@awsmbiz/inbis-auth-ui 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,59 @@
-# Temporary Holding Version
+# @awsmbiz/inbis-auth-ui
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+React screens for Inbis authentication, built from `@awsmbiz/inbis-ui` (shadcn/ui) and driven by the
+server's public auth config (`GET /api/auth/public-config`): a screen shows only the methods
+the app enables.
+
+| Export | Contents |
+|---|---|
+| `SignInScreen` | Email + password sign-in. Props: `client` (`InbisAuthClient`), `onSignedIn()`, optional `callbackURL`, optional `onCreateAccount()`, optional `onForgotPassword()`, optional `onVerifyEmail()`, optional `onPhoneSignIn()` ("Use a phone number instead", shown when the public config has `methods.phoneOtp`). A phone-only app (no email + password) gets the phone form right on this screen, described as signing in "with your phone number". Shows a message when no method is enabled and an alert on failure (wrong credentials, unverified email, network). The "Create an account" link appears only when `onCreateAccount` is given and registration is `open`. "Forgot password?" appears only when `onForgotPassword` is given and the public config offers password reset. After a `403 EMAIL_NOT_VERIFIED`, a "Send a new verification link" button calls `onVerifyEmail`. If the user has 2FA on, the password step is followed by the 2FA challenge, and `onSignedIn` runs after it. |
+| `VerifyEmailScreen` | Where verification links land. Props: `client`, `onSignIn()`, optional `callbackURL` (default `/verify-email?verified=1` on this origin), optional `search` (default `window.location.search`). `?verified=1` shows success. `?error=…` explains that the link is invalid or expired. `?sent=1` says "check your inbox". It always offers a form to request a new link, which gives the same answer for any address. |
+| `ForgotPasswordScreen` | Requests a reset link. Props: `client`, `onSignIn()`, optional `resetPasswordURL` (default `/reset-password` on this origin). It always confirms with the same words, whether or not the account exists. |
+| `ResetPasswordScreen` | Sets a new password from the link's `?token=`. Props: `client`, `onSignIn()`, `onRequestNewLink()`, optional `search`. It checks that the confirmation matches before calling the server. Errors it explains: an expired or used link (`INVALID_TOKEN`, also `?error=`), a breached password (`PASSWORD_COMPROMISED`) and the length bounds. |
+| `SignUpScreen` | Email + password registration. Props: `client`, `onSignedUp()`, `onSignIn()`, optional `callbackURL`. Shows the form only when registration is `open` and email + password is enabled; otherwise says registration is not open. The server enforces the policy regardless. |
+| `AcceptInvitationScreen` | Where invitation links land (`registration.invitations.acceptPath`, default `/accept-invitation`). Props: `client`, `onSignIn()`, optional `search` (default `window.location.search`). Looks the `?token=` up, shows who the invitation is for (and when it makes an administrator), asks for a name and, when email + password is on, a password with confirmation, then says the account is ready and offers sign-in (accepting does not sign in). An invalid, expired, revoked or used link shows a message and no form. Explains `USER_ALREADY_EXISTS`, `REGISTRATION_NOT_ALLOWED`, a breached password and the length bounds. A **phone invitation** (sent by SMS) shows the number and, with the optional `onSignedIn()` prop, signs in with that number right there (send code, enter code; the first sign-in creates the account); without it, it asks the invitee to sign in by phone. |
+| `PhoneSignInScreen` | Phone OTP sign-in. Props: `client`, `onSignedIn()`, optional `onSignIn()` (back to the other methods). Asks for an international number (hint: include the country code), sends a code, then shows `PhoneOtpVerification`. The confirmation never reveals whether the number has an account. Explains an invalid number, a wrong or expired code, too many attempts, `REGISTRATION_NOT_ALLOWED` and a suspended account; offers "Send a new code" and "Use a different number". |
+| `PhoneSignIn` | The same flow as a form inside another screen. Props: `client`, `phoneOtp` (from the public config), `onSignedIn()`, optional `phoneNumber` (fixed number: no number field, e.g. an invited number). |
+| `PhoneOtpVerification` | The code step on its own. Props: `client`, `phoneNumber`, `phoneOtp`, `onSignedIn()`, `onResend()`, optional `onChangeNumber()`. |
+| `TwoFactorChallenge` | The 2FA step of sign-in on its own (`SignInScreen` already includes it): authenticator code, or "Use a backup code" instead. Props: `client`, `onVerified()`. |
+| `TwoFactorSettingsScreen` | Account security for the signed-in user: 2FA status; set up an authenticator app (password → QR code and manual key → verify a code → save the 10 backup codes); regenerate backup codes; turn 2FA off. Every change asks for the current password; regenerating and turning off also need a recent sign-in, and on `SESSION_NOT_FRESH` the screen explains why and offers "Sign in again" when `onReauthenticate()` is given. Props: `client`, optional `onReauthenticate()`. Says 2FA is unavailable when the public config has no `twoFactor`. |
+| `DeleteAccountScreen` | Delete the signed-in user's account: explains what happens (at once, or after the grace period from the public config's `accountDeletion`), asks the user to type `DELETE`, then shows "deleted" or the scheduled date. On `SESSION_NOT_FRESH` it explains and offers "Sign in again" when `onReauthenticate()` is given. Props: `client`, `onDeleted()` (from the confirmation; the session has ended), `onCancel()`, optional `onReauthenticate()`. Says deletion is unavailable when the public config has no `accountDeletion`. |
+| `SessionsScreen` | The signed-in user's sessions: device (user agent), sign-in time and IP for each, "This device" on the current one, "Sign out" for each other session and "Sign out all other sessions" (then "Signed out N other sessions."). Signing out needs a recent sign-in; on `SESSION_NOT_FRESH` it explains why and offers "Sign in again" when `onReauthenticate()` is given. Props: `client`, optional `onReauthenticate()`. |
+| `StepUpScreen` | Shown **instead of** a protected page whose route answered `403 TWO_FACTOR_REQUIRED` or `403 STEP_UP_REQUIRED` (role policy, ADR-3), so the page's content never renders. Props: `client`, `requirement` (from `accessRequirementOf(response)` in `@awsmbiz/inbis-auth/client`), `onSatisfied()` (retry the page), `onSignInAgain()` (sign out, open sign-in). 2FA required and none set up: "Set up two-factor authentication" (password → QR code → code → backup codes; enrolment verifies the session), then `onSatisfied`. 2FA required and already set up: "Verify it's you" with "Sign in again". Step-up: "Sign in again" naming the allowed methods (e.g. "your email and password"). |
+| `useTurnstile(captcha, action)` | The Turnstile check for a custom form: `{ widget, ready, token, reset }`. `captcha` is the public config's `captcha`, `action` `"signIn"`, `"signUp"`, `"passwordReset"` or `"phoneOtp"`; a no-op when the action needs no check. Render `widget`, submit only when `ready`, send `token` as `captchaToken`, call `reset()` after every submit (tokens are single use). |
+| `usePublicAuthConfig(client)` | `{ status: "loading" } \| { status: "error" } \| { status: "ready", config }` |
+| `messages`, `t(key, values?)`, `MessageKey` | Every user-facing string by message key (English only for now). |
+| `@awsmbiz/inbis-auth-ui/styles.css` | `@source` for this package's `dist`, so Tailwind generates its classes |
+
+**Turnstile.** When the public config has `captcha`, `SignInScreen` (email + password),
+`SignUpScreen`, `ForgotPasswordScreen` and the phone screens (`PhoneSignInScreen`, `PhoneSignIn`, the phone path of `AcceptInvitationScreen`)
+render Cloudflare's Turnstile widget and send its token in the `x-captcha-response` header; the
+submit button waits for the check. The widget script is loaded once, on demand, from
+`https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit` (explicit rendering, as
+Cloudflare documents it), so a Content-Security-Policy must allow
+`https://challenges.cloudflare.com` in `script-src` and `frame-src`. "Send a new code" goes back
+to the number step for a fresh check. The screens also explain the abuse-control refusals
+(`PHONE_COUNTRY_NOT_ALLOWED`, `TOO_MANY_OTP_REQUESTS`, `SMS_DAILY_CAP_REACHED`, `RATE_LIMITED`,
+a failed check).
+
+Peer dependencies: `react`, `react-dom` ^19.3.1. Depends on `@awsmbiz/inbis-auth` (for
+`@awsmbiz/inbis-auth/client` only), `@awsmbiz/inbis-ui` and `uqr` (QR code as SVG, no dependencies; the QR
+code is rendered locally, the TOTP secret never leaves the page).
+
+```tsx
+import { createInbisAuthClient } from "@awsmbiz/inbis-auth/client";
+import { SignInScreen } from "@awsmbiz/inbis-auth-ui";
+
+const client = createInbisAuthClient(); // same origin as the API
+<SignInScreen client={client} onSignedIn={() => navigate("/")} />;
+```
+
+```css
+@import "@awsmbiz/inbis-ui/globals.css";
+@import "@awsmbiz/inbis-auth-ui/styles.css";
+```
+
+Tested in a real browser by the playground's Playwright suite
+(`pnpm --filter identity-playground test:e2e`): each config preset (`e2e/presets.spec.ts`) and
+axe-core WCAG 2.x A/AA checks of every screen in the states users meet them
+(`e2e/accessibility.spec.ts`).

package/dist/index.d.ts

@@ -0,0 +1,496 @@
+import { ReactNode } from "react";
+import { AccessRequirement, CaptchaAction, InbisAuthClient, PublicAuthConfig } from "@awsmbiz/inbis-auth/client";
+interface AcceptInvitationScreenProps {
+  client: InbisAuthClient;
+  /** Called to go to the sign-in screen (after accepting, or to give up). */
+  onSignIn: () => void;
+  /** The page's query string, which carries `token` from the emailed link. Defaults to `window.location.search`. */
+  search?: string;
+  /**
+   * Called once an invited phone number has signed in. Phone invitations (sent
+   * by SMS) are accepted by signing in with the number right on this screen;
+   * without this callback the screen only points the invitee to phone sign-in.
+   */
+  onSignedIn?: () => void;
+}
+/**
+ * Accepts an invitation from its emailed link (`?token=…`): shows who it is
+ * for, asks for a name and (when the password method is on) a password, and
+ * creates the account. Accepting does not sign in; it offers sign-in after.
+ * An invalid, expired, revoked or used link says so and creates nothing.
+ */
+export declare function AcceptInvitationScreen(props: AcceptInvitationScreenProps): import("react").JSX.Element;
+interface ForgotPasswordScreenProps {
+  client: InbisAuthClient;
+  /** Called to go back to the sign-in screen. */
+  onSignIn: () => void;
+  /**
+   * Where the emailed link sends the user (the `ResetPasswordScreen`), as a
+   * relative path or a trusted-origin URL. Default `/reset-password` on this origin.
+   */
+  resetPasswordURL?: string;
+}
+/**
+ * Asks for an email address and sends a password-reset link. Always confirms
+ * in the same words, whether or not the address has an account. Renders the
+ * Turnstile widget when the server's public config asks for it.
+ */
+export declare function ForgotPasswordScreen({ client, onSignIn, resetPasswordURL }: ForgotPasswordScreenProps): import("react").JSX.Element;
+/**
+ * Every user-facing string of `@awsmbiz/inbis-auth-ui`, by message key. English only
+ * in the baseline; keys keep a later translation a data change.
+ */
+export declare const messages: {
+  readonly "signIn.title": "Sign in";
+  readonly "signIn.description": "Sign in to {appName} with your email and password.";
+  readonly "signIn.descriptionPhone": "Sign in to {appName} with your phone number.";
+  readonly "signIn.email": "Email";
+  readonly "signIn.password": "Password";
+  readonly "signIn.submit": "Sign in";
+  readonly "signIn.submitting": "Signing in…";
+  readonly "signIn.failed": "Could not sign in";
+  readonly "signIn.invalidCredentials": "The email or password is incorrect.";
+  readonly "signIn.noMethods": "No sign-in method is enabled for this app.";
+  readonly "twoFactor.title": "Two-factor authentication";
+  readonly "twoFactor.challenge.description": "Enter the 6-digit code from your authenticator app.";
+  readonly "twoFactor.challenge.backupDescription": "Enter one of your backup codes. Each code works once.";
+  readonly "twoFactor.code": "6-digit code";
+  readonly "twoFactor.backupCode": "Backup code";
+  readonly "twoFactor.verify": "Verify";
+  readonly "twoFactor.verifying": "Verifying…";
+  readonly "twoFactor.useBackupCode": "Use a backup code";
+  readonly "twoFactor.useAuthenticator": "Use your authenticator app";
+  readonly "twoFactor.failed": "Could not verify";
+  readonly "twoFactor.invalidCode": "That code is not valid. Check your authenticator app and try again.";
+  readonly "twoFactor.invalidBackupCode": "That backup code is not valid or has already been used.";
+  readonly "twoFactor.challengeExpired": "This sign-in has expired. Sign in again.";
+  readonly "twoFactor.tooManyAttempts": "Too many attempts. Sign in again to get a new chance.";
+  readonly "twoFactor.locked": "Too many failed attempts. Try again later.";
+  readonly "twoFactor.settings.loading": "Loading…";
+  readonly "twoFactor.settings.unavailable": "Two-factor authentication is not available for this app.";
+  readonly "twoFactor.settings.on": "Two-factor authentication is on.";
+  readonly "twoFactor.settings.off": "Two-factor authentication is off.";
+  readonly "twoFactor.settings.explainer": "Protect your account with a code from an authenticator app each time you sign in.";
+  readonly "twoFactor.settings.setUp": "Set up authenticator app";
+  readonly "twoFactor.settings.regenerate": "Regenerate backup codes";
+  readonly "twoFactor.settings.disable": "Turn off two-factor authentication";
+  readonly "twoFactor.settings.failed": "Could not change two-factor authentication";
+  readonly "twoFactor.password": "Current password";
+  readonly "twoFactor.password.setUp": "Confirm your password to set up an authenticator app.";
+  readonly "twoFactor.password.regenerate": "Confirm your password to replace your backup codes. The old codes stop working.";
+  readonly "twoFactor.password.disable": "Confirm your password to turn off two-factor authentication.";
+  readonly "twoFactor.continue": "Continue";
+  readonly "twoFactor.regenerateSubmit": "Regenerate";
+  readonly "twoFactor.disableSubmit": "Turn off";
+  readonly "twoFactor.cancel": "Cancel";
+  readonly "twoFactor.working": "Working…";
+  readonly "twoFactor.invalidPassword": "The password is incorrect.";
+  readonly "twoFactor.notFresh": "For your security, sign in again before changing two-factor authentication.";
+  readonly "twoFactor.signInAgain": "Sign in again";
+  readonly "twoFactor.enrol.scan": "Scan this QR code with your authenticator app, then enter the 6-digit code it shows.";
+  readonly "twoFactor.enrol.qrAlt": "QR code for your authenticator app";
+  readonly "twoFactor.enrol.manual": "Can't scan it? Enter this key instead:";
+  readonly "twoFactor.enrol.submit": "Verify and turn on";
+  readonly "twoFactor.backupCodes.title": "Save your backup codes";
+  readonly "twoFactor.backupCodes.description": "Each code signs you in once if you lose your authenticator. Store them somewhere safe; they are not shown again.";
+  readonly "twoFactor.backupCodes.list": "Backup codes";
+  readonly "twoFactor.backupCodes.done": "I have saved my backup codes";
+  readonly "signIn.noAccount": "No account yet?";
+  readonly "signIn.createAccount": "Create an account";
+  readonly "signUp.title": "Create an account";
+  readonly "signUp.description": "Create your {appName} account.";
+  readonly "signUp.name": "Name";
+  readonly "signUp.email": "Email";
+  readonly "signUp.password": "Password";
+  readonly "signUp.passwordHint": "{minLength} to {maxLength} characters.";
+  readonly "signUp.submit": "Create account";
+  readonly "signUp.submitting": "Creating account…";
+  readonly "signUp.failed": "Could not create the account";
+  readonly "signUp.closedTitle": "Registration is not open";
+  readonly "signUp.closed": "{appName} does not accept new accounts here. Ask an administrator for an invitation.";
+  readonly "signUp.backToSignIn": "Back to sign in";
+  readonly "deleteAccount.title": "Delete account";
+  readonly "deleteAccount.unavailable": "Accounts cannot be deleted here. Contact {appName} to close your account.";
+  readonly "deleteAccount.warning": "This permanently deletes your {appName} account and signs you out everywhere. It cannot be undone.";
+  readonly "deleteAccount.warningGrace": "Your {appName} account will be permanently deleted after {graceDays} days, and you will be signed out everywhere. Signing in again before then cancels the deletion.";
+  readonly "deleteAccount.confirmLabel": "Type DELETE to confirm";
+  readonly "deleteAccount.confirmWord": "DELETE";
+  readonly "deleteAccount.submit": "Delete my account";
+  readonly "deleteAccount.submitting": "Deleting…";
+  readonly "deleteAccount.cancel": "Cancel";
+  readonly "deleteAccount.failed": "Could not delete the account";
+  readonly "deleteAccount.notFresh": "For your security, sign in again before deleting your account.";
+  readonly "deleteAccount.signInAgain": "Sign in again";
+  readonly "deleteAccount.deleted": "Your account has been deleted.";
+  readonly "deleteAccount.scheduled": "Your account will be deleted on {date}. Sign in before then to keep it.";
+  readonly "deleteAccount.done": "Done";
+  readonly "signIn.forgotPassword": "Forgot password?";
+  readonly "signIn.emailNotVerified": "Verify your email address before signing in. Check your inbox for the link.";
+  readonly "signIn.resendVerification": "Send a new verification link";
+  readonly "verifyEmail.title": "Verify your email";
+  readonly "verifyEmail.description": "Enter your email address and we will send you a new verification link.";
+  readonly "verifyEmail.email": "Email";
+  readonly "verifyEmail.submit": "Send verification link";
+  readonly "verifyEmail.submitting": "Sending…";
+  readonly "verifyEmail.sent": "If that email belongs to an account that still needs verifying, a new link is on its way. It works for a limited time.";
+  readonly "verifyEmail.checkInbox": "Check your inbox: we sent you a link to verify your email address.";
+  readonly "verifyEmail.verifiedTitle": "Email verified";
+  readonly "verifyEmail.verified": "Your email address is verified.";
+  readonly "verifyEmail.continue": "Continue to sign in";
+  readonly "verifyEmail.invalid": "This verification link is invalid or has expired. Request a new one below.";
+  readonly "verifyEmail.failed": "Could not send the link";
+  readonly "forgotPassword.title": "Reset your password";
+  readonly "forgotPassword.description": "Enter your email address and we will send you a link to choose a new password.";
+  readonly "forgotPassword.email": "Email";
+  readonly "forgotPassword.submit": "Send reset link";
+  readonly "forgotPassword.submitting": "Sending…";
+  readonly "forgotPassword.sent": "If an account exists for that email, we have sent a link to reset the password. It works for a limited time.";
+  readonly "forgotPassword.failed": "Could not send the link";
+  readonly "resetPassword.title": "Choose a new password";
+  readonly "resetPassword.newPassword": "New password";
+  readonly "resetPassword.confirmPassword": "Confirm new password";
+  readonly "resetPassword.submit": "Set new password";
+  readonly "resetPassword.submitting": "Saving…";
+  readonly "resetPassword.failed": "Could not change the password";
+  readonly "resetPassword.mismatch": "The passwords do not match.";
+  readonly "resetPassword.invalidLink": "This reset link has expired or was already used.";
+  readonly "resetPassword.compromised": "This password has appeared in a data breach, so it is not safe to use. Choose a different one.";
+  readonly "resetPassword.tooShort": "The password must be at least {minLength} characters.";
+  readonly "resetPassword.tooLong": "The password must be at most {maxLength} characters.";
+  readonly "resetPassword.done": "Your password has been changed. Sign in with your new password.";
+  readonly "resetPassword.requestNew": "Request a new link";
+  readonly "invitation.title": "Accept your invitation";
+  readonly "invitation.description": "Create your {appName} account for {email}.";
+  readonly "invitation.descriptionAdmin": "Create your {appName} administrator account for {email}.";
+  readonly "invitation.loading": "Checking your invitation…";
+  readonly "invitation.invalid": "This invitation link is invalid, has expired or was already used. Ask an administrator for a new invitation.";
+  readonly "invitation.phone": "This invitation is for a phone number. Sign in with your phone number to accept it.";
+  readonly "invitation.name": "Name";
+  readonly "invitation.password": "Password";
+  readonly "invitation.confirmPassword": "Confirm password";
+  readonly "invitation.submit": "Create account";
+  readonly "invitation.submitting": "Creating account…";
+  readonly "invitation.failed": "Could not create the account";
+  readonly "invitation.nameRequired": "Enter your name.";
+  readonly "invitation.exists": "An account with this email already exists. Sign in instead.";
+  readonly "invitation.notAllowed": "This app is not accepting new accounts right now. Ask an administrator.";
+  readonly "invitation.done": "Your account is ready. Sign in to continue.";
+  readonly "sessions.title": "Your sessions";
+  readonly "sessions.description": "Devices and browsers signed in to your account.";
+  readonly "sessions.loading": "Loading…";
+  readonly "sessions.loadFailed": "Could not load your sessions. Reload the page to try again.";
+  readonly "sessions.unknownDevice": "Unknown device";
+  readonly "sessions.signedInAt": "Signed in {date}";
+  readonly "sessions.thisDevice": "This device";
+  readonly "sessions.revoke": "Sign out";
+  readonly "sessions.revokeOthers": "Sign out all other sessions";
+  readonly "sessions.othersRevoked": "Signed out {count} other sessions.";
+  readonly "sessions.failed": "Could not sign out the session";
+  readonly "sessions.notFresh": "For your security, sign in again before signing out other sessions.";
+  readonly "sessions.notFound": "That session has already ended.";
+  readonly "sessions.signInAgain": "Sign in again";
+  readonly "signIn.withPhone": "Use a phone number instead";
+  readonly "phone.title": "Sign in with your phone";
+  readonly "phone.description": "We will text a sign-in code to your phone.";
+  readonly "phone.number": "Phone number";
+  readonly "phone.numberHint": "Include the country code, for example +44 7700 900123.";
+  readonly "phone.send": "Send code";
+  readonly "phone.sending": "Sending…";
+  readonly "phone.codeSent": "If {phoneNumber} can sign in here, a {codeLength}-digit code is on its way. It works for {minutes} minutes.";
+  readonly "phone.code": "6-digit code";
+  readonly "phone.verify": "Verify";
+  readonly "phone.verifying": "Verifying…";
+  readonly "phone.resend": "Send a new code";
+  readonly "phone.changeNumber": "Use a different number";
+  readonly "phone.failed": "Could not sign in";
+  readonly "phone.invalidNumber": "Enter the number in international format, starting with + and the country code.";
+  readonly "phone.invalidCode": "That code is not right. Check the SMS and try again.";
+  readonly "phone.expired": "That code has expired or was already used. Send a new code.";
+  readonly "phone.tooManyAttempts": "Too many wrong codes. Send a new code.";
+  readonly "phone.notAllowed": "This number cannot sign in here. Ask an administrator for an invitation.";
+  readonly "phone.banned": "This account is suspended. Contact an administrator.";
+  readonly "invitation.descriptionPhone": "Join {appName} with {phoneNumber}. We will text you a sign-in code.";
+  readonly "invitation.descriptionPhoneAdmin": "Join {appName} as an administrator with {phoneNumber}. We will text you a sign-in code.";
+  readonly "stepUp.setUp.title": "Set up two-factor authentication";
+  readonly "stepUp.setUp.description": "This area needs two-factor authentication. Set up an authenticator app to continue.";
+  readonly "stepUp.verify.title": "Verify it's you";
+  readonly "stepUp.verify.description": "This area needs a sign-in completed with your authenticator app. Sign in again with your password and code.";
+  readonly "stepUp.method.title": "Sign in again";
+  readonly "stepUp.method.description": "This area needs a sign-in with {methods}. Sign in again to continue.";
+  readonly "stepUp.method.password": "your email and password";
+  readonly "stepUp.method.phoneOtp": "a code sent to your phone";
+  readonly "stepUp.method.other": "another sign-in method";
+  readonly "stepUp.signInAgain": "Sign in again";
+  readonly "auth.backToSignIn": "Back to sign in";
+  readonly "auth.signIn": "Sign in";
+  readonly "config.loading": "Loading…";
+  readonly "config.failed": "Could not load the sign-in options. Reload the page to try again.";
+  readonly "error.network": "Could not reach the server. Check your connection and try again.";
+  readonly "error.generic": "Something went wrong. Try again.";
+  readonly "error.rateLimited": "Too many attempts. Wait a minute and try again.";
+  readonly "captcha.failed": "The security check could not run. Reload the page to try again.";
+  readonly "captcha.rejected": "The security check did not pass. Complete it again and retry.";
+  readonly "phone.countryNotAllowed": "Phone numbers from this country cannot be used here.";
+  readonly "phone.tooManyRequests": "Too many codes were requested. Wait a while before asking for another.";
+  readonly "phone.smsPaused": "Text messages are paused for today. Try again later or use another way to sign in.";
+};
+type MessageKey = keyof typeof messages;
+/** Looks up a message and fills `{name}` placeholders. */
+export declare function t(key: MessageKey, values?: Record<string, string>): string;
+interface ResetPasswordScreenProps {
+  client: InbisAuthClient;
+  /** Called to go to the sign-in screen (after the change, or to give up). */
+  onSignIn: () => void;
+  /** Called to request a new link, e.g. to navigate to the `ForgotPasswordScreen`. */
+  onRequestNewLink: () => void;
+  /**
+   * The page's query string, which carries `token` (or `error`) from the
+   * emailed link. Defaults to `window.location.search`.
+   */
+  search?: string;
+}
+/**
+ * Sets a new password with the token from an emailed reset link
+ * (`?token=…`). An expired or used link (`?error=INVALID_TOKEN`, or the
+ * server rejecting the token) offers a new link instead.
+ */
+export declare function ResetPasswordScreen(props: ResetPasswordScreenProps): import("react").JSX.Element;
+interface SignInScreenProps {
+  client: InbisAuthClient;
+  /** Called after a successful sign-in, e.g. to navigate to the protected area. */
+  onSignedIn: () => void;
+  /** Where the server may redirect after sign-in; must be relative or a trusted origin. */
+  callbackURL?: string;
+  /**
+   * Called when the user chooses to create an account, e.g. to navigate to the
+   * `SignUpScreen`. The link is shown only when registration is `open`.
+   */
+  onCreateAccount?: () => void;
+  /**
+   * Called when the user forgot their password, e.g. to navigate to the
+   * `ForgotPasswordScreen`. Shown only when the server offers password reset.
+   */
+  onForgotPassword?: () => void;
+  /**
+   * Called when the user wants a new verification link after signing in with
+   * an unverified address, e.g. to navigate to the `VerifyEmailScreen`.
+   */
+  onVerifyEmail?: () => void;
+  /**
+   * Called when the user chooses to sign in with a phone number, e.g. to
+   * navigate to the `PhoneSignInScreen`. Shown only when the server offers phone OTP.
+   */
+  onPhoneSignIn?: () => void;
+}
+/**
+ * The sign-in screen. Renders only the methods the server's public config
+ * enables (email + password, and phone OTP). For a user with 2FA on, the password is
+ * followed by the 2FA challenge (authenticator code or backup code).
+ */
+export declare function SignInScreen(props: SignInScreenProps): import("react").JSX.Element;
+interface SignUpScreenProps {
+  client: InbisAuthClient;
+  /** Called after the account was created (Better Auth signs the new user in). */
+  onSignedUp: () => void;
+  /** Called to go back to the sign-in screen. */
+  onSignIn: () => void;
+  /** Where the server may redirect after sign-up; must be relative or a trusted origin. */
+  callbackURL?: string;
+}
+/**
+ * The register screen. Shows the form only when the server's public config says
+ * registration is `open` and email + password is enabled; otherwise it explains
+ * that registration is not open. The server enforces the policy either way.
+ */
+export declare function SignUpScreen(props: SignUpScreenProps): import("react").JSX.Element;
+type PublicAuthConfigState = {
+  status: "loading";
+} | {
+  status: "error";
+} | {
+  status: "ready";
+  config: PublicAuthConfig;
+};
+/** Loads `GET {basePath}/public-config` once per client. */
+export declare function usePublicAuthConfig(client: InbisAuthClient): PublicAuthConfigState;
+interface VerifyEmailScreenProps {
+  client: InbisAuthClient;
+  /** Called to go to the sign-in screen. */
+  onSignIn: () => void;
+  /**
+   * Where verification links return to: this screen, with `verified=1`.
+   * Relative path or trusted-origin URL. Default `/verify-email?verified=1` on this origin.
+   * A failed link comes back with `&error=TOKEN_EXPIRED|INVALID_TOKEN`.
+   */
+  callbackURL?: string;
+  /** The page's query string. Defaults to `window.location.search`. */
+  search?: string;
+}
+/**
+ * Where verification links land, and where to send users after sign-up
+ * (`?sent=1`: "check your inbox"). Shows success (`?verified=1`), explains an
+ * expired or invalid link (`?error=…`), and otherwise lets the user ask for a
+ * new link. Requesting a link answers the same whether or not the address has
+ * an account.
+ */
+export declare function VerifyEmailScreen(props: VerifyEmailScreenProps): import("react").JSX.Element;
+interface TwoFactorChallengeProps {
+  client: InbisAuthClient;
+  /** Called once the second factor is accepted and the session exists. */
+  onVerified: () => void;
+}
+/**
+ * The second step of a password sign-in for a user with 2FA on: a code from
+ * the authenticator app, or a single-use backup code instead. Rendered by
+ * `SignInScreen` after the password is accepted; usable on its own too.
+ */
+export declare function TwoFactorChallenge({ client, onVerified }: TwoFactorChallengeProps): import("react").JSX.Element;
+interface TwoFactorSettingsScreenProps {
+  client: InbisAuthClient;
+  /**
+   * Called when a change needs a recent sign-in (`SESSION_NOT_FRESH`) and the
+   * user chooses to sign in again, e.g. sign out and navigate to sign-in.
+   * Without it, the screen only explains why the change was refused.
+   */
+  onReauthenticate?: () => void;
+}
+/**
+ * Account security: shows whether 2FA is on and lets the signed-in user set up
+ * an authenticator app (QR code, verify, backup codes), regenerate the backup
+ * codes, or turn 2FA off. Every change asks for the current password, and
+ * regenerating or turning off also needs a recent sign-in.
+ */
+export declare function TwoFactorSettingsScreen(props: TwoFactorSettingsScreenProps): import("react").JSX.Element;
+interface DeleteAccountScreenProps {
+  client: InbisAuthClient;
+  /** Called from the confirmation shown after the deletion (the session has ended). */
+  onDeleted: () => void;
+  /** Called when the user backs out. */
+  onCancel: () => void;
+  /**
+   * Called when deletion needs a recent sign-in (`SESSION_NOT_FRESH`) and the
+   * user chooses to sign in again, e.g. sign out and navigate to sign-in.
+   */
+  onReauthenticate?: () => void;
+}
+/**
+ * Lets the signed-in user delete their account, when the server's public
+ * config allows it. The user confirms by typing a word; the server also
+ * requires a recent sign-in and offers "sign in again" when it is not.
+ */
+export declare function DeleteAccountScreen(props: DeleteAccountScreenProps): import("react").JSX.Element;
+interface SessionsScreenProps {
+  client: InbisAuthClient;
+  /**
+   * Called when signing a session out needs a recent sign-in
+   * (`SESSION_NOT_FRESH`) and the user chooses to sign in again, e.g. sign out
+   * and navigate to sign-in. Without it, the screen only explains why.
+   */
+  onReauthenticate?: () => void;
+}
+/**
+ * The signed-in user's sessions: where and when each one signed in, which one
+ * is this device, "Sign out" for each other session and "Sign out all other
+ * sessions". Signing out other sessions needs a recent sign-in; on
+ * `SESSION_NOT_FRESH` the screen explains why and offers "Sign in again".
+ */
+export declare function SessionsScreen(props: SessionsScreenProps): import("react").JSX.Element;
+interface StepUpScreenProps {
+  client: InbisAuthClient;
+  /** What the protected route answered, from `accessRequirementOf(response)`. */
+  requirement: AccessRequirement;
+  /**
+   * Called once the current session satisfies the requirement (after setting
+   * up 2FA, which verifies the session): retry the protected page.
+   */
+  onSatisfied: () => void;
+  /** Sign out and go to sign-in, where the next sign-in meets the policy. */
+  onSignInAgain: () => void;
+}
+/**
+ * Shown instead of a protected page that answered `403 TWO_FACTOR_REQUIRED`
+ * or `403 STEP_UP_REQUIRED` (ADR-3), so the page's content never renders:
+ * - 2FA required, none set up: sets up an authenticator app here (enrolment
+ *   verifies the session), then `onSatisfied()`.
+ * - 2FA required, already set up: explains, and offers "Sign in again"
+ *   (password, then the authenticator code).
+ * - Step-up: names the allowed methods and offers "Sign in again".
+ */
+export declare function StepUpScreen({ client, requirement, onSatisfied, onSignInAgain }: StepUpScreenProps): import("react").JSX.Element;
+type PhoneOtp = NonNullable<PublicAuthConfig["methods"]["phoneOtp"]>;
+interface PhoneOtpVerificationProps {
+  client: InbisAuthClient;
+  /** The number the code was sent to (as entered; the server normalises it). */
+  phoneNumber: string;
+  /** Code length and lifetime, from the public config's `methods.phoneOtp`. */
+  phoneOtp: PhoneOtp;
+  /** Called once the code is accepted and the session exists. */
+  onSignedIn: () => void;
+  /** Asks for another code. */
+  onResend: () => void;
+  /** Goes back to entering a number; hidden when absent (e.g. a fixed, invited number). */
+  onChangeNumber?: () => void;
+}
+/**
+ * The second step of phone sign-in: the code from the SMS. Better Auth allows
+ * a few attempts per code; after that, or once it expires, the user sends a new one.
+ */
+export declare function PhoneOtpVerification({ client, phoneNumber, phoneOtp, onSignedIn, onResend, onChangeNumber }: PhoneOtpVerificationProps): import("react").JSX.Element;
+interface PhoneSignInProps {
+  client: InbisAuthClient;
+  phoneOtp: PhoneOtp;
+  onSignedIn: () => void;
+  /** A number fixed by the caller (an invited number): no number field, sent as is. */
+  phoneNumber?: string;
+  /** The public config's `captcha`: when it covers `phoneOtp`, each code request needs a Turnstile token. */
+  captcha?: PublicAuthConfig["captcha"];
+}
+/** Phone sign-in as a form: the number (unless fixed), then the code. */
+export declare function PhoneSignIn({ client, phoneOtp, onSignedIn, phoneNumber: fixed, captcha }: PhoneSignInProps): import("react").JSX.Element;
+interface PhoneSignInScreenProps {
+  client: InbisAuthClient;
+  /** Called after a successful sign-in, e.g. to navigate to the protected area. */
+  onSignedIn: () => void;
+  /** Back to the other sign-in methods (e.g. the `SignInScreen`); hidden when absent. */
+  onSignIn?: () => void;
+}
+/**
+ * Phone sign-in screen (when the public config has `methods.phoneOtp`): enter
+ * an international number, receive a code by SMS, enter it. A number's first
+ * sign-in creates the account when registration is open or the number was
+ * invited; the screen never reveals whether a number has an account.
+ */
+export declare function PhoneSignInScreen({ client, onSignedIn, onSignIn }: PhoneSignInScreenProps): import("react").JSX.Element;
+interface TurnstileApi {
+  render(container: HTMLElement, options: {
+    sitekey: string;
+    action?: string;
+    callback: (token: string) => void;
+    "expired-callback": () => void;
+    "error-callback": () => void;
+  }): string;
+  reset(widgetId: string): void;
+  remove(widgetId: string): void;
+}
+declare global {
+  interface Window {
+    turnstile?: TurnstileApi;
+  }
+}
+interface TurnstileState {
+  /** The widget to render inside the form; `null` when no check is needed. */
+  widget: ReactNode;
+  /** Whether the form may submit: no check is needed, or a token is ready. */
+  ready: boolean;
+  /** The token to send (`undefined` when no check is needed). */
+  token: string | undefined;
+  /** Call after every submit: a token works once. */
+  reset: () => void;
+}
+/**
+ * The Turnstile check for one form, when the public config's `captcha` covers
+ * `action`; otherwise a no-op state.
+ */
+export declare function useTurnstile(captcha: PublicAuthConfig["captcha"], action: CaptchaAction): TurnstileState;
+export type { AcceptInvitationScreenProps, DeleteAccountScreenProps, ForgotPasswordScreenProps, MessageKey, PhoneOtpVerificationProps, PhoneSignInProps, PhoneSignInScreenProps, PublicAuthConfigState, ResetPasswordScreenProps, SessionsScreenProps, SignInScreenProps, SignUpScreenProps, StepUpScreenProps, TurnstileState, TwoFactorChallengeProps, TwoFactorSettingsScreenProps, VerifyEmailScreenProps };
+//# sourceMappingURL=index.d.ts.map