. Use a code instead.";
+    readonly discoverableNotRecognized: "That passkey isn't recognized. Continue with your email instead.";
+};
+
+export declare type SignInErrorCode = AuthErrorCode | 'network' | 'unknown' | WebAuthnFailure | 'account_mismatch';
+
+/**
+ * The non-modal sign-in UI (flights-ui `/connect`, `ReauthDialog`): email →
+ * passkey or code → optional passkey enrollment, rendered from the
+ * `useMovmoSignIn` state machine.
+ *
+ * The machine is single-use: once it signs someone in (or ends on an account
+ * mismatch) it stays there. Mount a fresh `SignInFlow` for every attempt
+ * (render it conditionally, or change its `key`); `SignInModal` does this on
+ * every open. Every `useMovmoSignIn` option passes through, including
+ * `onVerified` and `onAccountMismatch`.
+ */
+export declare const SignInFlow: ({ title, description, onCancel, ...options }: SignInFlowProps) => JSX_2.Element;
+
+export declare interface SignInFlowProps extends UseMovmoSignInOptions {
+    /** Replaces the email, passkey and code step titles (e.g. "Confirm it's you"). */
+    title?: string;
+    /** Replaces the email and passkey step descriptions; the code step keeps "Enter the code we sent to …". */
+    description?: string;
+    /** Adds a Cancel button beside the primary action; it aborts the flow, then calls this. */
+    onCancel?: () => void;
+}
+
+export declare type SignInMethod = 'otp' | 'passkey';
+
+/**
+ * "Sign in to Movmo": `SignInFlow` inside the focus-trapping `Modal`. Code or
+ * passkey sign-in, then the passkey enrollment prompt when eligible.
+ *
+ * Breaking change in 0.14.0 (MOVMO-685): `loginUser`, `verifyOTP`,
+ * `showPhone` and `isRateLimitError` are gone; pass `api`
+ * (`createMovmoAuthApi(client)`), `surface` and `getCurrentUser` instead.
+ */
 export declare const SignInModal: default_2.FC<SignInModalProps>;
 
-export declare interface SignInModalProps {
+export declare interface SignInModalProps extends Omit<UseMovmoSignInOptions, 'onSignedIn'> {
     isOpen: boolean;
-    onClose: () => void;
     /**
-     * Called to start the sign-in flow. Rejected errors are inspected via
-     * `isRateLimitError` to decide whether to show the rate-limit notice. The
-     * default detector expects an axios-shaped rejection (`error.response.status`
-     * === 429); pass a custom `isRateLimitError` if you use a different HTTP client.
+     * A real dismissal only: the X, the backdrop or Escape. A step change
+     * (email → code, a passkey sheet, the enrollment prompt) never calls it.
      */
-    loginUser: (email: string, phone: string, usernameType: AuthenticationUsernameType) => Promise<LoginUserResponse>;
-    /**
-     * Called to verify the OTP code. Rejected errors are surfaced to the user:
-     *  - 429 (per `isRateLimitError`) → OTP modal locked + warning notice.
-     *  - 400 → "Invalid or expired code…" (most common: typo / expired code).
-     *  - 401 → "Your session has expired…".
-     *  - anything else → "Something went wrong. Please try again."
-     * Status is read from `error.response.status` (axios shape).
-     */
-    verifyOTP: (username: string, code: string, session: string, challengeName: AuthenticationChallengeName | null) => Promise<void>;
-    getCurrentUser: () => Promise<User>;
-    onLoginSuccess: (user: User) => void;
+    onClose: () => void;
+    /** Makes the dialog non-dismissable (no X, backdrop or Escape). */
     hideCloseButton?: boolean;
     /**
-     * Show the phone input alongside email. Defaults to false (MOVMO-445):
-     * sign-in is email-only — email → Continue → OTP to the email. Pass true
-     * only for legacy flows that still collect a phone at sign-in.
-     */
-    showPhone?: boolean;
-    /**
-     * Predicate used to detect HTTP 429 rate-limit rejections. Defaults to an
-     * axios-shaped check (`error.response?.status === 429`). Supply a custom
-     * implementation for non-axios clients (fetch, ky, custom error types).
+     * The traveler is signed in (after the enrollment prompt, when one is
+     * shown). Fires once per open. The dialog hides itself at this point; set
+     * `isOpen` to false here so the next open starts a fresh flow. Closing the
+     * dialog at the prompt (or at "Passkey added") counts as finishing: this
+     * fires first, then `onClose`. `onVerified` (optional) fires earlier, before
+     * the prompt; `onAccountMismatch` (re-auth with `expectedUserId`) fires
+     * after the package has ended the other account's session.
      */
-    isRateLimitError?: (error: unknown) => boolean;
+    onLoginSuccess: (user: User, info: {
+        method: SignInMethod;
+        newUser: boolean;
+    }) => void;
 }
 
+/** `mismatch` is terminal: re-auth signed in a different account (see `onAccountMismatch`). */
+export declare type SignInStep = 'email' | 'passkey' | 'code' | 'enroll' | 'enrolled' | 'done' | 'mismatch';
+
 export declare const Textarea: React_2.ForwardRefExoticComponent<TextareaProps & React_2.RefAttributes<HTMLTextAreaElement>>;
 
 declare interface TextareaProps extends React_2.TextareaHTMLAttributes<HTMLTextAreaElement> {
 }
 
+/** Resolves the browser's IANA time zone. `undefined` on any failure. */
+export declare const timeZone: () => string | undefined;
+
+/**
+ * Normalizes any rejection a `MovmoAuthApi` call can produce into an
+ * `AuthError`. Never throws. An axios-shaped error with a `response` maps
+ * its status/body; an axios-shaped error with no `response` (or a
+ * `fetch`-style network failure) maps to `'network'`; anything else maps
+ * to `'unknown'`. Never puts the request's email, code or credential into
+ * the resulting error.
+ */
+export declare function toAuthError(err: unknown): AuthError;
+
 export declare const Toggle: React_2.ForwardRefExoticComponent<ToggleProps & React_2.RefAttributes<HTMLButtonElement>>;
 
 export declare const ToggleGroup: React_2.ForwardRefExoticComponent<((Omit<ToggleGroupPrimitive.ToggleGroupSingleProps & React_2.RefAttributes<HTMLDivElement>, "ref"> & {
@@ -368,6 +860,56 @@ declare interface ToggleProps extends React_2.ComponentPropsWithoutRef<typeof Sw
     size?: 'sm' | 'md';
 }
 
+/** Untitled UI `trash-01`. */
+export declare const TrashIcon: (props: IconProps) => JSX_2.Element;
+
+/** Untitled UI `usb-flash-drive`. */
+export declare const UsbKeyIcon: (props: IconProps) => JSX_2.Element;
+
+export declare function useMovmoSignIn(o: UseMovmoSignInOptions): MovmoSignIn;
+
+export declare interface UseMovmoSignInOptions {
+    api: MovmoAuthApi;
+    /** A framed window is always treated as `'embedded'`, whatever this says. */
+    surface: 'top-level' | 'embedded';
+    getCurrentUser: () => Promise<User>;
+    /** The traveler is signed in: fires exactly once, after the enrollment prompt when one is shown. */
+    onSignedIn: (user: User, info: {
+        method: SignInMethod;
+        newUser: boolean;
+    }) => void;
+    /**
+     * Fires once, right after a successful verify and `getCurrentUser()` (the
+     * server session exists), BEFORE the enrollment prompt. Use it for work that
+     * mustn't wait for the traveler to answer the prompt; `onSignedIn` keeps its
+     * meaning.
+     */
+    onVerified?: (user: User, info: {
+        method: SignInMethod;
+        newUser: boolean;
+    }) => void;
+    /**
+     * Re-auth only (`expectedUserId`): a different account signed in. The server
+     * session has already been ended by the package (`api.logout()`) when this
+     * fires, even if the flow unmounted meanwhile; clear local auth state and
+     * prompt sign-in. The flow is terminal (`step: 'mismatch'`).
+     */
+    onAccountMismatch?: () => void;
+    onEvent?: (name: string, props: Record<string, unknown>) => void;
+    initialEmail?: string;
+    /** Re-auth: the email can't change. Email-first only (no autofill, no passkey button). */
+    lockedEmail?: string;
+    autoContinue?: boolean;
+    /** Default true. */
+    offerEnrollment?: boolean;
+    /**
+     * Re-auth: refuse a different account (checked on verify's `user_id` and on
+     * `getCurrentUser().id`). Email-first only, like `lockedEmail`.
+     */
+    expectedUserId?: string;
+    promptSurface?: 'modal' | 'connect';
+}
+
 export declare const validateEmail: (email: string) => boolean;
 
 export declare function validateName(value: string): {
@@ -377,4 +919,27 @@ export declare function validateName(value: string): {
 
 export declare function validatePhoneNumber(phone: string, countryCode?: string): boolean;
 
+/** Coarse, user-facing classification of a failed WebAuthn ceremony. */
+export declare type WebAuthnFailure = 'cancelled' | 'aborted' | 'exists' | 'unsupported' | 'security' | 'unknown';
+
+/**
+ * The `{ publicKey, mediation? }` shape the backend returns for both
+ * registration and authentication ceremonies (`publicKey` mirrors
+ * `PublicKeyCredentialCreationOptionsJSON`/`RequestOptionsJSON`).
+ */
+export declare type WebAuthnOptionsLike = {
+    publicKey: Record<string, unknown>;
+    mediation?: string;
+};
+
+/** Detected browser capabilities for WebAuthn. Never throws. */
+export declare interface WebAuthnSupport {
+    webauthn: boolean;
+    conditional: boolean;
+    platform: boolean;
+}
+
+/** Untitled UI `x-close`. */
+export declare const XCloseIcon: (props: IconProps) => JSX_2.Element;
+
 export { }