@rakomi/react-native 0.1.0 → 0.3.0

package/dist/index.d.cts

@@ -1,8 +1,8 @@
 import { ReactNode } from 'react';
-import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembership, OrgContext, TranslationFn, OAuthTokenResponse, HttpClient, RequestResult, VerifyResult } from '@rakomi/sdk-core';
-export { AuthError, AuthEvent, AuthMachineState, CryptoProvider, HasParams, HttpClient, KeyValueStore, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, PkceChallenge, RegisterResult, SessionResource, SignInOptions, SignInResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
-import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './expo-adapter-CtPCEgue.cjs';
-export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as DeepLinkProvider, j as DpopProofInput, k as NativeDpopModuleSpec, P as ParClient, S as SystemBrowser, l as createDefaultExpoAdapter, m as createNativeDpopProver } from './expo-adapter-CtPCEgue.cjs';
+import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembershipClaim, TranslationFn, OAuthTokenResponse, HttpClient, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeySummary, PasskeyError, AssertPasskeyResult, StepUpWithPasskeyResult, RegisterPasskeyResult, ListPasskeysResult, PasskeySummaryResult, DeletePasskeyResult, RequestResult, VerifyResult } from '@rakomi/sdk-core';
+export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, AuthorizationEndpointCache, AuthorizationEndpointCacheOptions, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './passkey-adapter-D_Z3Z7lV.cjs';
+export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, k as DpopProofInput, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, P as ParClient, S as SystemBrowser, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter } from './passkey-adapter-D_Z3Z7lV.cjs';
 
 /** Reason a DPoP-requested session was downgraded to Bearer by the server. */
 interface DpopDowngradeInfo {
@@ -134,6 +134,11 @@ declare function RakomiProvider(props: RakomiProviderProps): ReactNode;
  * Discriminated-union AuthState — identical to `@rakomi/react`'s `AuthState`.
  *
  * `state: AuthMachineState` is the addition.
+ *
+ * @experimental Preview — `signIn()` and `switchOrganization()` are present for type parity with
+ * `@rakomi/react` but always resolve `{ status: 'error', error: { code: 'INVALID_CONFIG', … } }` in the
+ * current release; nothing is wired to the network yet. Use one of the working sign-in paths instead
+ * (social, magic link, email OTP, passkeys — see the package README / docs).
  */
 type AuthState = {
     isLoaded: false;
@@ -212,6 +217,12 @@ interface UseFlagReturn<T = unknown> {
     isEnabled: boolean;
 }
 declare function useFlag<T = unknown>(flag: string, options?: UseFlagOptions): UseFlagReturn<T>;
+/** The active organization context, from the `org` scope's JWT claims. */
+interface OrgContext {
+    orgId: string;
+    orgRole: string;
+    orgMemberships: OrgMembershipClaim[];
+}
 interface UseOrganizationReturn {
     isLoaded: boolean;
     organization: OrgContext | null;
@@ -219,7 +230,7 @@ interface UseOrganizationReturn {
 declare function useOrganization(): UseOrganizationReturn;
 interface UseOrganizationListReturn {
     isLoaded: boolean;
-    organizations: OrgMembership[];
+    organizations: OrgMembershipClaim[];
 }
 declare function useOrganizationList(): UseOrganizationListReturn;
 type LinkProvider = 'google' | 'github' | 'microsoft' | 'apple' | 'discord' | 'facebook' | 'slack' | 'twitter' | 'gitlab' | 'linkedin';
@@ -233,13 +244,19 @@ type LinkedMethods = LinkedMethod[];
 interface UseLinkedAccountsResult {
     isLoaded: boolean;
     methods: LinkedMethods;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     link: (provider: LinkProvider) => Promise<{
         status: 'redirect' | 'error';
     }>;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     unlink: (provider: LinkProvider | 'password' | 'magic_link' | 'email_otp' | 'passkey') => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/**
+ * @experimental Preview — `methods` reads the JWT's `linked_methods` claim (live), but `link()` and
+ * `unlink()` are not yet wired to the network in this release; see the return type's per-field notes.
+ */
 declare function useLinkedAccounts(): UseLinkedAccountsResult;
 declare function useTranslation(): {
     t: TranslationFn;
@@ -257,12 +274,14 @@ interface UseBrandingReturn {
 declare function useBranding(): UseBrandingReturn;
 interface UseAnonymousSigninResult {
     isLoaded: boolean;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     signInAnonymously: (options?: {
         publicMetadata?: Record<string, unknown>;
     }) => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/** @experimental Preview — `signInAnonymously()` is not yet wired to the network in this release; see the return type's field note. */
 declare function useAnonymousSignin(): UseAnonymousSigninResult;
 interface BaasPlanPublicItem {
     id: string;
@@ -348,15 +367,19 @@ interface FeatureProps {
 declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
 
 /**
- * `<SignIn />` — RN port.
+ * `<SignIn />` — RN port. **Preview:** `@rakomi/react-native` is a pre-1.0 preview package — see the
+ * package README for the full "what's wired today" boundary.
  *
  * Renders a sign-in flow using ONLY RN primitives (`<View>`, `<Text>`,
  * `<TextInput>`, `<Pressable>`) — no HTML. Supports:
- * - Password (direct) sign-in.
  * - Social provider list (Google, GitHub, …) via `startSocialSignIn`.
  * - MFA TOTP code entry view (`keyboardType="number-pad"`,
  * `textContentType="oneTimeCode"`, `autoComplete="sms-otp"`).
  *
+ * There is no email/password field in this component — direct email+password sign-in is not wired in
+ * the current release. Use `useRegister()` for account creation, or one of the other working sign-in
+ * paths (magic link, email OTP, passkeys).
+ *
  * Accessibility:
  * - Every interactive element has `accessibilityLabel` + `accessibilityRole`.
  * - i18n keys come from `useRakomiContext.translate`.
@@ -364,7 +387,12 @@ declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
  */
 
 interface SignInProps {
-    /** Authorization endpoint, default `${baseUrl}/oauth/authorize`. */
+    /**
+     * Full authorization-endpoint URL to open the system browser to. Default: resolved via OIDC
+     * discovery against `baseUrl` (cached, with a host-naming fallback) — see `useRakomiContext()`'s
+     * `authorizationEndpointCache`. A bare `${baseUrl}/oauth/authorize` is NOT a valid default: that
+     * path on the API host returns JSON, not the hosted login UI.
+     */
     authorizationEndpoint?: string;
     /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
     tokenEndpoint?: string;
@@ -418,8 +446,8 @@ declare function UserButton(props: UserButtonProps): ReactNode;
 /**
  * `<UserProfile />` — RN port (PREVIEW).
  *
- * Marked `'preview'` until 0.2.0; on first mount in `__DEV__` builds we log a
- * warning so consumers don't accidentally ship it to production.
+ * In preview — on first mount in `__DEV__` builds we log a warning so consumers don't accidentally
+ * ship it to production ahead of graduation.
  */
 
 interface UserProfileProps {
@@ -565,6 +593,64 @@ type SocialSignInOutcome = {
  */
 declare function startSocialSignIn(input: StartSocialSignInInput): Promise<SocialSignInOutcome>;
 
+interface UsePasskeysOptions {
+    /**
+     * Override the ceremony adapter. Intended for tests (`createFakePasskeyAdapter()` from
+     * `@rakomi/sdk-core/passkeys/testing`) and for a host that builds its adapter outside the provider.
+     * When omitted, the adapter comes from `nativeAdapter.passkeys`.
+     */
+    adapter?: PasskeyCeremonyAdapter;
+}
+interface SignInWithPasskeyInput {
+    /**
+     * Identified sign-in. **An opaque, server-issued handle — NOT an email, NOT a username.** The type is
+     * branded (`OpaqueUserHandle`), so a raw string will not compile: passing a user-typed identifier here
+     * turns a usernameless flow into an account-enumeration oracle, and — because platform passkeys sync
+     * across a user's devices — can reveal which of their devices hold a credential. Omit it for the
+     * usernameless flow, which is what almost every app wants.
+     */
+    userHandle?: OpaqueUserHandle;
+}
+interface RegisterPasskeyHookInput {
+    /** Minted by `stepUpWithPasskey()` or by the password step-up endpoint. */
+    stepUpToken: string;
+    nickname?: string;
+}
+interface ListPasskeysHookInput {
+    stepUpToken: string;
+}
+interface RenamePasskeyHookInput {
+    stepUpToken: string;
+    passkeyId: string;
+    nickname: string;
+}
+interface DeletePasskeyHookInput {
+    stepUpToken: string;
+    passkeyId: string;
+}
+interface UsePasskeysResult {
+    /** `null` until the capability probe resolves. `false` means this device cannot run a ceremony. */
+    isSupported: boolean | null;
+    /** `null` until probed, and `null` also means UNKNOWN (a module that cannot answer). A UI hint for
+     * wording ("Sign in with Face ID"), never a gate. */
+    hasPlatformAuthenticator: boolean | null;
+    /** `undefined` until `listPasskeys` is called — the hook fetches nothing on mount. */
+    passkeys: PasskeySummary[] | undefined;
+    error: PasskeyError | null;
+    isSigningIn: boolean;
+    isRegistering: boolean;
+    isSteppingUp: boolean;
+    isLoading: boolean;
+    isMutating: boolean;
+    signInWithPasskey: (input?: SignInWithPasskeyInput) => Promise<AssertPasskeyResult>;
+    stepUpWithPasskey: () => Promise<StepUpWithPasskeyResult>;
+    registerPasskey: (input: RegisterPasskeyHookInput) => Promise<RegisterPasskeyResult>;
+    listPasskeys: (input: ListPasskeysHookInput) => Promise<ListPasskeysResult>;
+    renamePasskey: (input: RenamePasskeyHookInput) => Promise<PasskeySummaryResult>;
+    deletePasskey: (input: DeletePasskeyHookInput) => Promise<DeletePasskeyResult>;
+}
+declare function usePasskeys(options?: UsePasskeysOptions): UsePasskeysResult;
+
 /**
  * `useSubmitOAuthTokens` — bridge between `startSocialSignIn` (free function) and the
  * `<RakomiProvider>` runtime.
@@ -631,4 +717,4 @@ interface UseMfaResult {
 }
 declare function useMfa(): UseMfaResult;
 
-export { type AuthState, type CreateDpopSessionOptions, type CreateRnHttpClientOptions, DEFAULT_WEBHOOK_TOLERANCE, type DpopDowngradeInfo, DpopProver, type DpopRefreshError, type DpopRefreshErrorClass, type DpopRefreshResult, DpopSession, Feature, type FeatureProps, type LinkProvider, type LinkedMethod, type LinkedMethods, type LinkedVia, MAX_WEBHOOK_TOLERANCE, NativeAuthAdapter, Protect, type ProtectProps, type PublisherEventType, type PublisherWebhookEvent, type PublisherWebhookEventType, type PublisherWebhookVerifyData, RakomiProvider, type RakomiProviderProps, SignIn, type SignInProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, type SocialSignInOutcome, type StartSocialSignInInput, TokenCache, type UseAnonymousSigninResult, type UseAuthConfigReturn, type UseBaasPlansReturn, type UseBaasSubscriptionReturn, type UseBrandingReturn, type UseEmailOtpResult, type UseFlagOptions, type UseFlagReturn, type UseLinkedAccountsResult, type UseMagicLinkResult, type UseMfaResult, type UseOrganizationListReturn, type UseOrganizationReturn, type UseRegisterResult, type UseSessionReturn, type UseUserReturn, UserButton, type UserButtonProps, UserProfile, type UserProfileProps, type WebhookVerifyErrorClass, type WebhookVerifyResult, createDpopSession, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };
+export { type AuthState, type CreateDpopSessionOptions, type CreateRnHttpClientOptions, DEFAULT_WEBHOOK_TOLERANCE, type DeletePasskeyHookInput, type DpopDowngradeInfo, DpopProver, type DpopRefreshError, type DpopRefreshErrorClass, type DpopRefreshResult, DpopSession, Feature, type FeatureProps, type LinkProvider, type LinkedMethod, type LinkedMethods, type LinkedVia, type ListPasskeysHookInput, MAX_WEBHOOK_TOLERANCE, NativeAuthAdapter, Protect, type ProtectProps, type PublisherEventType, type PublisherWebhookEvent, type PublisherWebhookEventType, type PublisherWebhookVerifyData, RakomiProvider, type RakomiProviderProps, type RegisterPasskeyHookInput, type RenamePasskeyHookInput, SignIn, type SignInProps, type SignInWithPasskeyInput, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, type SocialSignInOutcome, type StartSocialSignInInput, TokenCache, type UseAnonymousSigninResult, type UseAuthConfigReturn, type UseBaasPlansReturn, type UseBaasSubscriptionReturn, type UseBrandingReturn, type UseEmailOtpResult, type UseFlagOptions, type UseFlagReturn, type UseLinkedAccountsResult, type UseMagicLinkResult, type UseMfaResult, type UseOrganizationListReturn, type UseOrganizationReturn, type UsePasskeysOptions, type UsePasskeysResult, type UseRegisterResult, type UseSessionReturn, type UseUserReturn, UserButton, type UserButtonProps, UserProfile, type UserProfileProps, type WebhookVerifyErrorClass, type WebhookVerifyResult, createDpopSession, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, usePasskeys, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { ReactNode } from 'react';
-import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembership, OrgContext, TranslationFn, OAuthTokenResponse, HttpClient, RequestResult, VerifyResult } from '@rakomi/sdk-core';
-export { AuthError, AuthEvent, AuthMachineState, CryptoProvider, HasParams, HttpClient, KeyValueStore, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, PkceChallenge, RegisterResult, SessionResource, SignInOptions, SignInResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
-import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './expo-adapter-CtPCEgue.js';
-export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as DeepLinkProvider, j as DpopProofInput, k as NativeDpopModuleSpec, P as ParClient, S as SystemBrowser, l as createDefaultExpoAdapter, m as createNativeDpopProver } from './expo-adapter-CtPCEgue.js';
+import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembershipClaim, TranslationFn, OAuthTokenResponse, HttpClient, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeySummary, PasskeyError, AssertPasskeyResult, StepUpWithPasskeyResult, RegisterPasskeyResult, ListPasskeysResult, PasskeySummaryResult, DeletePasskeyResult, RequestResult, VerifyResult } from '@rakomi/sdk-core';
+export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, AuthorizationEndpointCache, AuthorizationEndpointCacheOptions, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './passkey-adapter-D_Z3Z7lV.js';
+export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, k as DpopProofInput, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, P as ParClient, S as SystemBrowser, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter } from './passkey-adapter-D_Z3Z7lV.js';
 
 /** Reason a DPoP-requested session was downgraded to Bearer by the server. */
 interface DpopDowngradeInfo {
@@ -134,6 +134,11 @@ declare function RakomiProvider(props: RakomiProviderProps): ReactNode;
  * Discriminated-union AuthState — identical to `@rakomi/react`'s `AuthState`.
  *
  * `state: AuthMachineState` is the addition.
+ *
+ * @experimental Preview — `signIn()` and `switchOrganization()` are present for type parity with
+ * `@rakomi/react` but always resolve `{ status: 'error', error: { code: 'INVALID_CONFIG', … } }` in the
+ * current release; nothing is wired to the network yet. Use one of the working sign-in paths instead
+ * (social, magic link, email OTP, passkeys — see the package README / docs).
  */
 type AuthState = {
     isLoaded: false;
@@ -212,6 +217,12 @@ interface UseFlagReturn<T = unknown> {
     isEnabled: boolean;
 }
 declare function useFlag<T = unknown>(flag: string, options?: UseFlagOptions): UseFlagReturn<T>;
+/** The active organization context, from the `org` scope's JWT claims. */
+interface OrgContext {
+    orgId: string;
+    orgRole: string;
+    orgMemberships: OrgMembershipClaim[];
+}
 interface UseOrganizationReturn {
     isLoaded: boolean;
     organization: OrgContext | null;
@@ -219,7 +230,7 @@ interface UseOrganizationReturn {
 declare function useOrganization(): UseOrganizationReturn;
 interface UseOrganizationListReturn {
     isLoaded: boolean;
-    organizations: OrgMembership[];
+    organizations: OrgMembershipClaim[];
 }
 declare function useOrganizationList(): UseOrganizationListReturn;
 type LinkProvider = 'google' | 'github' | 'microsoft' | 'apple' | 'discord' | 'facebook' | 'slack' | 'twitter' | 'gitlab' | 'linkedin';
@@ -233,13 +244,19 @@ type LinkedMethods = LinkedMethod[];
 interface UseLinkedAccountsResult {
     isLoaded: boolean;
     methods: LinkedMethods;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     link: (provider: LinkProvider) => Promise<{
         status: 'redirect' | 'error';
     }>;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     unlink: (provider: LinkProvider | 'password' | 'magic_link' | 'email_otp' | 'passkey') => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/**
+ * @experimental Preview — `methods` reads the JWT's `linked_methods` claim (live), but `link()` and
+ * `unlink()` are not yet wired to the network in this release; see the return type's per-field notes.
+ */
 declare function useLinkedAccounts(): UseLinkedAccountsResult;
 declare function useTranslation(): {
     t: TranslationFn;
@@ -257,12 +274,14 @@ interface UseBrandingReturn {
 declare function useBranding(): UseBrandingReturn;
 interface UseAnonymousSigninResult {
     isLoaded: boolean;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     signInAnonymously: (options?: {
         publicMetadata?: Record<string, unknown>;
     }) => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/** @experimental Preview — `signInAnonymously()` is not yet wired to the network in this release; see the return type's field note. */
 declare function useAnonymousSignin(): UseAnonymousSigninResult;
 interface BaasPlanPublicItem {
     id: string;
@@ -348,15 +367,19 @@ interface FeatureProps {
 declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
 
 /**
- * `<SignIn />` — RN port.
+ * `<SignIn />` — RN port. **Preview:** `@rakomi/react-native` is a pre-1.0 preview package — see the
+ * package README for the full "what's wired today" boundary.
  *
  * Renders a sign-in flow using ONLY RN primitives (`<View>`, `<Text>`,
  * `<TextInput>`, `<Pressable>`) — no HTML. Supports:
- * - Password (direct) sign-in.
  * - Social provider list (Google, GitHub, …) via `startSocialSignIn`.
  * - MFA TOTP code entry view (`keyboardType="number-pad"`,
  * `textContentType="oneTimeCode"`, `autoComplete="sms-otp"`).
  *
+ * There is no email/password field in this component — direct email+password sign-in is not wired in
+ * the current release. Use `useRegister()` for account creation, or one of the other working sign-in
+ * paths (magic link, email OTP, passkeys).
+ *
  * Accessibility:
  * - Every interactive element has `accessibilityLabel` + `accessibilityRole`.
  * - i18n keys come from `useRakomiContext.translate`.
@@ -364,7 +387,12 @@ declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
  */
 
 interface SignInProps {
-    /** Authorization endpoint, default `${baseUrl}/oauth/authorize`. */
+    /**
+     * Full authorization-endpoint URL to open the system browser to. Default: resolved via OIDC
+     * discovery against `baseUrl` (cached, with a host-naming fallback) — see `useRakomiContext()`'s
+     * `authorizationEndpointCache`. A bare `${baseUrl}/oauth/authorize` is NOT a valid default: that
+     * path on the API host returns JSON, not the hosted login UI.
+     */
     authorizationEndpoint?: string;
     /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
     tokenEndpoint?: string;
@@ -418,8 +446,8 @@ declare function UserButton(props: UserButtonProps): ReactNode;
 /**
  * `<UserProfile />` — RN port (PREVIEW).
  *
- * Marked `'preview'` until 0.2.0; on first mount in `__DEV__` builds we log a
- * warning so consumers don't accidentally ship it to production.
+ * In preview — on first mount in `__DEV__` builds we log a warning so consumers don't accidentally
+ * ship it to production ahead of graduation.
  */
 
 interface UserProfileProps {
@@ -565,6 +593,64 @@ type SocialSignInOutcome = {
  */
 declare function startSocialSignIn(input: StartSocialSignInInput): Promise<SocialSignInOutcome>;
 
+interface UsePasskeysOptions {
+    /**
+     * Override the ceremony adapter. Intended for tests (`createFakePasskeyAdapter()` from
+     * `@rakomi/sdk-core/passkeys/testing`) and for a host that builds its adapter outside the provider.
+     * When omitted, the adapter comes from `nativeAdapter.passkeys`.
+     */
+    adapter?: PasskeyCeremonyAdapter;
+}
+interface SignInWithPasskeyInput {
+    /**
+     * Identified sign-in. **An opaque, server-issued handle — NOT an email, NOT a username.** The type is
+     * branded (`OpaqueUserHandle`), so a raw string will not compile: passing a user-typed identifier here
+     * turns a usernameless flow into an account-enumeration oracle, and — because platform passkeys sync
+     * across a user's devices — can reveal which of their devices hold a credential. Omit it for the
+     * usernameless flow, which is what almost every app wants.
+     */
+    userHandle?: OpaqueUserHandle;
+}
+interface RegisterPasskeyHookInput {
+    /** Minted by `stepUpWithPasskey()` or by the password step-up endpoint. */
+    stepUpToken: string;
+    nickname?: string;
+}
+interface ListPasskeysHookInput {
+    stepUpToken: string;
+}
+interface RenamePasskeyHookInput {
+    stepUpToken: string;
+    passkeyId: string;
+    nickname: string;
+}
+interface DeletePasskeyHookInput {
+    stepUpToken: string;
+    passkeyId: string;
+}
+interface UsePasskeysResult {
+    /** `null` until the capability probe resolves. `false` means this device cannot run a ceremony. */
+    isSupported: boolean | null;
+    /** `null` until probed, and `null` also means UNKNOWN (a module that cannot answer). A UI hint for
+     * wording ("Sign in with Face ID"), never a gate. */
+    hasPlatformAuthenticator: boolean | null;
+    /** `undefined` until `listPasskeys` is called — the hook fetches nothing on mount. */
+    passkeys: PasskeySummary[] | undefined;
+    error: PasskeyError | null;
+    isSigningIn: boolean;
+    isRegistering: boolean;
+    isSteppingUp: boolean;
+    isLoading: boolean;
+    isMutating: boolean;
+    signInWithPasskey: (input?: SignInWithPasskeyInput) => Promise<AssertPasskeyResult>;
+    stepUpWithPasskey: () => Promise<StepUpWithPasskeyResult>;
+    registerPasskey: (input: RegisterPasskeyHookInput) => Promise<RegisterPasskeyResult>;
+    listPasskeys: (input: ListPasskeysHookInput) => Promise<ListPasskeysResult>;
+    renamePasskey: (input: RenamePasskeyHookInput) => Promise<PasskeySummaryResult>;
+    deletePasskey: (input: DeletePasskeyHookInput) => Promise<DeletePasskeyResult>;
+}
+declare function usePasskeys(options?: UsePasskeysOptions): UsePasskeysResult;
+
 /**
  * `useSubmitOAuthTokens` — bridge between `startSocialSignIn` (free function) and the
  * `<RakomiProvider>` runtime.
@@ -631,4 +717,4 @@ interface UseMfaResult {
 }
 declare function useMfa(): UseMfaResult;
 
-export { type AuthState, type CreateDpopSessionOptions, type CreateRnHttpClientOptions, DEFAULT_WEBHOOK_TOLERANCE, type DpopDowngradeInfo, DpopProver, type DpopRefreshError, type DpopRefreshErrorClass, type DpopRefreshResult, DpopSession, Feature, type FeatureProps, type LinkProvider, type LinkedMethod, type LinkedMethods, type LinkedVia, MAX_WEBHOOK_TOLERANCE, NativeAuthAdapter, Protect, type ProtectProps, type PublisherEventType, type PublisherWebhookEvent, type PublisherWebhookEventType, type PublisherWebhookVerifyData, RakomiProvider, type RakomiProviderProps, SignIn, type SignInProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, type SocialSignInOutcome, type StartSocialSignInInput, TokenCache, type UseAnonymousSigninResult, type UseAuthConfigReturn, type UseBaasPlansReturn, type UseBaasSubscriptionReturn, type UseBrandingReturn, type UseEmailOtpResult, type UseFlagOptions, type UseFlagReturn, type UseLinkedAccountsResult, type UseMagicLinkResult, type UseMfaResult, type UseOrganizationListReturn, type UseOrganizationReturn, type UseRegisterResult, type UseSessionReturn, type UseUserReturn, UserButton, type UserButtonProps, UserProfile, type UserProfileProps, type WebhookVerifyErrorClass, type WebhookVerifyResult, createDpopSession, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };
+export { type AuthState, type CreateDpopSessionOptions, type CreateRnHttpClientOptions, DEFAULT_WEBHOOK_TOLERANCE, type DeletePasskeyHookInput, type DpopDowngradeInfo, DpopProver, type DpopRefreshError, type DpopRefreshErrorClass, type DpopRefreshResult, DpopSession, Feature, type FeatureProps, type LinkProvider, type LinkedMethod, type LinkedMethods, type LinkedVia, type ListPasskeysHookInput, MAX_WEBHOOK_TOLERANCE, NativeAuthAdapter, Protect, type ProtectProps, type PublisherEventType, type PublisherWebhookEvent, type PublisherWebhookEventType, type PublisherWebhookVerifyData, RakomiProvider, type RakomiProviderProps, type RegisterPasskeyHookInput, type RenamePasskeyHookInput, SignIn, type SignInProps, type SignInWithPasskeyInput, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, type SocialSignInOutcome, type StartSocialSignInInput, TokenCache, type UseAnonymousSigninResult, type UseAuthConfigReturn, type UseBaasPlansReturn, type UseBaasSubscriptionReturn, type UseBrandingReturn, type UseEmailOtpResult, type UseFlagOptions, type UseFlagReturn, type UseLinkedAccountsResult, type UseMagicLinkResult, type UseMfaResult, type UseOrganizationListReturn, type UseOrganizationReturn, type UsePasskeysOptions, type UsePasskeysResult, type UseRegisterResult, type UseSessionReturn, type UseUserReturn, UserButton, type UserButtonProps, UserProfile, type UserProfileProps, type WebhookVerifyErrorClass, type WebhookVerifyResult, createDpopSession, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, usePasskeys, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };