@dloizides/auth-web 1.17.0 → 1.18.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.18.0
+
+**Registration form, extracted from katalogos-web and erevna-web.** Additive.
+
+- `<RegisterForm>`: themeable sign-up form with seven fields plus the off-screen `website` honeypot.
+  Props: `onSubmit(values)` (the app builds the request and calls its BFF), `onSuccess(result)`,
+  `onError(code)`, `onSubmitAttempt`, `passwordPolicy`, `labels`, `theme`, `footer`, `testIdPrefix`.
+- `useRegisterForm({ onSubmit, passwordPolicy })` returns `{ state, setField, submit, isSubmitting, error }`.
+  A filled honeypot is refused with `Failed` and no network call; a second press mid-submit returns `InFlight`.
+- `RegisterErrorCode` (const enum) and `mapRegisterErrorCode(error)` decode `USERNAME_TAKEN`, `EMAIL_TAKEN`,
+  `REALM_REQUIRED`, `REALM_INVALID`. No error copy in the package; apps map the code to FM() keys.
+- `RegisterTestIds` keep the unprefixed `register-*` values the E2E suites select on.
+- Also exported: `isRegisterPasswordStrong`, `DEFAULT_REGISTER_LABELS`, the `Register*` types.
+
 ## 1.17.0
 
 **Multi-account demo login — the `<DemoCredentialsHint>` now renders one labelled,

package/dist/index.d.mts

@@ -507,6 +507,94 @@ interface AccountSettingsLabels {
 }
 declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
 
+/**
+ * The discrete failure states the registration flow can report.
+ *
+ * Each member is a stable key the consuming app maps onto a localised message
+ * (`FM('register.usernameTaken')`, …). The package never renders copy for these
+ * itself — it ships no translations.
+ */
+declare const enum RegisterErrorCode {
+    /** A required field (anything but the honeypot) is empty. */
+    MissingFields = "missingFields",
+    /** The email does not look like an address. */
+    InvalidEmail = "invalidEmail",
+    /** The password fails the active password policy. */
+    WeakPassword = "weakPassword",
+    /** The confirm field does not match the password. */
+    PasswordMismatch = "passwordMismatch",
+    /** The server reported `USERNAME_TAKEN`. */
+    UsernameTaken = "usernameTaken",
+    /** The server reported `EMAIL_TAKEN`. */
+    EmailTaken = "emailTaken",
+    /** The server reported `REALM_REQUIRED` or `REALM_INVALID`. */
+    RealmInvalid = "realmInvalid",
+    /** The server rejected the request with an unrecognised message. */
+    ValidationFailed = "validationFailed",
+    /** Generic failure: network error, empty message, or a filled honeypot (never revealed). */
+    Failed = "failed",
+    /** A submit is already running; the second press was ignored. Do not surface it. */
+    InFlight = "inFlight"
+}
+
+/** Every value the registration form holds. */
+interface RegisterFormValues {
+    firstName: string;
+    lastName: string;
+    username: string;
+    email: string;
+    password: string;
+    confirmPassword: string;
+    tenantName: string;
+    /**
+     * Honeypot (bot protection, no external captcha). Rendered as an off-screen,
+     * aria-hidden, non-focusable input a human never fills. A non-empty value
+     * means a bot: the hook refuses silently, and the shared BFF rejects it too
+     * for bots that POST directly. Never part of the required-field check.
+     */
+    website: string;
+}
+type RegisterField = keyof RegisterFormValues;
+/** The fields a human sees (everything except the honeypot). */
+type RegisterInputField = Exclude<RegisterField, 'website'>;
+/**
+ * What `onSubmit` receives: trimmed values with `confirmPassword` dropped. The
+ * honeypot is kept (empty for real users) so the BFF can enforce it as well.
+ */
+type RegisterSubmitValues = Omit<RegisterFormValues, 'confirmPassword'>;
+/** `true` when the password is acceptable. */
+type RegisterPasswordPolicy = (password: string) => boolean;
+type RegisterSubmitOutcome<TResult> = {
+    ok: true;
+    result: TResult;
+} | {
+    ok: false;
+    error: RegisterErrorCode;
+};
+
+/** Copy for one visible registration input. */
+interface RegisterFieldLabels {
+    /** Visible label above the input. */
+    label: string;
+    placeholder: string;
+    /** `accessibilityHint` for the input. */
+    hint: string;
+    /** `accessibilityLabel` for the input. */
+    inputLabel: string;
+}
+/** Strings rendered by `<RegisterForm>`. Error copy is not here: the app maps `RegisterErrorCode`. */
+interface RegisterFormLabels {
+    title: string;
+    subtitle: string;
+    submit: string;
+    /** `accessibilityHint` for the submit button. */
+    submitHint: string;
+    /** `accessibilityLabel` for the submit button while the request runs. */
+    submitting: string;
+    fields: Record<RegisterInputField, RegisterFieldLabels>;
+}
+declare const DEFAULT_REGISTER_LABELS: RegisterFormLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -2355,6 +2443,95 @@ declare function resolveAccountList(accounts?: readonly DemoAccount[] | null): D
  */
 declare function resolveDemoAccounts(credentials?: DemoCredentials | null): DemoAccount[];
 
+/**
+ * `<RegisterForm>` — the ready-made, themeable sign-up form.
+ *
+ * Extracted from the identical katalogos-web and erevna-web register screens.
+ * The app keeps what differs per product: the request it sends (`onSubmit`, which
+ * carries the realm and verify-URL template), where to go afterwards
+ * (`onSuccess`), and the localised copy (`labels`, plus mapping a
+ * `RegisterErrorCode` to a message in `onError`).
+ */
+
+interface RegisterFormProps<TResult> {
+    /** Send the registration (build the request, call the BFF). Throw on failure. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Called with whatever `onSubmit` resolved to. */
+    onSuccess: (result: TResult) => void;
+    /** Called with the failure code; map it to localised copy. */
+    onError?: (error: RegisterErrorCode) => void;
+    /** Called on every submit press, before validation (e.g. a "signup started" event). */
+    onSubmitAttempt?: () => void;
+    /** Password rule. Defaults to `isRegisterPasswordStrong`. */
+    passwordPolicy?: RegisterPasswordPolicy;
+    /** Localised copy. Partial: unspecified top-level keys fall back to English defaults. */
+    labels?: Partial<RegisterFormLabels>;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Rendered under the submit button (e.g. "Already have an account?"). */
+    footer?: ReactNode;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+}
+/** Themeable registration form built on `useRegisterForm`. */
+declare function RegisterForm<TResult>({ onSubmit, onSuccess, onError, onSubmitAttempt, passwordPolicy, labels: labelsProp, theme: themeProp, footer, testIdPrefix, }: Readonly<RegisterFormProps<TResult>>): ReactElement;
+
+/**
+ * `testID` values for `<RegisterForm>`.
+ *
+ * Kept apart from `AuthTestIds` on purpose: these are the unprefixed
+ * `register-*` IDs katalogos-web and erevna-web rendered before the extraction,
+ * and the E2E suites (`E2ETests/shared/testIds.ts`,
+ * `E2ETests/helpers/katalogos-signup-helpers.ts`) already select on them.
+ * Changing a value here breaks those suites.
+ *
+ * `sonarjs/no-hardcoded-passwords` is disabled for this file: it flags the
+ * `passwordInput` keys, but every value here is a UI test ID, not a credential.
+ */
+declare const RegisterTestIds: {
+    readonly form: "register-form";
+    readonly firstNameInput: "register-first-name-input";
+    readonly lastNameInput: "register-last-name-input";
+    readonly usernameInput: "register-username-input";
+    readonly emailInput: "register-email-input";
+    readonly passwordInput: "register-password-input";
+    readonly confirmPasswordInput: "register-confirm-password-input";
+    readonly tenantNameInput: "register-tenant-name-input";
+    readonly submitButton: "register-submit-button";
+    readonly websiteInput: "register-website";
+};
+
+interface UseRegisterFormArgs<TResult> {
+    /** Send the registration. Throw on failure; the message is decoded to a code. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Password rule. Defaults to {@link isRegisterPasswordStrong}. */
+    passwordPolicy?: RegisterPasswordPolicy;
+}
+interface UseRegisterFormResult<TResult> {
+    state: RegisterFormValues;
+    setField: (field: RegisterField, value: string) => void;
+    submit: () => Promise<RegisterSubmitOutcome<TResult>>;
+    isSubmitting: boolean;
+    /** The last failure, cleared when a submit starts. */
+    error: RegisterErrorCode | null;
+}
+/** Headless registration form logic. */
+declare function useRegisterForm<TResult>({ onSubmit, passwordPolicy, }: UseRegisterFormArgs<TResult>): UseRegisterFormResult<TResult>;
+
+/**
+ * Pure registration helpers: trimming, client-side validation and decoding of a
+ * TenantService failure (surfaced by the BFF as a plain error whose message
+ * carries an error-code substring).
+ *
+ * Merged from the katalogos-web and erevna-web `useRegisterForm` copies, which
+ * were identical apart from katalogos' honeypot.
+ */
+
+/** The default password rule: 8+ characters with a letter, a digit and a special character. */
+declare function isRegisterPasswordStrong(password: string): boolean;
+/** Decode a thrown registration failure into a {@link RegisterErrorCode}. */
+declare function mapRegisterErrorCode(error: unknown): RegisterErrorCode;
+
 /**
  * `createBffAuthClient` — the one-line wiring of a same-origin `BffAuthClient`.
  *
@@ -2644,4 +2821,4 @@ interface UseChangePasswordResult {
 }
 declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
 
-export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, RegisterErrorCode, type RegisterField, type RegisterFieldLabels, RegisterForm, type RegisterFormLabels, type RegisterFormProps, type RegisterFormValues, type RegisterInputField, type RegisterPasswordPolicy, type RegisterSubmitOutcome, type RegisterSubmitValues, RegisterTestIds, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseRegisterFormArgs, type UseRegisterFormResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isRegisterPasswordStrong, isValidForgotPasswordEmail, mapRegisterErrorCode, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };

package/dist/index.d.ts

@@ -507,6 +507,94 @@ interface AccountSettingsLabels {
 }
 declare const DEFAULT_ACCOUNT_SETTINGS_LABELS: AccountSettingsLabels;
 
+/**
+ * The discrete failure states the registration flow can report.
+ *
+ * Each member is a stable key the consuming app maps onto a localised message
+ * (`FM('register.usernameTaken')`, …). The package never renders copy for these
+ * itself — it ships no translations.
+ */
+declare const enum RegisterErrorCode {
+    /** A required field (anything but the honeypot) is empty. */
+    MissingFields = "missingFields",
+    /** The email does not look like an address. */
+    InvalidEmail = "invalidEmail",
+    /** The password fails the active password policy. */
+    WeakPassword = "weakPassword",
+    /** The confirm field does not match the password. */
+    PasswordMismatch = "passwordMismatch",
+    /** The server reported `USERNAME_TAKEN`. */
+    UsernameTaken = "usernameTaken",
+    /** The server reported `EMAIL_TAKEN`. */
+    EmailTaken = "emailTaken",
+    /** The server reported `REALM_REQUIRED` or `REALM_INVALID`. */
+    RealmInvalid = "realmInvalid",
+    /** The server rejected the request with an unrecognised message. */
+    ValidationFailed = "validationFailed",
+    /** Generic failure: network error, empty message, or a filled honeypot (never revealed). */
+    Failed = "failed",
+    /** A submit is already running; the second press was ignored. Do not surface it. */
+    InFlight = "inFlight"
+}
+
+/** Every value the registration form holds. */
+interface RegisterFormValues {
+    firstName: string;
+    lastName: string;
+    username: string;
+    email: string;
+    password: string;
+    confirmPassword: string;
+    tenantName: string;
+    /**
+     * Honeypot (bot protection, no external captcha). Rendered as an off-screen,
+     * aria-hidden, non-focusable input a human never fills. A non-empty value
+     * means a bot: the hook refuses silently, and the shared BFF rejects it too
+     * for bots that POST directly. Never part of the required-field check.
+     */
+    website: string;
+}
+type RegisterField = keyof RegisterFormValues;
+/** The fields a human sees (everything except the honeypot). */
+type RegisterInputField = Exclude<RegisterField, 'website'>;
+/**
+ * What `onSubmit` receives: trimmed values with `confirmPassword` dropped. The
+ * honeypot is kept (empty for real users) so the BFF can enforce it as well.
+ */
+type RegisterSubmitValues = Omit<RegisterFormValues, 'confirmPassword'>;
+/** `true` when the password is acceptable. */
+type RegisterPasswordPolicy = (password: string) => boolean;
+type RegisterSubmitOutcome<TResult> = {
+    ok: true;
+    result: TResult;
+} | {
+    ok: false;
+    error: RegisterErrorCode;
+};
+
+/** Copy for one visible registration input. */
+interface RegisterFieldLabels {
+    /** Visible label above the input. */
+    label: string;
+    placeholder: string;
+    /** `accessibilityHint` for the input. */
+    hint: string;
+    /** `accessibilityLabel` for the input. */
+    inputLabel: string;
+}
+/** Strings rendered by `<RegisterForm>`. Error copy is not here: the app maps `RegisterErrorCode`. */
+interface RegisterFormLabels {
+    title: string;
+    subtitle: string;
+    submit: string;
+    /** `accessibilityHint` for the submit button. */
+    submitHint: string;
+    /** `accessibilityLabel` for the submit button while the request runs. */
+    submitting: string;
+    fields: Record<RegisterInputField, RegisterFieldLabels>;
+}
+declare const DEFAULT_REGISTER_LABELS: RegisterFormLabels;
+
 /**
  * Who asked for a prefill — the difference between "the user requested this" and
  * "the app offered it".
@@ -2355,6 +2443,95 @@ declare function resolveAccountList(accounts?: readonly DemoAccount[] | null): D
  */
 declare function resolveDemoAccounts(credentials?: DemoCredentials | null): DemoAccount[];
 
+/**
+ * `<RegisterForm>` — the ready-made, themeable sign-up form.
+ *
+ * Extracted from the identical katalogos-web and erevna-web register screens.
+ * The app keeps what differs per product: the request it sends (`onSubmit`, which
+ * carries the realm and verify-URL template), where to go afterwards
+ * (`onSuccess`), and the localised copy (`labels`, plus mapping a
+ * `RegisterErrorCode` to a message in `onError`).
+ */
+
+interface RegisterFormProps<TResult> {
+    /** Send the registration (build the request, call the BFF). Throw on failure. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Called with whatever `onSubmit` resolved to. */
+    onSuccess: (result: TResult) => void;
+    /** Called with the failure code; map it to localised copy. */
+    onError?: (error: RegisterErrorCode) => void;
+    /** Called on every submit press, before validation (e.g. a "signup started" event). */
+    onSubmitAttempt?: () => void;
+    /** Password rule. Defaults to `isRegisterPasswordStrong`. */
+    passwordPolicy?: RegisterPasswordPolicy;
+    /** Localised copy. Partial: unspecified top-level keys fall back to English defaults. */
+    labels?: Partial<RegisterFormLabels>;
+    /** Explicit theme; overrides any `<AuthThemeProvider>`. */
+    theme?: AuthTheme;
+    /** Rendered under the submit button (e.g. "Already have an account?"). */
+    footer?: ReactNode;
+    /** Prefix applied to every `testID`. */
+    testIdPrefix?: string;
+}
+/** Themeable registration form built on `useRegisterForm`. */
+declare function RegisterForm<TResult>({ onSubmit, onSuccess, onError, onSubmitAttempt, passwordPolicy, labels: labelsProp, theme: themeProp, footer, testIdPrefix, }: Readonly<RegisterFormProps<TResult>>): ReactElement;
+
+/**
+ * `testID` values for `<RegisterForm>`.
+ *
+ * Kept apart from `AuthTestIds` on purpose: these are the unprefixed
+ * `register-*` IDs katalogos-web and erevna-web rendered before the extraction,
+ * and the E2E suites (`E2ETests/shared/testIds.ts`,
+ * `E2ETests/helpers/katalogos-signup-helpers.ts`) already select on them.
+ * Changing a value here breaks those suites.
+ *
+ * `sonarjs/no-hardcoded-passwords` is disabled for this file: it flags the
+ * `passwordInput` keys, but every value here is a UI test ID, not a credential.
+ */
+declare const RegisterTestIds: {
+    readonly form: "register-form";
+    readonly firstNameInput: "register-first-name-input";
+    readonly lastNameInput: "register-last-name-input";
+    readonly usernameInput: "register-username-input";
+    readonly emailInput: "register-email-input";
+    readonly passwordInput: "register-password-input";
+    readonly confirmPasswordInput: "register-confirm-password-input";
+    readonly tenantNameInput: "register-tenant-name-input";
+    readonly submitButton: "register-submit-button";
+    readonly websiteInput: "register-website";
+};
+
+interface UseRegisterFormArgs<TResult> {
+    /** Send the registration. Throw on failure; the message is decoded to a code. */
+    onSubmit: (values: RegisterSubmitValues) => Promise<TResult>;
+    /** Password rule. Defaults to {@link isRegisterPasswordStrong}. */
+    passwordPolicy?: RegisterPasswordPolicy;
+}
+interface UseRegisterFormResult<TResult> {
+    state: RegisterFormValues;
+    setField: (field: RegisterField, value: string) => void;
+    submit: () => Promise<RegisterSubmitOutcome<TResult>>;
+    isSubmitting: boolean;
+    /** The last failure, cleared when a submit starts. */
+    error: RegisterErrorCode | null;
+}
+/** Headless registration form logic. */
+declare function useRegisterForm<TResult>({ onSubmit, passwordPolicy, }: UseRegisterFormArgs<TResult>): UseRegisterFormResult<TResult>;
+
+/**
+ * Pure registration helpers: trimming, client-side validation and decoding of a
+ * TenantService failure (surfaced by the BFF as a plain error whose message
+ * carries an error-code substring).
+ *
+ * Merged from the katalogos-web and erevna-web `useRegisterForm` copies, which
+ * were identical apart from katalogos' honeypot.
+ */
+
+/** The default password rule: 8+ characters with a letter, a digit and a special character. */
+declare function isRegisterPasswordStrong(password: string): boolean;
+/** Decode a thrown registration failure into a {@link RegisterErrorCode}. */
+declare function mapRegisterErrorCode(error: unknown): RegisterErrorCode;
+
 /**
  * `createBffAuthClient` — the one-line wiring of a same-origin `BffAuthClient`.
  *
@@ -2644,4 +2821,4 @@ interface UseChangePasswordResult {
 }
 declare function useChangePassword({ client, onChanged, }: UseChangePasswordArgs): UseChangePasswordResult;
 
-export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };
+export { type AccountSettingsChangePasswordConfig, type AccountSettingsDevicePinConfig, type AccountSettingsLabels, type AccountSettingsPasskeysConfig, type AccountSettingsPreferredMethodConfig, AccountSettingsScreen, type AccountSettingsScreenProps, AuthScreen, type AuthScreenProps, AuthTestIds, type AuthTheme, type AuthThemeColors, AuthThemeProvider, type AuthThemeProviderProps, type AuthThemeRadii, type AuthThemeSpacing, type AuthThemeTypography, BffAuthStatus, type BffDeviceState, type BffLoginConfig, type BffLogoutClient, CHANGE_PASSWORD_ENDPOINT, type ChangePasswordCapableClient, ChangePasswordCard, type ChangePasswordCardProps, ChangePasswordErrorKey, type ChangePasswordRequest, type ChangePasswordResult, type CreateBffAuthClientOptions, type CreateBffChangePasswordClientOptions, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, type DemoCredentialsHintLabels, type DemoCredentialsHintProps, DemoCredentialsHintVariant, type DemoCredentialsHintWiring, type DemoCredentialsLoginFormProps, type DevicePinCapableClient, type DevicePinDisableCapableClient, type DevicePinEnrollCapableClient, DevicePinEnrollErrorKey, DevicePinEnrollForm, type DevicePinEnrollFormProps, type DevicePinEnrollLabels, type DevicePinEnrollResult, DevicePinErrorKey, DevicePinInput, type DevicePinInputProps, DevicePinLengthPicker, type DevicePinLengthPickerProps, DevicePinOffer, type DevicePinOfferProps, DevicePinSettingsCard, type DevicePinSettingsCardProps, type DevicePinSettingsLabels, type DevicePinUnlockCapableClient, type DevicePinUnlockLabels, type DevicePinUnlockResult, DevicePinUnlockScreen, type DevicePinUnlockScreenProps, type DevicePinUnlockedUser, ForgotPasswordFields, type ForgotPasswordFieldsLabels, type ForgotPasswordFieldsProps, ForgotPasswordForm, type ForgotPasswordFormLabels, type ForgotPasswordFormProps, type LoginConfigCapableClient, LoginForm, type LoginFormLabels, type LoginFormProps, OtpForm, type OtpFormLabels, type OtpFormProps, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, type PasskeyErrorCode, PasskeyLoginButton, type PasskeyLoginButtonProps, type PasskeyLoginLabels, PasskeySettingsCard, type PasskeySettingsCardProps, type PasskeySettingsLabels, PasswordPolicyError, type PerformBffLogoutOptions, PinForm, type PinFormLabels, type PinFormProps, type PreferencesClientOptions, type PreferredMethodClient, PreferredMethodHint, type PreferredMethodHintLabels, type PreferredMethodHintProps, PreferredMethodSettingsCard, type PreferredMethodSettingsCardProps, type PreferredMethodSettingsLabels, PrefillIntent, RegisterErrorCode, type RegisterField, type RegisterFieldLabels, RegisterForm, type RegisterFormLabels, type RegisterFormProps, type RegisterFormValues, type RegisterInputField, type RegisterPasswordPolicy, type RegisterSubmitOutcome, type RegisterSubmitValues, RegisterTestIds, ResetPasswordError, ResetPasswordForm, type ResetPasswordFormLabels, type ResetPasswordFormProps, type RoleRoute, type RoleRouteTable, type UseBffAuthOptions, type UseBffAuthResult, type UseBffForgotPasswordOptions, type UseBffLoginConfigResult, type UseBffResetPasswordOptions, type UseChangePasswordArgs, type UseChangePasswordResult, type UseDemoCredentialsOptions, type UseDemoCredentialsResult, type UseDevicePinDisableArgs, type UseDevicePinDisableResult, type UseDevicePinEnrollArgs, type UseDevicePinEnrollResult, type UseDevicePinUnlockArgs, type UseDevicePinUnlockResult, type UseForgotPasswordSubmitArgs, type UseForgotPasswordSubmitResult, type UseOtpLoginOptions, type UseOtpLoginResult, type UsePasskeyCeremonyOptions, type UsePasskeyCeremonyResult, type UsePinLoginOptions, type UsePinLoginResult, type UsePreferredMethodSettingArgs, type UsePreferredMethodSettingResult, type UseRegisterFormArgs, type UseRegisterFormResult, type UseResetPasswordFormArgs, type UseResetPasswordFormResult, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createPreferencesClient, defaultAuthTheme, isAllowedPinDigits, isPasswordValid, isRegisterPasswordStrong, isValidForgotPasswordEmail, mapRegisterErrorCode, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResetPasswordForm, validatePasswordPolicy, withTestIdPrefix };