@dloizides/auth-web 1.14.0 → 1.17.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 1.17.0
+
+**Multi-account demo login — the `<DemoCredentialsHint>` now renders one labelled,
+one-tap-fillable row per published demo account.** Additive and
+backward-compatible: a single account renders byte-for-byte as before.
+
+- **`resolveDemoAccounts` / `resolveAccountList`** (new exports) — resolve either
+  the `publishedAccounts` list (from `@dloizides/auth-client` 4.4.0 / a BFF on
+  Bff.AspNetCore 1.17.0+) or a legacy single pair into an ordered, validated
+  `DemoAccount[]`. `resolveDemoCredentials` is unchanged and still exported.
+- **`useDemoCredentials().hintProps`** gains `accounts: DemoAccount[]` (the
+  resolved list). `credentials` is still passed through unchanged, so the field
+  is purely additive; `onUse` fills whichever account the hint reports.
+- **`<DemoCredentialsHint>`** gains an `accounts?` prop (preferred over
+  `credentials` when present). One account → no per-account heading, unsuffixed
+  testIDs (unchanged). Multiple accounts → each gets its label heading and
+  index-suffixed testIDs (`…-username-0`, `…-use-1`, `…-account-label-0`).
+- New testID `demoCredentialsAccountLabel`; new re-exported type `DemoAccount`.
+- Bumps `@dloizides/auth-client` to `^4.4.0` for the `publishedAccounts` type.
+
+## 1.16.0
+
+**New shared `AccountSettingsScreen` — one authenticated account surface for all
+seven portals, plus a first-class in-app change-password form.**
+
+Adds `AccountSettingsScreen`: a self-contained, theme-driven surface that stacks
+the account-management cards each portal was otherwise wiring by hand. Sections
+are config-driven — a card renders only when its config is passed:
+
+- **Change password (always):** a new `ChangePasswordCard` — a real in-app form
+  (current / new / confirm) with client-side validation (new === confirm + the
+  shared password policy) that submits `POST /bff/account/change-password`
+  (204 → success; 400 → "current password incorrect or fails the policy";
+  401 → session expired). The signed-in user changes their OWN password in the
+  app — no Keycloak-console detour. This package never stores, logs or inspects
+  the password values; it forwards them to the app's own BFF over the session
+  cookie and reads back only a status.
+- **Device PIN (optional):** the existing `DevicePinSettingsCard`.
+- **Passkeys (optional):** the existing `PasskeySettingsCard`.
+- **Preferred sign-in method (optional):** the existing `PreferredMethodSettingsCard`.
+
+New public API:
+
+- `AccountSettingsScreen` + `AccountSettingsScreenProps` and the per-section
+  config types (`AccountSettingsChangePasswordConfig`, `AccountSettingsDevicePinConfig`,
+  `AccountSettingsPasskeysConfig`, `AccountSettingsPreferredMethodConfig`).
+- `ChangePasswordCard` + `ChangePasswordCardProps`.
+- `useChangePassword` (react-query-free form state + validation + submit),
+  `ChangePasswordErrorKey`, `ChangePasswordResult`.
+- `createBffChangePasswordClient` (ready same-origin BFF client, CSRF marker
+  header attached) + `ChangePasswordCapableClient` / `ChangePasswordRequest` /
+  `CHANGE_PASSWORD_ENDPOINT` / `CreateBffChangePasswordClientOptions`.
+- `AccountSettingsLabels` + `DEFAULT_ACCOUNT_SETTINGS_LABELS`.
+
+Backend contract required by adopters: `POST /bff/account/change-password`,
+body `{ currentPassword, newPassword }` → `204` on success, `400` on
+wrong-current/policy-fail, `401` when unauthenticated.
