@passflow/react 0.17.0 → 0.19.0

package/dist/src/hooks/use-signup.d.ts

@@ -1,11 +1,17 @@
 import type { PassflowPasskeyRegisterStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInPayload, PassflowSignUpPayload } from '@passflow/core';
 import type { AuthOperation, AuthUiError } from '../types/index.js';
+import { type UseEmailCodeStep } from './use-email-code-step.js';
 export type UseSignUpProps = () => {
     fetch: (payload: PassflowPasskeyRegisterStartPayload | PassflowSignUpPayload | PassflowPasswordlessSignInPayload, type: AuthOperation) => Promise<boolean | string | PassflowPasswordlessResponse>;
     isLoading: boolean;
     isError: boolean;
     error: AuthUiError | null;
     reset: () => void;
+    /**
+     * The emailed-code step. A password request the server answers with a code (or a link) enters it, and `fetch`
+     * resolves `false`: there is no session yet.
+     */
+    emailCode: UseEmailCodeStep;
 };
 export declare const useSignUp: UseSignUpProps;
 //# sourceMappingURL=use-signup.d.ts.map

package/dist/src/hooks/use-signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-signup.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI1D,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,mCAAmC,GAAG,qBAAqB,GAAG,iCAAiC,EACxG,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cA+CvB,CAAC"}
+{"version":3,"file":"use-signup.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-signup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAGhF,MAAM,MAAM,cAAc,GAAG,MAAM;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,mCAAmC,GAAG,qBAAqB,GAAG,iCAAiC,EACxG,IAAI,EAAE,aAAa,KAChB,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,4BAA4B,CAAC,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAwEvB,CAAC"}

package/dist/src/index.d.cts

@@ -6,5 +6,6 @@ export { PassflowProvider, UpgradeProvider } from './components/provider/index.c
 export * from './components/ui/index.cjs';
 export { INERT_UPGRADE_CONTEXT, UpgradeContext, type UpgradeContextValue, type UpgradeElevateOptions, type UpgradeErrorStatusKind, type UpgradeHookState, type UpgradePromptView, type UpgradeSettledState, } from './context/upgrade-context.cjs';
 export * from './hooks/index.cjs';
+export type { EmailCodeStep, EmailVerificationStep } from './types/index.cjs';
 export { attachAuth, withAuth } from './utils/upgrade-auth.cjs';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts

@@ -6,5 +6,6 @@ export { PassflowProvider, UpgradeProvider } from './components/provider/index.j
 export * from './components/ui/index.js';
 export { INERT_UPGRADE_CONTEXT, UpgradeContext, type UpgradeContextValue, type UpgradeElevateOptions, type UpgradeErrorStatusKind, type UpgradeHookState, type UpgradePromptView, type UpgradeSettledState, } from './context/upgrade-context.js';
 export * from './hooks/index.js';
+export type { EmailCodeStep, EmailVerificationStep } from './types/index.js';
 export { attachAuth, withAuth } from './utils/upgrade-auth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC1E,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC1E,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/src/types/auth-errors.d.cts

@@ -2,6 +2,8 @@ export type AuthErrorScope = 'form' | 'identity' | 'password' | 'credentials';
 export type AuthUiError = {
     message: string;
     scope: AuthErrorScope;
+    /** The request behind this form is gone, so the screen offers a full reload without its parent challenge. */
+    startAgain?: boolean;
 };
 export type AuthOperation = 'password' | 'passwordless' | 'passkey';
 export type AuthFlow = 'sign-in' | 'sign-up';

package/dist/src/types/auth-errors.d.ts

@@ -2,6 +2,8 @@ export type AuthErrorScope = 'form' | 'identity' | 'password' | 'credentials';
 export type AuthUiError = {
     message: string;
     scope: AuthErrorScope;
+    /** The request behind this form is gone, so the screen offers a full reload without its parent challenge. */
+    startAgain?: boolean;
 };
 export type AuthOperation = 'password' | 'passwordless' | 'passkey';
 export type AuthFlow = 'sign-in' | 'sign-up';

package/dist/src/types/auth-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../src/types/auth-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC"}
+{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../src/types/auth-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,6GAA6G;IAC7G,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC"}

package/dist/src/types/email-verification.d.cts

@@ -0,0 +1,18 @@
+/**
+ * What a sign-up, sign-in or password change answered instead of a session: `code` when a code was emailed
+ * (finish it with `verifyEmailCode`), `link` when a link was emailed instead (the sign-in finishes on that page).
+ * `message` is the server's text, or fixed copy when the server sent none.
+ */
+export type EmailVerificationStep = {
+    kind: 'code';
+    challengeId: string;
+    message: string;
+} | {
+    kind: 'link';
+    message: string;
+};
+/** The emailed-code step of a screen: `none` while the screen shows its own form. */
+export type EmailCodeStep = {
+    kind: 'none';
+} | EmailVerificationStep;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/types/email-verification.d.ts

