@dloizides/auth-web 1.22.0 → 1.23.0

package/dist/index.mjs

@@ -305,7 +305,8 @@ var DEFAULT_RESET_PASSWORD_LABELS = {
   errorWeakPassword: "Use at least 8 characters with an uppercase letter, a lowercase letter and a digit.",
   errorMismatch: "The passwords do not match.",
   errorTokenInvalid: "This reset link is invalid or has expired. Request a new one.",
-  errorNetwork: "Something went wrong. Please try again."
+  errorNetwork: "Something went wrong. Please try again.",
+  errorRateLimited: "Too many attempts. Wait a minute and try again."
 };
 
 // src/components/labels/accountSettingsLabels.ts
@@ -342,6 +343,8 @@ var DEFAULT_REGISTER_LABELS = {
   submitHint: "Creates your account",
   submitting: "Creating account...",
   fullName: field("Your name", "Enter your full name"),
+  checkEmailTitle: "Check your email",
+  checkEmailBody: "If this address can be used, a link to finish signing up is on its way.",
   fields: {
     firstName: field("First name", "Enter your first name"),
     lastName: field("Last name", "Enter your last name"),
@@ -354,6 +357,19 @@ var DEFAULT_REGISTER_LABELS = {
 };
 
 // src/components/labels/verifyEmailLabels.ts
+var DEFAULT_VERIFY_NEW_PASSWORD_LABELS = {
+  ...DEFAULT_RESET_PASSWORD_LABELS,
+  title: "Set a new password",
+  description: "To finish signing in, choose a new password for your account.",
+  submit: "Save and sign in",
+  submitting: "Saving..."
+};
+var DEFAULT_VERIFY_SIGN_IN_LABELS = {
+  title: "Your email is verified",
+  body: "We could not sign you in automatically. Please sign in with your password.",
+  action: "Sign in",
+  actionHint: "Go to the sign in page"
+};
 var DEFAULT_VERIFY_EMAIL_LABELS = {
   loadingTitle: "Verifying your email...",
   loadingHint: "Please wait while we verify your address.",
@@ -375,7 +391,10 @@ var DEFAULT_VERIFY_EMAIL_LABELS = {
   resendMissingEmail: "Enter your email address.",
   resendSubmit: "Send link",
   resendSubmitHint: "Sends a new verification email",
-  resendConfirmation: "If that address has an account, a new verification link is on its way."
+  resendConfirmation: "If that address has an account, a new verification link is on its way.",
+  errorRateLimited: "Too many attempts. Wait a minute and try again.",
+  newPassword: DEFAULT_VERIFY_NEW_PASSWORD_LABELS,
+  signIn: DEFAULT_VERIFY_SIGN_IN_LABELS
 };
 
 // src/components/testIds.ts
@@ -474,6 +493,8 @@ var AuthTestIds = {
   verifyEmailSuccess: "auth-verify-email-success",
   verifyEmailContinue: "auth-verify-email-continue",
   verifyEmailError: "auth-verify-email-error",
+  verifyEmailSignIn: "auth-verify-email-sign-in",
+  verifyEmailSignInContinue: "auth-verify-email-sign-in-continue",
   verifyEmailResendCta: "auth-verify-email-resend-cta",
   verifyEmailResendForm: "auth-verify-email-resend-form",
   verifyEmailResendEmail: "auth-verify-email-resend-email",
@@ -575,6 +596,12 @@ function useAuthStyles(theme) {
         marginTop: spacing.xs,
         color: colors.danger
       },
+      errorBody: {
+        fontSize: typography.body,
+        marginTop: spacing.xs,
+        marginBottom: spacing.md,
+        color: colors.danger
+      },
       successText: {
         fontSize: typography.body,
         lineHeight: typography.body * 1.4,
@@ -1268,8 +1295,107 @@ var ResetPasswordError = /* @__PURE__ */ ((ResetPasswordError2) => {
   ResetPasswordError2["Mismatch"] = "mismatch";
   ResetPasswordError2["TokenInvalid"] = "tokenInvalid";
   ResetPasswordError2["Network"] = "network";
+  ResetPasswordError2["RateLimited"] = "rateLimited";
   return ResetPasswordError2;
 })(ResetPasswordError || {});
+function errorMessage(errorKey, labels) {
+  switch (errorKey) {
+    case "empty" /* Empty */:
+      return labels.errorEmpty;
+    case "weakPassword" /* WeakPassword */:
+      return labels.errorWeakPassword;
+    case "mismatch" /* Mismatch */:
+      return labels.errorMismatch;
+    case "tokenInvalid" /* TokenInvalid */:
+      return labels.errorTokenInvalid;
+    case "network" /* Network */:
+      return labels.errorNetwork;
+    case "rateLimited" /* RateLimited */:
+      return labels.errorRateLimited ?? labels.errorNetwork;
+    default:
+      return null;
+  }
+}
+function ResetPasswordFields({
+  form,
+  labels,
+  styles: styles3,
+  theme,
+  testIdPrefix,
+  newPasswordRef,
+  onSubmitEditing
+}) {
+  const message = errorMessage(form.errorKey, labels);
+  const submitButtonStyle = form.isSubmitting ? [styles3.primaryButton, styles3.primaryButtonDisabled] : styles3.primaryButton;
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx(Text, { style: styles3.title, children: labels.title }),
+    /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.description }),
+    /* @__PURE__ */ jsxs(View, { style: styles3.fieldGroup, children: [
+      /* @__PURE__ */ jsx(Text, { style: styles3.label, children: labels.newPasswordLabel }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          ref: newPasswordRef,
+          secureTextEntry: true,
+          accessibilityHint: labels.newPasswordPlaceholder,
+          accessibilityLabel: labels.newPasswordLabel,
+          autoCapitalize: "none",
+          autoCorrect: false,
+          editable: !form.isSubmitting,
+          placeholder: labels.newPasswordPlaceholder,
+          placeholderTextColor: theme.colors.textSecondary,
+          style: styles3.input,
+          testID: withTestIdPrefix(AuthTestIds.resetPasswordNewInput, testIdPrefix),
+          value: form.newPassword,
+          onChangeText: form.setNewPassword,
+          onSubmitEditing
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs(View, { style: styles3.fieldGroup, children: [
+      /* @__PURE__ */ jsx(Text, { style: styles3.label, children: labels.confirmPasswordLabel }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          secureTextEntry: true,
+          accessibilityHint: labels.confirmPasswordPlaceholder,
+          accessibilityLabel: labels.confirmPasswordLabel,
+          autoCapitalize: "none",
+          autoCorrect: false,
+          editable: !form.isSubmitting,
+          placeholder: labels.confirmPasswordPlaceholder,
+          placeholderTextColor: theme.colors.textSecondary,
+          style: styles3.input,
+          testID: withTestIdPrefix(AuthTestIds.resetPasswordConfirmInput, testIdPrefix),
+          value: form.confirmPassword,
+          onChangeText: form.setConfirmPassword,
+          onSubmitEditing
+        }
+      )
+    ] }),
+    message !== null ? /* @__PURE__ */ jsx(
+      Text,
+      {
+        style: styles3.errorText,
+        testID: withTestIdPrefix(AuthTestIds.resetPasswordError, testIdPrefix),
+        children: message
+      }
+    ) : null,
+    /* @__PURE__ */ jsx(
+      TouchableOpacity,
+      {
+        accessibilityHint: labels.submit,
+        accessibilityLabel: form.isSubmitting ? labels.submitting : labels.submit,
+        accessibilityRole: "button",
+        disabled: form.isSubmitting,
+        style: submitButtonStyle,
+        testID: withTestIdPrefix(AuthTestIds.resetPasswordSubmitButton, testIdPrefix),
+        onPress: form.submit,
+        children: form.isSubmitting ? /* @__PURE__ */ jsx(ActivityIndicator, { color: theme.colors.onPrimary, size: "small" }) : /* @__PURE__ */ jsx(Text, { style: styles3.primaryButtonText, children: labels.submit })
+      }
+    )
+  ] });
+}
 
 // src/password/PasswordPolicyError.ts
 var PasswordPolicyError = /* @__PURE__ */ ((PasswordPolicyError2) => {
@@ -1408,22 +1534,6 @@ function useResetPasswordForm({
     submit
   };
 }
-function errorMessage(errorKey, labels) {
-  switch (errorKey) {
-    case "empty" /* Empty */:
-      return labels.errorEmpty;
-    case "weakPassword" /* WeakPassword */:
-      return labels.errorWeakPassword;
-    case "mismatch" /* Mismatch */:
-      return labels.errorMismatch;
-    case "tokenInvalid" /* TokenInvalid */:
-      return labels.errorTokenInvalid;
-    case "network" /* Network */:
-      return labels.errorNetwork;
-    default:
-      return null;
-  }
-}
 function ResetPasswordForm({
   client,
   token,
@@ -1439,78 +1549,21 @@ function ResetPasswordForm({
     [labelsProp]
   );
   const form = useResetPasswordForm({ client, token, onSuccess });
-  const message = errorMessage(form.errorKey, labels);
-  const submitButtonStyle = form.isSubmitting ? [styles3.primaryButton, styles3.primaryButtonDisabled] : styles3.primaryButton;
-  return /* @__PURE__ */ jsx(View, { style: styles3.screen, children: /* @__PURE__ */ jsxs(
+  return /* @__PURE__ */ jsx(View, { style: styles3.screen, children: /* @__PURE__ */ jsx(
     View,
     {
       style: styles3.card,
       testID: withTestIdPrefix(AuthTestIds.resetPasswordForm, testIdPrefix),
-      children: [
-        /* @__PURE__ */ jsx(Text, { style: styles3.title, children: labels.title }),
-        /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.description }),
-        /* @__PURE__ */ jsxs(View, { style: styles3.fieldGroup, children: [
-          /* @__PURE__ */ jsx(Text, { style: styles3.label, children: labels.newPasswordLabel }),
-          /* @__PURE__ */ jsx(
-            TextInput,
-            {
-              secureTextEntry: true,
-              accessibilityHint: labels.newPasswordPlaceholder,
-              accessibilityLabel: labels.newPasswordLabel,
-              autoCapitalize: "none",
-              autoCorrect: false,
-              editable: !form.isSubmitting,
-              placeholder: labels.newPasswordPlaceholder,
-              placeholderTextColor: theme.colors.textSecondary,
-              style: styles3.input,
-              testID: withTestIdPrefix(AuthTestIds.resetPasswordNewInput, testIdPrefix),
-              value: form.newPassword,
-              onChangeText: form.setNewPassword
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxs(View, { style: styles3.fieldGroup, children: [
-          /* @__PURE__ */ jsx(Text, { style: styles3.label, children: labels.confirmPasswordLabel }),
-          /* @__PURE__ */ jsx(
-            TextInput,
-            {
-              secureTextEntry: true,
-              accessibilityHint: labels.confirmPasswordPlaceholder,
-              accessibilityLabel: labels.confirmPasswordLabel,
-              autoCapitalize: "none",
-              autoCorrect: false,
-              editable: !form.isSubmitting,
-              placeholder: labels.confirmPasswordPlaceholder,
-              placeholderTextColor: theme.colors.textSecondary,
-              style: styles3.input,
-              testID: withTestIdPrefix(AuthTestIds.resetPasswordConfirmInput, testIdPrefix),
-              value: form.confirmPassword,
-              onChangeText: form.setConfirmPassword
-            }
-          )
-        ] }),
-        message !== null ? /* @__PURE__ */ jsx(
-          Text,
-          {
-            style: styles3.errorText,
-            testID: withTestIdPrefix(AuthTestIds.resetPasswordError, testIdPrefix),
-            children: message
-          }
-        ) : null,
-        /* @__PURE__ */ jsx(
-          TouchableOpacity,
-          {
-            accessibilityHint: labels.submit,
-            accessibilityLabel: form.isSubmitting ? labels.submitting : labels.submit,
-            accessibilityRole: "button",
-            disabled: form.isSubmitting,
-            style: submitButtonStyle,
-            testID: withTestIdPrefix(AuthTestIds.resetPasswordSubmitButton, testIdPrefix),
-            onPress: form.submit,
-            children: form.isSubmitting ? /* @__PURE__ */ jsx(ActivityIndicator, { color: theme.colors.onPrimary, size: "small" }) : /* @__PURE__ */ jsx(Text, { style: styles3.primaryButtonText, children: labels.submit })
-          }
-        )
-      ]
+      children: /* @__PURE__ */ jsx(
+        ResetPasswordFields,
+        {
+          form,
+          labels,
+          styles: styles3,
+          testIdPrefix,
+          theme
+        }
+      )
     }
   ) });
 }
@@ -4139,7 +4192,8 @@ var RegisterTestIds = {
   confirmPasswordInput: "register-confirm-password-input",
   tenantNameInput: "register-tenant-name-input",
   submitButton: "register-submit-button",
-  websiteInput: "register-website"
+  websiteInput: "register-website",
+  checkEmail: "register-check-email"
 };
 var FIELDS = [
   { key: "firstName", testId: RegisterTestIds.firstNameInput, autoComplete: "name" },
@@ -4261,6 +4315,14 @@ function routeRegisterOutcome(outcome, handlers) {
   }
 }
 
+// src/hooks/registerAccepted.ts
+function isRegisterAccepted(result) {
+  if (typeof result !== "object" || result === null) {
+    return false;
+  }
+  return result.accepted === true;
+}
+
 // src/hooks/registerErrors.ts
 var MIN_PASSWORD_LENGTH = 8;
 var WHITESPACE_REGEX = /\s/;
@@ -4413,6 +4475,42 @@ function expandCompactRegisterValues(values) {
   };
 }
 
+// src/hooks/newIdempotencyKey.ts
+var HEX_RADIX = 16;
+var HEX_BYTE_LENGTH = 2;
+var KEY_BYTES = 16;
+var fallbackSequence = 0;
+function newIdempotencyKey() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(KEY_BYTES));
+    return Array.from(bytes, (byte) => byte.toString(HEX_RADIX).padStart(HEX_BYTE_LENGTH, "0")).join("");
+  }
+  fallbackSequence += 1;
+  return `${Date.now().toString(HEX_RADIX)}-${String(fallbackSequence)}`;
+}
+
+// src/hooks/useRegisterSubmitMeta.ts
+function useRegisterSubmitMeta() {
+  const openedAt = useRef(Date.now());
+  const key = useRef(null);
+  return useMemo(
+    () => ({
+      next: () => {
+        key.current ?? (key.current = newIdempotencyKey());
+        return { idempotencyKey: key.current, formElapsedMs: Date.now() - openedAt.current };
+      },
+      resetKey: () => {
+        key.current = null;
+      }
+    }),
+    []
+  );
+}
+
 // src/hooks/useRegisterForm.ts
 var EMPTY_VALUES = {
   firstName: "",
@@ -4424,6 +4522,9 @@ var EMPTY_VALUES = {
   tenantName: "",
   website: ""
 };
+function withoutPasswords(values) {
+  return { ...values, password: "", confirmPassword: "" };
+}
 function toSubmitValues(values) {
   return {
     firstName: values.firstName,
@@ -4439,15 +4540,18 @@ function useRegisterForm({
   onSubmit,
   passwordPolicy = isRegisterPasswordStrong,
   onSubmitAttempt,
-  compact = false
+  compact = false,
+  sharedRegistration = false
 }) {
   const [state, setState] = useState(EMPTY_VALUES);
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [error, setError] = useState(null);
   const inFlight = useRef(false);
+  const submitMeta = useRegisterSubmitMeta();
   const setField = useCallback((field2, value) => {
+    submitMeta.resetKey();
     setState((prev) => ({ ...prev, [field2]: value }));
-  }, []);
+  }, [submitMeta]);
   const submit = useCallback(async () => {
     if (inFlight.current) {
       return { ok: false, error: "inFlight" /* InFlight */ };
@@ -4464,7 +4568,11 @@ function useRegisterForm({
     setError(null);
     setIsSubmitting(true);
     try {
-      const result = await onSubmit(toSubmitValues(trimmed));
+      const values = toSubmitValues(trimmed);
+      const result = await (sharedRegistration ? onSubmit(values, submitMeta.next()) : onSubmit(values));
+      if (sharedRegistration && isRegisterAccepted(result)) {
+        setState(withoutPasswords);
+      }
       return { ok: true, result };
     } catch (caught) {
       const code = mapRegisterErrorCode(caught);
@@ -4474,10 +4582,10 @@ function useRegisterForm({
       inFlight.current = false;
       setIsSubmitting(false);
     }
-  }, [compact, onSubmit, onSubmitAttempt, passwordPolicy, state]);
+  }, [compact, onSubmit, onSubmitAttempt, passwordPolicy, sharedRegistration, state, submitMeta]);
   return { state, setField, submit, isSubmitting, error };
 }
-function RegisterForm({
+function RegisterFormCore({
   onSubmit,
   onSuccess,
   onError,
@@ -4487,7 +4595,8 @@ function RegisterForm({
   theme: themeProp,
   footer,
   testIdPrefix,
-  compact = false
+  compact = false,
+  sharedRegistration
 }) {
   const theme = useAuthTheme(themeProp);
   const styles3 = useAuthStyles(theme);
@@ -4499,7 +4608,8 @@ function RegisterForm({
     onSubmit,
     onSubmitAttempt,
     passwordPolicy,
-    compact
+    compact,
+    sharedRegistration
   });
   const handlePress = useCallback(async () => {
     routeRegisterOutcome(await submit(), { onSuccess, onError });
@@ -4537,6 +4647,9 @@ function RegisterForm({
     footer
   ] }) });
 }
+function RegisterForm(props) {
+  return /* @__PURE__ */ jsx(RegisterFormCore, { ...props, sharedRegistration: false });
+}
 async function lazyFetchHttpClient(request) {
   const fetchImpl = typeof fetch === "function" ? fetch.bind(globalThis) : void 0;
   if (fetchImpl === void 0) {
@@ -4672,6 +4785,11 @@ function createBffChangePasswordClient(options = {}) {
     }
   };
 }
+function useFocusOnMount(ref) {
+  useEffect(() => {
+    ref.current?.focus();
+  }, [ref]);
+}
 function useResendVerification({ client, verifyUrlTemplate }) {
   const [email, setEmail] = useState("");
   const [missingEmail, setMissingEmail] = useState(false);
@@ -4691,6 +4809,11 @@ function useResendVerification({ client, verifyUrlTemplate }) {
   }, [client, email, verifyUrlTemplate]);
   return { email, setEmail, missingEmail, submitting, confirmed, submit };
 }
+function ResendConfirmation({ style, testID, text }) {
+  const ref = useRef(null);
+  useFocusOnMount(ref);
+  return /* @__PURE__ */ jsx(View, { ref, accessible: true, accessibilityLiveRegion: "polite", focusable: true, testID, children: /* @__PURE__ */ jsx(Text, { style, children: text }) });
+}
 function VerifyEmailResendForm({
   client,
   labels,
@@ -4702,7 +4825,7 @@ function VerifyEmailResendForm({
   const resend = useResendVerification({ client, verifyUrlTemplate });
   const id = (base) => withTestIdPrefix(base, testIdPrefix);
   if (resend.confirmed) {
-    return /* @__PURE__ */ jsx(Text, { style: styles3.successText, testID: id(AuthTestIds.verifyEmailResendConfirmation), children: labels.resendConfirmation });
+    return /* @__PURE__ */ jsx(ResendConfirmation, { style: styles3.successText, testID: id(AuthTestIds.verifyEmailResendConfirmation), text: labels.resendConfirmation });
   }
   const submit = () => {
     void resend.submit();
@@ -4731,7 +4854,7 @@ function VerifyEmailResendForm({
         }
       )
     ] }),
-    resend.missingEmail ? /* @__PURE__ */ jsx(Text, { style: styles3.errorText, children: labels.resendMissingEmail }) : null,
+    resend.missingEmail ? /* @__PURE__ */ jsx(Text, { style: styles3.errorBody, children: labels.resendMissingEmail }) : null,
     /* @__PURE__ */ jsx(
       TouchableOpacity,
       {
@@ -4755,19 +4878,155 @@ var VerifyEmailErrorCode = /* @__PURE__ */ ((VerifyEmailErrorCode2) => {
   VerifyEmailErrorCode2["TokenUsed"] = "TOKEN_USED";
   VerifyEmailErrorCode2["KeycloakUpdateFailed"] = "KEYCLOAK_UPDATE_FAILED";
   VerifyEmailErrorCode2["MissingToken"] = "MISSING_TOKEN";
+  VerifyEmailErrorCode2["NewPasswordRequired"] = "NEW_PASSWORD_REQUIRED";
+  VerifyEmailErrorCode2["WeakPassword"] = "WEAK_PASSWORD";
+  VerifyEmailErrorCode2["RateLimited"] = "RATE_LIMITED";
+  VerifyEmailErrorCode2["SignInFailed"] = "SIGN_IN_FAILED";
   VerifyEmailErrorCode2["Generic"] = "GENERIC";
   return VerifyEmailErrorCode2;
 })(VerifyEmailErrorCode || {});
 
+// src/verify/useVerifyNewPasswordForm.ts
+var GENERIC_FAILURE = { success: false, errorCode: "GENERIC" /* Generic */ };
+var DEAD_LINK_CODES = [
+  "TOKEN_INVALID" /* TokenInvalid */,
+  "TOKEN_EXPIRED" /* TokenExpired */,
+  "TOKEN_USED" /* TokenUsed */,
+  "SIGN_IN_FAILED" /* SignInFailed */
+];
+function retryableError(code) {
+  if (DEAD_LINK_CODES.includes(code)) {
+    return null;
+  }
+  if (code === "WEAK_PASSWORD" /* WeakPassword */) {
+    return "weakPassword" /* WeakPassword */;
+  }
+  return code === "RATE_LIMITED" /* RateLimited */ ? "rateLimited" /* RateLimited */ : "network" /* Network */;
+}
+function useVerifyNewPasswordForm({
+  client,
+  token,
+  onSettled
+}) {
+  const { state, setters } = useFormState();
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const inFlight = useRef(false);
+  const send = useMemo(
+    () => async (newPassword) => {
+      if (inFlight.current) {
+        return;
+      }
+      inFlight.current = true;
+      setIsSubmitting(true);
+      const result = await (client.setNewPassword?.(token, newPassword) ?? Promise.resolve(GENERIC_FAILURE)).catch(
+        () => GENERIC_FAILURE
+      );
+      inFlight.current = false;
+      setIsSubmitting(false);
+      const formError = result.success ? null : retryableError(result.errorCode);
+      if (formError === null) {
+        onSettled(result);
+        return;
+      }
+      setters.setErrorKey(formError);
+    },
+    [client, onSettled, setters, token]
+  );
+  return {
+    ...state,
+    setNewPassword: setters.setNewPassword,
+    setConfirmPassword: setters.setConfirmPassword,
+    isSubmitting,
+    submit: () => runSubmit({
+      newPassword: state.newPassword,
+      confirmPassword: state.confirmPassword,
+      token,
+      setErrorKey: setters.setErrorKey,
+      setHasInvalidToken: setters.setHasInvalidToken,
+      mutate: (request) => {
+        void send(request.newPassword);
+      }
+    })
+  };
+}
+function VerifyNewPasswordStep({
+  client,
+  token,
+  labels: labelsProp,
+  styles: styles3,
+  theme,
+  testIdPrefix,
+  onSettled
+}) {
+  const labels = useMemo(
+    () => ({ ...DEFAULT_VERIFY_NEW_PASSWORD_LABELS, ...labelsProp }),
+    [labelsProp]
+  );
+  const form = useVerifyNewPasswordForm({ client, token, onSettled });
+  const handleSubmitEditing = useSubmitOnEnter(form.submit);
+  const newPasswordRef = useRef(null);
+  useFocusOnMount(newPasswordRef);
+  return /* @__PURE__ */ jsx(View, { testID: withTestIdPrefix(AuthTestIds.resetPasswordForm, testIdPrefix), children: /* @__PURE__ */ jsx(
+    ResetPasswordFields,
+    {
+      form,
+      labels,
+      newPasswordRef,
+      styles: styles3,
+      testIdPrefix,
+      theme,
+      onSubmitEditing: handleSubmitEditing
+    }
+  ) });
+}
+function VerifySignInPrompt({
+  labels: labelsProp,
+  styles: styles3,
+  testID,
+  actionTestID,
+  onContinue
+}) {
+  const labels = useMemo(() => ({ ...DEFAULT_VERIFY_SIGN_IN_LABELS, ...labelsProp }), [labelsProp]);
+  const actionRef = useRef(null);
+  useFocusOnMount(actionRef);
+  return /* @__PURE__ */ jsxs(View, { testID, children: [
+    /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", style: styles3.title, children: labels.title }),
+    /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.body }),
+    /* @__PURE__ */ jsx(
+      TouchableOpacity,
+      {
+        ref: actionRef,
+        accessibilityHint: labels.actionHint,
+        accessibilityLabel: labels.action,
+        accessibilityRole: "button",
+        style: styles3.primaryButton,
+        testID: actionTestID,
+        onPress: onContinue,
+        children: /* @__PURE__ */ jsx(Text, { style: styles3.primaryButtonText, children: labels.action })
+      }
+    )
+  ] });
+}
+
 // src/verify/VerifyEmailPhase.ts
 var VerifyEmailPhase = /* @__PURE__ */ ((VerifyEmailPhase2) => {
   VerifyEmailPhase2["Loading"] = "loading";
   VerifyEmailPhase2["Success"] = "success";
   VerifyEmailPhase2["Failure"] = "failure";
+  VerifyEmailPhase2["NewPasswordRequired"] = "newPasswordRequired";
   return VerifyEmailPhase2;
 })(VerifyEmailPhase || {});
 
-// src/verify/useVerifyEmail.ts
+// src/verify/resolveVerifyView.ts
+function resolveVerifyView(verify, passwordOutcome) {
+  if (passwordOutcome === null) {
+    return verify;
+  }
+  if (passwordOutcome.success) {
+    return { phase: "success" /* Success */, errorCode: "GENERIC" /* Generic */ };
+  }
+  return { phase: "failure" /* Failure */, errorCode: passwordOutcome.errorCode };
+}
 var LOADING = {
   phase: "loading" /* Loading */,
   errorCode: "GENERIC" /* Generic */
@@ -4776,6 +5035,10 @@ var SUCCESS = {
   phase: "success" /* Success */,
   errorCode: "GENERIC" /* Generic */
 };
+var NEW_PASSWORD_REQUIRED = {
+  phase: "newPasswordRequired" /* NewPasswordRequired */,
+  errorCode: "GENERIC" /* Generic */
+};
 var REJECTED = { success: false, errorCode: "GENERIC" /* Generic */ };
 function failure(errorCode) {
   return { phase: "failure" /* Failure */, errorCode };
@@ -4801,6 +5064,10 @@ function useVerifyEmail({ client, token, onVerified, onFailed }) {
         latest.current.onVerified?.();
         return;
       }
+      if (result.errorCode === "NEW_PASSWORD_REQUIRED" /* NewPasswordRequired */) {
+        setState(NEW_PASSWORD_REQUIRED);
+        return;
+      }
       setState(failure(result.errorCode));
       latest.current.onFailed?.(result.errorCode);
     };
@@ -4826,8 +5093,31 @@ function verifyEmailErrorText(code, labels) {
   if (code === "MISSING_TOKEN" /* MissingToken */) {
     return labels.missingToken;
   }
+  if (code === "SIGN_IN_FAILED" /* SignInFailed */) {
+    return labels.signIn?.body ?? DEFAULT_VERIFY_SIGN_IN_LABELS.body;
+  }
+  if (code === "RATE_LIMITED" /* RateLimited */) {
+    return labels.errorRateLimited ?? labels.errorGeneric;
+  }
   return labels.errorGeneric;
 }
+function ResendCta({ label, hint, style, textStyle, testID, onPress }) {
+  const ref = useRef(null);
+  useFocusOnMount(ref);
+  return /* @__PURE__ */ jsx(
+    TouchableOpacity,
+    {
+      ref,
+      accessibilityHint: hint,
+      accessibilityLabel: label,
+      accessibilityRole: "button",
+      style,
+      testID,
+      onPress,
+      children: /* @__PURE__ */ jsx(Text, { style: textStyle, children: label })
+    }
+  );
+}
 function VerifyEmailScreen({
   client,
   token,
@@ -4845,7 +5135,20 @@ function VerifyEmailScreen({
     () => ({ ...DEFAULT_VERIFY_EMAIL_LABELS, ...labelsProp }),
     [labelsProp]
   );
-  const { phase, errorCode } = useVerifyEmail({ client, token, onVerified, onFailed });
+  const verify = useVerifyEmail({ client, token, onVerified, onFailed });
+  const [passwordOutcome, setPasswordOutcome] = useState(null);
+  const { phase, errorCode } = resolveVerifyView(verify, passwordOutcome);
+  const settlePassword = useCallback(
+    (result) => {
+      setPasswordOutcome(result);
+      if (result.success) {
+        onVerified?.();
+        return;
+      }
+      onFailed?.(result.errorCode);
+    },
+    [onFailed, onVerified]
+  );
   const [resendOpen, setResendOpen] = useState(false);
   const openResend = useCallback(() => setResendOpen(true), []);
   const id = (base) => withTestIdPrefix(base, testIdPrefix);
@@ -4855,6 +5158,18 @@ function VerifyEmailScreen({
       /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", style: styles3.title, children: labels.loadingTitle }),
       /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.loadingHint })
     ] }) : null,
+    phase === "newPasswordRequired" /* NewPasswordRequired */ ? /* @__PURE__ */ jsx(
+      VerifyNewPasswordStep,
+      {
+        client,
+        labels: labels.newPassword,
+        styles: styles3,
+        testIdPrefix,
+        theme,
+        token,
+        onSettled: settlePassword
+      }
+    ) : null,
     phase === "success" /* Success */ ? /* @__PURE__ */ jsxs(View, { testID: id(AuthTestIds.verifyEmailSuccess), children: [
       /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", style: styles3.title, children: labels.successTitle }),
       /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.successBody }),
@@ -4871,9 +5186,19 @@ function VerifyEmailScreen({
         }
       )
     ] }) : null,
-    phase === "failure" /* Failure */ ? /* @__PURE__ */ jsxs(View, { testID: id(AuthTestIds.verifyEmailError), children: [
+    phase === "failure" /* Failure */ && errorCode === "SIGN_IN_FAILED" /* SignInFailed */ ? /* @__PURE__ */ jsx(
+      VerifySignInPrompt,
+      {
+        actionTestID: id(AuthTestIds.verifyEmailSignInContinue),
+        labels: labels.signIn,
+        styles: styles3,
+        testID: id(AuthTestIds.verifyEmailSignIn),
+        onContinue
+      }
+    ) : null,
+    phase === "failure" /* Failure */ && errorCode !== "SIGN_IN_FAILED" /* SignInFailed */ ? /* @__PURE__ */ jsxs(View, { testID: id(AuthTestIds.verifyEmailError), children: [
       /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", style: styles3.title, children: labels.errorTitle }),
-      /* @__PURE__ */ jsx(Text, { style: styles3.errorText, children: verifyEmailErrorText(errorCode, labels) }),
+      /* @__PURE__ */ jsx(Text, { style: styles3.errorBody, children: verifyEmailErrorText(errorCode, labels) }),
       resendOpen ? /* @__PURE__ */ jsx(
         VerifyEmailResendForm,
         {
@@ -4885,15 +5210,14 @@ function VerifyEmailScreen({
           verifyUrlTemplate
         }
       ) : /* @__PURE__ */ jsx(
-        TouchableOpacity,
+        ResendCta,
         {
-          accessibilityHint: labels.resendCtaHint,
-          accessibilityLabel: labels.resendCta,
-          accessibilityRole: "button",
+          hint: labels.resendCtaHint,
+          label: labels.resendCta,
           style: styles3.primaryButton,
           testID: id(AuthTestIds.verifyEmailResendCta),
-          onPress: openResend,
-          children: /* @__PURE__ */ jsx(Text, { style: styles3.primaryButtonText, children: labels.resendCta })
+          textStyle: styles3.primaryButtonText,
+          onPress: openResend
         }
       )
     ] }) : null
@@ -4910,7 +5234,10 @@ var SERVER_ERROR_CODES2 = [
   "TOKEN_USED" /* TokenUsed */,
   "KEYCLOAK_UPDATE_FAILED" /* KeycloakUpdateFailed */
 ];
-var GENERIC_FAILURE = { success: false, errorCode: "GENERIC" /* Generic */ };
+var GENERIC_FAILURE2 = { success: false, errorCode: "GENERIC" /* Generic */ };
+var INVALID_TOKEN = { success: false, errorCode: "TOKEN_INVALID" /* TokenInvalid */ };
+var HTTP_BAD_REQUEST3 = 400;
+var TOKEN_FIELD = "token";
 async function lazyFetchHttpClient3(request) {
   const fetchImpl = typeof fetch === "function" ? fetch.bind(globalThis) : void 0;
   if (fetchImpl === void 0) {
@@ -4924,14 +5251,23 @@ function isServerErrorCode(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
-function decodeVerifyResponse(body) {
+function isTokenValidationRejection(status, body) {
+  if (status !== HTTP_BAD_REQUEST3 || !isRecord3(body.errors)) {
+    return false;
+  }
+  return Object.keys(body.errors).some((field2) => field2.toLowerCase() === TOKEN_FIELD);
+}
+function decodeVerifyResponse(status, body) {
   if (!isRecord3(body)) {
-    return GENERIC_FAILURE;
+    return GENERIC_FAILURE2;
   }
   if (body.success === true) {
     return { success: true };
   }
-  return isServerErrorCode(body.errorCode) ? { success: false, errorCode: body.errorCode } : GENERIC_FAILURE;
+  if (isServerErrorCode(body.errorCode)) {
+    return { success: false, errorCode: body.errorCode };
+  }
+  return isTokenValidationRejection(status, body) ? INVALID_TOKEN : GENERIC_FAILURE2;
 }
 function createBffVerifyEmailClient(options = {}) {
   const http = options.http ?? lazyFetchHttpClient3;
@@ -4947,9 +5283,9 @@ function createBffVerifyEmailClient(options = {}) {
     verifyEmail: async (token) => {
       try {
         const response = await post(VERIFY_EMAIL_ENDPOINT, { token });
-        return decodeVerifyResponse(response.data);
+        return decodeVerifyResponse(response.status, response.data);
       } catch {
-        return GENERIC_FAILURE;
+        return GENERIC_FAILURE2;
       }
     },
     resendVerification: async (email, verifyUrlTemplate) => {
@@ -4989,6 +5325,122 @@ function readVerifyToken(raw) {
   return typeof first === "string" ? first : "";
 }
 
-export { AccountSettingsScreen, AuthScreen, AuthTestIds, AuthThemeProvider, BffAuthStatus, CHANGE_PASSWORD_ENDPOINT, ChangePasswordCard, ChangePasswordErrorKey, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEFAULT_VERIFY_EMAIL_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, DemoCredentialsHintVariant, DevicePinEnrollErrorKey, DevicePinEnrollForm, DevicePinErrorKey, DevicePinInput, DevicePinLengthPicker, DevicePinOffer, DevicePinSettingsCard, DevicePinUnlockScreen, ForgotPasswordFields, ForgotPasswordForm, LoginForm, OtpForm, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, PasskeyLoginButton, PasskeySettingsCard, PasswordPolicyError, PinForm, PreferredMethodHint, PreferredMethodSettingsCard, PrefillIntent, RESEND_VERIFICATION_ENDPOINT, RegisterErrorCode, RegisterForm, RegisterTestIds, ResetPasswordError, ResetPasswordForm, VERIFY_EMAIL_ENDPOINT, VERIFY_TOKEN_PLACEHOLDER, VerifyEmailErrorCode, VerifyEmailPhase, VerifyEmailScreen, buildVerifyUrlTemplate, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createBffVerifyEmailClient, createPreferencesClient, defaultAuthTheme, deriveUsernameFromEmail, isAllowedPinDigits, isPasswordValid, isRegisterPasswordStrong, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, readVerifyToken, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, splitFullName, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResendVerification, useResetPasswordForm, useVerifyEmail, validatePasswordPolicy, verifyEmailErrorText, withTestIdPrefix };
+// src/verify/sharedRegistrationClient.ts
+var REGISTER_ENDPOINT = "/bff/register";
+var VERIFY_AND_LOGIN_ENDPOINT = "/bff/verify-and-login";
+var HTTP_ACCEPTED = 202;
+var HTTP_UNAUTHORIZED2 = 401;
+var HTTP_TOO_MANY_REQUESTS2 = 429;
+var NO_MESSAGE = "";
+var GENERIC_FAILURE3 = { success: false, errorCode: "GENERIC" /* Generic */ };
+function decodeVerifyAndLogin(response) {
+  if (response.ok) {
+    return { success: true };
+  }
+  if (response.status === HTTP_TOO_MANY_REQUESTS2) {
+    return { success: false, errorCode: "RATE_LIMITED" /* RateLimited */ };
+  }
+  if (response.status === HTTP_UNAUTHORIZED2) {
+    return { success: false, errorCode: "SIGN_IN_FAILED" /* SignInFailed */ };
+  }
+  const body = isRecord3(response.data) ? response.data : {};
+  if (body.errorCode === "NEW_PASSWORD_REQUIRED" /* NewPasswordRequired */ || body.errorCode === "WEAK_PASSWORD" /* WeakPassword */) {
+    return { success: false, errorCode: body.errorCode };
+  }
+  return decodeVerifyResponse(response.status, response.data);
+}
+function registerFailure(response) {
+  const body = isRecord3(response.data) ? response.data : {};
+  const errorCode = body.errorCode ?? body.code;
+  const message = `Registration failed with status ${String(response.status)}`;
+  return Object.assign(new Error(message), { status: response.status, errorCode });
+}
+function createSharedRegistrationClient(options = {}) {
+  const http = options.http ?? lazyFetchHttpClient3;
+  const baseUrl = options.baseUrl ?? "";
+  const post = (path, body, headers = {}) => http({
+    url: `${baseUrl}${path}`,
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-BFF-Csrf": "1", ...headers },
+    body: JSON.stringify(body),
+    credentials: "include"
+  });
+  const verifyAndLogin = async (body) => {
+    try {
+      return decodeVerifyAndLogin(await post(VERIFY_AND_LOGIN_ENDPOINT, body));
+    } catch {
+      return GENERIC_FAILURE3;
+    }
+  };
+  const verifyEmailClient = createBffVerifyEmailClient(options);
+  return {
+    register: async (request, meta) => {
+      const body = meta === void 0 ? request : { ...request, formElapsedMs: meta.formElapsedMs };
+      const headers = meta === void 0 ? {} : { "Idempotency-Key": meta.idempotencyKey };
+      const response = await post(REGISTER_ENDPOINT, body, headers).catch(() => {
+        throw new Error(NO_MESSAGE);
+      });
+      if (!response.ok) {
+        throw registerFailure(response);
+      }
+      return { accepted: response.status === HTTP_ACCEPTED, body: response.data };
+    },
+    verifyEmail: (token) => verifyAndLogin({ token }),
+    setNewPassword: (token, newPassword) => verifyAndLogin({ token, newPassword }),
+    resendVerification: (email, verifyUrlTemplate) => verifyEmailClient.resendVerification(email, verifyUrlTemplate)
+  };
+}
+function RegisterCheckEmail({
+  labels,
+  styles: styles3,
+  footer,
+  testIdPrefix
+}) {
+  const headingRef = useRef(null);
+  useFocusOnMount(headingRef);
+  return /* @__PURE__ */ jsx(View, { style: styles3.screen, children: /* @__PURE__ */ jsxs(
+    View,
+    {
+      accessibilityLiveRegion: "polite",
+      style: styles3.card,
+      testID: withTestIdPrefix(RegisterTestIds.checkEmail, testIdPrefix),
+      children: [
+        /* @__PURE__ */ jsx(View, { ref: headingRef, accessible: true, focusable: true, children: /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", style: styles3.title, children: labels.checkEmailTitle }) }),
+        /* @__PURE__ */ jsx(Text, { style: styles3.subtitle, children: labels.checkEmailBody }),
+        footer
+      ]
+    }
+  ) });
+}
+function SharedRegisterForm({
+  onSuccess,
+  onAccepted,
+  ...formProps
+}) {
+  const { footer, labels: labelsProp, testIdPrefix, theme: themeProp } = formProps;
+  const styles3 = useAuthStyles(useAuthTheme(themeProp));
+  const labels = useMemo(
+    () => ({ ...DEFAULT_REGISTER_LABELS, ...labelsProp }),
+    [labelsProp]
+  );
+  const [accepted, setAccepted] = useState(false);
+  const handleResult = useCallback(
+    (result) => {
+      if (!isRegisterAccepted(result)) {
+        onSuccess(result);
+        return;
+      }
+      setAccepted(true);
+      onAccepted?.(result);
+    },
+    [onAccepted, onSuccess]
+  );
+  if (accepted) {
+    return /* @__PURE__ */ jsx(RegisterCheckEmail, { footer, labels, styles: styles3, testIdPrefix });
+  }
+  return /* @__PURE__ */ jsx(RegisterFormCore, { ...formProps, sharedRegistration: true, onSuccess: handleResult });
+}
+
+export { AccountSettingsScreen, AuthScreen, AuthTestIds, AuthThemeProvider, BffAuthStatus, CHANGE_PASSWORD_ENDPOINT, ChangePasswordCard, ChangePasswordErrorKey, DEFAULT_ACCOUNT_SETTINGS_LABELS, DEFAULT_AUTH_CARD_MAX_WIDTH, DEFAULT_DEMO_CREDENTIALS_HINT_LABELS, DEFAULT_DEVICE_PIN_ENROLL_LABELS, DEFAULT_DEVICE_PIN_SETTINGS_LABELS, DEFAULT_DEVICE_PIN_UNLOCK_LABELS, DEFAULT_FORGOT_PASSWORD_FIELDS_LABELS, DEFAULT_FORGOT_PASSWORD_LABELS, DEFAULT_LOGIN_LABELS, DEFAULT_OTP_LABELS, DEFAULT_PASSKEY_LOGIN_LABELS, DEFAULT_PASSKEY_SETTINGS_LABELS, DEFAULT_PIN_LABELS, DEFAULT_PREFERRED_METHOD_HINT_LABELS, DEFAULT_PREFERRED_METHOD_SETTINGS_LABELS, DEFAULT_REGISTER_LABELS, DEFAULT_RESET_PASSWORD_LABELS, DEFAULT_VERIFY_EMAIL_LABELS, DEFAULT_VERIFY_NEW_PASSWORD_LABELS, DEFAULT_VERIFY_SIGN_IN_LABELS, DEVICE_PIN_ALLOWED_DIGITS, DEVICE_PIN_DEFAULT_DIGITS, DemoCredentialsHint, DemoCredentialsHintVariant, DevicePinEnrollErrorKey, DevicePinEnrollForm, DevicePinErrorKey, DevicePinInput, DevicePinLengthPicker, DevicePinOffer, DevicePinSettingsCard, DevicePinUnlockScreen, ForgotPasswordFields, ForgotPasswordForm, LoginForm, OtpForm, OtpLoginStep, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PasskeyCeremonyMode, PasskeyCeremonyStatus, PasskeyLoginButton, PasskeySettingsCard, PasswordPolicyError, PinForm, PreferredMethodHint, PreferredMethodSettingsCard, PrefillIntent, REGISTER_ENDPOINT, RESEND_VERIFICATION_ENDPOINT, RegisterErrorCode, RegisterForm, RegisterTestIds, ResetPasswordError, ResetPasswordForm, SharedRegisterForm, VERIFY_AND_LOGIN_ENDPOINT, VERIFY_EMAIL_ENDPOINT, VERIFY_TOKEN_PLACEHOLDER, VerifyEmailErrorCode, VerifyEmailPhase, VerifyEmailScreen, buildVerifyUrlTemplate, cachePreferredMethod, clearCachedPreferredMethod, collectUserRoles, createBffAuthClient, createBffChangePasswordClient, createBffVerifyEmailClient, createPreferencesClient, createSharedRegistrationClient, defaultAuthTheme, deriveUsernameFromEmail, isAllowedPinDigits, isPasswordValid, isRegisterAccepted, isRegisterPasswordStrong, isValidForgotPasswordEmail, performBffLogout, readCachedPreferredMethod, readPasskeyError, readPasskeyRegistered, readVerifyToken, resolveAccessibleRoutes, resolveAccountList, resolveDemoAccounts, resolveDemoCredentials, resolvePostLoginRoute, splitFullName, startPasskeyLogin, startPasskeyRegistration, syncPreferredMethodFromServer, useAuthTheme, useBffAuth, useBffForgotPassword, useBffLoginConfig, useBffResetPassword, useChangePassword, useDemoCredentials, useDevicePinDisable, useDevicePinEnroll, useDevicePinUnlock, useForgotPasswordSubmit, useOtpLogin, usePasskeyCeremony, usePinLogin, usePreferredMethodSetting, useRegisterForm, useResendVerification, useResetPasswordForm, useVerifyEmail, validatePasswordPolicy, verifyEmailErrorText, withTestIdPrefix };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map