@movmo_app/react-common 0.17.1 → 0.19.0

package/dist/index.d.ts

@@ -8,6 +8,7 @@ import { MovmoCodeFlow } from '@movmo_app/types';
 import { MovmoLoginResponse } from '@movmo_app/types';
 import { MovmoVerifyResponse } from '@movmo_app/types';
 import { OTPAction } from '@movmo_app/types';
+import { PasskeyListResponse } from '@movmo_app/types';
 import { PasskeyOptionsResponse } from '@movmo_app/types';
 import { PasskeyRegistrationStart } from '@movmo_app/types';
 import { PasskeySummary } from '@movmo_app/types';
@@ -329,7 +330,9 @@ export declare interface ModalProps {
     title: default_2.ReactNode;
     children: default_2.ReactNode;
     footer?: default_2.ReactNode;
+    /** Ignored when `placement="sheet"`. */
     maxWidth?: string;
+    /** Ignored when `placement="sheet"`. */
     maxWidthPx?: number;
     footerHasBorder?: boolean;
     /** Hides the X and disables backdrop click and Escape: the dialog can't be dismissed. */
@@ -341,6 +344,13 @@ export declare interface ModalProps {
      * and the content supplies its own heading (the MOVMO-685 sign-in dialogs).
      */
     header?: 'bar' | 'none';
+    /**
+     * `'center'` (default): a centered dialog. `'sheet'`: a right-hand side sheet
+     * from `md` up and a bottom sheet below it; the body scrolls and the footer
+     * stays pinned. It shares the open-stack, focus trap and Escape handling, and
+     * ignores `maxWidth`/`maxWidthPx`.
+     */
+    placement?: 'center' | 'sheet';
 }
 
 /** Typed client for every Movmo sign-in and passkey-management call. */
@@ -362,6 +372,8 @@ export declare interface MovmoAuthApi {
     verifyCode(flowId: string, code: string): Promise<MovmoVerifyResponse>;
     verifyPasskey(flowId: string, credential: CredentialJSON): Promise<MovmoVerifyResponse>;
     listPasskeys(): Promise<PasskeySummary[]>;
+    /** The raw list response, including the optional `user_handle`/`rp_id`/identity keys. */
+    fetchPasskeyList(): Promise<PasskeyListResponse>;
     startRegistration(): Promise<PasskeyRegistrationStart>;
     completeRegistration(flowId: string, credential: CredentialJSON): Promise<PasskeySummary>;
     /** Rejects an id that isn't base64url (1–512 chars) with `invalid_request`, before any request. */
@@ -604,6 +616,12 @@ export declare interface PasskeyListProps {
     recoveryUntil?: string | null;
 }
 
+/** The `user_handle`/`rp_id` cached from the last list that carried them. */
+export declare interface PasskeySignalFallback {
+    user_handle: string;
+    rp_id: string;
+}
+
 export declare const PhoneInput: default_2.FC<PhoneInputProps>;
 
 export declare interface PhoneInputProps {
@@ -772,6 +790,35 @@ export declare const ShieldTickIcon: (props: IconProps) => JSX_2.Element;
  */
 export declare function shouldOfferPasskey(now?: number, s?: PromptState | null): boolean;
 
+/**
+ * Tells the credential provider which passkeys the server still accepts and the
+ * account's current name (WebAuthn Signal API; MOVMO-738). Best effort:
+ * synchronous, returns nothing, never awaited (Safari's promise may never
+ * settle), never logs (the user handle is a stable per-user identifier).
+ *
+ * Always pass the SERVER's list, never a locally edited one: a passkey added on
+ * another device since the page loaded would otherwise be removed by the
+ * provider.
+ *
+ * `fallback` covers the last removal, where the server returns no handle or
+ * `rp_id`; it is used only for the accepted-credentials signal (an empty list
+ * carries no user details). Pass it only with proof that `list` is the cached
+ * handle's account (PasskeyList: a 204 removal of a passkey that handle's list
+ * held), never after a 404 or an add: an empty list from another account
+ * would hide every passkey of the cached one.
+ */
+export declare function signalPasskeyState(list: PasskeyListResponse, fallback?: PasskeySignalFallback): void;
+
+/**
+ * Tells the provider one credential is gone (`signalUnknownCredential`). Call it
+ * only after the server answered 204 to the DELETE: after the LAST removal the
+ * server forgets the user handle, so `signalAllAcceptedCredentials` could never
+ * hide it on a later page load. Needs no handle. Same rules as
+ * `signalPasskeyState`: best effort, synchronous, never awaited, never logged,
+ * no-op when framed.
+ */
+export declare function signalRemovedPasskey(rpId: string, credentialId: string): void;
+
 /**
  * User-facing copy for the sign-in state machine (`useMovmoSignIn`).
  * English only (D3); strings are verbatim from the MOVMO-685/718 design