@dloizides/auth-web 1.13.0 → 1.16.0

package/CHANGELOG.md

@@ -1,6 +1,114 @@
 # Changelog
 
-## 1.13.0 (2026-07-19)
+## 1.16.0
+
+**New shared `AccountSettingsScreen` — one authenticated account surface for all
+seven portals, plus a first-class in-app change-password form.**
+
+Adds `AccountSettingsScreen`: a self-contained, theme-driven surface that stacks
+the account-management cards each portal was otherwise wiring by hand. Sections
+are config-driven — a card renders only when its config is passed:
+
+- **Change password (always):** a new `ChangePasswordCard` — a real in-app form
+  (current / new / confirm) with client-side validation (new === confirm + the
+  shared password policy) that submits `POST /bff/account/change-password`
+  (204 → success; 400 → "current password incorrect or fails the policy";
+  401 → session expired). The signed-in user changes their OWN password in the
+  app — no Keycloak-console detour. This package never stores, logs or inspects
+  the password values; it forwards them to the app's own BFF over the session
+  cookie and reads back only a status.
+- **Device PIN (optional):** the existing `DevicePinSettingsCard`.
+- **Passkeys (optional):** the existing `PasskeySettingsCard`.
+- **Preferred sign-in method (optional):** the existing `PreferredMethodSettingsCard`.
+
+New public API:
+
+- `AccountSettingsScreen` + `AccountSettingsScreenProps` and the per-section
+  config types (`AccountSettingsChangePasswordConfig`, `AccountSettingsDevicePinConfig`,
+  `AccountSettingsPasskeysConfig`, `AccountSettingsPreferredMethodConfig`).
+- `ChangePasswordCard` + `ChangePasswordCardProps`.
+- `useChangePassword` (react-query-free form state + validation + submit),
+  `ChangePasswordErrorKey`, `ChangePasswordResult`.
+- `createBffChangePasswordClient` (ready same-origin BFF client, CSRF marker
+  header attached) + `ChangePasswordCapableClient` / `ChangePasswordRequest` /
+  `CHANGE_PASSWORD_ENDPOINT` / `CreateBffChangePasswordClientOptions`.
+- `AccountSettingsLabels` + `DEFAULT_ACCOUNT_SETTINGS_LABELS`.
+
+Backend contract required by adopters: `POST /bff/account/change-password`,
+body `{ currentPassword, newPassword }` → `204` on success, `400` on
+wrong-current/policy-fail, `401` when unauthenticated.
+
+## 1.14.0 (2026-07-19)
+
+Three defects found by measuring the DEPLOYED portals rather than reading the
+source. All three had passing tests over them.
+
+### Fixed
+
+- **The auth card no longer vertically centres, so expanding anything stops
+  moving the inputs.** Measured on `app.zygos.dloizides.com/login` at 1.13.0:
+  expanding the demo disclosure grew the card 445.6 → 589.6px and pulled the
+  username input from `y=275.2` to `y=203.2` and the password from `y=368.8` to
+  `y=296.8` — **72px UP each**, mid-interaction. `<DemoCredentialsHint>` was
+  deliberately mounted BELOW the form to avoid exactly this; centring defeated
+  the placement, because a centred card re-centres as it grows and drags
+  everything above the growth upward.
+
+  `useAuthScreenStyles.screen` and `useAuthStyles.screen` are now top-anchored
+  (`justifyContent: 'flex-start'` + a 64dp `paddingTop`) instead of centred.
+  ⚠️ **This is a visible change on every portal**: the login card now sits below
+  a fixed gap rather than floating in the middle of tall viewports.
+
+  Chosen over the alternatives because the defect is not specific to the
+  disclosure — ANY growth shifted the fields (a validation error under an input,
+  a passkey button arriving after the config fetch, an OTP tab swap), and only
+  top-anchoring fixes the whole class. Reserving the disclosure's height would
+  have left ~144px of permanent dead space on every login; absolutely
+  positioning the expanded panel would have removed it from the scrollable area,
+  making the credentials unreachable on a short viewport. Top-anchoring is also
+  strictly safer at small viewports than what it replaces: overflow now runs
+  downward only, where centring pushed the top of the card past the top edge
+  where no scroll could reach it.
