@luminaryworks/auth-react 0.4.4 → 0.5.0

package/dist/index.js

@@ -1,4 +1,4 @@
-(function(){if(typeof document==="undefined")return;var id="lw-auth-react-headless-login";if(document.getElementById(id))return;var s=document.createElement("style");s.id=id;s.textContent="/* src/HeadlessLoginPanel.module.scss */\n.HeadlessLoginPanel_module_panel {\n  --lw-auth-theme: #1677ff;\n  --lw-auth-theme-deep: color-mix(in srgb, var(--lw-auth-theme) 72%, #000);\n  width: min(100%, 400px);\n  padding: 28px 28px 22px;\n  border-radius: 16px;\n  background: rgba(255, 255, 255, 0.96);\n  color: #14212b;\n  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);\n  font-family:\n    \"Segoe UI\",\n    \"PingFang SC\",\n    \"Noto Sans SC\",\n    sans-serif;\n}\n.HeadlessLoginPanel_module_brand {\n  display: flex;\n  gap: 14px;\n  align-items: center;\n  margin-bottom: 12px;\n}\n.HeadlessLoginPanel_module_logo {\n  border-radius: 12px;\n  display: block;\n}\n.HeadlessLoginPanel_module_product {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 650;\n  letter-spacing: 0.04em;\n  text-transform: uppercase;\n  color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_title {\n  margin: 2px 0 0;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n}\n.HeadlessLoginPanel_module_subtitle {\n  margin: 0 0 18px;\n  font-size: 14px;\n  line-height: 1.5;\n  color: #4b5c68;\n}\n.HeadlessLoginPanel_module_form {\n  display: grid;\n  gap: 10px;\n}\n.HeadlessLoginPanel_module_socialStack {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 10px;\n  font-size: 12px;\n}\n.HeadlessLoginPanel_module_input {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid #c9d5de;\n  border-radius: 10px;\n  padding: 10px 12px;\n  font-size: 14px;\n  outline: none;\n  background: #f7fafc;\n}\n.HeadlessLoginPanel_module_input:focus {\n  border-color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_input:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_passwordField {\n  position: relative;\n  display: flex;\n  align-items: center;\n}\n.HeadlessLoginPanel_module_passwordInput {\n  padding-right: 42px;\n}\n.HeadlessLoginPanel_module_passwordToggle {\n  position: absolute;\n  right: 4px;\n  top: 50%;\n  transform: translateY(-50%);\n  z-index: 1;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 36px;\n  height: 36px;\n  border: none;\n  border-radius: 4px;\n  padding: 0;\n  color: #5a6b76;\n  background: transparent;\n  cursor: pointer;\n}\n.HeadlessLoginPanel_module_passwordToggle:hover:not(:disabled) {\n  color: var(--lw-auth-theme);\n  background: color-mix(in srgb, var(--lw-auth-theme) 12%, transparent);\n}\n.HeadlessLoginPanel_module_passwordToggle:focus-visible {\n  outline: 2px solid var(--lw-auth-theme);\n  outline-offset: 1px;\n}\n.HeadlessLoginPanel_module_passwordToggle:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_primaryBtn {\n  border: none;\n  border-radius: 10px;\n  padding: 11px 14px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #fff;\n  background:\n    linear-gradient(\n      135deg,\n      var(--lw-auth-theme) 0%,\n      var(--lw-auth-theme-deep) 100%);\n}\n.HeadlessLoginPanel_module_primaryBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialBtn {\n  flex: 1 1 calc(50% - 5px);\n  min-width: min(140px, 100%);\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  gap: 8px;\n  border: 1px solid #b7c9d4;\n  border-radius: 10px;\n  padding: 11px 10px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #14212b;\n  background: #fff;\n}\n.HeadlessLoginPanel_module_socialBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialLogo {\n  flex-shrink: 0;\n  display: block;\n}\n.HeadlessLoginPanel_module_logoFallback {\n  width: 18px;\n  height: 18px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--lw-auth-theme) 14%, #fff);\n  color: var(--lw-auth-theme-deep);\n  font-size: 11px;\n  font-weight: 700;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  flex-shrink: 0;\n}\n.HeadlessLoginPanel_module_cancelBtn {\n  margin-top: 10px;\n  width: 100%;\n  border: none;\n  background: transparent;\n  color: #5a6b76;\n  font-size: 13px;\n  cursor: pointer;\n  padding: 8px;\n}\n.HeadlessLoginPanel_module_cancelBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_divider {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 14px 0;\n  color: #90a0ab;\n}\n.HeadlessLoginPanel_module_dividerLine {\n  flex: 1;\n  height: 1px;\n  background: #d5e0e7;\n}\n.HeadlessLoginPanel_module_dividerText {\n  font-size: 12px;\n  text-transform: uppercase;\n  letter-spacing: 0.08em;\n}\n.HeadlessLoginPanel_module_hint {\n  margin: 10px 0 0;\n  font-size: 12px;\n  color: #6b7c87;\n  line-height: 1.45;\n}\n.HeadlessLoginPanel_module_error {\n  margin: 12px 0 0;\n  font-size: 13px;\n  color: #b42318;\n  line-height: 1.4;\n}\n.HeadlessLoginPanel_module_footer {\n  margin-top: 18px;\n  padding-top: 12px;\n  border-top: 1px solid #e4ebf0;\n  font-size: 12px;\n  color: #6b7c87;\n  display: flex;\n  gap: 8px;\n  justify-content: center;\n}\n/*# sourceMappingURL=index.css.map */";document.head.appendChild(s);})();
+(function(){if(typeof document==="undefined")return;var id="lw-auth-react-headless-login";if(document.getElementById(id))return;var s=document.createElement("style");s.id=id;s.textContent="/* src/HeadlessLoginPanel.module.scss */\n.HeadlessLoginPanel_module_panel {\n  --lw-auth-theme: #1677ff;\n  --lw-auth-theme-deep: color-mix(in srgb, var(--lw-auth-theme) 72%, #000);\n  width: min(100%, 400px);\n  padding: 28px 28px 22px;\n  border-radius: 16px;\n  background: rgba(255, 255, 255, 0.96);\n  color: #14212b;\n  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);\n  font-family:\n    \"Segoe UI\",\n    \"PingFang SC\",\n    \"Noto Sans SC\",\n    sans-serif;\n}\n.HeadlessLoginPanel_module_brand {\n  display: flex;\n  gap: 14px;\n  align-items: center;\n  margin-bottom: 12px;\n}\n.HeadlessLoginPanel_module_logo {\n  border-radius: 12px;\n  display: block;\n}\n.HeadlessLoginPanel_module_product {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 650;\n  letter-spacing: 0.04em;\n  text-transform: uppercase;\n  color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_title {\n  margin: 2px 0 0;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n}\n.HeadlessLoginPanel_module_subtitle {\n  margin: 0 0 18px;\n  font-size: 14px;\n  line-height: 1.5;\n  color: #4b5c68;\n}\n.HeadlessLoginPanel_module_form {\n  display: grid;\n  gap: 10px;\n}\n.HeadlessLoginPanel_module_channelTabs {\n  display: grid;\n  grid-template-columns: 1fr 1fr;\n  gap: 6px;\n  margin-bottom: 2px;\n}\n.HeadlessLoginPanel_module_channelTab {\n  border: 1px solid #c9d5de;\n  border-radius: 10px;\n  padding: 8px 10px;\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #4b5c68;\n  background: #f7fafc;\n}\n.HeadlessLoginPanel_module_channelTab:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_channelTabActive {\n  color: var(--lw-auth-theme-deep);\n  border-color: var(--lw-auth-theme);\n  background: color-mix(in srgb, var(--lw-auth-theme) 10%, #fff);\n}\n.HeadlessLoginPanel_module_codeRow {\n  display: grid;\n  grid-template-columns: 1fr auto;\n  gap: 8px;\n  align-items: stretch;\n}\n.HeadlessLoginPanel_module_codeInput {\n  min-width: 0;\n}\n.HeadlessLoginPanel_module_secondaryBtn {\n  border: 1px solid #b7c9d4;\n  border-radius: 10px;\n  padding: 0 12px;\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #14212b;\n  background: #fff;\n  white-space: nowrap;\n}\n.HeadlessLoginPanel_module_secondaryBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialStack {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 10px;\n  font-size: 12px;\n}\n.HeadlessLoginPanel_module_input {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid #c9d5de;\n  border-radius: 10px;\n  padding: 10px 12px;\n  font-size: 14px;\n  outline: none;\n  background: #f7fafc;\n}\n.HeadlessLoginPanel_module_input:focus {\n  border-color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_input:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_passwordField {\n  position: relative;\n  display: flex;\n  align-items: center;\n}\n.HeadlessLoginPanel_module_passwordInput {\n  padding-right: 42px;\n}\n.HeadlessLoginPanel_module_passwordToggle {\n  position: absolute;\n  right: 4px;\n  top: 50%;\n  transform: translateY(-50%);\n  z-index: 1;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 36px;\n  height: 36px;\n  border: none;\n  border-radius: 4px;\n  padding: 0;\n  color: #5a6b76;\n  background: transparent;\n  cursor: pointer;\n}\n.HeadlessLoginPanel_module_passwordToggle:hover:not(:disabled) {\n  color: var(--lw-auth-theme);\n  background: color-mix(in srgb, var(--lw-auth-theme) 12%, transparent);\n}\n.HeadlessLoginPanel_module_passwordToggle:focus-visible {\n  outline: 2px solid var(--lw-auth-theme);\n  outline-offset: 1px;\n}\n.HeadlessLoginPanel_module_passwordToggle:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_primaryBtn {\n  border: none;\n  border-radius: 10px;\n  padding: 11px 14px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #fff;\n  background:\n    linear-gradient(\n      135deg,\n      var(--lw-auth-theme) 0%,\n      var(--lw-auth-theme-deep) 100%);\n}\n.HeadlessLoginPanel_module_primaryBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialBtn {\n  flex: 1 1 calc(50% - 5px);\n  min-width: min(140px, 100%);\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  gap: 8px;\n  border: 1px solid #b7c9d4;\n  border-radius: 10px;\n  padding: 11px 10px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #14212b;\n  background: #fff;\n}\n.HeadlessLoginPanel_module_socialBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialLogo {\n  flex-shrink: 0;\n  display: block;\n}\n.HeadlessLoginPanel_module_logoFallback {\n  width: 18px;\n  height: 18px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--lw-auth-theme) 14%, #fff);\n  color: var(--lw-auth-theme-deep);\n  font-size: 11px;\n  font-weight: 700;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  flex-shrink: 0;\n}\n.HeadlessLoginPanel_module_cancelBtn {\n  margin-top: 10px;\n  width: 100%;\n  border: none;\n  background: transparent;\n  color: #5a6b76;\n  font-size: 13px;\n  cursor: pointer;\n  padding: 8px;\n}\n.HeadlessLoginPanel_module_cancelBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_divider {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 14px 0;\n  color: #90a0ab;\n}\n.HeadlessLoginPanel_module_dividerLine {\n  flex: 1;\n  height: 1px;\n  background: #d5e0e7;\n}\n.HeadlessLoginPanel_module_dividerText {\n  font-size: 12px;\n  text-transform: uppercase;\n  letter-spacing: 0.08em;\n}\n.HeadlessLoginPanel_module_hint {\n  margin: 10px 0 0;\n  font-size: 12px;\n  color: #6b7c87;\n  line-height: 1.45;\n}\n.HeadlessLoginPanel_module_domainsHint {\n  margin: -2px 0 0;\n  font-size: 12px;\n  line-height: 1.45;\n  color: #4b5c68;\n  word-break: break-word;\n}\n.HeadlessLoginPanel_module_switchMode {\n  margin: 12px 0 0;\n  text-align: center;\n}\n.HeadlessLoginPanel_module_switchModeBtn {\n  border: none;\n  background: transparent;\n  color: var(--lw-auth-theme);\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  padding: 4px 8px;\n  text-decoration: underline;\n  text-underline-offset: 3px;\n}\n.HeadlessLoginPanel_module_switchModeBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_error {\n  margin: 12px 0 0;\n  font-size: 13px;\n  color: #b42318;\n  line-height: 1.4;\n}\n.HeadlessLoginPanel_module_footer {\n  margin-top: 18px;\n  padding-top: 12px;\n  border-top: 1px solid #e4ebf0;\n  font-size: 12px;\n  color: #6b7c87;\n  display: flex;\n  gap: 8px;\n  justify-content: center;\n}\n/*# sourceMappingURL=index.css.map */";document.head.appendChild(s);})();
 'use strict';
 
 var oidcClientTs = require('oidc-client-ts');
@@ -55,6 +55,8 @@ var LOGIN_EXPERIENCE_CAPABILITIES = {
   passwordSignIn: "password-sign-in",
   /** Username + password self-register via Experience (Logto NewPasswordIdentity). */
   passwordSignUp: "password-sign-up",
+  /** Email + verification code + password self-register. */
+  emailCodeSignUp: "email-code-sign-up",
   socialConnectors: "social-connectors",
   socialDirectSignIn: "social-direct-sign-in"
 };
@@ -86,6 +88,160 @@ function resolveLoginExperienceProviderFromEnv(env = {}) {
   return env.VITE_IAM_PROVIDER ?? env.PUBLIC_IAM_PROVIDER ?? env.IAM_PROVIDER ?? env.IDP_MODE ?? "logto";
 }
 
+// src/register-policy.ts
+var DEFAULT_REGISTER_EMAIL_ALLOWLIST = [
+  // Google
+  "gmail.com",
+  "googlemail.com",
+  // Tencent / QQ
+  "qq.com",
+  "foxmail.com",
+  // NetEase
+  "163.com",
+  "126.com",
+  "yeah.net",
+  // Microsoft
+  "outlook.com",
+  "hotmail.com",
+  "live.com",
+  "msn.com",
+  // Apple
+  "icloud.com",
+  "me.com",
+  "mac.com",
+  // Yahoo
+  "yahoo.com",
+  "yahoo.co.jp",
+  // Proton
+  "proton.me",
+  "protonmail.com",
+  // Others commonly used by real users
+  "sina.com",
+  "sina.cn",
+  "aliyun.com",
+  "139.com"
+];
+var DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST = [
+  "mailinator.com",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "10minutemail.com",
+  "tempmail.com",
+  "temp-mail.org",
+  "yopmail.com",
+  "trashmail.com",
+  "sharklasers.com",
+  "getnada.com",
+  "maildrop.cc",
+  "discard.email",
+  "mailnesia.com"
+];
+function parseList(raw) {
+  if (!raw) return [];
+  const parts = Array.isArray(raw) ? raw : String(raw).split(/[\s,;]+/);
+  return [
+    ...new Set(
+      parts.map((s) => s.trim().toLowerCase().replace(/^@/, "")).filter(Boolean)
+    )
+  ];
+}
+function normalizeRegisterEmailMode(raw) {
+  const key = (raw || "allowlist").trim().toLowerCase();
+  if (key === "off" || key === "false" || key === "0" || key === "disabled") return "off";
+  if (key === "blocklist" || key === "deny" || key === "blacklist") return "blocklist";
+  return "allowlist";
+}
+function resolveRegisterEmailPolicy(input = {}) {
+  const mode = normalizeRegisterEmailMode(input.mode);
+  const allowlist = parseList(input.allowlist);
+  const blocklist = parseList(input.blocklist);
+  return {
+    mode,
+    allowlist: allowlist.length ? allowlist : DEFAULT_REGISTER_EMAIL_ALLOWLIST,
+    blocklist: blocklist.length ? blocklist : DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST
+  };
+}
+function readRegisterEmailPolicyFromEnv(env = {}) {
+  return resolveRegisterEmailPolicy({
+    mode: env.VITE_AUTH_REGISTER_EMAIL_MODE || env.PUBLIC_AUTH_REGISTER_EMAIL_MODE || env.NEXT_PUBLIC_AUTH_REGISTER_EMAIL_MODE || env.AUTH_REGISTER_EMAIL_MODE,
+    allowlist: env.VITE_AUTH_REGISTER_EMAIL_ALLOWLIST || env.PUBLIC_AUTH_REGISTER_EMAIL_ALLOWLIST || env.NEXT_PUBLIC_AUTH_REGISTER_EMAIL_ALLOWLIST || env.AUTH_REGISTER_EMAIL_ALLOWLIST,
+    blocklist: env.VITE_AUTH_REGISTER_EMAIL_BLOCKLIST || env.PUBLIC_AUTH_REGISTER_EMAIL_BLOCKLIST || env.NEXT_PUBLIC_AUTH_REGISTER_EMAIL_BLOCKLIST || env.AUTH_REGISTER_EMAIL_BLOCKLIST
+  });
+}
+function emailDomain(email) {
+  const trimmed = email.trim().toLowerCase();
+  const at = trimmed.lastIndexOf("@");
+  if (at <= 0 || at === trimmed.length - 1) return null;
+  if (trimmed.includes(" ") || trimmed.indexOf("@") !== at) return null;
+  return trimmed.slice(at + 1);
+}
+function isValidEmailShape(email) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+function evaluateRegisterEmail(email, policy = resolveRegisterEmailPolicy()) {
+  if (!isValidEmailShape(email)) return { ok: false, reason: "invalid" };
+  const domain = emailDomain(email);
+  if (!domain) return { ok: false, reason: "invalid" };
+  if (policy.blocklist.includes(domain)) {
+    return { ok: false, reason: "disposable", domain };
+  }
+  if (policy.mode === "off") return { ok: true, domain };
+  if (policy.mode === "blocklist") return { ok: true, domain };
+  if (!policy.allowlist.includes(domain)) {
+    return { ok: false, reason: "not_allowed", domain };
+  }
+  return { ok: true, domain };
+}
+function registerEmailRejectionMessage(decision) {
+  if (decision.ok) return "";
+  if (decision.reason === "invalid") return "Enter a valid email address";
+  if (decision.reason === "disposable") {
+    return "Temporary or disposable email addresses are not allowed";
+  }
+  return "This email provider is not accepted for self-registration. Use Gmail, Outlook, QQ, 163, iCloud, or another allowed provider \u2014 or sign in with Google / GitHub.";
+}
+function formatAllowedEmailDomains(policy, options) {
+  if (policy.mode !== "allowlist") return null;
+  const list = [...policy.allowlist].map((d) => d.toLowerCase()).filter(Boolean);
+  if (!list.length) return null;
+  const max = options?.max ?? 16;
+  const shown = list.slice(0, max);
+  const rest = list.length - shown.length;
+  const body = shown.join(", ");
+  return rest > 0 ? `${body}, +${rest} more` : body;
+}
+function registerEmailDomainsHint(policy, labels) {
+  const prefix = labels?.allowedDomainsPrefix ?? "Allowed email domains";
+  const formatted = formatAllowedEmailDomains(policy);
+  if (formatted) return `${prefix}: ${formatted}`;
+  if (policy.mode === "blocklist") {
+    return labels?.allowedDomainsBlocklist ?? "Most email providers are accepted. Temporary / disposable addresses are blocked.";
+  }
+  if (policy.mode === "off" && policy.blocklist.length > 0) {
+    return labels?.allowedDomainsBlocklist ?? "Most email providers are accepted. Temporary / disposable addresses are blocked.";
+  }
+  return labels?.allowedDomainsOpen ?? "Email registration is open for most providers.";
+}
+async function fetchRegisterEmailPolicy(apiBase, init) {
+  const base = apiBase.replace(/\/$/, "");
+  try {
+    const res = await fetch(`${base}/api/register-policy`, {
+      credentials: "omit",
+      headers: { Accept: "application/json" },
+      ...init
+    });
+    if (!res.ok) return resolveRegisterEmailPolicy();
+    const data = await res.json();
+    return resolveRegisterEmailPolicy({
+      mode: data.mode,
+      allowlist: data.allowlist,
+      blocklist: data.blocklist
+    });
+  } catch {
+    return resolveRegisterEmailPolicy();
+  }
+}
+
 // src/logto-experience-adapter.ts
 var LOGTO_USERNAME_RE = /^[A-Za-z_]\w*$/;
 function isLogtoRegisterUsername(value) {
@@ -173,9 +329,11 @@ var LogtoExperienceAdapter = class {
   capabilities = [
     LOGIN_EXPERIENCE_CAPABILITIES.passwordSignIn,
     LOGIN_EXPERIENCE_CAPABILITIES.passwordSignUp,
+    LOGIN_EXPERIENCE_CAPABILITIES.emailCodeSignUp,
     LOGIN_EXPERIENCE_CAPABILITIES.socialConnectors,
     LOGIN_EXPERIENCE_CAPABILITIES.socialDirectSignIn
   ];
+  emailPolicy = resolveRegisterEmailPolicy();
   async experiencePasswordSignIn(input) {
     const { apiBase, identifier, password } = input;
     await bootstrapOidcInteraction(input);
@@ -240,7 +398,10 @@ var LogtoExperienceAdapter = class {
     await bootstrapOidcInteraction(input);
     await experienceFetch(apiBase, "", {
       method: "PUT",
-      body: JSON.stringify({ interactionEvent: "Register" })
+      body: JSON.stringify({
+        interactionEvent: "Register",
+        ...input.captchaToken ? { captchaToken: input.captchaToken } : {}
+      })
     });
     const verified = await experienceFetch(
       apiBase,
@@ -267,6 +428,96 @@ var LogtoExperienceAdapter = class {
     });
     return { redirectTo: submitted?.redirectTo, raw: submitted };
   }
+  async sendRegisterEmailCode(input) {
+    const email = (input.email || input.identifier || "").trim().toLowerCase();
+    const decision = evaluateRegisterEmail(email, this.emailPolicy);
+    if (!decision.ok) {
+      throw new Error(registerEmailRejectionMessage(decision));
+    }
+    await bootstrapOidcInteraction({
+      apiBase: input.apiBase,
+      issuer: input.issuer,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      audience: input.audience,
+      scopes: input.scopes,
+      returnUrl: input.returnUrl
+    });
+    await experienceFetch(input.apiBase, "", {
+      method: "PUT",
+      body: JSON.stringify({
+        interactionEvent: "Register",
+        ...input.captchaToken ? { captchaToken: input.captchaToken } : {}
+      })
+    });
+    const sent = await experienceFetch(
+      input.apiBase,
+      "/verification/verification-code",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          identifier: { type: "email", value: email },
+          interactionEvent: "Register"
+        })
+      }
+    );
+    if (!sent?.verificationId) {
+      throw new Error("Experience API did not return verificationId for email code");
+    }
+    return { verificationId: sent.verificationId };
+  }
+  async experienceEmailPasswordSignUp(input) {
+    const email = (input.email || input.identifier || "").trim().toLowerCase();
+    const decision = evaluateRegisterEmail(email, this.emailPolicy);
+    if (!decision.ok) {
+      throw new Error(registerEmailRejectionMessage(decision));
+    }
+    if (!input.password || input.password.length < 8) {
+      throw new Error("Password must be at least 8 characters");
+    }
+    if (!input.code?.trim() || !input.verificationId?.trim()) {
+      throw new Error("Email verification code is required");
+    }
+    const verified = await experienceFetch(
+      input.apiBase,
+      "/verification/verification-code/verify",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          identifier: { type: "email", value: email },
+          verificationId: input.verificationId,
+          code: input.code.trim()
+        })
+      }
+    );
+    const codeVerificationId = verified?.verificationId || input.verificationId;
+    try {
+      await experienceFetch(input.apiBase, "/identification", {
+        method: "POST",
+        body: JSON.stringify({ verificationId: codeVerificationId })
+      });
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      if (!/missing_profile/i.test(msg)) {
+        if (!/422|password|profile/i.test(msg)) {
+          throw error instanceof Error ? error : new Error(msg);
+        }
+      }
+    }
+    await experienceFetch(input.apiBase, "/profile", {
+      method: "POST",
+      body: JSON.stringify({ type: "password", value: input.password })
+    });
+    await experienceFetch(input.apiBase, "/identification", {
+      method: "POST",
+      body: JSON.stringify({})
+    });
+    const submitted = await experienceFetch(input.apiBase, "/submit", {
+      method: "POST",
+      body: JSON.stringify({})
+    });
+    return { redirectTo: submitted?.redirectTo, raw: submitted };
+  }
   async fetchSocialConnectors(input) {
     const url = new URL(`${input.apiBase.replace(/\/$/, "")}/api/.well-known/sign-in-exp`);
     if (input.appId?.trim()) url.searchParams.set("appId", input.appId.trim());
@@ -678,6 +929,12 @@ var HeadlessLoginPanel_module_default = {
   title: "HeadlessLoginPanel_module_title",
   subtitle: "HeadlessLoginPanel_module_subtitle",
   form: "HeadlessLoginPanel_module_form",
+  channelTabs: "HeadlessLoginPanel_module_channelTabs",
+  channelTab: "HeadlessLoginPanel_module_channelTab",
+  channelTabActive: "HeadlessLoginPanel_module_channelTabActive",
+  codeRow: "HeadlessLoginPanel_module_codeRow",
+  codeInput: "HeadlessLoginPanel_module_codeInput",
+  secondaryBtn: "HeadlessLoginPanel_module_secondaryBtn",
   socialStack: "HeadlessLoginPanel_module_socialStack",
   input: "HeadlessLoginPanel_module_input",
   passwordField: "HeadlessLoginPanel_module_passwordField",
@@ -692,6 +949,9 @@ var HeadlessLoginPanel_module_default = {
   dividerLine: "HeadlessLoginPanel_module_dividerLine",
   dividerText: "HeadlessLoginPanel_module_dividerText",
   hint: "HeadlessLoginPanel_module_hint",
+  domainsHint: "HeadlessLoginPanel_module_domainsHint",
+  switchMode: "HeadlessLoginPanel_module_switchMode",
