@dloizides/auth-web 1.16.0 → 1.18.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.18.0
+
+**Registration form, extracted from katalogos-web and erevna-web.** Additive.
+
+- `<RegisterForm>`: themeable sign-up form with seven fields plus the off-screen `website` honeypot.
+  Props: `onSubmit(values)` (the app builds the request and calls its BFF), `onSuccess(result)`,
+  `onError(code)`, `onSubmitAttempt`, `passwordPolicy`, `labels`, `theme`, `footer`, `testIdPrefix`.
+- `useRegisterForm({ onSubmit, passwordPolicy })` returns `{ state, setField, submit, isSubmitting, error }`.
+  A filled honeypot is refused with `Failed` and no network call; a second press mid-submit returns `InFlight`.
+- `RegisterErrorCode` (const enum) and `mapRegisterErrorCode(error)` decode `USERNAME_TAKEN`, `EMAIL_TAKEN`,
+  `REALM_REQUIRED`, `REALM_INVALID`. No error copy in the package; apps map the code to FM() keys.
+- `RegisterTestIds` keep the unprefixed `register-*` values the E2E suites select on.
+- Also exported: `isRegisterPasswordStrong`, `DEFAULT_REGISTER_LABELS`, the `Register*` types.
+
+## 1.17.0
+
+**Multi-account demo login — the `<DemoCredentialsHint>` now renders one labelled,
+one-tap-fillable row per published demo account.** Additive and
+backward-compatible: a single account renders byte-for-byte as before.
+
+- **`resolveDemoAccounts` / `resolveAccountList`** (new exports) — resolve either
+  the `publishedAccounts` list (from `@dloizides/auth-client` 4.4.0 / a BFF on
+  Bff.AspNetCore 1.17.0+) or a legacy single pair into an ordered, validated
+  `DemoAccount[]`. `resolveDemoCredentials` is unchanged and still exported.
+- **`useDemoCredentials().hintProps`** gains `accounts: DemoAccount[]` (the
+  resolved list). `credentials` is still passed through unchanged, so the field
+  is purely additive; `onUse` fills whichever account the hint reports.
+- **`<DemoCredentialsHint>`** gains an `accounts?` prop (preferred over
+  `credentials` when present). One account → no per-account heading, unsuffixed
+  testIDs (unchanged). Multiple accounts → each gets its label heading and
+  index-suffixed testIDs (`…-username-0`, `…-use-1`, `…-account-label-0`).
+- New testID `demoCredentialsAccountLabel`; new re-exported type `DemoAccount`.
+- Bumps `@dloizides/auth-client` to `^4.4.0` for the `publishedAccounts` type.
+
 ## 1.16.0
 
 **New shared `AccountSettingsScreen` — one authenticated account surface for all

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { ReactNode, ReactElement } from 'react';
-import { BffAuthClient, BffUser, DemoCredentials, HttpClient, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
-export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
+import { BffAuthClient, BffUser, DemoCredentials, HttpClient, DemoAccount, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
+export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoAccount, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
 import { UseMutationOptions, UseMutationResult } from '@tanstack/react-query';
 
 /**
@@ -507,6 +507,94 @@ interface AccountSettingsLabels {
 }
 declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
 
+/**
+ * The discrete failure states the registration flow can report.
+ *
+ * Each member is a stable key the consuming app maps onto a localised message
+ * (`FM('register.usernameTaken')`, …). The package never renders copy for these
+ * itself — it ships no translations.
+ */
+declare const enum RegisterErrorCode {
+    /** A required field (anything but the honeypot) is empty. */
+    MissingFields = "missingFields",
+    /** The email does not look like an address. */
+    InvalidEmail = "invalidEmail",
+    /** The password fails the active password policy. */
+    WeakPassword = "weakPassword",
+    /** The confirm field does not match the password. */
+    PasswordMismatch = "passwordMismatch",
+    /** The server reported `USERNAME_TAKEN`. */
+    UsernameTaken = "usernameTaken",
+    /** The server reported `EMAIL_TAKEN`. */
+    EmailTaken = "emailTaken",
+    /** The server reported `REALM_REQUIRED` or `REALM_INVALID`. */
+    RealmInvalid = "realmInvalid",
+    /** The server rejected the request with an unrecognised message. */
+    ValidationFailed = "validationFailed",
+    /** Generic failure: network error, empty message, or a filled honeypot (never revealed). */
+    Failed = "failed",
+    /** A submit is already running; the second press was ignored. Do not surface it. */
+    InFlight = "inFlight"
+}
+
+/** Every value the registration form holds. */
+interface RegisterFormValues {
+    firstName: string;
+    lastName: string;
+    username: string;
+    email: string;
+    password: string;
+    confirmPassword: string;
+    tenantName: string;
+    /**
+     * Honeypot (bot protection, no external captcha). Rendered as an off-screen,
+     * aria-hidden, non-focusable input a human never fills. A non-empty value
+     * means a bot: the hook refuses silently, and the shared BFF rejects it too
+     * for bots that POST directly. Never part of the required-field check.
+     */
+    website: string;
+}
+type RegisterField = keyof RegisterFormValues;
+/** The fields a human sees (everything except the honeypot). */
+type RegisterInputField = Exclude<RegisterField, 'website'>;
+/**
+ * What `onSubmit` receives: trimmed values with `confirmPassword` dropped. The
+ * honeypot is kept (empty for real users) so the BFF can enforce it as well.
+ */
+type RegisterSubmitValues = Omit<RegisterFormValues, 'confirmPassword'>;
+/** `true` when the password is acceptable. */
+type RegisterPasswordPolicy = (password: string) => boolean;
+type RegisterSubmitOutcome<TResult> = {
+    ok: true;
+    result: TResult;
+} | {
+    ok: false;
+    error: RegisterErrorCode;
+};
+
+/** Copy for one visible registration input. */
+interface RegisterFieldLabels {
+    /** Visible label above the input. */
+    label: string;
+    placeholder: string;
+    /** `accessibilityHint` for the input. */
+    hint: string;
+    /** `accessibilityLabel` for the input. */
+    inputLabel: string;
+}
+/** Strings rendered by `<RegisterForm>`. Error copy is not here: the app maps `RegisterErrorCode`. */
+interface RegisterFormLabels {
+    title: string;
+    subtitle: string;
+    submit: string;
+    /** `accessibilityHint` for the submit button. */
+    submitHint: string;
+    /** `accessibilityLabel` for the submit button while the request runs. */
+    submitting: string;
+    fields: Record<RegisterInputField, RegisterFieldLabels>;
+}
+declare const DEFAULT_REGISTER_LABELS: RegisterFormLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -1609,9 +1697,18 @@ declare const enum DemoCredentialsHintVariant {
 interface DemoCredentialsHintProps {
     /**
      * The demo credentials to advertise. `undefined` — or a pair with a blank
-     * username or password — renders nothing at all.
+     * username or password — renders nothing at all. When {@link accounts} is given
+     * and non-empty it takes precedence; otherwise this single pair is resolved
+     * (and, if it carries a `publishedAccounts` list, expanded) into the rows.
      */
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts to advertise, one labelled row per entry.
+     * Preferred over {@link credentials} when present and non-empty. A single entry
+     * renders exactly like the legacy single-pair panel (no per-account heading).
+     * This is what `useDemoCredentials().hintProps` supplies.
+     */
+    accounts?: DemoAccount[];
     /**
      * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
      * `Panel` for the original always-open block.
@@ -1631,7 +1728,7 @@ interface DemoCredentialsHintProps {
     onUse?: (credentials: DemoCredentials) => void;
 }
 /** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+declare function DemoCredentialsHint({ credentials, accounts, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1747,6 +1844,7 @@ declare const AuthTestIds: {
     readonly changePasswordError: "auth-change-password-error";
     readonly changePasswordSuccess: "auth-change-password-success";
     readonly demoCredentialsHint: "auth-demo-credentials-hint";
+    readonly demoCredentialsAccountLabel: "auth-demo-credentials-account-label";
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
@@ -2283,6 +2381,13 @@ interface DemoCredentialsLoginFormProps {
 /** The `<DemoCredentialsHint>` props that carry the credentials + fill action. */
 interface DemoCredentialsHintWiring {
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts (from `publishedAccounts`, else the legacy
+     * single pair wrapped into one). The hint renders one labelled row per entry and
+     * prefers this over {@link credentials} when present. Additive — a hint given only
+     * `credentials` still resolves the same list itself.
+     */
+    accounts: DemoAccount[];
     onUse: (credentials: DemoCredentials) => void;
 }
 /** What {@link useDemoCredentials} hands back. */
@@ -2325,6 +2430,108 @@ declare function useDemoCredentials({ credentials, prefillOnMount, }?: Readonly<
  */
 declare function resolveDemoCredentials(credentials?: DemoCredentials | null): DemoCredentials | null;
 
+/**
+ * Validate a raw list of accounts, dropping any unusable entry. Used by the hint
+ * when a consumer passes an `accounts` prop directly (the hook already routes its
+ * list through here too, so validation happens in exactly one place).
+ */
+declare function resolveAccountList(accounts?: readonly DemoAccount[] | null): DemoAccount[];
+/**
+ * Resolve the ordered list of demo accounts to advertise, from either the new
+ * `publishedAccounts` list or the legacy single pair. Returns `[]` when nothing
+ * is usable — the "render nothing" contract, as a list.
+ */
+declare function resolveDemoAccounts(credentials?: DemoCredentials | null): DemoAccount[];
+
+/**
+ * `<RegisterForm>` — the ready-made, themeable sign-up form.
+ *
+ * Extracted from the identical katalogos-web and erevna-web register screens.
+ * The app keeps what differs per product: the request it sends (`onSubmit`, which
+ * carries the realm and verify-URL template), where to go afterwards
+ * (`onSuccess`), and the localised copy (`labels`, plus mapping a
+ * `RegisterErrorCode` to a message in `onError`).
+ */
+
+interface RegisterFormProps<TResult> {
+    /** Send the registration (build the request, call the BFF). Throw on failure. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Called with whatever `onSubmit` resolved to. */
+    onSuccess: (result: TResult) => void;
+    /** Called with the failure code; map it to localised copy. */
+    onError?: (error: RegisterErrorCode) => void;
+    /** Called on every submit press, before validation (e.g. a "signup started" event). */
+    onSubmitAttempt?: () => void;
+    /** Password rule. Defaults to `isRegisterPasswordStrong`. */
+    passwordPolicy?: RegisterPasswordPolicy;
+    /** Localised copy. Partial: unspecified top-level keys fall back to English defaults. */
+    labels?: Partial<RegisterFormLabels>;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Rendered under the submit button (e.g. "Already have an account?"). */
+    footer?: ReactNode;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+}
+/** Themeable registration form built on `useRegisterForm`. */
+declare function RegisterForm<TResult>({ onSubmit, onSuccess, onError, onSubmitAttempt, passwordPolicy, labels: labelsProp, theme: themeProp, footer, testIdPrefix, }: Readonly<RegisterFormProps<TResult>>): ReactElement;
+
+/**
+ * `testID` values for `<RegisterForm>`.
+ *
+ * Kept apart from `AuthTestIds` on purpose: these are the unprefixed
+ * `register-*` IDs katalogos-web and erevna-web rendered before the extraction,
+ * and the E2E suites (`E2ETests/shared/testIds.ts`,
+ * `E2ETests/helpers/katalogos-signup-helpers.ts`) already select on them.
+ * Changing a value here breaks those suites.
+ *
+ * `sonarjs/no-hardcoded-passwords` is disabled for this file: it flags the
+ * `passwordInput` keys, but every value here is a UI test ID, not a credential.
+ */
+declare const RegisterTestIds: {
+    readonly form: "register-form";
+    readonly firstNameInput: "register-first-name-input";
+    readonly lastNameInput: "register-last-name-input";
+    readonly usernameInput: "register-username-input";
+    readonly emailInput: "register-email-input";
+    readonly passwordInput: "register-password-input";
+    readonly confirmPasswordInput: "register-confirm-password-input";
+    readonly tenantNameInput: "register-tenant-name-input";
+    readonly submitButton: "register-submit-button";
+    readonly websiteInput: "register-website";
+};
+
+interface UseRegisterFormArgs<TResult> {
+    /** Send the registration. Throw on failure; the message is decoded to a code. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Password rule. Defaults to {@link isRegisterPasswordStrong}. */
+    passwordPolicy?: RegisterPasswordPolicy;
+}
+interface UseRegisterFormResult<TResult> {
+    state: RegisterFormValues;
+    setField: (field: RegisterField, value: string) => void;
+    submit: () => Promise<RegisterSubmitOutcome<TResult>>;
+    isSubmitting: boolean;
+    /** The last failure, cleared when a submit starts. */
+    error: RegisterErrorCode | null;
+}
+/** Headless registration form logic. */
+declare function useRegisterForm<TResult>({ onSubmit, passwordPolicy, }: UseRegisterFormArgs<TResult>): UseRegisterFormResult<TResult>;
+
+/**
+ * Pure registration helpers: trimming, client-side validation and decoding of a
+ * TenantService failure (surfaced by the BFF as a plain error whose message
+ * carries an error-code substring).
+ *
+ * Merged from the katalogos-web and erevna-web `useRegisterForm` copies, which
+ * were identical apart from katalogos' honeypot.
+ */
+
+/** The default password rule: 8+ characters with a letter, a digit and a special character. */
+declare function isRegisterPasswordStrong(password: string): boolean;
+/** Decode a thrown registration failure into a {@link RegisterErrorCode}. */
+declare function mapRegisterErrorCode(error: unknown): RegisterErrorCode;
+
 /**
  * `createBffAuthClient` — the one-line wiring of a same-origin `BffAuthClient`.
  *
@@ -2614,4 +2821,4 @@ interface UseChangePasswordResult {
 }
 declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
 
-export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, RegisterErrorCode, type RegisterField, type RegisterFieldLabels, RegisterForm, type RegisterFormLabels, type RegisterFormProps, type RegisterFormValues, type RegisterInputField, type RegisterPasswordPolicy, type RegisterSubmitOutcome, type RegisterSubmitValues, RegisterTestIds, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseRegisterFormArgs, type UseRegisterFormResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isRegisterPasswordStrong, isValidForgotPasswordEmail, mapRegisterErrorCode, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode, ReactElement } from 'react';
-import { BffAuthClient, BffUser, DemoCredentials, HttpClient, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
-export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
+import { BffAuthClient, BffUser, DemoCredentials, HttpClient, DemoAccount, BffLoginRequest, BffForgotPasswordRequest, BffResetPasswordRequest, BffOtpRequestResult } from '@dloizides/auth-client';
+export { BffAuthClient, BffAuthClientOptions, BffForgotPasswordRequest, BffLoginRequest, BffOtpRequestRequest, BffOtpRequestResult, BffOtpVerifyRequest, BffPinLoginRequest, BffRegisterRequest, BffResetPasswordRequest, BffUser, DemoAccount, DemoCredentials, HttpClient, HttpRequest, HttpResponse, createFetchHttpClient } from '@dloizides/auth-client';
 import { UseMutationOptions, UseMutationResult } from '@tanstack/react-query';
 
 /**
@@ -507,6 +507,94 @@ interface AccountSettingsLabels {
 }
 declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
 
+/**
+ * The discrete failure states the registration flow can report.
+ *
+ * Each member is a stable key the consuming app maps onto a localised message
+ * (`FM('register.usernameTaken')`, …). The package never renders copy for these
+ * itself — it ships no translations.