+
 ## 1.14.0 (2026-07-19)
 
 Three defects found by measuring the DEPLOYED portals rather than reading the

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { ReactNode, ReactElement } from 'react';
-import { BffAuthClient, BffUser, DemoCredentials, HttpClient, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
-export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
+import { BffAuthClient, BffUser, DemoCredentials, HttpClient, DemoAccount, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
+export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoAccount, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
 import { UseMutationOptions, UseMutationResult } from '@tanstack/react-query';
 
 /**
@@ -463,6 +463,50 @@ interface ResetPasswordFormLabels {
 }
 declare const DEFAULT_RESET_PASSWORD_LABELS: ResetPasswordFormLabels;
 
+/**
+ * Strings rendered by `<AccountSettingsScreen>` and its `ChangePasswordCard`.
+ *
+ * As with every auth label bag, the consuming app supplies already-localised
+ * strings; the `DEFAULT_*` English constant lets the screen render with no
+ * `labels` prop and lets an app spread-override only the keys it cares about.
+ */
+/** Strings for the account-settings screen shell + the in-app change-password form. */
+interface AccountSettingsLabels {
+    /** The screen heading above the stacked settings cards. */
+    heading: string;
+    /** Card title. */
+    changePasswordTitle: string;
+    /** Card body copy above the fields. */
+    changePasswordDescription: string;
+    currentPasswordLabel: string;
+    currentPasswordPlaceholder: string;
+    newPasswordLabel: string;
+    newPasswordPlaceholder: string;
+    confirmPasswordLabel: string;
+    confirmPasswordPlaceholder: string;
+    /** Submit button. */
+    submit: string;
+    /** Shown while the submit is in flight. */
+    submitting: string;
+    /** Accessibility hint for the submit button. */
+    submitHint: string;
+    /** Shown after a successful change. */
+    success: string;
+    /** New password fails the shared policy. */
+    errorWeakNewPassword: string;
+    /** New password and confirmation do not match. */
+    errorMismatch: string;
+    /** Current password field left blank. */
+    errorCurrentRequired: string;
+    /** BFF 400 — current password wrong or new one rejected server-side. */
+    errorInvalidCurrent: string;
+    /** BFF 401 — session not authenticated. */
+    errorUnauthorized: string;
+    /** Any other failure. */
+    errorFailed: string;
+}
+declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -1281,6 +1325,175 @@ interface PreferredMethodSettingsCardProps {
 /** Themeable authenticated preferred-method picker. */
 declare function PreferredMethodSettingsCard({ client, availableMethods, theme: themeProp, labels: labelsProp, testIdPrefix, onChanged, }: Readonly<PreferredMethodSettingsCardProps>): ReactElement;
 
+/**
+ * Discriminated result of an authenticated change-password attempt.
+ *
+ * Mirrors the device-PIN result shapes: the client never rejects for an expected
+ * outcome — it resolves one of these so the form routes on the distinct causes
+ * (a wrong current password / policy rejection vs. an expired session vs. an
+ * unexpected error) rather than collapsing them into one opaque failure.
+ */
+type ChangePasswordResult = {
+    status: 'success';
+}
+/** BFF 400 — current password incorrect, or the new password failed the server policy. */
+ | {
+    status: 'invalidCurrent';
+}
+/** BFF 401 — the session is not / no longer authenticated. */
+ | {
+    status: 'unauthorized';
+}
+/** Any other status / transport failure. */
+ | {
+    status: 'error';
+};
+
+/**
+ * The client capability the authenticated change-password form depends on, plus
+ * a ready-made same-origin BFF implementation.
+ *
+ * As with the device-PIN surfaces, the UI depends on a **structural** shape
+ * ({@link ChangePasswordCapableClient}) — exactly one method — so a consuming app
+ * may pass the ready-made client below or a thin hand-rolled object. The ready
+ * client POSTs to the same-origin BFF and maps the response to a
+ * {@link ChangePasswordResult}; it never rejects for an expected outcome.
+ *
+ * SECURITY: the password values live only in the request the end user's OWN
+ * browser sends to their OWN app's BFF over the session cookie. This package
+ * neither stores, logs, nor inspects them — it forwards `currentPassword` /
+ * `newPassword` to the BFF and reads back only a status code.
+ */
+
+/** The request body posted to `POST /bff/account/change-password`. */
+interface ChangePasswordRequest {
+    currentPassword: string;
+    newPassword: string;
+}
+/** The single-method capability the change-password form needs. */
+interface ChangePasswordCapableClient {
+    /** Change the signed-in user's password. Resolves a result; never rejects on an expected outcome. */
+    changePassword(request: ChangePasswordRequest): Promise<ChangePasswordResult>;
+}
+/** Options for {@link createBffChangePasswordClient}. */
+interface CreateBffChangePasswordClientOptions {
+    /**
+     * BFF origin. Omit (the production default) for same-origin — the SPA's own
+     * host is the BFF. An explicit origin is useful only for a non-same-origin BFF
+     * or for tests.
+     */
+    baseUrl?: string;
+    /**
+     * Override the HTTP transport. Defaults to a lazily-resolved native `fetch`
+     * (module load stays side-effect-free, so a `fetch`-less test runtime does not
+     * blow up on import). Tests pass a fake `HttpClient`.
+     */
+    http?: HttpClient;
+}
+/** The BFF endpoint the ready client posts to. */
+declare const CHANGE_PASSWORD_ENDPOINT = "/bff/account/change-password";
+/**
+ * Build a same-origin change-password client. With no arguments this is the exact
+ * production wiring: same-origin, lazy `fetch`, session-cookie auth, the BFF CSRF
+ * marker header attached. A thrown transport error resolves to `{ status: 'error' }`
+ * so the caller never has to catch.
+ */
+declare function createBffChangePasswordClient(options?: CreateBffChangePasswordClientOptions): ChangePasswordCapableClient;
+
+/**
+ * AccountSettingsScreen — the shared, composable authenticated account surface
+ * every dloizides portal can mount to give a signed-in user one place to manage
+ * their account. Self-contained and theme-driven: it stacks a set of independent,
+ * individually-themed cards, each rendered only when its config is supplied.
+ *
+ *  - **Change password** (always) — the in-app `<ChangePasswordCard>` form
+ *    (`POST /bff/account/change-password`). No password value is handled by this
+ *    package beyond forwarding it to the app's own BFF.
+ *  - **Device PIN** (optional) — the existing `<DevicePinSettingsCard>`, so every
+ *    portal gets quick-PIN enable/disable for free.
+ *  - **Passkeys** (optional) — the existing `<PasskeySettingsCard>`.
+ *  - **Preferred sign-in method** (optional) — the existing
+ *    `<PreferredMethodSettingsCard>`.
+ *
+ * Purely presentational assembly: each card owns its own behaviour + hooks (all
+ * react-query-free). The screen only threads the shared `theme` / `testIdPrefix`
+ * down and lays the cards out in a scrollable, centered column.
+ */
+
+/** Device-PIN section config — mirrors `DevicePinSettingsCard` (theme/testIdPrefix threaded by the screen). */
+interface AccountSettingsDevicePinConfig {
+    client: DevicePinEnrollCapableClient & DevicePinDisableCapableClient;
+    initialHasPin: boolean;
+    labels?: Partial<DevicePinSettingsLabels>;
+    enrollLabels?: Partial<DevicePinEnrollLabels>;
+    onChanged?: (hasPin: boolean) => void;
+}
+/** Passkeys section config — mirrors `PasskeySettingsCard`. */
+interface AccountSettingsPasskeysConfig {
+    returnUrl?: string;
+    labels?: Partial<PasskeySettingsLabels>;
+}
+/** Preferred-method section config — mirrors `PreferredMethodSettingsCard`. */
+interface AccountSettingsPreferredMethodConfig {
+    client: PreferredMethodClient;
+    availableMethods: readonly string[];
+    labels?: Partial<PreferredMethodSettingsLabels>;
+    onChanged?: (method: string | null) => void;
+}
+/** Change-password section config. */
+interface AccountSettingsChangePasswordConfig {
+    client: ChangePasswordCapableClient;
+    onChanged?: () => void;
+}
+interface AccountSettingsScreenProps {
+    /** Change-password form config (always rendered). */
+    changePassword: AccountSettingsChangePasswordConfig;
+    /** Device-PIN card config. Omit to hide the section. */
+    devicePin?: AccountSettingsDevicePinConfig;
+    /** Passkeys card config. Omit to hide the section. */
+    passkeys?: AccountSettingsPasskeysConfig;
+    /** Preferred-method card config. Omit to hide the section. */
+    preferredMethod?: AccountSettingsPreferredMethodConfig;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. Threaded to every card. */
+    theme?: AuthTheme;
+    /** Screen + change-password copy (partial; unspecified keys fall back to English). */
+    labels?: Partial<AccountSettingsLabels>;
+    /** Prefix applied to every `testID`, on the screen and every card. */
+    testIdPrefix?: string;
+}
+/** The shared authenticated account-management surface. */
+declare function AccountSettingsScreen({ changePassword, devicePin, passkeys, preferredMethod, theme: themeProp, labels: labelsProp, testIdPrefix, }: Readonly<AccountSettingsScreenProps>): ReactElement;
+
+/**
+ * ChangePasswordCard — an authenticated, in-app "Change password" form.
+ *
+ * The signed-in user types their OWN current + new password in their OWN app;
+ * that is a legitimate first-class feature (no Keycloak-console detour). The card
+ * is purely presentational: all state, validation and submission live in
+ * {@link useChangePassword}, which posts to `POST /bff/account/change-password`
+ * through a {@link ChangePasswordCapableClient}. This package never stores, logs
+ * or inspects the password values — it forwards them to the app's own BFF over
+ * the session cookie and reads back only a status.
+ *
+ * Theme-driven and react-query-free, mirroring `DevicePinSettingsCard` /
+ * `ResetPasswordForm`.
+ */
+
+interface ChangePasswordCardProps {
+    /** The client exposing `changePassword` (see `createBffChangePasswordClient`). */
+    client: ChangePasswordCapableClient;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Localised copy. Partial — unspecified keys fall back to English defaults. */
+    labels?: Partial<AccountSettingsLabels>;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+    /** Called once after a successful password change. */
+    onChanged?: () => void;
+}
+/** Themeable authenticated change-password form. */
+declare function ChangePasswordCard({ client, theme: themeProp, labels: labelsProp, testIdPrefix, onChanged, }: Readonly<ChangePasswordCardProps>): ReactElement;
+
 /**
  * The login-screen "you usually sign in with…" hint (unified-login D5).
  *
@@ -1396,9 +1609,18 @@ declare const enum DemoCredentialsHintVariant {
 interface DemoCredentialsHintProps {
     /**
      * The demo credentials to advertise. `undefined` — or a pair with a blank
-     * username or password — renders nothing at all.
+     * username or password — renders nothing at all. When {@link accounts} is given
+     * and non-empty it takes precedence; otherwise this single pair is resolved
+     * (and, if it carries a `publishedAccounts` list, expanded) into the rows.
      */
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts to advertise, one labelled row per entry.
+     * Preferred over {@link credentials} when present and non-empty. A single entry
+     * renders exactly like the legacy single-pair panel (no per-account heading).
+     * This is what `useDemoCredentials().hintProps` supplies.
+     */
+    accounts?: DemoAccount[];
     /**
      * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
      * `Panel` for the original always-open block.
@@ -1418,7 +1640,7 @@ interface DemoCredentialsHintProps {
     onUse?: (credentials: DemoCredentials) => void;
 }
 /** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+declare function DemoCredentialsHint({ credentials, accounts, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1525,7 +1747,16 @@ declare const AuthTestIds: {
     readonly preferredMethodSettingsOption: "auth-preferred-method-settings-option";
     readonly preferredMethodSettingsError: "auth-preferred-method-settings-error";
     readonly preferredMethodHint: "auth-preferred-method-hint";
+    readonly accountSettings: "auth-account-settings";
+    readonly accountSettingsChangePassword: "auth-account-settings-change-password";
+    readonly changePasswordCurrentInput: "auth-change-password-current";
+    readonly changePasswordNewInput: "auth-change-password-new";
+    readonly changePasswordConfirmInput: "auth-change-password-confirm";
+    readonly changePasswordSubmit: "auth-change-password-submit";
+    readonly changePasswordError: "auth-change-password-error";
+    readonly changePasswordSuccess: "auth-change-password-success";
     readonly demoCredentialsHint: "auth-demo-credentials-hint";
+    readonly demoCredentialsAccountLabel: "auth-demo-credentials-account-label";
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
@@ -2062,6 +2293,13 @@ interface DemoCredentialsLoginFormProps {
 /** The `<DemoCredentialsHint>` props that carry the credentials + fill action. */
 interface DemoCredentialsHintWiring {
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts (from `publishedAccounts`, else the legacy
+     * single pair wrapped into one). The hint renders one labelled row per entry and
+     * prefers this over {@link credentials} when present. Additive — a hint given only
+     * `credentials` still resolves the same list itself.
+     */
+    accounts: DemoAccount[];
     onUse: (credentials: DemoCredentials) => void;
 }
 /** What {@link useDemoCredentials} hands back. */
@@ -2104,6 +2342,19 @@ declare function useDemoCredentials({ credentials, prefillOnMount, }?: Readonly<
  */
 declare function resolveDemoCredentials(credentials?: DemoCredentials | null): DemoCredentials | null;
 
+/**
+ * Validate a raw list of accounts, dropping any unusable entry. Used by the hint
+ * when a consumer passes an `accounts` prop directly (the hook already routes its
+ * list through here too, so validation happens in exactly one place).
+ */
+declare function resolveAccountList(accounts?: readonly DemoAccount[] | null): DemoAccount[];
+/**
+ * Resolve the ordered list of demo accounts to advertise, from either the new
+ * `publishedAccounts` list or the legacy single pair. Returns `[]` when nothing
+ * is usable — the "render nothing" contract, as a list.
+ */
+declare function resolveDemoAccounts(credentials?: DemoCredentials | null): DemoAccount[];
+
 /**
  * `createBffAuthClient` — the one-line wiring of a same-origin `BffAuthClient`.
  *
@@ -2347,4 +2598,50 @@ declare function validatePasswordPolicy(password: string): PasswordPolicyError[]
 /** `true` when the password satisfies every policy rule. */
 declare function isPasswordValid(password: string): boolean;
 
-export { AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, type CreateBffAuthClientOptions, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+/**
+ * The localizable failure states the authenticated "Change password" form can
+ * show. Client-side validation states never hit the network; the rest map from
+ * the BFF's `POST /bff/account/change-password` response.
+ */
+declare const enum ChangePasswordErrorKey {
+    /** New password is empty / fails the shared password policy (no network call). */
+    WeakNewPassword = "weak_new_password",
+    /** New password and its confirmation do not match (no network call). */
+    Mismatch = "mismatch",
+    /** Current password field was left blank (no network call). */
+    CurrentRequired = "current_required",
+    /** BFF 400 — the current password is wrong, or the new one was rejected server-side. */
+    InvalidCurrent = "invalid_current",
+    /** BFF 401 — the session is not (or no longer) authenticated. */
+    Unauthorized = "unauthorized",
+    /** Any other failure (network / unexpected). */
+    Failed = "failed"
+}
+
+interface UseChangePasswordArgs {
+    /** The client exposing `changePassword`. */
+    client: ChangePasswordCapableClient;
+    /** Called once after a successful change (the form has been cleared by then). */
+    onChanged?: () => void;
+}
+interface UseChangePasswordResult {
+    currentPassword: string;
+    newPassword: string;
+    confirmPassword: string;
+    setCurrentPassword: (value: string) => void;
+    setNewPassword: (value: string) => void;
+    setConfirmPassword: (value: string) => void;
+    /** `true` while a BFF submit is in flight. */
+    submitting: boolean;
+    /** `true` after a successful change (until `reset` / a field edit). */
+    succeeded: boolean;
+    /** The current failure cause, or `null` when there is none. */
+    errorKey: ChangePasswordErrorKey | null;
+    /** Validate then submit. A validation failure sets `errorKey` and skips the network call. */
+    submit: () => void;
+    /** Clear every field + status back to a blank form. */
+    reset: () => void;
+}
+declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
+
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };