@dloizides/auth-web 1.11.0 → 1.12.1

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode, ReactElement } from 'react';
-import { BffAuthClient, BffUser, HttpClient, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
-export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
+import { BffAuthClient, BffUser, DemoCredentials, HttpClient, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
+export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
 import { UseMutationOptions, UseMutationResult } from '@tanstack/react-query';
 
 /**
@@ -129,18 +129,6 @@ interface AuthScreenProps {
 /** The screen-level auth composition: one centered card the controls share. */
 declare function AuthScreen({ children, theme: themeProp, testID, cardTestID, maxWidth, title, subtitle, footer, }: Readonly<AuthScreenProps>): ReactElement;
 
-/**
- * Label bags for the auth components.
- *
- * `@dloizides/auth-web` ships **no** translation framework — it is i18n-agnostic
- * by design (each app already owns its own i18n). Every user-facing string a
- * component renders is supplied by the consuming app through a typed `labels`
- * prop. The app passes strings it has already localised with `FM()` / `t()`.
- *
- * Each bag has a `DEFAULT_*` constant (English) so a component renders sensibly
- * with no `labels` prop and a consuming app can spread-override only the keys
- * it wants to change.
- */
 /** Strings rendered by `<LoginForm>`. */
 interface LoginFormLabels {
     title: string;
@@ -162,6 +150,8 @@ interface LoginFormLabels {
     /** Shown when one or both fields are empty on submit. */
     missingFields: string;
 }
+declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
+
 /** Strings rendered by `<ForgotPasswordForm>`. */
 interface ForgotPasswordFormLabels {
     title: string;
@@ -189,6 +179,9 @@ interface ForgotPasswordFieldsLabels extends ForgotPasswordFormLabels {
     /** The "close" button shown on the success state. */
     close: string;
 }
+declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
+declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
+
 /** Strings rendered by `<OtpForm>` — the two-step email-OTP login form. */
 interface OtpFormLabels {
     /** Title shown on the request-a-code step. */
@@ -224,6 +217,8 @@ interface OtpFormLabels {
     /** The "use a different email" link text — returns to step 1. */
     changeEmail: string;
 }
+declare const DEFAULT_OTP_LABELS: OtpFormLabels;
+
 /** Strings rendered by `<PinForm>` — the single-step event-PIN login form. */
 interface PinFormLabels {
     /** Title shown above the PIN field. */
@@ -241,6 +236,8 @@ interface PinFormLabels {
     /** Generic "that PIN was wrong / expired / locked out" message. */
     invalidPin: string;
 }
+declare const DEFAULT_PIN_LABELS: PinFormLabels;
+
 /**
  * Strings rendered by `<DevicePinUnlockScreen>` — the returning-device unlock
  * gate. `{name}` / `{count}` placeholders are substituted by the component.
@@ -336,6 +333,10 @@ interface DevicePinSettingsLabels {
     /** Error shown when disabling fails. */
     disableFailed: string;
 }
+declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
+declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
+declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
+
 /** Strings rendered by `<PasskeyLoginButton>` — the login-surface passkey CTA. */
 interface PasskeyLoginLabels {
     /** The "sign in with a passkey" button. */
@@ -365,6 +366,9 @@ interface PasskeySettingsLabels {
     /** Success line shown after returning from a registration. */
     registeredSuccess: string;
 }
+declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
+declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
+
 /** Strings rendered by `<PreferredMethodSettingsCard>` — the cross-device default-method picker. */
 interface PreferredMethodSettingsLabels {
     title: string;
@@ -391,6 +395,9 @@ interface PreferredMethodHintLabels {
     /** Full sentence shown when the cached preference is passkey. */
     passkey: string;
 }
+declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
+declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
+
 /** Strings rendered by `<DemoCredentialsHint>` — the public-demo credentials panel. */
 interface DemoCredentialsHintLabels {
     /** Panel heading (e.g. "Demo access"). */
@@ -406,6 +413,8 @@ interface DemoCredentialsHintLabels {
     /** Accessibility hint for that button. */
     useCredentialsHint: string;
 }
+declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
+
 /** Strings rendered by `<ResetPasswordForm>`. */
 interface ResetPasswordFormLabels {
     title: string;
@@ -427,33 +436,32 @@ interface ResetPasswordFormLabels {
     /** Error: a network / 5xx failure. */
     errorNetwork: string;
 }
-declare const DEFAULT_LOGIN_LABELS: LoginFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_LABELS: ForgotPasswordFormLabels;
-declare const DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS: ForgotPasswordFieldsLabels;
-declare const DEFAULT_OTP_LABELS: OtpFormLabels;
-declare const DEFAULT_PIN_LABELS: PinFormLabels;
-declare const DEFAULT_DEVICE_PIN_UNLOCK_LABELS: DevicePinUnlockLabels;
-declare const DEFAULT_DEVICE_PIN_ENROLL_LABELS: DevicePinEnrollLabels;
-declare const DEFAULT_DEVICE_PIN_SETTINGS_LABELS: DevicePinSettingsLabels;
-declare const DEFAULT_PASSKEY_LOGIN_LABELS: PasskeyLoginLabels;
-declare const DEFAULT_PASSKEY_SETTINGS_LABELS: PasskeySettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS: PreferredMethodSettingsLabels;
-declare const DEFAULT_PREFERRED_METHOD_HINT_LABELS: PreferredMethodHintLabels;
-declare const DEFAULT_DEMO_CREDENTIALS_HINT_LABELS: DemoCredentialsHintLabels;
 declare const DEFAULT_RESET_PASSWORD_LABELS: ResetPasswordFormLabels;
 
 /**
- * `<LoginForm>` — the ready-made, themeable password-login form.
+ * Who asked for a prefill — the difference between "the user requested this" and
+ * "the app offered it".
  *
- * The "themeable component" half of the package design: drop it in, pass a
- * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
- * `labels` bag, and you have a branded login surface. It is built on the
- * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
- * one code path.
+ * A seed that the USER asked for (tapping "use these credentials") must always
+ * apply: they can see the fields, they know what is in them, and they asked
+ * anyway. A seed the APP offers (a demo pair arriving from `GET /bff/config`
+ * mid-typing) must not: it is an unrequested, racing write against a field the
+ * user may already be filling in.
  *
- * The package ships no router and no i18n. `onSuccess` hands the signed-in
- * `BffUser` back to the app, which decides where to navigate (typically via
- * `resolvePostLoginRoute`). All copy comes from `labels`.
+ * Collapsing the two into a bare nonce bump is what makes a late-arriving config
+ * fetch overwrite the username a real account holder is halfway through typing.
+ * `<LoginForm>` switches on this, never on a string literal.
+ */
+declare const enum PrefillIntent {
+    /** The user asked for it. Always applies, over whatever is in the fields. */
+    Explicit = "explicit",
+    /** The app offered it. Applies only to untouched, empty fields. */
+    Opportunistic = "opportunistic"
+}
+
+/**
+ * Props for `<LoginForm>`, split out of the component file to keep the render
+ * body under the component size limit. Purely a type module — no runtime code.
  */
 
 interface LoginFormProps {
@@ -498,12 +506,35 @@ interface LoginFormProps {
      * props alone does nothing once mounted.
      *
      * Most apps should not manage this by hand: `useDemoCredentials` returns a
-     * `loginFormProps` bag carrying all three, ready to spread.
+     * `loginFormProps` bag carrying all four, ready to spread.
      */
     prefillNonce?: number;
+    /**
+     * Whether the pending re-seed was requested by the user or offered by the app.
+     * An {@link PrefillIntent.Opportunistic} re-seed (e.g. a demo pair arriving
+     * from `GET /bff/config` after mount) is DROPPED unless both fields are still
+     * empty, so a late fetch never overwrites what someone is typing. Defaults to
+     * unconditional — omit it and every nonce bump applies.
+     */
+    prefillIntent?: PrefillIntent;
 }
+
+/**
+ * `<LoginForm>` — the ready-made, themeable password-login form.
+ *
+ * The "themeable component" half of the package design: drop it in, pass a
+ * `client`, a `theme` (or wrap in `<AuthThemeProvider>`) and a localised
+ * `labels` bag, and you have a branded login surface. It is built on the
+ * headless `useBffAuth` hook, so the ready-made and custom-layout paths share
+ * one code path.
+ *
+ * The package ships no router and no i18n. `onSuccess` hands the signed-in
+ * `BffUser` back to the app, which decides where to navigate (typically via
+ * `resolvePostLoginRoute`). All copy comes from `labels`.
+ */
+
 /** Themeable password-login form built on `useBffAuth`. */
-declare function LoginForm({ client, theme: themeProp, labels: labelsProp, onSuccess, onForgotPassword, onSignUp, testIdPrefix, chromeless, initialUsername, initialPassword, prefillNonce, }: Readonly<LoginFormProps>): ReactElement;
+declare function LoginForm({ client, theme: themeProp, labels: labelsProp, onSuccess, onForgotPassword, onSignUp, testIdPrefix, chromeless, initialUsername, initialPassword, prefillNonce, prefillIntent, }: Readonly<LoginFormProps>): ReactElement;
 
 /**
  * `<ForgotPasswordForm>` — the ready-made, themeable "request a reset link"
@@ -802,6 +833,7 @@ declare const enum DevicePinErrorKey {
  * error) so the unlock / enrol UIs can route on each one rather than collapsing
  * them into a single opaque failure.
  */
+
 /**
  * The per-device half of `GET /bff/config` — what this device remembers about
  * the last user, all fields safe-defaulted by the parser when absent.
@@ -824,6 +856,14 @@ interface BffLoginConfig {
     registrationEnabled: boolean;
     /** The per-device remembered state. */
     deviceState: BffDeviceState;
+    /**
+     * The published demo credentials this deployment advertises, or `null` when
+     * none is configured. Feeds `useDemoCredentials` / `<DemoCredentialsHint>`:
+     * `useDemoCredentials({ credentials: config.demo ?? undefined })`. `auth-client`
+     * 4.2.0 populates it; older clients (and hand-rolled objects) simply omit it,
+     * which reads as `undefined` — treated the same as "no demo" by the hint.
+     */
+    demo?: DemoCredentials | null;
 }
 /**
  * Discriminated result of a device-PIN UNLOCK attempt. The client never rejects;
@@ -1245,23 +1285,6 @@ interface PreferredMethodHintProps {
 /** Themeable login-screen preferred-method hint. Renders `null` when there is nothing to say. */
 declare function PreferredMethodHint({ method, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<PreferredMethodHintProps>): ReactElement | null;
 
-/**
- * Public demo-credential contracts.
- *
- * A "demo credential" is a REAL account that a product publishes openly so a
- * prospective evaluator can sign in without a sign-up step. It is not a bypass:
- * the credentials travel the ordinary login path (same BFF, same Keycloak, same
- * session cookie, same roles). The package only makes them *discoverable* and
- * *one-click fillable* — it never authenticates anything itself.
- */
-/** A publishable demo username + password pair. */
-interface DemoCredentials {
-    /** The demo account's username. */
-    username: string;
-    /** The demo account's password. */
-    password: string;
-}
-
 /**
  * `<DemoCredentialsHint>` — the public-demo credentials panel.
  *
@@ -1942,6 +1965,7 @@ interface DemoCredentialsLoginFormProps {
     initialUsername?: string;
     initialPassword?: string;
     prefillNonce: number;
+    prefillIntent: PrefillIntent;
 }
 /** The `<DemoCredentialsHint>` props that carry the credentials + fill action. */
 interface DemoCredentialsHintWiring {
@@ -2231,4 +2255,4 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, type DemoCredentials, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };

package/dist/index.js

@@ -114,7 +114,7 @@ function AuthScreen({
   ] });
 }
 
-// src/components/labels.ts
+// src/components/labels/loginLabels.ts
 var DEFAULT_LOGIN_LABELS = {
   title: "Sign in",
   subtitle: "Welcome back",
@@ -129,6 +129,8 @@ var DEFAULT_LOGIN_LABELS = {
   invalidCredentials: "Incorrect username or password.",
   missingFields: "Enter both your username and password."
 };
+
+// src/components/labels/forgotPasswordLabels.ts
 var DEFAULT_FORGOT_PASSWORD_LABELS = {
   title: "Forgot password",
   description: "Enter your email and we will send you a reset link.",
@@ -145,6 +147,8 @@ var DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS = {
   cancel: "Cancel",
   close: "Close"
 };
+
+// src/components/labels/otpLabels.ts
 var DEFAULT_OTP_LABELS = {
   requestTitle: "Sign in with a code",
   requestDescription: "Enter your email and we will send you a one-time code.",
@@ -165,6 +169,8 @@ var DEFAULT_OTP_LABELS = {
   resending: "Resending...",
   changeEmail: "Use a different email"
 };
+
+// src/components/labels/pinLabels.ts
 var DEFAULT_PIN_LABELS = {
   title: "Enter your event PIN",
   description: "Enter the PIN for this event to sign in.",
@@ -175,6 +181,8 @@ var DEFAULT_PIN_LABELS = {
   missingPin: "Enter your event PIN.",
   invalidPin: "That PIN is incorrect, has expired, or is locked out."
 };
+
+// src/components/labels/devicePinLabels.ts
 var DEFAULT_DEVICE_PIN_UNLOCK_LABELS = {
   title: "Welcome back, {name}",
   titleNoName: "Welcome back",
@@ -232,6 +240,8 @@ var DEFAULT_DEVICE_PIN_SETTINGS_LABELS = {
   disabling: "Disabling...",
   disableFailed: "Could not disable PIN sign-in. Try again later."
 };
+
+// src/components/labels/passkeyLabels.ts
 var DEFAULT_PASSKEY_LOGIN_LABELS = {
   signInButton: "Sign in with a passkey",
   signInHint: "Use your fingerprint, face, or security key to sign in",
@@ -247,6 +257,8 @@ var DEFAULT_PASSKEY_SETTINGS_LABELS = {
   addHint: "Start setting up a passkey for this account",
   registeredSuccess: "Your passkey was added. You can now use it to sign in."
 };
+
+// src/components/labels/preferredMethodLabels.ts
 var DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS = {
   title: "Preferred sign-in method",
   description: "Pick how you usually sign in. We will show this method first on your devices.",
@@ -262,6 +274,8 @@ var DEFAULT_PREFERRED_METHOD_HINT_LABELS = {
   pin: "You usually sign in with your quick PIN on this account.",
   passkey: "You usually sign in with a passkey."
 };
+
+// src/components/labels/demoLabels.ts
 var DEFAULT_DEMO_CREDENTIALS_HINT_LABELS = {
   title: "Demo access",
   description: "Explore the full product with our shared demo account.",
@@ -270,6 +284,8 @@ var DEFAULT_DEMO_CREDENTIALS_HINT_LABELS = {
   useCredentials: "Use these credentials",
   useCredentialsHint: "Fill the sign-in form with the demo username and password"
 };
+
+// src/components/labels/resetPasswordLabels.ts
 var DEFAULT_RESET_PASSWORD_LABELS = {
   title: "Reset password",
   description: "Choose a new password for your account.",
@@ -494,21 +510,64 @@ function useAuthStyles(theme) {
     });
   }, [theme]);
 }
+
+// src/components/PrefillIntent.ts
+var PrefillIntent = /* @__PURE__ */ ((PrefillIntent2) => {
+  PrefillIntent2["Explicit"] = "explicit";
+  PrefillIntent2["Opportunistic"] = "opportunistic";
+  return PrefillIntent2;
+})(PrefillIntent || {});
+
+// src/components/useLoginPrefill.ts
 function useLoginPrefill({
   initialUsername,
   initialPassword,
-  prefillNonce
+  prefillNonce,
+  prefillIntent
 }) {
   const [username, setUsername] = react.useState(initialUsername ?? "");
   const [password, setPassword] = react.useState(initialPassword ?? "");
   const [appliedNonce, setAppliedNonce] = react.useState(prefillNonce);
   if (prefillNonce !== appliedNonce) {
     setAppliedNonce(prefillNonce);
-    setUsername(initialUsername ?? "");
-    setPassword(initialPassword ?? "");
+    const isPristine = username.length === 0 && password.length === 0;
+    const mayApply = prefillIntent !== "opportunistic" /* Opportunistic */ || isPristine;
+    if (mayApply) {
+      setUsername(initialUsername ?? "");
+      setPassword(initialPassword ?? "");
+    }
   }
   return { username, password, setUsername, setPassword };
 }
+function useLoginSubmit({
+  username,
+  password,
+  login,
+  onSuccess,
+  missingFieldsLabel,
+  invalidCredentialsLabel
+}) {
+  const [errorText, setErrorText] = react.useState(null);
+  const runLogin = react.useCallback(async () => {
+    setErrorText(null);
+    const trimmedUsername = username.trim();
+    const hasMissingField = trimmedUsername.length === 0 || password.length === 0;
+    if (hasMissingField) {
+      setErrorText(missingFieldsLabel);
+      return;
+    }
+    try {
+      const user = await login({ username: trimmedUsername, password });
+      onSuccess(user);
+    } catch {
+      setErrorText(invalidCredentialsLabel);
+    }
+  }, [username, password, login, onSuccess, missingFieldsLabel, invalidCredentialsLabel]);
+  const handleSubmit = react.useCallback(() => {
+    void runLogin();
+  }, [runLogin]);
+  return { errorText, handleSubmit };
+}
 var BffAuthStatus = /* @__PURE__ */ ((BffAuthStatus2) => {
   BffAuthStatus2["Loading"] = "loading";
   BffAuthStatus2["Authenticated"] = "authenticated";
@@ -623,7 +682,8 @@ function LoginForm({
   chromeless = false,
   initialUsername,
   initialPassword,
-  prefillNonce
+  prefillNonce,
+  prefillIntent
 }) {
   const theme = useAuthTheme(themeProp);
   const styles3 = useAuthStyles(theme);
@@ -635,27 +695,17 @@ function LoginForm({
   const { username, password, setUsername, setPassword } = useLoginPrefill({
     initialUsername,
     initialPassword,
-    prefillNonce
+    prefillNonce,
+    prefillIntent
+  });
+  const { errorText, handleSubmit } = useLoginSubmit({
+    username,
+    password,
+    login,
+    onSuccess,
+    missingFieldsLabel: labels.missingFields,
+    invalidCredentialsLabel: labels.invalidCredentials
   });
-  const [errorText, setErrorText] = react.useState(null);
-  const runLogin = react.useCallback(async () => {
-    setErrorText(null);
-    const trimmedUsername = username.trim();
-    const hasMissingField = trimmedUsername.length === 0 || password.length === 0;
-    if (hasMissingField) {
-      setErrorText(labels.missingFields);
-      return;
-    }
-    try {
-      const user = await login({ username: trimmedUsername, password });
-      onSuccess(user);
-    } catch {
-      setErrorText(labels.invalidCredentials);
-    }
-  }, [username, password, login, onSuccess, labels.missingFields, labels.invalidCredentials]);
-  const handleSubmit = react.useCallback(() => {
-    void runLogin();
-  }, [runLogin]);
   const submitButtonStyle = isSubmitting ? [styles3.primaryButton, styles3.primaryButtonDisabled] : styles3.primaryButton;
   const content = /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
     /* @__PURE__ */ jsxRuntime.jsx(reactNative.Text, { style: styles3.title, children: labels.title }),
@@ -3324,7 +3374,8 @@ var EMPTY_CONFIG = {
     hasPin: false,
     pinDigits: null,
     preferredMethod: null
-  }
+  },
+  demo: null
 };
 function useBffLoginConfig(client) {
   const [config, setConfig] = react.useState(EMPTY_CONFIG);
@@ -3421,6 +3472,12 @@ async function syncPreferredMethodFromServer(client) {
     return null;
   }
 }
+function isSamePair(a, b) {
+  if (a === null || b === null) {
+    return a === b;
+  }
+  return a.username === b.username && a.password === b.password;
+}
 function useDemoCredentials({
   credentials,
   prefillOnMount = false
@@ -3430,23 +3487,38 @@ function useDemoCredentials({
     prefillOnMount ? resolved : null
   );
   const [prefillNonce, setPrefillNonce] = react.useState(0);
+  const [prefillIntent, setPrefillIntent] = react.useState(
+    "opportunistic" /* Opportunistic */
+  );
+  const [autoSeeded, setAutoSeeded] = react.useState(
+    prefillOnMount ? resolved : null
+  );
+  const shouldAutoSeed = prefillOnMount && resolved !== null && !isSamePair(resolved, autoSeeded);
+  if (shouldAutoSeed) {
+    setAutoSeeded(resolved);
+    setFilled(resolved);
+    setPrefillNonce((current) => current + 1);
+    setPrefillIntent("opportunistic" /* Opportunistic */);
+  }
   const handleUse = react.useCallback((next) => {
     setFilled(next);
     setPrefillNonce((current) => current + 1);
+    setPrefillIntent("explicit" /* Explicit */);
   }, []);
   return react.useMemo(
     () => ({
       loginFormProps: {
         initialUsername: filled?.username,
         initialPassword: filled?.password,
-        prefillNonce
+        prefillNonce,
+        prefillIntent
       },
       // `credentials` is passed through unresolved on purpose: the hint applies
       // `resolveDemoCredentials` itself, so it fails closed even when it is used
       // standalone, without this hook.
       hintProps: { credentials, onUse: handleUse }
     }),
-    [filled, prefillNonce, credentials, handleUse]
+    [filled, prefillNonce, prefillIntent, credentials, handleUse]
   );
 }
 async function lazyFetchHttpClient(request) {
@@ -3588,6 +3660,7 @@ exports.PasswordPolicyError = PasswordPolicyError;
 exports.PinForm = PinForm;
 exports.PreferredMethodHint = PreferredMethodHint;
 exports.PreferredMethodSettingsCard = PreferredMethodSettingsCard;
+exports.PrefillIntent = PrefillIntent;
 exports.ResetPasswordError = ResetPasswordError;
 exports.ResetPasswordForm = ResetPasswordForm;
 exports.cachePreferredMethod = cachePreferredMethod;