+ */
+declare const enum RegisterErrorCode {
+    /** A required field (anything but the honeypot) is empty. */
+    MissingFields = "missingFields",
+    /** The email does not look like an address. */
+    InvalidEmail = "invalidEmail",
+    /** The password fails the active password policy. */
+    WeakPassword = "weakPassword",
+    /** The confirm field does not match the password. */
+    PasswordMismatch = "passwordMismatch",
+    /** The server reported `USERNAME_TAKEN`. */
+    UsernameTaken = "usernameTaken",
+    /** The server reported `EMAIL_TAKEN`. */
+    EmailTaken = "emailTaken",
+    /** The server reported `REALM_REQUIRED` or `REALM_INVALID`. */
+    RealmInvalid = "realmInvalid",
+    /** The server rejected the request with an unrecognised message. */
+    ValidationFailed = "validationFailed",
+    /** Generic failure: network error, empty message, or a filled honeypot (never revealed). */
+    Failed = "failed",
+    /** A submit is already running; the second press was ignored. Do not surface it. */
+    InFlight = "inFlight"
+}
+
+/** Every value the registration form holds. */
+interface RegisterFormValues {
+    firstName: string;
+    lastName: string;
+    username: string;
+    email: string;
+    password: string;
+    confirmPassword: string;
+    tenantName: string;
+    /**
+     * Honeypot (bot protection, no external captcha). Rendered as an off-screen,
+     * aria-hidden, non-focusable input a human never fills. A non-empty value
+     * means a bot: the hook refuses silently, and the shared BFF rejects it too
+     * for bots that POST directly. Never part of the required-field check.
+     */
+    website: string;
+}
+type RegisterField = keyof RegisterFormValues;
+/** The fields a human sees (everything except the honeypot). */
+type RegisterInputField = Exclude<RegisterField, 'website'>;
+/**
+ * What `onSubmit` receives: trimmed values with `confirmPassword` dropped. The
+ * honeypot is kept (empty for real users) so the BFF can enforce it as well.
+ */
+type RegisterSubmitValues = Omit<RegisterFormValues, 'confirmPassword'>;
+/** `true` when the password is acceptable. */
+type RegisterPasswordPolicy = (password: string) => boolean;
+type RegisterSubmitOutcome<TResult> = {
+    ok: true;
+    result: TResult;
+} | {
+    ok: false;
+    error: RegisterErrorCode;
+};
+
+/** Copy for one visible registration input. */
+interface RegisterFieldLabels {
+    /** Visible label above the input. */
+    label: string;
+    placeholder: string;
+    /** `accessibilityHint` for the input. */
+    hint: string;
+    /** `accessibilityLabel` for the input. */
+    inputLabel: string;
+}
+/** Strings rendered by `<RegisterForm>`. Error copy is not here: the app maps `RegisterErrorCode`. */
+interface RegisterFormLabels {
+    title: string;
+    subtitle: string;
+    submit: string;
+    /** `accessibilityHint` for the submit button. */
+    submitHint: string;
+    /** `accessibilityLabel` for the submit button while the request runs. */
+    submitting: string;
+    fields: Record<RegisterInputField, RegisterFieldLabels>;
+}
+declare const DEFAULT_REGISTER_LABELS: RegisterFormLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -1609,9 +1697,18 @@ declare const enum DemoCredentialsHintVariant {
 interface DemoCredentialsHintProps {
     /**
      * The demo credentials to advertise. `undefined` — or a pair with a blank
-     * username or password — renders nothing at all.
+     * username or password — renders nothing at all. When {@link accounts} is given
+     * and non-empty it takes precedence; otherwise this single pair is resolved
+     * (and, if it carries a `publishedAccounts` list, expanded) into the rows.
      */
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts to advertise, one labelled row per entry.
+     * Preferred over {@link credentials} when present and non-empty. A single entry
+     * renders exactly like the legacy single-pair panel (no per-account heading).
+     * This is what `useDemoCredentials().hintProps` supplies.