+
+- **Selection and expansion states are now announced on the web.** Three
+  components declared `accessibilityState` and announced nothing:
+  `<DemoCredentialsHint>` (`expanded`), `<DevicePinLengthPicker>` (`selected`)
+  and `<PreferredMethodSettingsCard>` (`selected`). Each now passes the ARIA
+  attribute **explicitly** (`aria-expanded` / `aria-checked`) alongside the RN
+  prop, which is kept for native.
+
+  Root cause is systemic, not a typo. Measured against react-native-web 0.21.2:
+  a `<TouchableOpacity>` given `accessibilityLabel`, `accessibilityRole`,
+  `accessibilityHint` and `accessibilityState={{ expanded: true, selected: true }}`
+  renders `<button role="button" aria-label="…">` — **no `aria-expanded`, no
+  `aria-selected`, and no trace of the hint at all**. `accessibilityState` is not
+  read by react-native-web; `accessibilityHint` produces zero DOM output.
+
+  For `<DevicePinLengthPicker>` the practical effect was WCAG 1.4.1: the chosen
+  PIN length was distinguishable only by the pill's fill colour. Its options also
+  move from `accessibilityRole="button"` to `"radio"` inside a `radiogroup`,
+  since `aria-checked` is only meaningful on a checkable role.
+
+- **Field labels now speak the shared contract's `field` voice — 13/600, not
+  14/600.** The forms contract (mirrored in `@dloizides/ui-forms`'
+  `labelVariants.ts`) defines exactly two label voices: `field` (13/600, sentence
+  case) and `control` (11/700, uppercase). `defaultAuthTheme.typography.label`
+  was 14, which is neither — drift, inherited uniformly by every portal, since
+  they all reuse `defaultAuthTheme.typography` verbatim. It read against the 13px
+  `Field` labels those same apps use on every non-auth form.
+
+### Tests
+
+- **New DOM-level guards** (`*.dom.test.tsx`), rendered through the real
+  `react-native-web` in a `jsdom` environment, asserting the rendered
+  **attribute** rather than the React prop. This is the point: the pre-existing
+  suite mocked `react-native` down to host strings and asserted
+  `props.accessibilityState` — so it passed, unchanged, against a button that
+  announced nothing in every browser. A prop assertion cannot catch this class of
+  bug, and did not.
+- `authVisualContract.test.ts` guards the two visual contracts by naming the
+  defect they forbid (`justifyContent` must NOT be `'center'`; labels must be
+  13/600 written as a literal, not read back from the token under test).
 
 `<DemoCredentialsHint>` gets a **discreet** presentation, and it is now the
 default. The demo stops competing with the sign-in form on login pages that real

package/dist/index.d.mts

@@ -62,7 +62,21 @@ interface AuthThemeTypography {
     title: number;
     /** Form subtitle. */
     subtitle: number;
-    /** Field labels. */
+    /**
+     * Field labels.
+     *
+     * The shared forms contract ("The TWO legitimate label voices", mirrored in
+     * `@dloizides/ui-forms`' `labelVariants.ts`) defines exactly two: `field` —
+     * 13 / 600 / sentence case, a label that is READ — and `control` — 11 / 700 /
+     * uppercase, a label that is SCANNED. Auth field labels are prose addressed to
+     * the person signing in, so they are the `field` voice: **13**.
+     *
+     * Through 1.13.0 this default was 14, which is neither voice — drift. Every
+     * portal that renders `<LoginForm>` inherits this token (all of them reuse
+     * `defaultAuthTheme.typography` verbatim), so the drift was uniform across
+     * zygos, agora, erevna, katalogos and ichnos, and it read against the 13px
+     * `Field` labels those same apps use on every non-auth form.
+     */
     label: number;
     /** Input text and button text. */
     body: number;
@@ -449,6 +463,50 @@ interface ResetPasswordFormLabels {
 }
 declare const DEFAULT_RESET_PASSWORD_LABELS: ResetPasswordFormLabels;
 
+/**
+ * Strings rendered by `<AccountSettingsScreen>` and its `ChangePasswordCard`.
+ *
+ * As with every auth label bag, the consuming app supplies already-localised
+ * strings; the `DEFAULT_*` English constant lets the screen render with no
+ * `labels` prop and lets an app spread-override only the keys it cares about.
+ */
+/** Strings for the account-settings screen shell + the in-app change-password form. */
+interface AccountSettingsLabels {
+    /** The screen heading above the stacked settings cards. */
+    heading: string;
+    /** Card title. */
+    changePasswordTitle: string;
+    /** Card body copy above the fields. */
+    changePasswordDescription: string;
+    currentPasswordLabel: string;
+    currentPasswordPlaceholder: string;
+    newPasswordLabel: string;
+    newPasswordPlaceholder: string;
+    confirmPasswordLabel: string;
+    confirmPasswordPlaceholder: string;
+    /** Submit button. */
+    submit: string;
+    /** Shown while the submit is in flight. */
+    submitting: string;
+    /** Accessibility hint for the submit button. */
+    submitHint: string;
+    /** Shown after a successful change. */
+    success: string;
+    /** New password fails the shared policy. */
+    errorWeakNewPassword: string;
+    /** New password and confirmation do not match. */
+    errorMismatch: string;
+    /** Current password field left blank. */
+    errorCurrentRequired: string;
+    /** BFF 400 — current password wrong or new one rejected server-side. */
+    errorInvalidCurrent: string;
+    /** BFF 401 — session not authenticated. */
+    errorUnauthorized: string;
+    /** Any other failure. */
+    errorFailed: string;
+}
+declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -1267,6 +1325,175 @@ interface PreferredMethodSettingsCardProps {
 /** Themeable authenticated preferred-method picker. */
 declare function PreferredMethodSettingsCard({ client, availableMethods, theme: themeProp, labels: labelsProp, testIdPrefix, onChanged, }: Readonly<PreferredMethodSettingsCardProps>): ReactElement;
 
+/**
+ * Discriminated result of an authenticated change-password attempt.
+ *
+ * Mirrors the device-PIN result shapes: the client never rejects for an expected
+ * outcome — it resolves one of these so the form routes on the distinct causes
+ * (a wrong current password / policy rejection vs. an expired session vs. an
+ * unexpected error) rather than collapsing them into one opaque failure.
+ */
+type ChangePasswordResult = {
+    status: 'success';
+}
+/** BFF 400 — current password incorrect, or the new password failed the server policy. */
+ | {
+    status: 'invalidCurrent';
+}
+/** BFF 401 — the session is not / no longer authenticated. */
+ | {
+    status: 'unauthorized';
+}
+/** Any other status / transport failure. */
+ | {
+    status: 'error';
+};
+
+/**
+ * The client capability the authenticated change-password form depends on, plus
+ * a ready-made same-origin BFF implementation.
+ *
+ * As with the device-PIN surfaces, the UI depends on a **structural** shape
+ * ({@link ChangePasswordCapableClient}) — exactly one method — so a consuming app
+ * may pass the ready-made client below or a thin hand-rolled object. The ready
+ * client POSTs to the same-origin BFF and maps the response to a
+ * {@link ChangePasswordResult}; it never rejects for an expected outcome.
+ *
+ * SECURITY: the password values live only in the request the end user's OWN
+ * browser sends to their OWN app's BFF over the session cookie. This package
+ * neither stores, logs, nor inspects them — it forwards `currentPassword` /
+ * `newPassword` to the BFF and reads back only a status code.
+ */
+
+/** The request body posted to `POST /bff/account/change-password`. */
+interface ChangePasswordRequest {
+    currentPassword: string;
+    newPassword: string;
+}
+/** The single-method capability the change-password form needs. */
+interface ChangePasswordCapableClient {
+    /** Change the signed-in user's password. Resolves a result; never rejects on an expected outcome. */
+    changePassword(request: ChangePasswordRequest): Promise<ChangePasswordResult>;
+}
+/** Options for {@link createBffChangePasswordClient}. */
+interface CreateBffChangePasswordClientOptions {
+    /**
+     * BFF origin. Omit (the production default) for same-origin — the SPA's own
+     * host is the BFF. An explicit origin is useful only for a non-same-origin BFF
+     * or for tests.
+     */
+    baseUrl?: string;
+    /**
+     * Override the HTTP transport. Defaults to a lazily-resolved native `fetch`
+     * (module load stays side-effect-free, so a `fetch`-less test runtime does not
+     * blow up on import). Tests pass a fake `HttpClient`.
+     */
+    http?: HttpClient;
+}
+/** The BFF endpoint the ready client posts to. */
+declare const CHANGE_PASSWORD_ENDPOINT = "/bff/account/change-password";
+/**
+ * Build a same-origin change-password client. With no arguments this is the exact
+ * production wiring: same-origin, lazy `fetch`, session-cookie auth, the BFF CSRF
+ * marker header attached. A thrown transport error resolves to `{ status: 'error' }`
+ * so the caller never has to catch.
+ */
+declare function createBffChangePasswordClient(options?: CreateBffChangePasswordClientOptions): ChangePasswordCapableClient;
+
+/**
+ * AccountSettingsScreen — the shared, composable authenticated account surface
+ * every dloizides portal can mount to give a signed-in user one place to manage
+ * their account. Self-contained and theme-driven: it stacks a set of independent,
+ * individually-themed cards, each rendered only when its config is supplied.
+ *
+ *  - **Change password** (always) — the in-app `<ChangePasswordCard>` form
+ *    (`POST /bff/account/change-password`). No password value is handled by this
+ *    package beyond forwarding it to the app's own BFF.
+ *  - **Device PIN** (optional) — the existing `<DevicePinSettingsCard>`, so every
+ *    portal gets quick-PIN enable/disable for free.
+ *  - **Passkeys** (optional) — the existing `<PasskeySettingsCard>`.
+ *  - **Preferred sign-in method** (optional) — the existing
+ *    `<PreferredMethodSettingsCard>`.
+ *
+ * Purely presentational assembly: each card owns its own behaviour + hooks (all
+ * react-query-free). The screen only threads the shared `theme` / `testIdPrefix`
+ * down and lays the cards out in a scrollable, centered column.
+ */
+
+/** Device-PIN section config — mirrors `DevicePinSettingsCard` (theme/testIdPrefix threaded by the screen). */
+interface AccountSettingsDevicePinConfig {
+    client: DevicePinEnrollCapableClient & DevicePinDisableCapableClient;
+    initialHasPin: boolean;
+    labels?: Partial<DevicePinSettingsLabels>;
+    enrollLabels?: Partial<DevicePinEnrollLabels>;
+    onChanged?: (hasPin: boolean) => void;
+}
+/** Passkeys section config — mirrors `PasskeySettingsCard`. */
+interface AccountSettingsPasskeysConfig {
+    returnUrl?: string;
+    labels?: Partial<PasskeySettingsLabels>;
+}
+/** Preferred-method section config — mirrors `PreferredMethodSettingsCard`. */
+interface AccountSettingsPreferredMethodConfig {
+    client: PreferredMethodClient;
+    availableMethods: readonly string[];
+    labels?: Partial<PreferredMethodSettingsLabels>;
+    onChanged?: (method: string | null) => void;
+}
+/** Change-password section config. */
+interface AccountSettingsChangePasswordConfig {
+    client: ChangePasswordCapableClient;
+    onChanged?: () => void;
+}
+interface AccountSettingsScreenProps {
+    /** Change-password form config (always rendered). */
+    changePassword: AccountSettingsChangePasswordConfig;
+    /** Device-PIN card config. Omit to hide the section. */
+    devicePin?: AccountSettingsDevicePinConfig;
+    /** Passkeys card config. Omit to hide the section. */
+    passkeys?: AccountSettingsPasskeysConfig;
+    /** Preferred-method card config. Omit to hide the section. */
+    preferredMethod?: AccountSettingsPreferredMethodConfig;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. Threaded to every card. */
+    theme?: AuthTheme;
+    /** Screen + change-password copy (partial; unspecified keys fall back to English). */
+    labels?: Partial<AccountSettingsLabels>;
+    /** Prefix applied to every `testID`, on the screen and every card. */
+    testIdPrefix?: string;
+}
+/** The shared authenticated account-management surface. */
+declare function AccountSettingsScreen({ changePassword, devicePin, passkeys, preferredMethod, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<AccountSettingsScreenProps>): ReactElement;
+
+/**
+ * ChangePasswordCard — an authenticated, in-app "Change password" form.
+ *
+ * The signed-in user types their OWN current + new password in their OWN app;
+ * that is a legitimate first-class feature (no Keycloak-console detour). The card
+ * is purely presentational: all state, validation and submission live in
+ * {@link useChangePassword}, which posts to `POST /bff/account/change-password`
+ * through a {@link ChangePasswordCapableClient}. This package never stores, logs
+ * or inspects the password values — it forwards them to the app's own BFF over
+ * the session cookie and reads back only a status.
+ *
+ * Theme-driven and react-query-free, mirroring `DevicePinSettingsCard` /
+ * `ResetPasswordForm`.
+ */
+
+interface ChangePasswordCardProps {
+    /** The client exposing `changePassword` (see `createBffChangePasswordClient`). */
+    client: ChangePasswordCapableClient;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Localised copy. Partial — unspecified keys fall back to English defaults. */
+    labels?: Partial<AccountSettingsLabels>;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+    /** Called once after a successful password change. */
+    onChanged?: () => void;
+}
+/** Themeable authenticated change-password form. */
+declare function ChangePasswordCard({ client, theme: themeProp, labels: labelsProp, testIdPrefix, onChanged, }: Readonly<ChangePasswordCardProps>): ReactElement;
+
 /**
  * The login-screen "you usually sign in with…" hint (unified-login D5).
  *
@@ -1359,9 +1586,15 @@ declare const enum DemoCredentialsHintVariant {
  *    the same AA-held token as every other piece of helper copy. Discretion is
  *    carried by size, placement and the absence of chrome.
  *  - **It does not hide from assistive tech.** The trigger is a real focusable
- *    button carrying `accessibilityState.expanded`, so a screen reader
- *    announces both that it exists and whether it is open. Visually quiet must
- *    not mean absent — a demo nobody can find is a demo nobody uses.
+ *    button carrying an explicit `aria-expanded` (plus `accessibilityState` for
+ *    native), so a screen reader announces both that it exists and whether it is
+ *    open. Visually quiet must not mean absent — a demo nobody can find is a demo
+ *    nobody uses.
+ *
+ *    ⚠️ Through 1.13.0 this carried ONLY `accessibilityState={{ expanded }}` and
+ *    therefore announced nothing on web: react-native-web 0.21.2 does not read
+ *    `accessibilityState`, so the rendered button had no `aria-expanded` at all.
+ *    The old unit test asserted the React *prop*, so it passed against the bug.
  *
  * ## Layout stability
  *
@@ -1505,6 +1738,14 @@ declare const AuthTestIds: {
     readonly preferredMethodSettingsOption: "auth-preferred-method-settings-option";
     readonly preferredMethodSettingsError: "auth-preferred-method-settings-error";
     readonly preferredMethodHint: "auth-preferred-method-hint";
+    readonly accountSettings: "auth-account-settings";
+    readonly accountSettingsChangePassword: "auth-account-settings-change-password";
+    readonly changePasswordCurrentInput: "auth-change-password-current";
+    readonly changePasswordNewInput: "auth-change-password-new";
+    readonly changePasswordConfirmInput: "auth-change-password-confirm";
+    readonly changePasswordSubmit: "auth-change-password-submit";
+    readonly changePasswordError: "auth-change-password-error";
+    readonly changePasswordSuccess: "auth-change-password-success";
     readonly demoCredentialsHint: "auth-demo-credentials-hint";
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
@@ -2327,4 +2568,50 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+/**
+ * The localizable failure states the authenticated "Change password" form can
+ * show. Client-side validation states never hit the network; the rest map from
+ * the BFF's `POST /bff/account/change-password` response.
+ */
+declare const enum ChangePasswordErrorKey {
+    /** New password is empty / fails the shared password policy (no network call). */
+    WeakNewPassword = "weak_new_password",
+    /** New password and its confirmation do not match (no network call). */
+    Mismatch = "mismatch",
+    /** Current password field was left blank (no network call). */
+    CurrentRequired = "current_required",
+    /** BFF 400 — the current password is wrong, or the new one was rejected server-side. */
+    InvalidCurrent = "invalid_current",
+    /** BFF 401 — the session is not (or no longer) authenticated. */
+    Unauthorized = "unauthorized",
+    /** Any other failure (network / unexpected). */
+    Failed = "failed"
+}
+
+interface UseChangePasswordArgs {
+    /** The client exposing `changePassword`. */
+    client: ChangePasswordCapableClient;
+    /** Called once after a successful change (the form has been cleared by then). */
+    onChanged?: () => void;
+}
+interface UseChangePasswordResult {
+    currentPassword: string;
+    newPassword: string;
+    confirmPassword: string;
+    setCurrentPassword: (value: string) => void;
+    setNewPassword: (value: string) => void;
+    setConfirmPassword: (value: string) => void;
+    /** `true` while a BFF submit is in flight. */
+    submitting: boolean;
+    /** `true` after a successful change (until `reset` / a field edit). */
+    succeeded: boolean;
+    /** The current failure cause, or `null` when there is none. */
+    errorKey: ChangePasswordErrorKey | null;
+    /** Validate then submit. A validation failure sets `errorKey` and skips the network call. */
+    submit: () => void;
+    /** Clear every field + status back to a blank form. */
+    reset: () => void;
+}
+declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
+
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };