@movmo_app/react-common 0.15.0 → 0.16.0

package/dist/index.d.ts

@@ -345,7 +345,14 @@ export declare interface ModalProps {
 
 /** Typed client for every Movmo sign-in and passkey-management call. */
 export declare interface MovmoAuthApi {
-    login(email: string): Promise<MovmoLoginResponse>;
+    /**
+     * `POST /v1/auth/login`. `deferCode` sends `defer_code: true`: an unenrolled
+     * email's flow is created without sending a code (`sendCode` releases the
+     * first send); used by the partner iframe.
+     */
+    login(email: string, opts?: {
+        deferCode?: boolean;
+    }): Promise<MovmoLoginResponse>;
     sendCode(flowId: string): Promise<MovmoCodeFlow>;
     /**
      * `POST /v1/auth/recovery {flow_id, time_zone?}`: starts account recovery for
@@ -391,10 +398,19 @@ export declare interface MovmoSignIn {
     recoveryAvailable: boolean;
     /** Recovery step: the server refused recovery (`recovery_blocked`); terminal, only Close remains. */
     recoveryBlocked: boolean;
+    /**
+     * Framed passkeys: the browser won't run the passkey ceremony in this frame
+     * (`topOrigin_required`, or remembered). The passkey step offers `continueTopLevel`.
+     */
+    topLevelRequired: boolean;
+    /** Framed window with `framedPasskeys`: the passkey step always offers "Continue in a new window". */
+    framedPasskeys: boolean;
     liveMessage: string;
     submitEmail(): void;
     signInWithPasskey(): void;
     retryPasskey(): void;
+    /** Passkey step, `topLevelRequired`: calls `onContinueTopLevel` synchronously (inside the click). */
+    continueTopLevel(): void;
     /** Passkey step: "I can't use my passkey" → the recovery step (aborts the ceremony). No-op on re-auth. */
     cantUsePasskey(): void;
     /** Recovery step: `POST /v1/auth/recovery`, then the code step. */
@@ -791,6 +807,11 @@ export declare const signInCopy: {
     readonly passkeyUnavailable: "This browser couldn't use a passkey. Choose 'I can't use my passkey' to sign in with a code.";
     readonly discoverableNotRecognized: "That passkey isn't recognized. Continue with your email instead.";
     readonly recoveryStarted: "Sign in without your passkey";
+    /** Framed passkeys (MOVMO-686): the browser won't run the passkey ceremony inside the frame. */
+    readonly topLevelRequired: "Your browser needs a separate window to use your passkey.";
+    readonly continueTopLevel: "Continue in a new window";
+    /** Framed passkeys: any browser-side failure; never points a framed user at account recovery first. */
+    readonly framedPasskeyFailed: "Your passkey didn't work here. Try again, or continue in a new window.";
     readonly recoveryBlocked: "We can't recover this account right now";
 };
 
@@ -938,6 +959,36 @@ export declare interface UseMovmoSignInOptions {
      */
     expectedUserId?: string;
     promptSurface?: 'modal' | 'connect';
+    /**
+     * A framed window may run the email-first passkey `get()` (the embedding SDK
+     * granted `publickey-credentials-get` on the iframe). Default false. Never
+     * enables autofill, the passkey button, enrollment or `create()`.
+     */
+    framedPasskeys?: boolean;
+    /**
+     * The `/v1/auth/login` response the app already obtained, expected from
+     * `api.login(email, { deferCode: true })`: adopted on mount instead of asking
+     * for an email. `next:"passkey"` runs the ceremony at once (the app must call
+     * within the click's transient activation, ~5 s); `next:"code"` sends the first
+     * code (`/v1/auth/code` on the deferred flow) and shows the code step. The
+     * email comes from `initialEmail` / `lockedEmail`. `api.login` is not called.
+     */
+    resumeLogin?: MovmoLoginResponse;
+    /**
+     * `continueTopLevel()` calls this synchronously (the app opens its popup
+     * inside the click; nothing may `await` before it) with the flow's current
+     * email, the one the ceremony ran for (it may differ from `initialEmail`
+     * after an email change).
+     */
+    onContinueTopLevel?: (email: string) => void;
+    /**
+     * With `resumeLogin`: the passkey/code step's "Change" calls this instead of showing the
+     * hook's own email step, and the host owns the email change. That step
+     * calls `api.login` without `deferCode`, which would send a code at once and
+     * sign a code user in inside the frame, bypassing the host's popup rule.
+     * Without `resumeLogin` or without this, behaviour is unchanged.
+     */
+    onChangeEmail?: () => void;
 }
 
 export declare const validateEmail: (email: string) => boolean;