+     */
+    accounts?: DemoAccount[];
     /**
      * Presentation. Defaults to `Disclosure` (one quiet expandable line); pass
      * `Panel` for the original always-open block.
@@ -1631,7 +1728,7 @@ interface DemoCredentialsHintProps {
     onUse?: (credentials: DemoCredentials) => void;
 }
 /** Themeable public-demo credentials surface. Renders `null` when there is no demo. */
-declare function DemoCredentialsHint({ credentials, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
+declare function DemoCredentialsHint({ credentials, accounts, variant, theme: themeProp, labels: labelsProp, testIdPrefix, onUse, }: Readonly<DemoCredentialsHintProps>): ReactElement | null;
 
 /**
  * React context for the `AuthTheme`.
@@ -1747,6 +1844,7 @@ declare const AuthTestIds: {
     readonly changePasswordError: "auth-change-password-error";
     readonly changePasswordSuccess: "auth-change-password-success";
     readonly demoCredentialsHint: "auth-demo-credentials-hint";
+    readonly demoCredentialsAccountLabel: "auth-demo-credentials-account-label";
     readonly demoCredentialsUsername: "auth-demo-credentials-username";
     readonly demoCredentialsPassword: "auth-demo-credentials-password";
     readonly demoCredentialsUseButton: "auth-demo-credentials-use";
@@ -2283,6 +2381,13 @@ interface DemoCredentialsLoginFormProps {
 /** The `<DemoCredentialsHint>` props that carry the credentials + fill action. */
 interface DemoCredentialsHintWiring {
     credentials?: DemoCredentials;
+    /**
+     * The resolved list of demo accounts (from `publishedAccounts`, else the legacy
+     * single pair wrapped into one). The hint renders one labelled row per entry and
+     * prefers this over {@link credentials} when present. Additive — a hint given only
+     * `credentials` still resolves the same list itself.
+     */
+    accounts: DemoAccount[];
     onUse: (credentials: DemoCredentials) => void;
 }
 /** What {@link useDemoCredentials} hands back. */
@@ -2325,6 +2430,108 @@ declare function useDemoCredentials({ credentials, prefillOnMount, }?: Readonly<
  */
 declare function resolveDemoCredentials(credentials?: DemoCredentials | null): DemoCredentials | null;
 
+/**
+ * Validate a raw list of accounts, dropping any unusable entry. Used by the hint
+ * when a consumer passes an `accounts` prop directly (the hook already routes its
+ * list through here too, so validation happens in exactly one place).
+ */
+declare function resolveAccountList(accounts?: readonly DemoAccount[] | null): DemoAccount[];
+/**
+ * Resolve the ordered list of demo accounts to advertise, from either the new
+ * `publishedAccounts` list or the legacy single pair. Returns `[]` when nothing
+ * is usable — the "render nothing" contract, as a list.
+ */
+declare function resolveDemoAccounts(credentials?: DemoCredentials | null): DemoAccount[];
+
+/**
+ * `<RegisterForm>` — the ready-made, themeable sign-up form.
+ *
+ * Extracted from the identical katalogos-web and erevna-web register screens.
+ * The app keeps what differs per product: the request it sends (`onSubmit`, which
+ * carries the realm and verify-URL template), where to go afterwards
+ * (`onSuccess`), and the localised copy (`labels`, plus mapping a
+ * `RegisterErrorCode` to a message in `onError`).
+ */
+
+interface RegisterFormProps<TResult> {
+    /** Send the registration (build the request, call the BFF). Throw on failure. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Called with whatever `onSubmit` resolved to. */
+    onSuccess: (result: TResult) => void;
+    /** Called with the failure code; map it to localised copy. */
+    onError?: (error: RegisterErrorCode) => void;
+    /** Called on every submit press, before validation (e.g. a "signup started" event). */
+    onSubmitAttempt?: () => void;
+    /** Password rule. Defaults to `isRegisterPasswordStrong`. */
+    passwordPolicy?: RegisterPasswordPolicy;
+    /** Localised copy. Partial: unspecified top-level keys fall back to English defaults. */
+    labels?: Partial<RegisterFormLabels>;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Rendered under the submit button (e.g. "Already have an account?"). */
+    footer?: ReactNode;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+}
+/** Themeable registration form built on `useRegisterForm`. */
+declare function RegisterForm<TResult>({ onSubmit, onSuccess, onError, onSubmitAttempt, passwordPolicy, labels: labelsProp, theme: themeProp, footer, testIdPrefix, }: Readonly<RegisterFormProps<TResult>>): ReactElement;
+
+/**
+ * `testID` values for `<RegisterForm>`.
+ *
+ * Kept apart from `AuthTestIds` on purpose: these are the unprefixed
+ * `register-*` IDs katalogos-web and erevna-web rendered before the extraction,
+ * and the E2E suites (`E2ETests/shared/testIds.ts`,
+ * `E2ETests/helpers/katalogos-signup-helpers.ts`) already select on them.
+ * Changing a value here breaks those suites.
+ *
+ * `sonarjs/no-hardcoded-passwords` is disabled for this file: it flags the
+ * `passwordInput` keys, but every value here is a UI test ID, not a credential.
+ */
+declare const RegisterTestIds: {
+    readonly form: "register-form";
+    readonly firstNameInput: "register-first-name-input";
+    readonly lastNameInput: "register-last-name-input";
+    readonly usernameInput: "register-username-input";
+    readonly emailInput: "register-email-input";
+    readonly passwordInput: "register-password-input";
+    readonly confirmPasswordInput: "register-confirm-password-input";
+    readonly tenantNameInput: "register-tenant-name-input";
+    readonly submitButton: "register-submit-button";
+    readonly websiteInput: "register-website";
+};
+
+interface UseRegisterFormArgs<TResult> {
+    /** Send the registration. Throw on failure; the message is decoded to a code. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Password rule. Defaults to {@link isRegisterPasswordStrong}. */
+    passwordPolicy?: RegisterPasswordPolicy;
+}
+interface UseRegisterFormResult<TResult> {
+    state: RegisterFormValues;
+    setField: (field: RegisterField, value: string) => void;
+    submit: () => Promise<RegisterSubmitOutcome<TResult>>;
+    isSubmitting: boolean;
+    /** The last failure, cleared when a submit starts. */
+    error: RegisterErrorCode | null;
+}
+/** Headless registration form logic. */
+declare function useRegisterForm<TResult>({ onSubmit, passwordPolicy, }: UseRegisterFormArgs<TResult>): UseRegisterFormResult<TResult>;
+
+/**
+ * Pure registration helpers: trimming, client-side validation and decoding of a
+ * TenantService failure (surfaced by the BFF as a plain error whose message
+ * carries an error-code substring).
+ *
+ * Merged from the katalogos-web and erevna-web `useRegisterForm` copies, which
+ * were identical apart from katalogos' honeypot.
+ */
+
+/** The default password rule: 8+ characters with a letter, a digit and a special character. */
+declare function isRegisterPasswordStrong(password: string): boolean;
+/** Decode a thrown registration failure into a {@link RegisterErrorCode}. */
+declare function mapRegisterErrorCode(error: unknown): RegisterErrorCode;
+
 /**
  * `createBffAuthClient` — the one-line wiring of a same-origin `BffAuthClient`.
  *
@@ -2614,4 +2821,4 @@ interface UseChangePasswordResult {
 }
 declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
 
-export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, RegisterErrorCode, type RegisterField, type RegisterFieldLabels, RegisterForm, type RegisterFormLabels, type RegisterFormProps, type RegisterFormValues, type RegisterInputField, type RegisterPasswordPolicy, type RegisterSubmitOutcome, type RegisterSubmitValues, RegisterTestIds, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseRegisterFormArgs, type UseRegisterFormResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isRegisterPasswordStrong, isValidForgotPasswordEmail, mapRegisterErrorCode, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };