@movmo_app/react-common 0.17.1 → 0.18.0

package/dist/index.d.ts

@@ -8,6 +8,7 @@ import { MovmoCodeFlow } from '@movmo_app/types';
 import { MovmoLoginResponse } from '@movmo_app/types';
 import { MovmoVerifyResponse } from '@movmo_app/types';
 import { OTPAction } from '@movmo_app/types';
+import { PasskeyListResponse } from '@movmo_app/types';
 import { PasskeyOptionsResponse } from '@movmo_app/types';
 import { PasskeyRegistrationStart } from '@movmo_app/types';
 import { PasskeySummary } from '@movmo_app/types';
@@ -362,6 +363,8 @@ export declare interface MovmoAuthApi {
     verifyCode(flowId: string, code: string): Promise<MovmoVerifyResponse>;
     verifyPasskey(flowId: string, credential: CredentialJSON): Promise<MovmoVerifyResponse>;
     listPasskeys(): Promise<PasskeySummary[]>;
+    /** The raw list response, including the optional `user_handle`/`rp_id`/identity keys. */
+    fetchPasskeyList(): Promise<PasskeyListResponse>;
     startRegistration(): Promise<PasskeyRegistrationStart>;
     completeRegistration(flowId: string, credential: CredentialJSON): Promise<PasskeySummary>;
     /** Rejects an id that isn't base64url (1–512 chars) with `invalid_request`, before any request. */
@@ -604,6 +607,12 @@ export declare interface PasskeyListProps {
     recoveryUntil?: string | null;
 }
 
+/** The `user_handle`/`rp_id` cached from the last list that carried them. */
+export declare interface PasskeySignalFallback {
+    user_handle: string;
+    rp_id: string;
+}
+
 export declare const PhoneInput: default_2.FC<PhoneInputProps>;
 
 export declare interface PhoneInputProps {
@@ -772,6 +781,35 @@ export declare const ShieldTickIcon: (props: IconProps) => JSX_2.Element;
  */
 export declare function shouldOfferPasskey(now?: number, s?: PromptState | null): boolean;
 
+/**
+ * Tells the credential provider which passkeys the server still accepts and the
+ * account's current name (WebAuthn Signal API; MOVMO-738). Best effort:
+ * synchronous, returns nothing, never awaited (Safari's promise may never
+ * settle), never logs (the user handle is a stable per-user identifier).
+ *
+ * Always pass the SERVER's list, never a locally edited one: a passkey added on
+ * another device since the page loaded would otherwise be removed by the
+ * provider.
+ *
+ * `fallback` covers the last removal, where the server returns no handle or
+ * `rp_id`; it is used only for the accepted-credentials signal (an empty list
+ * carries no user details). Pass it only with proof that `list` is the cached
+ * handle's account (PasskeyList: a 204 removal of a passkey that handle's list
+ * held), never after a 404 or an add: an empty list from another account
+ * would hide every passkey of the cached one.
+ */
+export declare function signalPasskeyState(list: PasskeyListResponse, fallback?: PasskeySignalFallback): void;
+
+/**
+ * Tells the provider one credential is gone (`signalUnknownCredential`). Call it
+ * only after the server answered 204 to the DELETE: after the LAST removal the
+ * server forgets the user handle, so `signalAllAcceptedCredentials` could never
+ * hide it on a later page load. Needs no handle. Same rules as
+ * `signalPasskeyState`: best effort, synchronous, never awaited, never logged,
+ * no-op when framed.
+ */
+export declare function signalRemovedPasskey(rpId: string, credentialId: string): void;
+
 /**
  * User-facing copy for the sign-in state machine (`useMovmoSignIn`).
  * English only (D3); strings are verbatim from the MOVMO-685/718 design