@passflow/react 0.16.0 → 0.18.0

package/dist/src/hooks/use-email-code-step.d.cts

@@ -0,0 +1,39 @@
+import type { PassflowAuthorizationResponse } from '@passflow/core';
+import type { EmailCodeStep } from '../types/index.cjs';
+export type UseEmailCodeStepOptions = {
+    /**
+     * Repeats the request that produced the step (the same sign-up or sign-in body). Absent when the code cannot be
+     * sent again, as after a password change: the reset link is spent.
+     */
+    resend?: () => Promise<unknown>;
+    /** The step ended (cancelled, verified, or turned into a link): anything held only for resend can be dropped. */
+    onRelease?: () => void;
+};
+export type UseEmailCodeStep = {
+    step: EmailCodeStep;
+    /** Enters the step when `answer` is an email verification step; `false` (nothing changes) for any other answer. */
+    enter: (answer: unknown) => boolean;
+    /**
+     * Posts the code. Resolves the session answer on success (the caller runs its post-auth path), `null` on a failure
+     * (shown in `error`), when a verify is already in flight, or when the step was left meanwhile.
+     */
+    verify: (otp: string) => Promise<PassflowAuthorizationResponse | null>;
+    /**
+     * Sends a new code by repeating the original request. Resolves `null` normally (the step moves to the new code or
+     * to the link); resolves the session answer in the rare case the repeated request signed the user in directly.
+     */
+    resend: () => Promise<PassflowAuthorizationResponse | null>;
+    canResend: boolean;
+    /** Leaves the step for the screen's own form. Ignored while a verify is in flight. */
+    cancel: () => void;
+    isVerifying: boolean;
+    isResending: boolean;
+    error: string | null;
+};
+/**
+ * The emailed-code step of a sign-up, sign-in or password change: holds the step, posts the code with
+ * `passflow.verifyEmailCode`, and resends by repeating the original request. An answer that arrives after the user
+ * left the step (or after a newer step replaced it) is dropped.
+ */
+export declare const useEmailCodeStep: (options?: UseEmailCodeStepOptions) => UseEmailCodeStep;
+//# sourceMappingURL=use-email-code-step.d.ts.map

package/dist/src/hooks/use-email-code-step.d.ts

@@ -0,0 +1,39 @@
+import type { PassflowAuthorizationResponse } from '@passflow/core';
+import type { EmailCodeStep } from '../types/index.js';
+export type UseEmailCodeStepOptions = {
+    /**
+     * Repeats the request that produced the step (the same sign-up or sign-in body). Absent when the code cannot be
+     * sent again, as after a password change: the reset link is spent.
+     */
+    resend?: () => Promise<unknown>;
+    /** The step ended (cancelled, verified, or turned into a link): anything held only for resend can be dropped. */
+    onRelease?: () => void;
+};
+export type UseEmailCodeStep = {
+    step: EmailCodeStep;
+    /** Enters the step when `answer` is an email verification step; `false` (nothing changes) for any other answer. */
+    enter: (answer: unknown) => boolean;
+    /**
+     * Posts the code. Resolves the session answer on success (the caller runs its post-auth path), `null` on a failure
+     * (shown in `error`), when a verify is already in flight, or when the step was left meanwhile.
+     */
+    verify: (otp: string) => Promise<PassflowAuthorizationResponse | null>;
+    /**
+     * Sends a new code by repeating the original request. Resolves `null` normally (the step moves to the new code or
+     * to the link); resolves the session answer in the rare case the repeated request signed the user in directly.
+     */
+    resend: () => Promise<PassflowAuthorizationResponse | null>;
+    canResend: boolean;
+    /** Leaves the step for the screen's own form. Ignored while a verify is in flight. */
+    cancel: () => void;
+    isVerifying: boolean;
+    isResending: boolean;
+    error: string | null;
+};
+/**
+ * The emailed-code step of a sign-up, sign-in or password change: holds the step, posts the code with
+ * `passflow.verifyEmailCode`, and resends by repeating the original request. An answer that arrives after the user
+ * left the step (or after a newer step replaced it) is dropped.
+ */
+export declare const useEmailCodeStep: (options?: UseEmailCodeStepOptions) => UseEmailCodeStep;
+//# sourceMappingURL=use-email-code-step.d.ts.map

package/dist/src/hooks/use-email-code-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-email-code-step.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-email-code-step.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,iHAAiH;IACjH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mHAAmH;IACnH,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IACpC;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAAC;IACvE;;;OAGG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAAC;IAC5D,SAAS,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAa,uBAAuB,KAAQ,gBAiIxE,CAAC"}

package/dist/src/hooks/use-join-invite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-join-invite.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-join-invite.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG,MAAM;IACrC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,kBA4B3B,CAAC"}
+{"version":3,"file":"use-join-invite.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-join-invite.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,kBAAkB,GAAG,MAAM;IACrC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,kBA4B3B,CAAC"}

package/dist/src/hooks/use-refresh-status.d.cts

@@ -0,0 +1,36 @@
+export interface UseRefreshStatusResult {
+    /**
+     * True inside a transient-failure episode: a token refresh failed for a reason that
+     * does not end the session (network, 5xx) and core is retrying. The session is kept.
+     */
+    isFailing: boolean;
+    /**
+     * Epoch ms of the episode's first transient failure (`RefreshFailing.since`).
+     */
+    since: number | null;
+    /**
+     * Epoch ms of the pending retry, when core knows it (`RefreshFailing.nextRetryAt`).
+     */
+    nextRetryAt: number | null;
+}
+/**
+ * Hook to show a "connection trouble" notice while token refresh is failing transiently.
+ *
+ * Set by `RefreshFailing`; cleared by `RefreshRecovered`, and by `SessionExpired`,
+ * `SignOut`, `SignIn` and `Register`, which end or replace the session the episode
+ * belonged to. A real end of the session is reported by `useSessionExpired`, not here.
+ *
+ * Core reports the episode only as events (there is no getter to read on mount), so a
+ * component that mounts after `RefreshFailing` starts idle. Call the hook in a component
+ * that lives for the whole app, near `PassflowProvider`.
+ *
+ * @example
+ * ```tsx
+ * function ConnectionNotice() {
+ *   const { isFailing } = useRefreshStatus();
+ *   return isFailing ? <Banner>Reconnecting...</Banner> : null;
+ * }
+ * ```
+ */
+export declare function useRefreshStatus(): UseRefreshStatusResult;
+//# sourceMappingURL=use-refresh-status.d.ts.map

package/dist/src/hooks/use-refresh-status.d.ts

@@ -0,0 +1,36 @@
+export interface UseRefreshStatusResult {
+    /**
+     * True inside a transient-failure episode: a token refresh failed for a reason that
+     * does not end the session (network, 5xx) and core is retrying. The session is kept.
+     */
+    isFailing: boolean;
+    /**
+     * Epoch ms of the episode's first transient failure (`RefreshFailing.since`).
+     */
+    since: number | null;
+    /**
+     * Epoch ms of the pending retry, when core knows it (`RefreshFailing.nextRetryAt`).
+     */
+    nextRetryAt: number | null;
+}
+/**
+ * Hook to show a "connection trouble" notice while token refresh is failing transiently.
+ *
+ * Set by `RefreshFailing`; cleared by `RefreshRecovered`, and by `SessionExpired`,
+ * `SignOut`, `SignIn` and `Register`, which end or replace the session the episode
+ * belonged to. A real end of the session is reported by `useSessionExpired`, not here.
+ *
+ * Core reports the episode only as events (there is no getter to read on mount), so a
+ * component that mounts after `RefreshFailing` starts idle. Call the hook in a component
+ * that lives for the whole app, near `PassflowProvider`.
+ *
+ * @example
+ * ```tsx
+ * function ConnectionNotice() {
+ *   const { isFailing } = useRefreshStatus();
+ *   return isFailing ? <Banner>Reconnecting...</Banner> : null;
+ * }
+ * ```
+ */
+export declare function useRefreshStatus(): UseRefreshStatusResult;
+//# sourceMappingURL=use-refresh-status.d.ts.map

package/dist/src/hooks/use-refresh-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-refresh-status.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-refresh-status.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,IAAI,sBAAsB,CA4BzD"}

package/dist/src/hooks/use-reset-password.d.cts

@@ -1,9 +1,22 @@
+import { type UseEmailCodeStep } from './use-email-code-step.cjs';
 export type UseResetPasswordProps = () => {
-    fetch: (newPassword: string) => Promise<boolean>;
+    /**
+     * Saves the new password. Pass the reset link's `token` when you have it: without it core looks for `?token=` in
+     * the address bar, which a hash or memory router does not keep. Resolves `true` for a session, `false` on an error
+     * or when the server asks for an emailed code first (`emailCode` then holds the step).
+     */
+    fetch: (newPassword: string, resetToken?: string) => Promise<boolean>;
     isLoading: boolean;
     isError: boolean;
     error: string;
+    /**
+     * The password was changed, but the emailed code that should follow was refused for now (429). Asking for the
+     * password again would be wrong: the user should sign in with it later.
+     */
+    isPasswordSaved: boolean;
     reset: () => void;
+    /** The emailed-code step a password change may answer with. No resend: the reset link is spent. */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useResetPassword: UseResetPasswordProps;
 //# sourceMappingURL=use-reset-password.d.ts.map

package/dist/src/hooks/use-reset-password.d.ts

@@ -1,9 +1,22 @@
+import { type UseEmailCodeStep } from './use-email-code-step.js';
 export type UseResetPasswordProps = () => {
-    fetch: (newPassword: string) => Promise<boolean>;
+    /**
+     * Saves the new password. Pass the reset link's `token` when you have it: without it core looks for `?token=` in
+     * the address bar, which a hash or memory router does not keep. Resolves `true` for a session, `false` on an error
+     * or when the server asks for an emailed code first (`emailCode` then holds the step).
+     */
+    fetch: (newPassword: string, resetToken?: string) => Promise<boolean>;
     isLoading: boolean;
     isError: boolean;
     error: string;
+    /**
+     * The password was changed, but the emailed code that should follow was refused for now (429). Asking for the
+     * password again would be wrong: the user should sign in with it later.
+     */
+    isPasswordSaved: boolean;
     reset: () => void;
+    /** The emailed-code step a password change may answer with. No resend: the reset link is spent. */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useResetPassword: UseResetPasswordProps;
 //# sourceMappingURL=use-reset-password.d.ts.map

package/dist/src/hooks/use-reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-reset-password.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-reset-password.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,qBAAqB,GAAG,MAAM;IACxC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,qBA8B9B,CAAC"}
+{"version":3,"file":"use-reset-password.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-reset-password.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAGhF,MAAM,MAAM,qBAAqB,GAAG,MAAM;IACxC;;;;OAIG;IACH,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,mGAAmG;IACnG,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,qBAuC9B,CAAC"}

package/dist/src/hooks/use-session-expired.d.cts

@@ -1,4 +1,4 @@
-export type SessionExpiredReason = 'refresh_failed' | 'token_invalid' | 'logged_out';
+import { type SessionExpiredReason } from '@passflow/core';
 export interface UseSessionExpiredOptions {
     /**
      * Called when the session expires.
@@ -23,9 +23,13 @@ export interface UseSessionExpiredResult {
 /**
  * Hook to handle session expiration events.
  *
- * When the SDK detects that the session is invalid (e.g., refresh token expired),
- * it emits a SessionExpired event. This hook allows you to react to that event
- * and redirect users to your login page.
+ * Core emits SessionExpired only when the session has really ended: the last
+ * auth strike (`'refresh_failed'`), no successor token pair in time
+ * (`'successor_timeout'`), or another user's tokens in storage
+ * (`'identity_changed'`). A transient refresh failure (network, 5xx) keeps the
+ * session and is reported as RefreshFailing / RefreshRecovered instead; see
+ * `useRefreshStatus`. This hook lets you react to the real end and redirect
+ * users to your login page.
  *
  * @example
  * ```tsx

package/dist/src/hooks/use-session-expired.d.ts

@@ -1,4 +1,4 @@
-export type SessionExpiredReason = 'refresh_failed' | 'token_invalid' | 'logged_out';
+import { type SessionExpiredReason } from '@passflow/core';
 export interface UseSessionExpiredOptions {
     /**
      * Called when the session expires.
@@ -23,9 +23,13 @@ export interface UseSessionExpiredResult {
 /**
  * Hook to handle session expiration events.
  *
- * When the SDK detects that the session is invalid (e.g., refresh token expired),
- * it emits a SessionExpired event. This hook allows you to react to that event
- * and redirect users to your login page.
+ * Core emits SessionExpired only when the session has really ended: the last
+ * auth strike (`'refresh_failed'`), no successor token pair in time
+ * (`'successor_timeout'`), or another user's tokens in storage
+ * (`'identity_changed'`). A transient refresh failure (network, 5xx) keeps the
+ * session and is reported as RefreshFailing / RefreshRecovered instead; see
+ * `useRefreshStatus`. This hook lets you react to the real end and redirect
+ * users to your login page.
  *
  * @example
  * ```tsx

package/dist/src/hooks/use-session-expired.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-session-expired.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-session-expired.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,eAAe,GAAG,YAAY,CAAC;AAErF,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C;;OAEG;IACH,mBAAmB,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,uBAAuB,CAsC7F"}
+{"version":3,"file":"use-session-expired.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-session-expired.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAInG,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C;;OAEG;IACH,mBAAmB,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,uBAAuB,CAsC7F"}

package/dist/src/hooks/use-signin.d.cts

@@ -1,11 +1,17 @@
 import type { PassflowPasskeyAuthenticateStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInPayload, PassflowSignInPayload } from '@passflow/core';
 import type { AuthOperation, AuthUiError } from '../types/index.cjs';
+import { type UseEmailCodeStep } from './use-email-code-step.cjs';
 export type UseSignInProps = () => {
     fetch: (payload: PassflowPasskeyAuthenticateStartPayload | PassflowSignInPayload | PassflowPasswordlessSignInPayload, type: AuthOperation) => Promise<boolean | string | PassflowPasswordlessResponse>;
     isLoading: boolean;
     isError: boolean;
     error: AuthUiError | null;
     reset: () => void;
+    /**
+     * The emailed-code step. A password request the server answers with a code (or a link) enters it, and `fetch`
+     * resolves `false`: there is no session yet.
+     */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useSignIn: UseSignInProps;
 //# sourceMappingURL=use-signin.d.ts.map

package/dist/src/hooks/use-signin.d.ts

@@ -1,11 +1,17 @@
 import type { PassflowPasskeyAuthenticateStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInPayload, PassflowSignInPayload } from '@passflow/core';
 import type { AuthOperation, AuthUiError } from '../types/index.js';
+import { type UseEmailCodeStep } from './use-email-code-step.js';
 export type UseSignInProps = () => {
     fetch: (payload: PassflowPasskeyAuthenticateStartPayload | PassflowSignInPayload | PassflowPasswordlessSignInPayload, type: AuthOperation) => Promise<boolean | string | PassflowPasswordlessResponse>;
     isLoading: boolean;
     isError: boolean;
     error: AuthUiError | null;
     reset: () => void;
+    /**
+     * The emailed-code step. A password request the server answers with a code (or a link) enters it, and `fetch`
+     * resolves `false`: there is no session yet.
+     */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useSignIn: UseSignInProps;
 //# sourceMappingURL=use-signin.d.ts.map

package/dist/src/hooks/use-signin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-signin.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uCAAuC,EACvC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI1D,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,uCAAuC,GAAG,qBAAqB,GAAG,iCAAiC,EAC5G,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cA4CvB,CAAC"}
+{"version":3,"file":"use-signin.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uCAAuC,EACvC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAGhF,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,uCAAuC,GAAG,qBAAqB,GAAG,iCAAiC,EAC5G,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAqEvB,CAAC"}

package/dist/src/hooks/use-signup.d.cts

@@ -1,11 +1,17 @@
 import type { PassflowPasskeyRegisterStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInPayload, PassflowSignUpPayload } from '@passflow/core';
 import type { AuthOperation, AuthUiError } from '../types/index.cjs';
+import { type UseEmailCodeStep } from './use-email-code-step.cjs';
 export type UseSignUpProps = () => {
     fetch: (payload: PassflowPasskeyRegisterStartPayload | PassflowSignUpPayload | PassflowPasswordlessSignInPayload, type: AuthOperation) => Promise<boolean | string | PassflowPasswordlessResponse>;
     isLoading: boolean;
     isError: boolean;
     error: AuthUiError | null;
     reset: () => void;
+    /**
+     * The emailed-code step. A password request the server answers with a code (or a link) enters it, and `fetch`
+     * resolves `false`: there is no session yet.
+     */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useSignUp: UseSignUpProps;
 //# sourceMappingURL=use-signup.d.ts.map

package/dist/src/hooks/use-signup.d.ts

@@ -1,11 +1,17 @@
 import type { PassflowPasskeyRegisterStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInPayload, PassflowSignUpPayload } from '@passflow/core';
 import type { AuthOperation, AuthUiError } from '../types/index.js';
+import { type UseEmailCodeStep } from './use-email-code-step.js';
 export type UseSignUpProps = () => {
     fetch: (payload: PassflowPasskeyRegisterStartPayload | PassflowSignUpPayload | PassflowPasswordlessSignInPayload, type: AuthOperation) => Promise<boolean | string | PassflowPasswordlessResponse>;
     isLoading: boolean;
     isError: boolean;
     error: AuthUiError | null;
     reset: () => void;
+    /**
+     * The emailed-code step. A password request the server answers with a code (or a link) enters it, and `fetch`
+     * resolves `false`: there is no session yet.
+     */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useSignUp: UseSignUpProps;
 //# sourceMappingURL=use-signup.d.ts.map

package/dist/src/hooks/use-signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-signup.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI1D,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,mCAAmC,GAAG,qBAAqB,GAAG,iCAAiC,EACxG,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cA+CvB,CAAC"}
+{"version":3,"file":"use-signup.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAGhF,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,mCAAmC,GAAG,qBAAqB,GAAG,iCAAiC,EACxG,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAwEvB,CAAC"}

package/dist/src/index.d.cts

@@ -6,5 +6,6 @@ export { PassflowProvider, UpgradeProvider } from './components/provider/index.c
 export * from './components/ui/index.cjs';
 export { INERT_UPGRADE_CONTEXT, UpgradeContext, type UpgradeContextValue, type UpgradeElevateOptions, type UpgradeErrorStatusKind, type UpgradeHookState, type UpgradePromptView, type UpgradeSettledState, } from './context/upgrade-context.cjs';
 export * from './hooks/index.cjs';
+export type { EmailCodeStep, EmailVerificationStep } from './types/index.cjs';
 export { attachAuth, withAuth } from './utils/upgrade-auth.cjs';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts

@@ -6,5 +6,6 @@ export { PassflowProvider, UpgradeProvider } from './components/provider/index.j
 export * from './components/ui/index.js';
 export { INERT_UPGRADE_CONTEXT, UpgradeContext, type UpgradeContextValue, type UpgradeElevateOptions, type UpgradeErrorStatusKind, type UpgradeHookState, type UpgradePromptView, type UpgradeSettledState, } from './context/upgrade-context.js';
 export * from './hooks/index.js';
+export type { EmailCodeStep, EmailVerificationStep } from './types/index.js';
 export { attachAuth, withAuth } from './utils/upgrade-auth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC1E,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC1E,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/src/types/email-verification.d.cts

@@ -0,0 +1,18 @@
+/**
+ * What a sign-up, sign-in or password change answered instead of a session: `code` when a code was emailed
+ * (finish it with `verifyEmailCode`), `link` when a link was emailed instead (the sign-in finishes on that page).
+ * `message` is the server's text, or fixed copy when the server sent none.
+ */
+export type EmailVerificationStep = {
+    kind: 'code';
+    challengeId: string;
+    message: string;
+} | {
+    kind: 'link';
+    message: string;
+};
+/** The emailed-code step of a screen: `none` while the screen shows its own form. */
+export type EmailCodeStep = {
+    kind: 'none';
+} | EmailVerificationStep;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/types/email-verification.d.ts

@@ -0,0 +1,18 @@
+/**
+ * What a sign-up, sign-in or password change answered instead of a session: `code` when a code was emailed
+ * (finish it with `verifyEmailCode`), `link` when a link was emailed instead (the sign-in finishes on that page).
+ * `message` is the server's text, or fixed copy when the server sent none.
+ */
+export type EmailVerificationStep = {
+    kind: 'code';
+    challengeId: string;
+    message: string;
+} | {
+    kind: 'link';
+    message: string;
+};
+/** The emailed-code step of a screen: `none` while the screen shows its own form. */
+export type EmailCodeStep = {
+    kind: 'none';
+} | EmailVerificationStep;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/types/email-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../../../src/types/email-verification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/H,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,CAAC"}

package/dist/src/types/index.d.cts

@@ -5,6 +5,7 @@ export type SuccessAuthRedirect = string;
 export type { RegisteredTwoFactorMethod, TwoFactorChallengeResponse, TwoFactorMethod, TwoFactorVerifyRequestV2, TwoFactorVerifyResponseV2, } from '@passflow/core';
 export type { AuthErrorScope, AuthFlow, AuthOperation, AuthUiError } from './auth-errors.cjs';
 export type { DeviceError, DeviceErrorType } from './device-errors.cjs';
+export type { EmailCodeStep, EmailVerificationStep } from './email-verification.cjs';
 export type { TwoFactorError, TwoFactorErrorType } from './two-factor-errors.cjs';
 export interface UseTwoFactorChallengeReturn {
     challenge: import('@passflow/core').TwoFactorChallengeResponse | null;

package/dist/src/types/index.d.ts

@@ -5,6 +5,7 @@ export type SuccessAuthRedirect = string;
 export type { RegisteredTwoFactorMethod, TwoFactorChallengeResponse, TwoFactorMethod, TwoFactorVerifyRequestV2, TwoFactorVerifyResponseV2, } from '@passflow/core';
 export type { AuthErrorScope, AuthFlow, AuthOperation, AuthUiError } from './auth-errors.js';
 export type { DeviceError, DeviceErrorType } from './device-errors.js';
+export type { EmailCodeStep, EmailVerificationStep } from './email-verification.js';
 export type { TwoFactorError, TwoFactorErrorType } from './two-factor-errors.js';
 export interface UseTwoFactorChallengeReturn {
     challenge: import('@passflow/core').TwoFactorChallengeResponse | null;

package/dist/src/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAGzC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,OAAO,gBAAgB,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,cAAc,EAAE,OAAO,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,OAAO,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC7D,iBAAiB,EAAE,OAAO,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAGzC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,OAAO,gBAAgB,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,cAAc,EAAE,OAAO,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,OAAO,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC7D,iBAAiB,EAAE,OAAO,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}

package/dist/src/utils/auth-error.d.cts

@@ -4,4 +4,50 @@ export declare const verificationLinkErrorMessage = "This verification link is i
 export declare const invitationLinkErrorMessage = "This invitation link is invalid or has expired.";
 export declare const verificationRequestErrorMessage = "This verification request is no longer available. Start again to request a new link or code.";
 export declare const authErrorFor: (flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * Server error ids whose `message` is written for the end user (localized, no operator detail) and may be shown as
+ * is. Every other id keeps the SDK's fixed copy, so server text that was not meant for a sign-in screen never reaches
+ * one. `error.not.found` is deliberately absent: it is a generic id across the API (its text can name a missing user).
+ */
+export declare const SERVER_MESSAGE_ERROR_IDS: ReadonlySet<string>;
+/**
+ * The server's own message for an allow-listed error id, trimmed; `null` for anything else. Duck-typed on
+ * `{ id, message }`, so it reads a `PassflowError`, a raw axios rejection's body, or a plain object such as a
+ * redirect's query.
+ */
+export declare const serverMessageFor: (error: unknown) => string | null;
+/** A hook's display error: the server's message for an allow-listed id, else the fixed copy for the operation. */
+export declare const authErrorFrom: (error: unknown, flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * The message for a federated redirect that came back as `?error=<id>&message=<text>`: the server's text when the id
+ * is allow-listed, else the generic redirect copy.
+ */
+export declare const authRedirectErrorFrom: (error: string, message: string | null) => string;
+export declare const invitationJoinErrorMessage = "We couldn't accept this invitation. Try again.";
+/** Invitation join error: the server's message for an allow-listed id, else the fixed copy. */
+export declare const invitationJoinErrorFrom: (error: unknown) => string;
+export declare const emailCodeInvalidMessage = "This code is no longer valid. Request a new code.";
+export declare const emailCodeUnavailableMessage = "We couldn't check the code. Try again.";
+export declare const emailCodeRestartMessage = "We couldn't verify the code. Go back and start again.";
+/**
+ * Error copy for the emailed-code step (`/auth/validate`, resend): allow-listed ids (wrong, expired or spent code,
+ * rate limit, ...) show the server message; `error.not.found` (unknown or spent challenge) asks for a new code; a
+ * request that got no answer at all (offline, CORS, timeout) asks to retry; every other server answer (401, a missing
+ * PKCE verifier, an unlisted 4xx or a 5xx) asks to start again, and the screen keeps its way back to the form.
+ */
+export declare const emailCodeErrorMessage: (error: unknown) => string;
+export declare const resetLinkInvalidMessage = "This link is invalid or has expired. Request a new one.";
+export declare const newPasswordUnavailableMessage = "We couldn't save your password. Try again.";
+export declare const passwordSavedRateLimitedMessage = "Your password was saved, but we cannot send a verification code right now. Wait a few minutes, then sign in with your new password.";
+/**
+ * A 429 from `/auth/password/change`: the password was already changed, only the emailed code that should follow
+ * was refused, so the screen must not ask for the password again.
+ */
+export declare const isPasswordSavedRateLimit: (error: unknown) => boolean;
+/**
+ * Error copy for the new-password screen (reset link or registration continuation): allow-listed ids show the server
+ * message; a refused or spent link (any other 4xx, an `error.token.*` id) asks for a new one; a server or network
+ * failure asks to retry. The raw message of anything else is never shown.
+ */
+export declare const newPasswordErrorMessage: (error: unknown) => string;
 //# sourceMappingURL=auth-error.d.ts.map

package/dist/src/utils/auth-error.d.ts

@@ -4,4 +4,50 @@ export declare const verificationLinkErrorMessage = "This verification link is i
 export declare const invitationLinkErrorMessage = "This invitation link is invalid or has expired.";
 export declare const verificationRequestErrorMessage = "This verification request is no longer available. Start again to request a new link or code.";
 export declare const authErrorFor: (flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * Server error ids whose `message` is written for the end user (localized, no operator detail) and may be shown as
+ * is. Every other id keeps the SDK's fixed copy, so server text that was not meant for a sign-in screen never reaches
+ * one. `error.not.found` is deliberately absent: it is a generic id across the API (its text can name a missing user).
+ */
+export declare const SERVER_MESSAGE_ERROR_IDS: ReadonlySet<string>;
+/**
+ * The server's own message for an allow-listed error id, trimmed; `null` for anything else. Duck-typed on
+ * `{ id, message }`, so it reads a `PassflowError`, a raw axios rejection's body, or a plain object such as a
+ * redirect's query.
+ */
+export declare const serverMessageFor: (error: unknown) => string | null;
+/** A hook's display error: the server's message for an allow-listed id, else the fixed copy for the operation. */
+export declare const authErrorFrom: (error: unknown, flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * The message for a federated redirect that came back as `?error=<id>&message=<text>`: the server's text when the id
+ * is allow-listed, else the generic redirect copy.
+ */
+export declare const authRedirectErrorFrom: (error: string, message: string | null) => string;
+export declare const invitationJoinErrorMessage = "We couldn't accept this invitation. Try again.";
+/** Invitation join error: the server's message for an allow-listed id, else the fixed copy. */
+export declare const invitationJoinErrorFrom: (error: unknown) => string;
+export declare const emailCodeInvalidMessage = "This code is no longer valid. Request a new code.";
+export declare const emailCodeUnavailableMessage = "We couldn't check the code. Try again.";
+export declare const emailCodeRestartMessage = "We couldn't verify the code. Go back and start again.";
+/**
+ * Error copy for the emailed-code step (`/auth/validate`, resend): allow-listed ids (wrong, expired or spent code,
+ * rate limit, ...) show the server message; `error.not.found` (unknown or spent challenge) asks for a new code; a
+ * request that got no answer at all (offline, CORS, timeout) asks to retry; every other server answer (401, a missing
+ * PKCE verifier, an unlisted 4xx or a 5xx) asks to start again, and the screen keeps its way back to the form.
+ */
+export declare const emailCodeErrorMessage: (error: unknown) => string;
+export declare const resetLinkInvalidMessage = "This link is invalid or has expired. Request a new one.";
+export declare const newPasswordUnavailableMessage = "We couldn't save your password. Try again.";
+export declare const passwordSavedRateLimitedMessage = "Your password was saved, but we cannot send a verification code right now. Wait a few minutes, then sign in with your new password.";
+/**
+ * A 429 from `/auth/password/change`: the password was already changed, only the emailed code that should follow
+ * was refused, so the screen must not ask for the password again.
+ */
+export declare const isPasswordSavedRateLimit: (error: unknown) => boolean;
+/**
+ * Error copy for the new-password screen (reset link or registration continuation): allow-listed ids show the server
+ * message; a refused or spent link (any other 4xx, an `error.token.*` id) asks for a new one; a server or network
+ * failure asks to retry. The raw message of anything else is never shown.
+ */
+export declare const newPasswordErrorMessage: (error: unknown) => string;
 //# sourceMappingURL=auth-error.d.ts.map

package/dist/src/utils/auth-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../../src/utils/auth-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAiCpE,eAAO,MAAM,wBAAwB,uFAAuF,CAAC;AAE7H,eAAO,MAAM,4BAA4B,+FACqD,CAAC;AAE/F,eAAO,MAAM,0BAA0B,oDAAoD,CAAC;AAE5F,eAAO,MAAM,+BAA+B,iGACoD,CAAC;AAEjG,eAAO,MAAM,YAAY,SAAU,QAAQ,aAAa,aAAa,KAAG,WAA+C,CAAC"}
+{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../../src/utils/auth-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAiCpE,eAAO,MAAM,wBAAwB,uFAAuF,CAAC;AAE7H,eAAO,MAAM,4BAA4B,+FACqD,CAAC;AAE/F,eAAO,MAAM,0BAA0B,oDAAoD,CAAC;AAE5F,eAAO,MAAM,+BAA+B,iGACoD,CAAC;AAEjG,eAAO,MAAM,YAAY,SAAU,QAAQ,aAAa,aAAa,KAAG,WAA+C,CAAC;AAExH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAavD,CAAC;AAkBH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,MAAM,GAAG,IAQ1D,CAAC;AAEF,kHAAkH;AAClH,eAAO,MAAM,aAAa,UAAW,OAAO,QAAQ,QAAQ,aAAa,aAAa,KAAG,WAGxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,UAAW,MAAM,WAAW,MAAM,GAAG,IAAI,KAAG,MACR,CAAC;AAEvE,eAAO,MAAM,0BAA0B,mDAAmD,CAAC;AAE3F,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,UAAW,OAAO,KAAG,MAA+D,CAAC;AAEzH,eAAO,MAAM,uBAAuB,sDAAsD,CAAC;AAC3F,eAAO,MAAM,2BAA2B,2CAA2C,CAAC;AACpF,eAAO,MAAM,uBAAuB,0DAA0D,CAAC;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,MAUtD,CAAC;AAEF,eAAO,MAAM,uBAAuB,4DAA4D,CAAC;AACjG,eAAO,MAAM,6BAA6B,+CAA+C,CAAC;AAC1F,eAAO,MAAM,+BAA+B,wIAC2F,CAAC;AAExI;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAAW,OAAO,KAAG,OAGzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,UAAW,OAAO,KAAG,MAWxD,CAAC"}

package/dist/src/utils/email-verification.d.cts

@@ -0,0 +1,44 @@
+import type { EmailCodeStep, EmailVerificationStep } from '../types/index.cjs';
+export declare const emailCodeSentFallbackMessage = "We sent a code to your email.";
+export declare const emailLinkSentFallbackMessage = "Check your email for a link to finish signing up.";
+/**
+ * Reads an auth answer as an email verification step: `code` when the server emailed a code (a non-empty
+ * `challenge_id`), `link` when it emailed a link instead. `null` for anything else (tokens, a 2FA token, no answer).
+ */
+export declare const readEmailVerificationStep: (answer: unknown) => EmailVerificationStep | null;
+export type EmailCodeStepState = {
+    step: EmailCodeStep;
+    /** The display message of the last failed verify or resend; cleared by the next attempt or a new code. */
+    error: string | null;
+};
+export type EmailCodeStepEvent = {
+    type: 'ENTER';
+    step: EmailVerificationStep;
+} | {
+    type: 'VERIFY_STARTED';
+} | {
+    type: 'VERIFY_OK';
+} | {
+    type: 'VERIFY_FAILED';
+    message: string;
+} | {
+    type: 'RESENT';
+    challengeId: string;
+    message: string;
+} | {
+    type: 'LINK_SENT';
+    message: string;
+} | {
+    type: 'RESEND_FAILED';
+    message: string;
+} | {
+    type: 'CANCEL';
+};
+export declare const initialEmailCodeStepState: EmailCodeStepState;
+/**
+ * The emailed-code step as a transition table. Only `ENTER` leaves `none`: a verify or resend answer that lands
+ * after the user went back is a real race, not a bug, so it is ignored rather than resurrecting the step. Verify and
+ * resend events only change a `code` step; in `link` there is nothing left to verify or resend.
+ */
+export declare const emailCodeStepReducer: (state: EmailCodeStepState, event: EmailCodeStepEvent) => EmailCodeStepState;
+//# sourceMappingURL=email-verification.d.ts.map