@@ -0,0 +1,18 @@
+/**
+ * What a sign-up, sign-in or password change answered instead of a session: `code` when a code was emailed
+ * (finish it with `verifyEmailCode`), `link` when a link was emailed instead (the sign-in finishes on that page).
+ * `message` is the server's text, or fixed copy when the server sent none.
+ */
+export type EmailVerificationStep = {
+    kind: 'code';
+    challengeId: string;
+    message: string;
+} | {
+    kind: 'link';
+    message: string;
+};
+/** The emailed-code step of a screen: `none` while the screen shows its own form. */
+export type EmailCodeStep = {
+    kind: 'none';
+} | EmailVerificationStep;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/types/email-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../../../src/types/email-verification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/H,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,CAAC"}

package/dist/src/types/index.d.cts

@@ -2,9 +2,11 @@ export type PreferIdentity = 'identity' | 'phone' | 'none';
 export type DefaultMethod = 'email_or_username' | 'phone';
 export type PreferChallenge = 'passkey' | 'password' | 'otp' | 'magic_link';
 export type SuccessAuthRedirect = string;
+export type FederatedLanding = 'app' | 'login-page';
 export type { RegisteredTwoFactorMethod, TwoFactorChallengeResponse, TwoFactorMethod, TwoFactorVerifyRequestV2, TwoFactorVerifyResponseV2, } from '@passflow/core';
 export type { AuthErrorScope, AuthFlow, AuthOperation, AuthUiError } from './auth-errors.cjs';
 export type { DeviceError, DeviceErrorType } from './device-errors.cjs';
+export type { EmailCodeStep, EmailVerificationStep } from './email-verification.cjs';
 export type { TwoFactorError, TwoFactorErrorType } from './two-factor-errors.cjs';
 export interface UseTwoFactorChallengeReturn {
     challenge: import('@passflow/core').TwoFactorChallengeResponse | null;

package/dist/src/types/index.d.ts

@@ -2,9 +2,11 @@ export type PreferIdentity = 'identity' | 'phone' | 'none';
 export type DefaultMethod = 'email_or_username' | 'phone';
 export type PreferChallenge = 'passkey' | 'password' | 'otp' | 'magic_link';
 export type SuccessAuthRedirect = string;
+export type FederatedLanding = 'app' | 'login-page';
 export type { RegisteredTwoFactorMethod, TwoFactorChallengeResponse, TwoFactorMethod, TwoFactorVerifyRequestV2, TwoFactorVerifyResponseV2, } from '@passflow/core';
 export type { AuthErrorScope, AuthFlow, AuthOperation, AuthUiError } from './auth-errors.js';
 export type { DeviceError, DeviceErrorType } from './device-errors.js';
+export type { EmailCodeStep, EmailVerificationStep } from './email-verification.js';
 export type { TwoFactorError, TwoFactorErrorType } from './two-factor-errors.js';
 export interface UseTwoFactorChallengeReturn {
     challenge: import('@passflow/core').TwoFactorChallengeResponse | null;

package/dist/src/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAGzC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,OAAO,gBAAgB,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,cAAc,EAAE,OAAO,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,OAAO,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC7D,iBAAiB,EAAE,OAAO,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,YAAY,CAAC;AAGpD,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACjF,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,OAAO,gBAAgB,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,cAAc,EAAE,OAAO,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,OAAO,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC7D,iBAAiB,EAAE,OAAO,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}

package/dist/src/utils/auth-error.d.cts

@@ -4,4 +4,81 @@ export declare const verificationLinkErrorMessage = "This verification link is i
 export declare const invitationLinkErrorMessage = "This invitation link is invalid or has expired.";
 export declare const verificationRequestErrorMessage = "This verification request is no longer available. Start again to request a new link or code.";
 export declare const authErrorFor: (flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * Server error ids whose `message` is written for the end user (localized, no operator detail) and may be shown as
+ * is. Every other id keeps the SDK's fixed copy, so server text that was not meant for a sign-in screen never reaches
+ * one. `error.not.found` is deliberately absent: it is a generic id across the API (its text can name a missing user).
+ */
+export declare const SERVER_MESSAGE_ERROR_IDS: ReadonlySet<string>;
+/**
+ * The server's own message for an allow-listed error id, trimmed; `null` for anything else. Duck-typed on
+ * `{ id, message }`, so it reads a `PassflowError`, a raw axios rejection's body, or a plain object such as a
+ * redirect's query.
+ */
+export declare const serverMessageFor: (error: unknown) => string | null;
+/** A hook's display error: a refused parent's copy, the server's message for an allow-listed id, else the operation's fixed copy. */
+export declare const authErrorFrom: (error: unknown, flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * The message for a federated redirect that came back as `?error=<id>&message=<text>`: the server's text when the id
+ * is allow-listed, else the generic redirect copy.
+ */
+export declare const authRedirectErrorFrom: (error: string, message: string | null) => string;
+export declare const invitationJoinErrorMessage = "We couldn't accept this invitation. Try again.";
+/** Invitation join error: the server's message for an allow-listed id, else the fixed copy. */
+export declare const invitationJoinErrorFrom: (error: unknown) => string;
+export declare const emailCodeInvalidMessage = "This code is no longer valid. Request a new code.";
+export declare const emailCodeUnavailableMessage = "We couldn't check the code. Try again.";
+export declare const emailCodeRestartMessage = "We couldn't verify the code. Go back and start again.";
+/**
+ * Error copy for the emailed-code step (`/auth/validate`, resend): allow-listed ids (wrong, expired or spent code,
+ * rate limit, ...) show the server message; `error.not.found` (unknown or spent challenge) asks for a new code; a
+ * request that got no answer at all (offline, CORS, timeout) asks to retry; every other server answer (401, a missing
+ * PKCE verifier, an unlisted 4xx or a 5xx) asks to start again, and the screen keeps its way back to the form.
+ */
+export declare const emailCodeErrorMessage: (error: unknown) => string;
+export declare const passwordlessWaitDeniedMessage = "This sign-in was denied. Start again.";
+export declare const passwordlessLinkExpiredMessage = "This link expired. Start again.";
+export declare const passwordlessWaitCompletedMessage = "This sign-in was already used. Start again.";
+export declare const passwordlessSignInFailedMessage = "Sign-in failed. Start again.";
+export declare const approvalInvalidMessage = "This link is not valid. Start again from the page where you signed in.";
+export declare const approvalUnavailableMessage = "This sign-in cannot be approved here. Start again.";
+export declare const approvalAlreadyDecidedMessage = "This sign-in was already decided.";
+export declare const approvalAttemptsMessage = "Too many wrong codes. This sign-in was denied. Start again.";
+export declare const approvalConnectionMessage = "Check your connection and try again.";
+export declare const approvalUnknownErrorMessage = "Something went wrong. Try again later.";
+export declare const approvalApprovedMessage = "Approved. Return to the tab that started sign-in. You can close this tab.";
+export declare const approvalDeniedMessage = "Denied. No one was signed in. You can close this tab.";
+export type ApprovalError = {
+    message: string;
+    /** Nothing more can be done on this screen: the form goes away. */
+    terminal: boolean;
+};
+/** A wrong code on the approve screen: the tries left must be read again before showing the message. */
+export declare const isApprovalMatchError: (error: unknown) => boolean;
+/**
+ * Error copy for the approve screen. `attemptsLeft` is the count re-read after the rejection. A plain core error with
+ * no response body arrives as id `error.passwordless.approval`, status 0: nothing was decided, so the screen stays.
+ */
+export declare const approvalErrorFrom: (error: unknown, attemptsLeft?: number) => ApprovalError;
+/**
+ * A failed passwordless completion. A row that only another device can approve has its own copy. A failed exchange comes
+ * after the row was spent, so retrying cannot work, even with no response (id `error.pkce.exchange`, status 0). Core
+ * rejects a network failure or raw 429 on the completion itself as id `error.passwordless.complete`: the code was not
+ * refused, so the user can try again.
+ */
+export declare const passwordlessCompleteErrorMessage: (error: unknown) => string;
+export declare const resetLinkInvalidMessage = "This link is invalid or has expired. Request a new one.";
+export declare const newPasswordUnavailableMessage = "We couldn't save your password. Try again.";
+export declare const passwordSavedRateLimitedMessage = "Your password was saved, but we cannot send a verification code right now. Wait a few minutes, then sign in with your new password.";
+/**
+ * A 429 from `/auth/password/change`: the password was already changed, only the emailed code that should follow
+ * was refused, so the screen must not ask for the password again.
+ */
+export declare const isPasswordSavedRateLimit: (error: unknown) => boolean;
+/**
+ * Error copy for the new-password screen (reset link or registration continuation): allow-listed ids show the server
+ * message; a refused or spent link (any other 4xx, an `error.token.*` id) asks for a new one; a server or network
+ * failure asks to retry. The raw message of anything else is never shown.
+ */
+export declare const newPasswordErrorMessage: (error: unknown) => string;
 //# sourceMappingURL=auth-error.d.ts.map

package/dist/src/utils/auth-error.d.ts

@@ -4,4 +4,81 @@ export declare const verificationLinkErrorMessage = "This verification link is i
 export declare const invitationLinkErrorMessage = "This invitation link is invalid or has expired.";
 export declare const verificationRequestErrorMessage = "This verification request is no longer available. Start again to request a new link or code.";
 export declare const authErrorFor: (flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * Server error ids whose `message` is written for the end user (localized, no operator detail) and may be shown as
+ * is. Every other id keeps the SDK's fixed copy, so server text that was not meant for a sign-in screen never reaches
+ * one. `error.not.found` is deliberately absent: it is a generic id across the API (its text can name a missing user).
+ */
+export declare const SERVER_MESSAGE_ERROR_IDS: ReadonlySet<string>;
+/**
+ * The server's own message for an allow-listed error id, trimmed; `null` for anything else. Duck-typed on
+ * `{ id, message }`, so it reads a `PassflowError`, a raw axios rejection's body, or a plain object such as a
+ * redirect's query.
+ */
+export declare const serverMessageFor: (error: unknown) => string | null;
+/** A hook's display error: a refused parent's copy, the server's message for an allow-listed id, else the operation's fixed copy. */
+export declare const authErrorFrom: (error: unknown, flow: AuthFlow, operation: AuthOperation) => AuthUiError;
+/**
+ * The message for a federated redirect that came back as `?error=<id>&message=<text>`: the server's text when the id
+ * is allow-listed, else the generic redirect copy.
+ */
+export declare const authRedirectErrorFrom: (error: string, message: string | null) => string;
+export declare const invitationJoinErrorMessage = "We couldn't accept this invitation. Try again.";
+/** Invitation join error: the server's message for an allow-listed id, else the fixed copy. */
+export declare const invitationJoinErrorFrom: (error: unknown) => string;
+export declare const emailCodeInvalidMessage = "This code is no longer valid. Request a new code.";
+export declare const emailCodeUnavailableMessage = "We couldn't check the code. Try again.";
+export declare const emailCodeRestartMessage = "We couldn't verify the code. Go back and start again.";
+/**
+ * Error copy for the emailed-code step (`/auth/validate`, resend): allow-listed ids (wrong, expired or spent code,
+ * rate limit, ...) show the server message; `error.not.found` (unknown or spent challenge) asks for a new code; a
+ * request that got no answer at all (offline, CORS, timeout) asks to retry; every other server answer (401, a missing
+ * PKCE verifier, an unlisted 4xx or a 5xx) asks to start again, and the screen keeps its way back to the form.
+ */
+export declare const emailCodeErrorMessage: (error: unknown) => string;
+export declare const passwordlessWaitDeniedMessage = "This sign-in was denied. Start again.";
+export declare const passwordlessLinkExpiredMessage = "This link expired. Start again.";
+export declare const passwordlessWaitCompletedMessage = "This sign-in was already used. Start again.";
+export declare const passwordlessSignInFailedMessage = "Sign-in failed. Start again.";
+export declare const approvalInvalidMessage = "This link is not valid. Start again from the page where you signed in.";
+export declare const approvalUnavailableMessage = "This sign-in cannot be approved here. Start again.";
+export declare const approvalAlreadyDecidedMessage = "This sign-in was already decided.";
+export declare const approvalAttemptsMessage = "Too many wrong codes. This sign-in was denied. Start again.";
+export declare const approvalConnectionMessage = "Check your connection and try again.";
+export declare const approvalUnknownErrorMessage = "Something went wrong. Try again later.";
+export declare const approvalApprovedMessage = "Approved. Return to the tab that started sign-in. You can close this tab.";
+export declare const approvalDeniedMessage = "Denied. No one was signed in. You can close this tab.";
+export type ApprovalError = {
+    message: string;
+    /** Nothing more can be done on this screen: the form goes away. */
+    terminal: boolean;
+};
+/** A wrong code on the approve screen: the tries left must be read again before showing the message. */
+export declare const isApprovalMatchError: (error: unknown) => boolean;
+/**
+ * Error copy for the approve screen. `attemptsLeft` is the count re-read after the rejection. A plain core error with
+ * no response body arrives as id `error.passwordless.approval`, status 0: nothing was decided, so the screen stays.
+ */
+export declare const approvalErrorFrom: (error: unknown, attemptsLeft?: number) => ApprovalError;
+/**
+ * A failed passwordless completion. A row that only another device can approve has its own copy. A failed exchange comes
+ * after the row was spent, so retrying cannot work, even with no response (id `error.pkce.exchange`, status 0). Core
+ * rejects a network failure or raw 429 on the completion itself as id `error.passwordless.complete`: the code was not
+ * refused, so the user can try again.
+ */
+export declare const passwordlessCompleteErrorMessage: (error: unknown) => string;
+export declare const resetLinkInvalidMessage = "This link is invalid or has expired. Request a new one.";
+export declare const newPasswordUnavailableMessage = "We couldn't save your password. Try again.";
+export declare const passwordSavedRateLimitedMessage = "Your password was saved, but we cannot send a verification code right now. Wait a few minutes, then sign in with your new password.";
+/**
+ * A 429 from `/auth/password/change`: the password was already changed, only the emailed code that should follow
+ * was refused, so the screen must not ask for the password again.
+ */
+export declare const isPasswordSavedRateLimit: (error: unknown) => boolean;
+/**
+ * Error copy for the new-password screen (reset link or registration continuation): allow-listed ids show the server
+ * message; a refused or spent link (any other 4xx, an `error.token.*` id) asks for a new one; a server or network
+ * failure asks to retry. The raw message of anything else is never shown.
+ */
+export declare const newPasswordErrorMessage: (error: unknown) => string;
 //# sourceMappingURL=auth-error.d.ts.map

package/dist/src/utils/auth-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../../src/utils/auth-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAiCpE,eAAO,MAAM,wBAAwB,uFAAuF,CAAC;AAE7H,eAAO,MAAM,4BAA4B,+FACqD,CAAC;AAE/F,eAAO,MAAM,0BAA0B,oDAAoD,CAAC;AAE5F,eAAO,MAAM,+BAA+B,iGACoD,CAAC;AAEjG,eAAO,MAAM,YAAY,SAAU,QAAQ,aAAa,aAAa,KAAG,WAA+C,CAAC"}
+{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../../src/utils/auth-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAiCpE,eAAO,MAAM,wBAAwB,uFAAuF,CAAC;AAE7H,eAAO,MAAM,4BAA4B,+FACqD,CAAC;AAE/F,eAAO,MAAM,0BAA0B,oDAAoD,CAAC;AAE5F,eAAO,MAAM,+BAA+B,iGACoD,CAAC;AAEjG,eAAO,MAAM,YAAY,SAAU,QAAQ,aAAa,aAAa,KAAG,WAA+C,CAAC;AAExH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAavD,CAAC;AAkBH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,MAAM,GAAG,IAQ1D,CAAC;AASF,qIAAqI;AACrI,eAAO,MAAM,aAAa,UAAW,OAAO,QAAQ,QAAQ,aAAa,aAAa,KAAG,WAMxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,UAAW,MAAM,WAAW,MAAM,GAAG,IAAI,KAAG,MACR,CAAC;AAEvE,eAAO,MAAM,0BAA0B,mDAAmD,CAAC;AAE3F,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,UAAW,OAAO,KAAG,MAA+D,CAAC;AAEzH,eAAO,MAAM,uBAAuB,sDAAsD,CAAC;AAC3F,eAAO,MAAM,2BAA2B,2CAA2C,CAAC;AACpF,eAAO,MAAM,uBAAuB,0DAA0D,CAAC;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,MAUtD,CAAC;AAGF,eAAO,MAAM,6BAA6B,0CAA0C,CAAC;AACrF,eAAO,MAAM,8BAA8B,oCAAoC,CAAC;AAChF,eAAO,MAAM,gCAAgC,gDAAgD,CAAC;AAC9F,eAAO,MAAM,+BAA+B,iCAAiC,CAAC;AAG9E,eAAO,MAAM,sBAAsB,2EAA2E,CAAC;AAC/G,eAAO,MAAM,0BAA0B,uDAAuD,CAAC;AAC/F,eAAO,MAAM,6BAA6B,sCAAsC,CAAC;AACjF,eAAO,MAAM,uBAAuB,gEAAgE,CAAC;AACrG,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAChF,eAAO,MAAM,2BAA2B,2CAA2C,CAAC;AACpF,eAAO,MAAM,uBAAuB,8EAA8E,CAAC;AACnH,eAAO,MAAM,qBAAqB,0DAA0D,CAAC;AAE7F,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAOF,wGAAwG;AACxG,eAAO,MAAM,oBAAoB,UAAW,OAAO,KAAG,OACwC,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAW,OAAO,iBAAiB,MAAM,KAAG,aAuBzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,UAAW,OAAO,KAAG,MAQjE,CAAC;AAEF,eAAO,MAAM,uBAAuB,4DAA4D,CAAC;AACjG,eAAO,MAAM,6BAA6B,+CAA+C,CAAC;AAC1F,eAAO,MAAM,+BAA+B,wIAC2F,CAAC;AAExI;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAAW,OAAO,KAAG,OAGzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,UAAW,OAAO,KAAG,MAWxD,CAAC"}

package/dist/src/utils/email-verification.d.cts

@@ -0,0 +1,44 @@
+import type { EmailCodeStep, EmailVerificationStep } from '../types/index.cjs';
+export declare const emailCodeSentFallbackMessage = "We sent a code to your email.";
+export declare const emailLinkSentFallbackMessage = "Check your email for a link to finish signing up.";
+/**
+ * Reads an auth answer as an email verification step: `code` when the server emailed a code (a non-empty
+ * `challenge_id`), `link` when it emailed a link instead. `null` for anything else (tokens, a 2FA token, no answer).
+ */
+export declare const readEmailVerificationStep: (answer: unknown) => EmailVerificationStep | null;
+export type EmailCodeStepState = {
+    step: EmailCodeStep;
+    /** The display message of the last failed verify or resend; cleared by the next attempt or a new code. */
+    error: string | null;
+};
+export type EmailCodeStepEvent = {
+    type: 'ENTER';
+    step: EmailVerificationStep;
+} | {
+    type: 'VERIFY_STARTED';
+} | {
+    type: 'VERIFY_OK';
+} | {
+    type: 'VERIFY_FAILED';
+    message: string;
+} | {
+    type: 'RESENT';
+    challengeId: string;
+    message: string;
+} | {
+    type: 'LINK_SENT';
+    message: string;
+} | {
+    type: 'RESEND_FAILED';
+    message: string;
+} | {
+    type: 'CANCEL';
+};
+export declare const initialEmailCodeStepState: EmailCodeStepState;
+/**
+ * The emailed-code step as a transition table. Only `ENTER` leaves `none`: a verify or resend answer that lands
+ * after the user went back is a real race, not a bug, so it is ignored rather than resurrecting the step. Verify and
+ * resend events only change a `code` step; in `link` there is nothing left to verify or resend.
+ */
+export declare const emailCodeStepReducer: (state: EmailCodeStepState, event: EmailCodeStepEvent) => EmailCodeStepState;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/utils/email-verification.d.ts

@@ -0,0 +1,44 @@
+import type { EmailCodeStep, EmailVerificationStep } from '../types/index.js';
+export declare const emailCodeSentFallbackMessage = "We sent a code to your email.";
+export declare const emailLinkSentFallbackMessage = "Check your email for a link to finish signing up.";
+/**
+ * Reads an auth answer as an email verification step: `code` when the server emailed a code (a non-empty
+ * `challenge_id`), `link` when it emailed a link instead. `null` for anything else (tokens, a 2FA token, no answer).
+ */
+export declare const readEmailVerificationStep: (answer: unknown) => EmailVerificationStep | null;
+export type EmailCodeStepState = {
+    step: EmailCodeStep;
+    /** The display message of the last failed verify or resend; cleared by the next attempt or a new code. */
+    error: string | null;
+};
+export type EmailCodeStepEvent = {
+    type: 'ENTER';
+    step: EmailVerificationStep;
+} | {
+    type: 'VERIFY_STARTED';
+} | {
+    type: 'VERIFY_OK';
+} | {
+    type: 'VERIFY_FAILED';
+    message: string;
+} | {
+    type: 'RESENT';
+    challengeId: string;
+    message: string;
+} | {
+    type: 'LINK_SENT';
+    message: string;
+} | {
+    type: 'RESEND_FAILED';
+    message: string;
+} | {
+    type: 'CANCEL';
+};
+export declare const initialEmailCodeStepState: EmailCodeStepState;
+/**
+ * The emailed-code step as a transition table. Only `ENTER` leaves `none`: a verify or resend answer that lands
+ * after the user went back is a real race, not a bug, so it is ignored rather than resurrecting the step. Verify and
+ * resend events only change a `code` step; in `link` there is nothing left to verify or resend.
+ */
+export declare const emailCodeStepReducer: (state: EmailCodeStepState, event: EmailCodeStepEvent) => EmailCodeStepState;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/src/utils/email-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../../../src/utils/email-verification.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEpE,eAAO,MAAM,4BAA4B,kCAAkC,CAAC;AAC5E,eAAO,MAAM,4BAA4B,sDAAsD,CAAC;AAKhG;;;GAGG;AACH,eAAO,MAAM,yBAAyB,WAAY,OAAO,KAAG,qBAAqB,GAAG,IAOnF,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,0GAA0G;IAC1G,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,eAAO,MAAM,yBAAyB,EAAE,kBAA4D,CAAC;AAErG;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAAW,kBAAkB,SAAS,kBAAkB,KAAG,kBAuB3F,CAAC"}

package/dist/src/utils/get-url-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-url-errors.d.ts","sourceRoot":"","sources":["../../../src/utils/get-url-errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,YAAa,MAAM;;;CAM3C,CAAC"}
+{"version":3,"file":"get-url-errors.d.ts","sourceRoot":"","sources":["../../../src/utils/get-url-errors.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,YAAY,YAAa,MAAM;;;CAM3C,CAAC"}

package/dist/src/utils/index.d.cts

@@ -1,8 +1,9 @@
-export { authErrorFor, authRedirectErrorMessage, invitationLinkErrorMessage, verificationLinkErrorMessage, verificationRequestErrorMessage, } from './auth-error.cjs';
+export { type ApprovalError, approvalAlreadyDecidedMessage, approvalApprovedMessage, approvalAttemptsMessage, approvalConnectionMessage, approvalDeniedMessage, approvalErrorFrom, approvalInvalidMessage, approvalUnavailableMessage, approvalUnknownErrorMessage, authErrorFor, authErrorFrom, authRedirectErrorFrom, authRedirectErrorMessage, emailCodeErrorMessage, invitationJoinErrorFrom, invitationLinkErrorMessage, isApprovalMatchError, isPasswordSavedRateLimit, newPasswordErrorMessage, passwordlessCompleteErrorMessage, passwordlessLinkExpiredMessage, passwordlessSignInFailedMessage, passwordlessWaitCompletedMessage, passwordlessWaitDeniedMessage, serverMessageFor, verificationLinkErrorMessage, verificationRequestErrorMessage, } from './auth-error.cjs';
 export { classifyDeviceError, DeviceApiError, deviceErrorOfType } from './classify-device-error.cjs';
 export { classifyTwoFactorError, getUserFriendlyErrorMessage } from './classify-two-factor-error.cjs';
 export { cn } from './cn.cjs';
 export * from './dayjs/index.cjs';
+export { type EmailCodeStepEvent, type EmailCodeStepState, emailCodeStepReducer, initialEmailCodeStepState, readEmailVerificationStep, } from './email-verification.cjs';
 export { type AuthMethods, getAuthMethods } from './get-auth-methods.cjs';
 export { getIdentityLabel, getPasswordlessData, getValidationErrorsLabel } from './get-form-labels.cjs';
 export { getUrlErrors } from './get-url-errors.cjs';
@@ -12,7 +13,7 @@ export { routeToSecondFactor, urlCarriesTwoFactorToken } from './second-factor.c
 export { TwoFactorLoopPrevention } from './two-factor-loop-prevention.cjs';
 export { undefinedOnCatch } from './undefined-on-catch.cjs';
 export { attachAuth, registerUpgradeAuthInstance, releaseUpgradeAuthInstance, upgradeAuthInstance, withAuth, } from './upgrade-auth.cjs';
-export { useUrlParams } from './url-params.cjs';
+export { readParentChallengeIdFromURL, urlWithoutParentChallenge, useUrlParams } from './url-params.cjs';
 export { isValidUrl } from './validate-url.cjs';
 export * from './validation-schemas/index.cjs';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/utils/index.d.ts

@@ -1,8 +1,9 @@
-export { authErrorFor, authRedirectErrorMessage, invitationLinkErrorMessage, verificationLinkErrorMessage, verificationRequestErrorMessage, } from './auth-error.js';
+export { type ApprovalError, approvalAlreadyDecidedMessage, approvalApprovedMessage, approvalAttemptsMessage, approvalConnectionMessage, approvalDeniedMessage, approvalErrorFrom, approvalInvalidMessage, approvalUnavailableMessage, approvalUnknownErrorMessage, authErrorFor, authErrorFrom, authRedirectErrorFrom, authRedirectErrorMessage, emailCodeErrorMessage, invitationJoinErrorFrom, invitationLinkErrorMessage, isApprovalMatchError, isPasswordSavedRateLimit, newPasswordErrorMessage, passwordlessCompleteErrorMessage, passwordlessLinkExpiredMessage, passwordlessSignInFailedMessage, passwordlessWaitCompletedMessage, passwordlessWaitDeniedMessage, serverMessageFor, verificationLinkErrorMessage, verificationRequestErrorMessage, } from './auth-error.js';
 export { classifyDeviceError, DeviceApiError, deviceErrorOfType } from './classify-device-error.js';
 export { classifyTwoFactorError, getUserFriendlyErrorMessage } from './classify-two-factor-error.js';
 export { cn } from './cn.js';
 export * from './dayjs/index.js';
+export { type EmailCodeStepEvent, type EmailCodeStepState, emailCodeStepReducer, initialEmailCodeStepState, readEmailVerificationStep, } from './email-verification.js';
 export { type AuthMethods, getAuthMethods } from './get-auth-methods.js';
 export { getIdentityLabel, getPasswordlessData, getValidationErrorsLabel } from './get-form-labels.js';
 export { getUrlErrors } from './get-url-errors.js';
@@ -12,7 +13,7 @@ export { routeToSecondFactor, urlCarriesTwoFactorToken } from './second-factor.j
 export { TwoFactorLoopPrevention } from './two-factor-loop-prevention.js';
 export { undefinedOnCatch } from './undefined-on-catch.js';
 export { attachAuth, registerUpgradeAuthInstance, releaseUpgradeAuthInstance, upgradeAuthInstance, withAuth, } from './upgrade-auth.js';
-export { useUrlParams } from './url-params.js';
+export { readParentChallengeIdFromURL, urlWithoutParentChallenge, useUrlParams } from './url-params.js';
 export { isValidUrl } from './validate-url.js';
 export * from './validation-schemas/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,KAAK,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,6BAA6B,EAC7B,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,gCAAgC,EAChC,8BAA8B,EAC9B,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,cAAc,sBAAsB,CAAC"}

package/dist/src/utils/url-params.d.cts

@@ -1,3 +1,20 @@
+/**
+ * Read `parent_challenge_id` from the current URL's query string.
+ * Returns `undefined` when not present so callers can short-circuit
+ * the OIDC interceptor on non-OIDC mounts.
+ *
+ * Lowercases only the parameter KEYS (not values) so the
+ * KSUID-shaped value isn't corrupted on the way through. (URL params
+ * are case-sensitive per RFC 3986; some Passflow URLs use mixed
+ * case like `appId=...`. The lowercase-keys treatment mirrors what
+ * the bundled login-app was doing pre-SDK-migration.)
+ */
+export declare const readParentChallengeIdFromURL: () => string | undefined;
+/**
+ * The URL without `parent_challenge_id`, in any key case. Works on the raw query, so every other param keeps its
+ * exact encoding.
+ */
+export declare const urlWithoutParentChallenge: (url: string) => string;
 /**
  * Get URL parameters. Inside PassflowFlow they come from the flow's location; outside it, from the
  * address bar.

package/dist/src/utils/url-params.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Read `parent_challenge_id` from the current URL's query string.
+ * Returns `undefined` when not present so callers can short-circuit
+ * the OIDC interceptor on non-OIDC mounts.
+ *
+ * Lowercases only the parameter KEYS (not values) so the
+ * KSUID-shaped value isn't corrupted on the way through. (URL params
+ * are case-sensitive per RFC 3986; some Passflow URLs use mixed
+ * case like `appId=...`. The lowercase-keys treatment mirrors what
+ * the bundled login-app was doing pre-SDK-migration.)
+ */
+export declare const readParentChallengeIdFromURL: () => string | undefined;
+/**
+ * The URL without `parent_challenge_id`, in any key case. Works on the raw query, so every other param keeps its
+ * exact encoding.
+ */
+export declare const urlWithoutParentChallenge: (url: string) => string;
 /**
  * Get URL parameters. Inside PassflowFlow they come from the flow's location; outside it, from the
  * address bar.

package/dist/src/utils/url-params.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-params.d.ts","sourceRoot":"","sources":["../../../src/utils/url-params.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,kBAAkB,CAAC;;eAuC5D,MAAM;kBASH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAmB5C,CAAC"}
+{"version":3,"file":"url-params.d.ts","sourceRoot":"","sources":["../../../src/utils/url-params.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,QAAO,MAAM,GAAG,SAQxD,CAAC;AAKF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAAS,MAAM,KAAG,MAYvD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,kBAAkB,CAAC;;eAuC5D,MAAM;kBASH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAmB5C,CAAC"}