@passflow/react 0.14.0 → 0.15.1

package/dist/src/context/navigation-context.d.ts

@@ -21,5 +21,5 @@ export type NavigationContextType = {
     setTwoFactorVerifyPath?: (path: string | null) => void;
 };
 export declare const defaultNavigate: NavigateFunction;
-export declare const NavigationContext: import('react').Context<NavigationContextType>;
+export declare const NavigationContext: import("react").Context<NavigationContextType>;
 //# sourceMappingURL=navigation-context.d.ts.map

package/dist/src/context/passflow-context.d.cts

@@ -0,0 +1,26 @@
+import type { AppSettings, Passflow, PassflowPasswordPolicySettings } from '@passflow/core';
+import { type Dispatch } from 'react';
+export type PassflowState = {
+    appSettings: AppSettings | null;
+    passwordPolicy: PassflowPasswordPolicySettings | null;
+    url?: string;
+    appId?: string;
+    scopes?: string[];
+    createTenantForNewUser?: boolean;
+    parseQueryParams?: boolean;
+    isDiscoveringAppId?: boolean;
+    hasSettingsError?: boolean;
+};
+export type PassflowAction = {
+    type: 'SET_PASSFLOW_STATE';
+    payload: PassflowState;
+};
+export type PassflowContextType = {
+    state: PassflowState;
+    dispatch: Dispatch<PassflowAction>;
+    passflow: Passflow;
+};
+export declare const initialState: PassflowState;
+export declare const PassflowContext: import("react").Context<PassflowContextType | undefined>;
+export declare const passflowReducer: (state: PassflowState, action: PassflowAction) => PassflowState;
+//# sourceMappingURL=passflow-context.d.ts.map

package/dist/src/context/passflow-context.d.ts

@@ -1,5 +1,5 @@
-import { AppSettings, Passflow, PassflowPasswordPolicySettings } from '@passflow/core';
-import { Dispatch } from 'react';
+import type { AppSettings, Passflow, PassflowPasswordPolicySettings } from '@passflow/core';
+import { type Dispatch } from 'react';
 export type PassflowState = {
     appSettings: AppSettings | null;
     passwordPolicy: PassflowPasswordPolicySettings | null;
@@ -21,6 +21,6 @@ export type PassflowContextType = {
     passflow: Passflow;
 };
 export declare const initialState: PassflowState;
-export declare const PassflowContext: import('react').Context<PassflowContextType | undefined>;
+export declare const PassflowContext: import("react").Context<PassflowContextType | undefined>;
 export declare const passflowReducer: (state: PassflowState, action: PassflowAction) => PassflowState;
 //# sourceMappingURL=passflow-context.d.ts.map

package/dist/src/context/passflow-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passflow-context.d.ts","sourceRoot":"","sources":["../../../src/context/passflow-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,KAAK,QAAQ,EAAiB,MAAM,OAAO,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnC,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,aAU1B,CAAC;AAEF,eAAO,MAAM,eAAe,0DAA4D,CAAC;AAEzF,eAAO,MAAM,eAAe,GAAI,OAAO,aAAa,EAAE,QAAQ,cAAc,KAAG,aAO9E,CAAC"}
+{"version":3,"file":"passflow-context.d.ts","sourceRoot":"","sources":["../../../src/context/passflow-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,OAAO,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnC,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,aAU1B,CAAC;AAEF,eAAO,MAAM,eAAe,0DAA4D,CAAC;AAEzF,eAAO,MAAM,eAAe,UAAW,aAAa,UAAU,cAAc,KAAG,aAO9E,CAAC"}

package/dist/src/context/router-context.d.cts

@@ -0,0 +1,42 @@
+export declare const routes: {
+    signin: {
+        path: string;
+    };
+    signup: {
+        path: string;
+    };
+    verify_otp: {
+        path: string;
+    };
+    verify_magic_link: {
+        path: string;
+    };
+    forgot_password: {
+        path: string;
+    };
+    forgot_password_success: {
+        path: string;
+    };
+    reset_password: {
+        path: string;
+    };
+    invitation: {
+        path: string;
+    };
+    passkey: {
+        path: string;
+    };
+    two_factor_verify: {
+        path: string;
+    };
+    two_factor_recovery: {
+        path: string;
+    };
+    two_factor_setup: {
+        path: string;
+    };
+    two_factor_setup_magic_link: {
+        path: string;
+    };
+};
+//# sourceMappingURL=router-context.d.ts.map

