@seamless-auth/react 0.3.0 → 0.5.0

package/README.md

@@ -17,7 +17,8 @@
 - `useAuthClient()`
 - `usePasskeySupport()`
 - `hasScopedRole()` and `roleGrantsAccess()`
-- types including `AuthContextType`, `Credential`, `User`, `OAuthProvider`, `StepUpStatus`, and the headless client input/result types
+- `SeamlessAuthError`, the error type carried on a failed result
+- types including `AuthContextType`, `Credential`, `User`, `OAuthProvider`, `StepUpStatus`, the `SeamlessAuthResult` wrapper, and the headless client input/result types
 
 ## Installation
 
@@ -114,20 +115,21 @@ You are still responsible for your app’s route protection and redirects.
   markSignedIn(): void;
   hasRole(role: string): boolean | undefined;
   hasScopedRole(role: string | string[]): boolean | undefined;
-  listOAuthProviders(): Promise<OAuthProvidersResult>;
-  startOAuthLogin(input: StartOAuthLoginInput): Promise<StartOAuthLoginResult>;
-  finishOAuthLogin(input: FinishOAuthLoginInput): Promise<void>;
-  refreshSession(): Promise<void>;
-  refreshStepUpStatus(): Promise<StepUpStatus | null>;
-  verifyStepUpWithPasskey(): Promise<StepUpVerificationResult>;
-  verifyStepUpWithPasskeyPrf(input: PasskeyPrfInput): Promise<StepUpWithPasskeyPrfResult>;
-  logout(): Promise<void>;
-  logoutAllSessions(): Promise<void>;
-  deleteUser(): Promise<void>;
-  login(identifier: string, passkeyAvailable: boolean): Promise<Response>;
-  handlePasskeyLogin(): Promise<boolean>;
-  updateCredential(credential: Credential): Promise<Credential>;
-  deleteCredential(credentialId: string): Promise<void>;
+  listOAuthProviders(): Promise<SeamlessAuthResult<OAuthProvidersResult>>;
+  startOAuthLogin(input: StartOAuthLoginInput): Promise<SeamlessAuthResult<StartOAuthLoginResult>>;
+  finishOAuthLogin(input: FinishOAuthLoginInput): Promise<SeamlessAuthResult<MessageResult>>;
+  refreshSession(): Promise<SeamlessAuthResult<CurrentUserResult>>;
+  refreshStepUpStatus(): Promise<SeamlessAuthResult<StepUpStatus>>;
+  verifyStepUpWithPasskey(): Promise<SeamlessAuthResult<StepUpStatus>>;
+  verifyStepUpWithPasskeyPrf(input: PasskeyPrfInput): Promise<SeamlessAuthResult<StepUpPrfData>>;
+  verifyStepUpWithTotp(code: string): Promise<SeamlessAuthResult<StepUpStatus>>;
+  logout(): Promise<SeamlessAuthResult<MessageResult>>;
+  logoutAllSessions(): Promise<SeamlessAuthResult<MessageResult>>;
+  deleteUser(): Promise<SeamlessAuthResult<MessageResult>>;
+  login(identifier: string, passkeyAvailable: boolean): Promise<SeamlessAuthResult<LoginStartResult>>;
+  handlePasskeyLogin(): Promise<SeamlessAuthResult<PasskeyLoginData>>;
+  updateCredential(credential: Credential): Promise<SeamlessAuthResult<Credential>>;
+  deleteCredential(credentialId: string): Promise<SeamlessAuthResult<MessageResult>>;
 }
 ```
 
@@ -159,12 +161,12 @@ If you are building a fully custom flow, call `markSignedIn()` after a successfu
 const { markSignedIn, refreshSession } = useAuth();
 
 async function completeLogin() {
-  const response = await authClient.login({
+  const { error } = await authClient.login({
     identifier: 'user@example.com',
     passkeyAvailable: true,
   });
 
-  if (response.ok) {
+  if (!error) {
     markSignedIn();
     await refreshSession();
   }
@@ -200,8 +202,8 @@ function DeleteAccountButton() {
   const { refreshStepUpStatus, verifyStepUpWithPasskey } = useAuth();
 
   async function handleDeleteAccount() {
-    const status = await refreshStepUpStatus();
-    const fresh = status?.fresh ? true : (await verifyStepUpWithPasskey()).success;
+    const { data: status } = await refreshStepUpStatus();
+    const fresh = status?.fresh ? true : !(await verifyStepUpWithPasskey()).error;
 
     if (!fresh) {
       return;
@@ -214,7 +216,46 @@ function DeleteAccountButton() {
 }
 ```
 
-The current step-up backend supports WebAuthn/passkeys. `refreshStepUpStatus()` calls `/step-up/status`, and `verifyStepUpWithPasskey()` performs the `/step-up/webauthn/start` and `/step-up/webauthn/finish` challenge flow.
+Step-up supports WebAuthn/passkeys and TOTP (authenticator apps). `refreshStepUpStatus()` calls `/step-up/status`, `verifyStepUpWithPasskey()` performs the `/step-up/webauthn/start` and `/step-up/webauthn/finish` challenge flow, and `verifyStepUpWithTotp(code)` verifies a 6-digit authenticator code via `/totp/verify-mfa`. The verification helpers return a `SeamlessAuthResult<StepUpStatus>` and refresh the provider's `stepUpStatus` when they succeed.
+
+```tsx
+const { verifyStepUpWithTotp } = useAuth();
+
+const { error } = await verifyStepUpWithTotp('123456'); // 6-digit code from the authenticator app
+if (!error) {
+  // step-up is fresh; proceed with the sensitive action
+}
+```
+
+### TOTP (authenticator apps)
+
+TOTP lets users register an authenticator app (Google Authenticator, 1Password, etc.) as a second factor for step-up verification. The SDK exposes headless client methods for enrollment and management; use them from a settings screen. All require an authenticated session.
+
+```ts
+import { createSeamlessAuthClient } from '@seamless-auth/react';
+import type { TotpStatus, TotpEnrollmentStartResult } from '@seamless-auth/react';
+
+const authClient = createSeamlessAuthClient({ apiHost: 'https://your.api' });
+
+// 1. Check whether TOTP is already enabled
+const { data: status } = await authClient.getTotpStatus();
+
+// 2. Start enrollment: render `otpauthUrl` as a QR code (or show `secret` for manual entry)
+const { data: enrollment } = await authClient.startTotpEnrollment();
+
+// 3. Confirm the first code from the user's authenticator app
+const { error } = await authClient.verifyTotpEnrollment('123456');
+if (!error) {
+  // TOTP is now enabled
+}
+
+// Disabling requires a current code
+await authClient.disableTotp('123456');
+```
+
+These methods follow the standard result convention: check `error`, then read `data`. Enrolling TOTP is a sensitive change; gate it behind a fresh step-up when appropriate.
+
+> TOTP is not currently a login second factor. The Seamless Auth API issues a full session on the first factor and does not gate login on TOTP, so TOTP applies to step-up verification, not to the login flow.
 
 ### WebAuthn PRF
 
@@ -250,18 +291,18 @@ if (prfSupported) {
 For local key unwrap flows such as Seamless Secrets, use PRF during step-up and consume the returned bytes in browser memory:
 
 ```ts
-const result = await authClient.verifyStepUpWithPasskeyPrf({
+const { data, error } = await authClient.verifyStepUpWithPasskeyPrf({
   salt: vaultSaltBase64url,
   credentialId,
 });
 
-if (!result.success || !result.prf) {
-  throw new Error('PRF step-up failed');
+if (error) {
+  throw error;
 }
 
 const vaultUnlockMaterial: { credentialId: string; output: Uint8Array } = {
-  credentialId: result.credentialId!,
-  output: result.prf.output,
+  credentialId: data.credentialId,
+  output: data.prf.output,
 };
 ```
 
@@ -323,11 +364,14 @@ function OAuthCallback() {
 
   useEffect(() => {
     const params = new URLSearchParams(window.location.search);
-    const providerId = 'google';
+    // Persist the provider you passed to startOAuthLogin so the callback knows
+    // which provider to finish. The built-in AuthRoutes flow stores this in
+    // sessionStorage; use whatever your custom start flow saved.
+    const providerId = sessionStorage.getItem('seamless:oauth:provider');
     const code = params.get('code');
     const state = params.get('state');
 
-    if (!code || !state) {
+    if (!providerId || !code || !state) {
       return;
     }
 
@@ -374,14 +418,18 @@ const authClient = createSeamlessAuthClient({
   apiHost: 'https://your.api',
 });
 
-const response = await authClient.login({
+const { data, error } = await authClient.login({
   identifier: 'user@example.com',
   passkeyAvailable: true,
 });
 
-if (response.ok) {
-  // Continue your custom flow
+if (error) {
+  // error.message, error.status, and error.body carry the server detail
+  return;
 }
+
+// data is typed as LoginStartResult
+console.log(data.loginMethods);
 ```
 
 The headless client exposes helpers for:
@@ -393,20 +441,45 @@ The headless client exposes helpers for:
 - magic-link request, verify, and polling
 - OAuth provider listing, start, and callback completion
 - passkey registration
-- step-up status and passkey verification
+- step-up status, passkey verification, and TOTP verification
+- TOTP enrollment, status, and disable
 - logout and delete-user
 - credential update and deletion
 
-Client methods return raw `Response` objects except for the passkey convenience helpers:
+### Result convention
+
+Every request method resolves to a `SeamlessAuthResult<T>`:
+
+```ts
+type SeamlessAuthResult<T> =
+  | { data: T; error: null }
+  | { data: null; error: SeamlessAuthError };
+```
+
+Check `error` first, then read `data`. TypeScript enforces this: `data` is not readable until the
+error has been ruled out.
+
+```ts
+const { data, error } = await authClient.getCurrentUser();
+
+if (error) {
+  console.log(error.message, error.status, error.body);
+  return;
+}
+
+setUser(data.user); // typed as CurrentUserResult
+```
+
+Nothing throws for an HTTP failure, and transport failures are absorbed too, reported as an error
+with `status` `0`. That means an expected auth outcome such as a wrong OTP, an expired magic link, or
+a disabled provider is a value you can map straight to UI state rather than an exception to catch.
 
-- `loginWithPasskey(options?: PasskeyLoginOptions): Promise<PasskeyLoginWithPrfResult>`
-- `registerPasskey(metadata | { metadata, requestPrf?, requirePrf? }): Promise<PasskeyRegistrationResult>`
-- `isPasskeyPrfSupported(): Promise<boolean>`
-- `verifyStepUpWithPasskey(): Promise<StepUpVerificationResult>`
-- `verifyStepUpWithPasskeyPrf(input): Promise<StepUpWithPasskeyPrfResult>`
-- `listOAuthProviders(): Promise<OAuthProvidersResult>`
-- `startOAuthLogin(input): Promise<StartOAuthLoginResult>`
-- `finishOAuthLogin(input): Promise<Response>`
+`SeamlessAuthError` carries the server's `message`, the HTTP `status`, and the parsed response
+`body`, so you can branch on a specific failure.
+
+The single exception is `isPasskeySupported`-style capability checks:
+`isPasskeyPrfSupported(): Promise<boolean>` is a local check rather than a request, so it returns a
+plain boolean.
 
 ## React Hooks For Custom UI
 
@@ -421,12 +494,12 @@ function CustomLogin() {
   const { passkeySupported, loading } = usePasskeySupport();
 
   async function handleEmailLogin() {
-    const response = await authClient.login({
+    const { error } = await authClient.login({
       identifier: 'user@example.com',
       passkeyAvailable: passkeySupported,
     });
 
-    if (response.ok) {
+    if (!error) {
       await refreshSession();
     }
   }
@@ -439,20 +512,260 @@ function CustomLogin() {
 }
 ```
 
+### One error style everywhere
+
+`useAuth()` helpers and the headless client report failure the same way: both return
+`{ data, error }` and neither throws. Whatever surface you reach for, the handling is identical.
+
+```tsx
+const { error } = await updateCredential({ ...credential, friendlyName: 'Work laptop' });
+
+if (error) {
+  setMessage(error.message);
+}
+```
+
+Helpers that also mutate provider state, such as `switchOrganization` and `deleteCredential`, apply
+that state change only when the call succeeds, then hand the result back for you to inspect.
+
+## Custom UI Recipes
+
+Worked examples for the flows the bundled screens cover, using only public primitives.
+
+### Custom registration
+
+Registration is two steps: create the account, then verify the emailed code. Call `markSignedIn()`
+once the account is live so returning visits can default to sign-in.
+
+```tsx
+import { useAuth, useAuthClient } from '@seamless-auth/react';
+import { useState } from 'react';
+
+function CustomRegistration() {
+  const { markSignedIn, refreshSession } = useAuth();
+  const authClient = useAuthClient();
+  const [step, setStep] = useState<'details' | 'verify'>('details');
+  const [message, setMessage] = useState('');
+
+  async function createAccount(email: string) {
+    // Registration needs only an email. A phone can be added and verified later.
+    const { error } = await authClient.register({ email });
+
+    if (error) {
+      setMessage(error.message);
+      return;
+    }
+
+    // The API emails a verification code as part of registering.
+    setStep('verify');
+  }
+
+  async function verifyCode(code: string) {
+    const { error } = await authClient.verifyEmailOtp(code);
+
+    if (error) {
+      setMessage(error.message);
+      return;
+    }
+
+    markSignedIn();
+    await refreshSession();
+  }
+
+  return step === 'details' ? (
+    <DetailsForm onSubmit={createAccount} error={message} />
+  ) : (
+    <CodeForm
+      onSubmit={verifyCode}
+      onResend={() => authClient.requestEmailOtp()}
+      error={message}
+    />
+  );
+}
+```
+
+To offer a passkey right after registering, call `registerPasskey()` before `refreshSession()`:
+
+```ts
+const { data, error } = await authClient.registerPasskey({
+  friendlyName: 'My laptop',
+  platform: 'macOS',
+  browser: 'Chrome',
+  deviceInfo: navigator.userAgent,
+});
+
+if (!error) {
+  console.log(data.credentialId, data.prfCapable);
+}
+```
+
+### OTP and magic-link continuation
+
+> **The request helpers take no identifier.** `requestMagicLink()`, `requestLoginEmailOtp()`, and
+> `requestLoginPhoneOtp()` send nothing but the session cookie. They rely on server-side state
+> established by a preceding `login()` call, so calling them without it fails or targets the wrong
+> account. This is not obvious from their signatures. Always call `login()` first, and use the same
+> browser session for the continuation step.
+
+```tsx
+function CustomLoginContinuation() {
+  const { login, refreshSession } = useAuth();
+  const authClient = useAuthClient();
+
+  async function start(identifier: string) {
+    // Required first: this is what the request helpers below depend on.
+    const { data, error } = await login(identifier, false);
+
+    if (error) {
+      return;
+    }
+
+    // Offer only what the server says this account supports.
+    return data.loginMethods ?? ['magic_link', 'email_otp'];
+  }
+
+  async function sendEmailCode() {
+    const { error } = await authClient.requestLoginEmailOtp();
+    if (error) {
+      // surface error.message
+    }
+  }
+
+  async function submitEmailCode(code: string) {
+    const { error } = await authClient.verifyLoginEmailOtp(code);
+
+    if (!error) {
+      await refreshSession();
+    }
+  }
+}
+```
+
+Magic links complete in whichever tab opens the emailed link, so a custom flow needs two pieces.
+
+The waiting screen polls until the link is used:
+
+```ts
+const interval = setInterval(async () => {
+  const { error } = await authClient.checkMagicLink();
+
+  if (!error) {
+    clearInterval(interval);
+    await refreshSession();
+  }
+}, 5000);
+```
+
+The landing route verifies the token from the query string, then refreshes its own session:
+
+```tsx
+function CustomMagicLinkLanding() {
+  const { refreshSession } = useAuth(); // plus: import { useEffect } from 'react'
+  const authClient = useAuthClient();
+
+  useEffect(() => {
+    const token = new URLSearchParams(window.location.search).get('token');
+    if (!token) return;
+
+    void authClient.verifyMagicLink(token).then(async ({ error }) => {
+      if (!error) {
+        // Refresh here too. This tab set the cookie, but its provider state
+        // was loaded before the cookie existed.
+        await refreshSession();
+      }
+    });
+  }, [authClient, refreshSession]);
+
+  return <p>Finishing sign-in...</p>;
+}
+```
+
+The auth API emails a link pointing at `/verify-magiclink?token=...`, so a custom app must serve that
+path.
+
+### Credential management
+
+`useAuth()` exposes the signed-in user's passkeys plus helpers to rename and remove them. These
+helpers update provider state on success and report failure through `error`.
+
+```tsx
+import { useAuth } from '@seamless-auth/react';
+import type { Credential } from '@seamless-auth/react';
+import { useState } from 'react';
+
+function PasskeyList() {
+  const { credentials, updateCredential, deleteCredential } = useAuth();
+  const [message, setMessage] = useState('');
+
+  async function rename(credential: Credential, friendlyName: string) {
+    const { error } = await updateCredential({ ...credential, friendlyName });
+
+    if (error) {
+      setMessage(error.message);
+    }
+  }
+
+  async function remove(credentialId: string) {
+    const { error } = await deleteCredential(credentialId);
+
+    if (error) {
+      setMessage(error.message);
+    }
+  }
+
+  return (
+    <ul>
+      {credentials.map(credential => (
+        <li key={credential.id}>
+          {credential.friendlyName ?? credential.deviceInfo}
+          <button onClick={() => void rename(credential, 'Work laptop')}>Rename</button>
+          <button onClick={() => void remove(credential.id)}>Remove</button>
+        </li>
+      ))}
+    </ul>
+  );
+}
+```
+
+Removing a passkey is a sensitive change. Gate it behind a fresh step-up when the account has other
+factors, using `refreshStepUpStatus()` and `verifyStepUpWithPasskey()` from the step-up section.
+
 ## Built-In Routes
 
-`AuthRoutes` currently includes:
+`AuthRoutes` serves these canonical paths:
 
 - `/login`
-- `/passKeyLogin`
-- `/verifyPhoneOTP`
-- `/verifyEmailOTP`
-- `/verify-magiclink`
-- `/registerPasskey`
-- `/magiclinks-sent`
+- `/passkey-login`
+- `/verify-phone-otp`
+- `/verify-email-otp`
+- `/verify-magic-link`
+- `/oauth/callback`
+- `/register-passkey`
+- `/magic-link-sent`
 
 These are optional UI wrappers over the same SDK primitives the package now exports for custom flows.
 
+### Renamed routes
+
+The earlier mixed-case paths were renamed and are no longer served. Anything linking directly to
+them now falls through to `/login`, so update those links:
+
+| Old path           | New path            |
+| ------------------ | ------------------- |
+| `/passKeyLogin`    | `/passkey-login`    |
+| `/verifyPhoneOTP`  | `/verify-phone-otp` |
+| `/verifyEmailOTP`  | `/verify-email-otp` |
+| `/registerPasskey` | `/register-passkey` |
+| `/magiclinks-sent` | `/magic-link-sent`  |
+
+Two paths are unchanged because they are owned by contracts outside this package:
+
+- `/verify-magiclink` is the URL the auth API builds when it emails a magic link, so it has to match
+  that value exactly. Renaming it here would send every emailed link to `/login` with the token
+  discarded.
+- `/oauth/callback` is registered with OAuth providers as an allowed redirect URI, so renaming it
+  would break configured integrations.
+
 ## Backend Expectations
 
 This package assumes a Seamless Auth-compatible backend with the auth adapter mounted at `/auth`.
@@ -472,11 +785,15 @@ The built-in flows assume compatible endpoints for:
 - `/webAuthn/login/finish`
 - `/webAuthn/register/start`
 - `/webAuthn/register/finish`
-- `/otp/generate-phone-otp`
-- `/otp/generate-email-otp`
+- `POST /otp/generate-phone-otp`
+- `POST /otp/generate-email-otp`
 - `/otp/verify-phone-otp`
 - `/otp/verify-email-otp`
-- `/magic-link`
+- `POST /otp/generate-login-phone-otp`
+- `POST /otp/generate-login-email-otp`
+- `/otp/verify-login-phone-otp`
+- `/otp/verify-login-email-otp`
+- `POST /magic-link`
 - `/magic-link/check`
 - `/magic-link/verify/:token`
 - `/oauth/providers`
@@ -485,9 +802,24 @@ The built-in flows assume compatible endpoints for:
 - `/step-up/status`
 - `/step-up/webauthn/start`
 - `/step-up/webauthn/finish`
+- `/totp/status`
+- `/totp/enroll/start`
+- `/totp/enroll/verify`
+- `/totp/disable`
+- `/totp/verify-mfa`
 - `/users/me`
 - `/users/credentials`
 - `/users/delete`
+- `/organizations`
+- `/organizations/:organizationId`
+- `/organizations/:organizationId/switch`
+- `/organizations/:organizationId/members`
+- `/organizations/:organizationId/members/:userId`
+
+The state-changing OTP and magic-link request routes are `POST` (marked above). They were previously
+`GET`, which made them reachable as simple cross-site requests, so an `<img>` tag could trigger SMS or
+email sends to a signed-in user. Using `@seamless-auth/react` with an older adapter that only serves the
+`GET` forms returns a 404 for those requests. See the changelog for the minimum adapter version.
 
 ## Notes
 

package/dist/AuthProvider.d.ts

@@ -1,13 +1,14 @@
-import { FinishOAuthLoginInput, OAuthProvidersResult, StartOAuthLoginInput, StartOAuthLoginResult, StepUpWithPasskeyPrfResult, StepUpStatus, StepUpVerificationResult } from '@/client/createSeamlessAuthClient';
-import { PasskeyPrfInput } from '@/client/webauthnPrf';
-import { Credential, Organization, User } from '@/types';
+import { CurrentUserResult, FinishOAuthLoginInput, LoginStartResult, MessageResult, OAuthProvidersResult, OrganizationSwitchResult, PasskeyLoginData, StartOAuthLoginInput, StartOAuthLoginResult, StepUpPrfData, StepUpStatus } from './client/createSeamlessAuthClient';
+import type { SeamlessAuthResult } from './client/result';
+import { PasskeyPrfInput } from './client/webauthnPrf';
+import { Credential, Organization, User } from './types';
 import React, { ReactNode } from 'react';
 export interface AuthContextType {
     user: User | null;
-    logout: () => Promise<void>;
-    logoutAllSessions: () => Promise<void>;
-    deleteUser: () => Promise<void>;
-    refreshSession: () => Promise<void>;
+    logout: () => Promise<SeamlessAuthResult<MessageResult>>;
+    logoutAllSessions: () => Promise<SeamlessAuthResult<MessageResult>>;
+    deleteUser: () => Promise<SeamlessAuthResult<MessageResult>>;
+    refreshSession: () => Promise<SeamlessAuthResult<CurrentUserResult>>;
     isAuthenticated: boolean;
     hasRole: (role: string) => boolean | undefined;
     hasScopedRole: (role: string | string[]) => boolean | undefined;
@@ -17,18 +18,19 @@ export interface AuthContextType {
     credentials: Credential[];
     organizations: Organization[];
     activeOrganization: Organization | null;
-    switchOrganization: (organizationId: string) => Promise<void>;
-    listOAuthProviders: () => Promise<OAuthProvidersResult>;
-    startOAuthLogin: (input: StartOAuthLoginInput) => Promise<StartOAuthLoginResult>;
-    finishOAuthLogin: (input: FinishOAuthLoginInput) => Promise<void>;
+    switchOrganization: (organizationId: string) => Promise<SeamlessAuthResult<OrganizationSwitchResult>>;
+    listOAuthProviders: () => Promise<SeamlessAuthResult<OAuthProvidersResult>>;
+    startOAuthLogin: (input: StartOAuthLoginInput) => Promise<SeamlessAuthResult<StartOAuthLoginResult>>;
+    finishOAuthLogin: (input: FinishOAuthLoginInput) => Promise<SeamlessAuthResult<MessageResult>>;
     stepUpStatus: StepUpStatus | null;
-    updateCredential: (credential: Credential) => Promise<Credential>;
-    deleteCredential: (credentialId: string) => Promise<void>;
-    login: (identifier: string, passkeyAvailable: boolean) => Promise<Response | null>;
-    handlePasskeyLogin: () => Promise<boolean>;
-    refreshStepUpStatus: () => Promise<StepUpStatus | null>;
-    verifyStepUpWithPasskey: () => Promise<StepUpVerificationResult>;
-    verifyStepUpWithPasskeyPrf: (input: PasskeyPrfInput) => Promise<StepUpWithPasskeyPrfResult>;
+    updateCredential: (credential: Credential) => Promise<SeamlessAuthResult<Credential>>;
+    deleteCredential: (credentialId: string) => Promise<SeamlessAuthResult<MessageResult>>;
+    login: (identifier: string, passkeyAvailable: boolean) => Promise<SeamlessAuthResult<LoginStartResult>>;
+    handlePasskeyLogin: () => Promise<SeamlessAuthResult<PasskeyLoginData>>;
+    refreshStepUpStatus: () => Promise<SeamlessAuthResult<StepUpStatus>>;
+    verifyStepUpWithPasskey: () => Promise<SeamlessAuthResult<StepUpStatus>>;
+    verifyStepUpWithPasskeyPrf: (input: PasskeyPrfInput) => Promise<SeamlessAuthResult<StepUpPrfData>>;
+    verifyStepUpWithTotp: (code: string) => Promise<SeamlessAuthResult<StepUpStatus>>;
     loading: boolean;
 }
 /**