package/dist/src/context/router-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../../../src/context/router-context.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwClB,CAAC"}
+{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../../../src/context/router-context.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,MAAM;IACjB,MAAM;QACJ,IAAI;;IAEN,MAAM;QACJ,IAAI;;IAEN,UAAU;QACR,IAAI;;IAEN,iBAAiB;QACf,IAAI;;IAEN,eAAe;QACb,IAAI;;IAEN,uBAAuB;QACrB,IAAI;;IAEN,cAAc;QACZ,IAAI;;IAEN,UAAU;QACR,IAAI;;IAEN,OAAO;QACL,IAAI;;IAEN,iBAAiB;QACf,IAAI;;IAEN,mBAAmB;QACjB,IAAI;;IAEN,gBAAgB;QACd,IAAI;;IAEN,2BAA2B;QACzB,IAAI;;CAEP,CAAC"}

package/dist/src/context/upgrade-context.d.cts

@@ -0,0 +1,107 @@
+/**
+ * The assurance-upgrade context — the one channel between `UpgradeProvider`
+ * and `useUpgrade` (architecture §8.2, §13.3).
+ *
+ * The provider owns the controller, the prompt handler and every transition;
+ * this module owns only the shape they are read through. Two hooks each
+ * installing a prompt handler would produce two prompts and defeat
+ * single-flight, so nothing here installs anything.
+ *
+ * `status` is §13.5's `UpgradeHookState`, which is §13.3's settlement table
+ * read down the hook column. Two consequences the types enforce:
+ *
+ * - **`insufficient` is a first-class state, not an error and not a success.**
+ *   "Elevated to AAL2; this action requires AAL3" is the normal path for an
+ *   AAL3 endpoint and a TOTP-only user, and a design cannot both claim the
+ *   server is the authority and delete the path by which its second refusal
+ *   reaches the user.
+ * - **Cancellation is not a status.** It is `elevate()` resolving `null`. The
+ *   hook is the one surface where that is right, because there the
+ *   cancellation IS the whole value: the consumer is rendering a decision, not
+ *   handling a transport outcome.
+ */
+import type { AssuranceBar, UpgradeChallenge, UpgradeFactor, UpgradeFactorType } from '@passflow/core';
+/** What a protected elevation can fail with, in the hook's vocabulary (§13.3's table). */
+export type UpgradeErrorStatusKind = 'exhausted' | 'unsatisfiable' | 'unavailable' | 'transport';
+/**
+ * The hook's observable state. Exactly one terminal state per flight, taken
+ * from the controller's outcome summary (§13.4).
+ *
+ * `idle` is also where a flight abandoned by a session change lands: nothing
+ * happened, and nothing is reported as though it had.
+ */
+export type UpgradeHookState = {
+    status: 'idle';
+} | {
+    status: 'challenged';
+    challenge: UpgradeChallenge;
+    factors: UpgradeFactorType[];
+} | {
+    status: 'submitting';
+} | {
+    status: 'success';
+} | {
+    status: 'insufficient';
+    obtained: AssuranceBar;
+    required: AssuranceBar;
+} | {
+    status: 'error';
+    kind: UpgradeErrorStatusKind;
+    error: Error;
+};
+/** The states a flight can settle in. `null` alongside these is cancellation. */
+export type UpgradeSettledState = Extract<UpgradeHookState, {
+    status: 'idle' | 'success' | 'insufficient' | 'error';
+}>;
+/** A bar a caller states for itself on the imperative seam (§13.2 T10 / H-6). */
+export type UpgradeElevateOptions = {
+    acrValues?: string;
+    maxAge?: number;
+};
+/** The open prompt, as the dialog and the hook read it. */
+export type UpgradePromptView = {
+    challenge: UpgradeChallenge;
+    /** Already ranked by `selectFactors`; index 0 is the suggested factor. */
+    factors: readonly UpgradeFactor[];
+    /** The previous attempt's failure, when the controller re-prompted. */
+    previousError?: Error;
+};
+export type UpgradeContextValue = {
+    /** True when the provider installed a prompt handler on this `Passflow` instance. */
+    enabled: boolean;
+    state: UpgradeHookState;
+    /** The open prompt, or `null` when no elevation is collecting an answer. */
+    prompt: UpgradePromptView | null;
+    selectedFactor: UpgradeFactorType | null;
+    /**
+     * The factor-selection signal. Reports the user's choice to the controller
+     * through `UpgradePromptRequest.onFactorSelected` the moment it is made and
+     * before any answer is submitted — §13.2's late-join boundary (T3), which is
+     * selection and not submission.
+     */
+    selectFactor: (factor: UpgradeFactorType) => void;
+    /** Answers the open prompt. Resolves the controller's promise exactly once. */
+    submit: (code?: string) => void;
+    /** Declines the open prompt. Exactly once; never leaves the promise pending. */
+    cancel: () => void;
+    /** Acknowledges a terminal state, closing the dialog. Settles nothing. */
+    dismiss: () => void;
+    /**
+     * Drives an elevation directly — a "verify now" button, or a headless
+     * caller. Resolves **`null`** when the user cancelled, and otherwise the
+     * flight's terminal state; it never rejects, because the hook's contract is
+     * a rendered decision rather than a thrown transport outcome.
+     */
+    elevate: (options?: UpgradeElevateOptions) => Promise<UpgradeSettledState | null>;
+};
+export declare const UpgradeContext: import("react").Context<UpgradeContextValue | undefined>;
+/**
+ * What `useUpgrade` reads outside an `UpgradeProvider`: idle, inert, and it
+ * does not throw (§9.5 H8) — a component that merely wants to know whether an
+ * elevation is running is not a bug.
+ *
+ * `elevate` resolves `{ status: 'idle' }` rather than `null`: nothing was
+ * asked and nothing was declined, and `null` means the user declined.
+ */
+export declare const INERT_UPGRADE_CONTEXT: UpgradeContextValue;
+//# sourceMappingURL=upgrade-context.d.ts.map

package/dist/src/context/upgrade-context.d.ts

@@ -1,4 +1,26 @@
-import { AssuranceBar, UpgradeChallenge, UpgradeFactor, UpgradeFactorType } from '@passflow/core';
+/**
+ * The assurance-upgrade context — the one channel between `UpgradeProvider`
+ * and `useUpgrade` (architecture §8.2, §13.3).
+ *
+ * The provider owns the controller, the prompt handler and every transition;
+ * this module owns only the shape they are read through. Two hooks each
+ * installing a prompt handler would produce two prompts and defeat
+ * single-flight, so nothing here installs anything.
+ *
+ * `status` is §13.5's `UpgradeHookState`, which is §13.3's settlement table
+ * read down the hook column. Two consequences the types enforce:
+ *
+ * - **`insufficient` is a first-class state, not an error and not a success.**
+ *   "Elevated to AAL2; this action requires AAL3" is the normal path for an
+ *   AAL3 endpoint and a TOTP-only user, and a design cannot both claim the
+ *   server is the authority and delete the path by which its second refusal
+ *   reaches the user.
+ * - **Cancellation is not a status.** It is `elevate()` resolving `null`. The
+ *   hook is the one surface where that is right, because there the
+ *   cancellation IS the whole value: the consumer is rendering a decision, not
+ *   handling a transport outcome.
+ */
+import type { AssuranceBar, UpgradeChallenge, UpgradeFactor, UpgradeFactorType } from '@passflow/core';
 /** What a protected elevation can fail with, in the hook's vocabulary (§13.3's table). */
 export type UpgradeErrorStatusKind = 'exhausted' | 'unsatisfiable' | 'unavailable' | 'transport';
 /**
@@ -72,7 +94,7 @@ export type UpgradeContextValue = {
      */
     elevate: (options?: UpgradeElevateOptions) => Promise<UpgradeSettledState | null>;
 };
-export declare const UpgradeContext: import('react').Context<UpgradeContextValue | undefined>;
+export declare const UpgradeContext: import("react").Context<UpgradeContextValue | undefined>;
 /**
  * What `useUpgrade` reads outside an `UpgradeProvider`: idle, inert, and it
  * does not throw (§9.5 H8) — a component that merely wants to know whether an

package/dist/src/hocs/index.d.cts

@@ -0,0 +1,2 @@
+export { withError } from './with-error.cjs';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/hocs/index.d.ts

@@ -1,2 +1,2 @@
-export { withError } from './with-error';
+export { withError } from './with-error.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/hocs/with-error.d.cts

@@ -0,0 +1,8 @@
+import { type ComponentType } from 'react';
+import type { TError } from '../components/error/index.cjs';
+import type { PassflowProps } from '../components/flow/passflow/index.cjs';
+import type { TInvitationJoinFlow, TSignIn, TSignUp } from '../components/form/index.cjs';
+type UnionType = TSignIn | TSignUp | TInvitationJoinFlow | PassflowProps;
+export declare const withError: <P extends UnionType>(Component: ComponentType<P>, ErrorComponent: ComponentType<TError>) => (props: P) => import("react").JSX.Element | null;
+export default withError;
+//# sourceMappingURL=with-error.d.ts.map

package/dist/src/hocs/with-error.d.ts

@@ -1,8 +1,8 @@
-import { TError } from '../components/error';
-import { PassflowProps } from '../components/flow/passflow';
-import { TInvitationJoinFlow, TSignIn, TSignUp } from '../components/form';
-import { default as React, ComponentType } from 'react';
+import { type ComponentType } from 'react';
+import type { TError } from '../components/error/index.js';
+import type { PassflowProps } from '../components/flow/passflow/index.js';
+import type { TInvitationJoinFlow, TSignIn, TSignUp } from '../components/form/index.js';
 type UnionType = TSignIn | TSignUp | TInvitationJoinFlow | PassflowProps;
-export declare const withError: <P extends UnionType>(Component: ComponentType<P>, ErrorComponent: ComponentType<TError>) => (props: P) => React.JSX.Element | null;
+export declare const withError: <P extends UnionType>(Component: ComponentType<P>, ErrorComponent: ComponentType<TError>) => (props: P) => import("react").JSX.Element | null;
 export default withError;
 //# sourceMappingURL=with-error.d.ts.map

package/dist/src/hocs/with-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-error.d.ts","sourceRoot":"","sources":["../../../src/hocs/with-error.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,KAAK,aAAa,EAAc,MAAM,OAAO,CAAC;AAGvD,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAQzE,eAAO,MAAM,SAAS,GACnB,CAAC,SAAS,SAAS,EAAE,WAAW,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,aAAa,CAAC,MAAM,CAAC,MACvF,OAAO,CAAC,6BAyCR,CAAC;AAEJ,eAAe,SAAS,CAAC"}
+{"version":3,"file":"with-error.d.ts","sourceRoot":"","sources":["../../../src/hocs/with-error.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAc,MAAM,OAAO,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG/E,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAMzE,eAAO,MAAM,SAAS,GACnB,CAAC,SAAS,SAAS,aAAa,aAAa,CAAC,CAAC,CAAC,kBAAkB,aAAa,CAAC,MAAM,CAAC,aAChF,CAAC,uCAyCR,CAAC;eAEW,SAAS"}

package/dist/src/hooks/index.d.cts

@@ -0,0 +1,28 @@
+export { type UseAppSettingsProps, useAppSettings } from './use-app-settings.cjs';
+export { useAuth } from './use-auth.cjs';
+export { useAuthCloudRedirect } from './use-auth-cloud-redirect.cjs';
+export { type ConsentError, type ConsentInfo, type ConsentScopeMetadata, type ConsentStatus, type UseConsentProps, useConsent, } from './use-consent.cjs';
+export { type DeviceUIMode, type DeviceVerifyInfo, type DeviceVerifyStatus, type UseDeviceVerifyProps, useDeviceVerify, } from './use-device-verify.cjs';
+export { type UseForgotPasswordProps, useForgotPassword } from './use-forgot-password.cjs';
+export { useJoinInvite } from './use-join-invite.cjs';
+export { type UseLogoutProps, useLogout } from './use-logout.cjs';
+export { useNavigation } from './use-navigation.cjs';
+export { useOutsideClick } from './use-outsideclick.cjs';
+export { usePassflow } from './use-passflow.cjs';
+export { type UsePasswordlessCompleteProps, usePasswordlessComplete } from './use-passwordless-complete.cjs';
+export { type UseProviderProps, useProvider } from './use-provider.cjs';
+export { type UseResetPasswordProps, useResetPassword } from './use-reset-password.cjs';
+export { type SessionExpiredReason, type UseSessionExpiredOptions, type UseSessionExpiredResult, useSessionExpired, } from './use-session-expired.cjs';
+export { type UseSignInProps, useSignIn } from './use-signin.cjs';
+export { type UseSignUpProps, useSignUp } from './use-signup.cjs';
+export { type UseTrustedDevicesProps, useTrustedDevices } from './use-trusted-devices.cjs';
+export { type UseTwoFactorChallengeReturn, useTwoFactorChallenge } from './use-two-factor-challenge.cjs';
+export { type UseTwoFactorManageProps, useTwoFactorManage } from './use-two-factor-manage.cjs';
+export { type UseTwoFactorMethodsReturn, useTwoFactorMethods } from './use-two-factor-methods.cjs';
+export { type TwoFactorSetupStep, type UseTwoFactorSetupProps, useTwoFactorSetup } from './use-two-factor-setup.cjs';
+export { type UseTwoFactorSetupMagicLinkReturn, useTwoFactorSetupMagicLink } from './use-two-factor-setup-magic-link.cjs';
+export { type UseTwoFactorStatusProps, useTwoFactorStatus } from './use-two-factor-status.cjs';
+export { type UseTwoFactorVerifyProps, useTwoFactorVerify } from './use-two-factor-verify.cjs';
+export { type UseUpgradeResult, useUpgrade } from './use-upgrade.cjs';
+export { type UseUserPasskeysProps, useUserPasskeys } from './use-user-passkeys.cjs';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/hooks/index.d.ts

@@ -1,28 +1,28 @@
-export { useSignIn, type UseSignInProps } from './use-signin';
-export { useProvider, type UseProviderProps } from './use-provider';
-export { useSignUp, type UseSignUpProps } from './use-signup';
-export { useForgotPassword, type UseForgotPasswordProps } from './use-forgot-password';
-export { useResetPassword, type UseResetPasswordProps } from './use-reset-password';
-export { useAppSettings, type UseAppSettingsProps } from './use-app-settings';
-export { usePassflow } from './use-passflow';
-export { usePasswordlessComplete, type UsePasswordlessCompleteProps } from './use-passwordless-complete';
-export { useAuth } from './use-auth';
-export { useLogout, type UseLogoutProps } from './use-logout';
-export { useUserPasskeys, type UseUserPasskeysProps } from './use-user-passkeys';
-export { useAuthCloudRedirect } from './use-auth-cloud-redirect';
-export { useJoinInvite } from './use-join-invite';
-export { useOutsideClick } from './use-outsideclick';
-export { useNavigation } from './use-navigation';
-export { useTwoFactorStatus, type UseTwoFactorStatusProps } from './use-two-factor-status';
-export { useTwoFactorSetup, type UseTwoFactorSetupProps, type TwoFactorSetupStep } from './use-two-factor-setup';
-export { useTwoFactorVerify, type UseTwoFactorVerifyProps } from './use-two-factor-verify';
-export { useTwoFactorManage, type UseTwoFactorManageProps } from './use-two-factor-manage';
-export { useTwoFactorSetupMagicLink, type UseTwoFactorSetupMagicLinkReturn } from './use-two-factor-setup-magic-link';
-export { useTwoFactorChallenge, type UseTwoFactorChallengeReturn } from './use-two-factor-challenge';
-export { useTwoFactorMethods, type UseTwoFactorMethodsReturn } from './use-two-factor-methods';
-export { useTrustedDevices, type UseTrustedDevicesProps } from './use-trusted-devices';
-export { useSessionExpired, type UseSessionExpiredOptions, type UseSessionExpiredResult, type SessionExpiredReason, } from './use-session-expired';
-export { useDeviceVerify, type UseDeviceVerifyProps, type DeviceVerifyStatus, type DeviceVerifyInfo, type DeviceUIMode, } from './use-device-verify';
-export { useConsent, type UseConsentProps, type ConsentStatus, type ConsentInfo, type ConsentError, type ConsentScopeMetadata, } from './use-consent';
-export { useUpgrade, type UseUpgradeResult } from './use-upgrade';
+export { type UseAppSettingsProps, useAppSettings } from './use-app-settings.js';
+export { useAuth } from './use-auth.js';
+export { useAuthCloudRedirect } from './use-auth-cloud-redirect.js';
+export { type ConsentError, type ConsentInfo, type ConsentScopeMetadata, type ConsentStatus, type UseConsentProps, useConsent, } from './use-consent.js';
+export { type DeviceUIMode, type DeviceVerifyInfo, type DeviceVerifyStatus, type UseDeviceVerifyProps, useDeviceVerify, } from './use-device-verify.js';
+export { type UseForgotPasswordProps, useForgotPassword } from './use-forgot-password.js';
+export { useJoinInvite } from './use-join-invite.js';
+export { type UseLogoutProps, useLogout } from './use-logout.js';
+export { useNavigation } from './use-navigation.js';
+export { useOutsideClick } from './use-outsideclick.js';
+export { usePassflow } from './use-passflow.js';
+export { type UsePasswordlessCompleteProps, usePasswordlessComplete } from './use-passwordless-complete.js';
+export { type UseProviderProps, useProvider } from './use-provider.js';
+export { type UseResetPasswordProps, useResetPassword } from './use-reset-password.js';
+export { type SessionExpiredReason, type UseSessionExpiredOptions, type UseSessionExpiredResult, useSessionExpired, } from './use-session-expired.js';
+export { type UseSignInProps, useSignIn } from './use-signin.js';
+export { type UseSignUpProps, useSignUp } from './use-signup.js';
+export { type UseTrustedDevicesProps, useTrustedDevices } from './use-trusted-devices.js';
+export { type UseTwoFactorChallengeReturn, useTwoFactorChallenge } from './use-two-factor-challenge.js';
+export { type UseTwoFactorManageProps, useTwoFactorManage } from './use-two-factor-manage.js';
+export { type UseTwoFactorMethodsReturn, useTwoFactorMethods } from './use-two-factor-methods.js';
+export { type TwoFactorSetupStep, type UseTwoFactorSetupProps, useTwoFactorSetup } from './use-two-factor-setup.js';
+export { type UseTwoFactorSetupMagicLinkReturn, useTwoFactorSetupMagicLink } from './use-two-factor-setup-magic-link.js';
+export { type UseTwoFactorStatusProps, useTwoFactorStatus } from './use-two-factor-status.js';
+export { type UseTwoFactorVerifyProps, useTwoFactorVerify } from './use-two-factor-verify.js';
+export { type UseUpgradeResult, useUpgrade } from './use-upgrade.js';
+export { type UseUserPasskeysProps, useUserPasskeys } from './use-user-passkeys.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,KAAK,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,KAAK,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,KAAK,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,KAAK,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,KAAK,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,KAAK,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,KAAK,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACjH,OAAO,EAAE,KAAK,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAEtH,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/hooks/use-app-settings.d.cts

@@ -0,0 +1,16 @@
+import type { AppSettings, LoginWebAppStyle, LoginWebAppTheme, PassflowPasswordPolicySettings } from '@passflow/core';
+export type UseAppSettingsProps = () => {
+    appSettings: AppSettings | null;
+    passwordPolicy: PassflowPasswordPolicySettings | null;
+    isLoading: boolean;
+    isError: boolean;
+    error: string;
+    reset: () => void;
+    currentTheme: string;
+    currentStyles: LoginWebAppStyle | null;
+    scopes: string[];
+    createTenantForNewUser: boolean;
+    loginAppTheme?: LoginWebAppTheme;
+};
+export declare const useAppSettings: UseAppSettingsProps;
+//# sourceMappingURL=use-app-settings.d.ts.map

package/dist/src/hooks/use-app-settings.d.ts

@@ -1,4 +1,4 @@
-import { AppSettings, LoginWebAppStyle, LoginWebAppTheme, PassflowPasswordPolicySettings } from '@passflow/core';
+import type { AppSettings, LoginWebAppStyle, LoginWebAppTheme, PassflowPasswordPolicySettings } from '@passflow/core';
 export type UseAppSettingsProps = () => {
     appSettings: AppSettings | null;
     passwordPolicy: PassflowPasswordPolicySettings | null;

package/dist/src/hooks/use-app-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-app-settings.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-app-settings.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAKtH,MAAM,MAAM,mBAAmB,GAAG,MAAM;IACtC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sBAAsB,EAAE,OAAO,CAAC;IAChC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,CAAC;AAMF,eAAO,MAAM,cAAc,EAAE,mBA4N5B,CAAC"}
+{"version":3,"file":"use-app-settings.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-app-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAMtH,MAAM,MAAM,mBAAmB,GAAG,MAAM;IACtC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sBAAsB,EAAE,OAAO,CAAC;IAChC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,CAAC;AAMF,eAAO,MAAM,cAAc,EAAE,mBAuN5B,CAAC"}

package/dist/src/hooks/use-auth-cloud-redirect.d.cts

@@ -0,0 +1,4 @@
+type UseAuthCloudRedirectProps = (cloudPassflowUrl: string) => () => void;
+export declare const useAuthCloudRedirect: UseAuthCloudRedirectProps;
+export {};
+//# sourceMappingURL=use-auth-cloud-redirect.d.ts.map

package/dist/src/hooks/use-auth.d.cts

@@ -0,0 +1,3 @@
+import { type AuthContextValue } from '../context/index.cjs';
+export declare const useAuth: () => AuthContextValue;
+//# sourceMappingURL=use-auth.d.ts.map

package/dist/src/hooks/use-auth.d.ts

@@ -1,3 +1,3 @@
-import { AuthContextValue } from '../context';
+import { type AuthContextValue } from '../context/index.js';
 export declare const useAuth: () => AuthContextValue;
 //# sourceMappingURL=use-auth.d.ts.map

package/dist/src/hooks/use-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG/D,eAAO,MAAM,OAAO,QAAO,gBAO1B,CAAC"}
+{"version":3,"file":"use-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D,eAAO,MAAM,OAAO,QAAO,gBAO1B,CAAC"}

package/dist/src/hooks/use-consent.d.cts

@@ -0,0 +1,68 @@
+/**
+ * The OIDC consent decision, as a hook.
+ *
+ * The URL is the bearer. `parent_challenge_id` identifies a staged
+ * authorization request the server is holding, and possessing that id is what
+ * authorizes reading it — there is no Authorization header on the GET. The
+ * server hands back a `csrf_token` with the request metadata, and every
+ * state-changing POST must carry it back in `X-Passflow-CSRF`. That token is
+ * the only thing separating a real decision from one a third-party page forged
+ * on the user's behalf, so it is never optional and never cached across
+ * challenges.
+ *
+ * The decision endpoints answer with a discriminated response rather than a
+ * redirect status, because the OIDC `response_mode` decides HOW the user gets
+ * back to the client: `query` is an ordinary navigation, `form_post` must be a
+ * POST with the parameters in a form body (they cannot go in a URL). The server
+ * knows which; the client just executes what it is told.
+ */
+export type ConsentScopeMetadata = {
+    scope: string;
+    label: string;
+    description: string;
+};
+/** What GET /oidc/requests/{parent_challenge_id} hands the page to render itself. */
+export type ConsentInfo = {
+    client_id: string;
+    app_name: string;
+    app_logo_url: string;
+    requested_scopes: string[];
+    scope_metadata: ConsentScopeMetadata[];
+    redirect_uri: string;
+    state: string;
+    response_mode: '' | 'query' | 'form_post';
+    first_party: boolean;
+    csrf_token: string;
+};
+export type ConsentStatus = 
+/** Fetching the staged request. */
+'loading'
+/** Metadata in hand; awaiting the user's decision. */
+ | 'ready'
+/** A decision is in flight. */
+ | 'working'
+/** Decision accepted; the browser is on its way back to the client. */
+ | 'redirecting'
+/** The link itself is unusable — missing, expired, or rejected id. Terminal. */
+ | 'invalid';
+export type ConsentError = {
+    message: string;
+    description?: string;
+};
+export type UseConsentProps = {
+    status: ConsentStatus;
+    info: ConsentInfo | null;
+    /** The scopes still switched on. A subset of `info.requested_scopes`. */
+    grantedScopes: string[];
+    error: ConsentError | null;
+    /** Metadata for a scope, falling back to the bare scope string. */
+    scopeMetadata: (scope: string) => ConsentScopeMetadata;
+    /** Switch one requested scope on or off before deciding. */
+    toggleScope: (scope: string) => void;
+    /** Grant the currently-selected subset. */
+    allow: () => Promise<void>;
+    /** Refuse the request outright (OAuth2 `access_denied`). */
+    deny: () => Promise<void>;
+};
+export declare const useConsent: () => UseConsentProps;
+//# sourceMappingURL=use-consent.d.ts.map

package/dist/src/hooks/use-device-verify.d.cts

@@ -0,0 +1,96 @@
+import type { DeviceError } from '../types/device-errors.cjs';
+/**
+ * The RFC 8628 verification flow, as a hook.
+ *
+ * ── The one rule the whole thing is built around ────────────────────────────
+ * Signing in and approving are TWO ACTS, and this hook keeps them two. Proving
+ * who you are (`/oidc/device/authenticate`) yields an approval ticket and
+ * NOTHING else — no tokens, no session. Approving (`/oidc/device/approve`) is
+ * what releases tokens to the waiting terminal, and it needs that ticket.
+ *
+ * The gap between them is not ceremony, it is RFC 8628 §5.4: an attacker can
+ * start a device grant and walk a victim into approving it (STORM-2372). They
+ * know the user_code — they created it — and the page is public, so they can
+ * read its CSRF token too. Neither can be the authority for approval. Only the
+ * ticket, held in this hook's memory and bound to the browser that actually
+ * authenticated, can be.
+ *
+ * So: never collapse authenticate+approve into one call "for convenience".
+ * Mode 1 puts both behind one TAP (see confirmWithPassword) — that is a UI
+ * affordance and is fine, because the human still looked at the code first.
+ * Mode 3 skips the tap entirely, which it earns by using an origin-bound
+ * passkey; see the note on confirmWithPasskey.
+ *
+ * When the app requires a second factor, the first ticket cannot approve: the
+ * server refuses it. The page asks for the factor (`/oidc/device/second-factor`)
+ * and approves with the ticket that answers, which records both.
+ */
+/** The UI the server resolved for this challenge. A closed set — the client does not choose. */
+export type DeviceUIMode = 'consent' | 'full_login' | 'passkey';
+/** What GET /oidc/device/info hands the page to render itself. */
+export type DeviceVerifyInfo = {
+    mode: DeviceUIMode;
+    /** Absent for `passkey` mode, by design — see device_page.go. */
+    user_code?: string;
+    app_name: string;
+    csrf_token: string;
+    methods: {
+        password: boolean;
+        passkey: boolean;
+    };
+};
+/** A second factor the verification page can take. */
+export type DeviceSecondFactorMethod = 'totp' | 'recovery_codes';
+export type DeviceVerifyStatus = 
+/** Asking the server what to render. */
+'loading'
+/** No code yet — show the entry form. */
+ | 'code_entry'
+/** Info in hand; awaiting the user. */
+ | 'ready'
+/** A call is in flight. */
+ | 'working'
+/** A first factor proven; the app wants a second before anything can be approved. */
+ | 'second_factor'
+/** Identity proven, ticket held, not yet approved. */
+ | 'signed_in'
+/** Approved. The terminal has its tokens. */
+ | 'done'
+/** The mode is switched off. Terminal, and nothing approvable is rendered. */
+ | 'refused'
+/** Terminal failure — bad/expired code, dead app. */
+ | 'failed';
+export type UseDeviceVerifyProps = {
+    status: DeviceVerifyStatus;
+    info: DeviceVerifyInfo | null;
+    error: DeviceError | null;
+    /** The email that authenticated, once one has. */
+    email: string | null;
+    /** Whether an approval ticket is held. */
+    isAuthenticated: boolean;
+    /** Whether a first-factor ticket is waiting for its second factor. */
+    isSecondFactorPending: boolean;
+    /** The second factors the server takes, once a sign-in owes one. */
+    secondFactorMethods: DeviceSecondFactorMethod[];
+    /** Re-run the info lookup for a code typed by hand. */
+    submitCode: (code: string) => void;
+    /** Prove identity with a password. Does NOT approve. */
+    signInWithPassword: (email: string, password: string) => Promise<void>;
+    /** Prove identity with a passkey. Does NOT approve. */
+    signInWithPasskey: () => Promise<void>;
+    /** Approve, using the ticket already held. */
+    approve: () => Promise<void>;
+    /** One tap: prove identity if needed, then approve. */
+    confirmWithPassword: (email: string, password: string) => Promise<void>;
+    /** Passkey ceremony then approve, with no tap in between. */
+    confirmWithPasskey: () => Promise<void>;
+    /**
+     * Prove the second factor. Approves too when the act that asked for it was
+     * an approval (consent's tap, the passkey mode); otherwise lands on signed_in.
+     */
+    submitSecondFactor: (method: DeviceSecondFactorMethod, code: string) => Promise<void>;
+    /** Clear a recoverable error so the user can try again. */
+    clearError: () => void;
+};
+export declare const useDeviceVerify: () => UseDeviceVerifyProps;
+//# sourceMappingURL=use-device-verify.d.ts.map

package/dist/src/hooks/use-device-verify.d.ts

@@ -1,4 +1,4 @@
-import { DeviceError } from '../types/device-errors';
+import type { DeviceError } from '../types/device-errors.js';
 /**
  * The RFC 8628 verification flow, as a hook.
  *