+  switchModeBtn: "HeadlessLoginPanel_module_switchModeBtn",
   error: "HeadlessLoginPanel_module_error",
   footer: "HeadlessLoginPanel_module_footer"
 };
@@ -710,14 +970,26 @@ var defaults = {
   submitGithub: "GitHub",
   socialDivider: "or",
   hint: "Social providers open directly. Password uses your LuminaryWorks account.",
-  registerHint: "Create a username (start with a letter or _). Prefer email? Use a social provider below.",
+  registerHint: "Email register needs a code (Gmail / Outlook / QQ / 163 / iCloud \u2026). Username is an alternative. Prefer one-click? Use a social provider.",
   cancel: "Cancel",
   experienceUnavailable: "Password sign-in is unavailable; use a social provider instead.",
   showPassword: "Show password",
   hidePassword: "Hide password",
   registerLink: "Create an account",
   loginLink: "Already have an account? Sign in",
-  passwordMismatch: "Passwords do not match"
+  passwordMismatch: "Passwords do not match",
+  registerTitle: "Create account",
+  registerSubtitle: "Create your LuminaryWorks unified account",
+  registerWithEmail: "Email",
+  registerWithUsername: "Username",
+  emailPlaceholder: "Email",
+  verificationCodePlaceholder: "Verification code",
+  sendCode: "Send code",
+  resendCode: "Resend code",
+  allowedDomainsPrefix: "Allowed email domains",
+  allowedDomainsOpen: "Email registration is open for most providers.",
+  allowedDomainsBlocklist: "Most email providers are accepted. Temporary / disposable addresses are blocked.",
+  waitingExternalBrowser: "Finish signing in with your browser, then return to this app."
 };
 function resolveSieBase(config) {
   const explicit = config.experienceApiBase?.trim();
@@ -746,8 +1018,12 @@ function HeadlessLoginPanel({
   labels: labelsProp,
   returnUrl,
   mode = "popup",
+  openExternalUrl,
   showSocialConnectors = true,
   showRegister = true,
+  registerEmailPolicy: registerEmailPolicyProp,
+  fetchRegisterPolicy = true,
+  getCaptchaToken,
   socialProviders = "auto",
   showCancel,
   onCancel,
@@ -762,12 +1038,50 @@ function HeadlessLoginPanel({
     experienceAdapterProp,
     config.iamProvider
   );
+  const [emailPolicy, setEmailPolicy] = react.useState(
+    () => registerEmailPolicyProp ?? resolveRegisterEmailPolicy()
+  );
+  react.useEffect(() => {
+    if (registerEmailPolicyProp) {
+      setEmailPolicy(registerEmailPolicyProp);
+      return;
+    }
+    if (!fetchRegisterPolicy || !showRegister) {
+      setEmailPolicy(resolveRegisterEmailPolicy());
+      return;
+    }
+    const base = config.experienceApiBase?.trim();
+    if (!base) {
+      setEmailPolicy(resolveRegisterEmailPolicy());
+      return;
+    }
+    let cancelled = false;
+    void fetchRegisterEmailPolicy(base).then((policy) => {
+      if (!cancelled) setEmailPolicy(policy);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [
+    config.experienceApiBase,
+    fetchRegisterPolicy,
+    registerEmailPolicyProp,
+    showRegister
+  ]);
+  react.useEffect(() => {
+    if (experienceAdapter instanceof LogtoExperienceAdapter) {
+      experienceAdapter.emailPolicy = emailPolicy;
+    }
+  }, [emailPolicy, experienceAdapter]);
   const labels = { ...defaults, ...labelsProp };
   const configured = isIdpConfigured(config);
   const [panelMode, setPanelMode] = react.useState("sign-in");
+  const [registerChannel, setRegisterChannel] = react.useState("email");
   const [identifier, setIdentifier] = react.useState("");
   const [password, setPassword] = react.useState("");
   const [confirmPassword, setConfirmPassword] = react.useState("");
+  const [verificationCode, setVerificationCode] = react.useState("");
+  const [emailVerificationId, setEmailVerificationId] = react.useState(null);
   const [passwordVisible, setPasswordVisible] = react.useState(false);
   const panelStyle = {
     ...style,
@@ -775,12 +1089,20 @@ function HeadlessLoginPanel({
   };
   const [loading, setLoading] = react.useState(null);
   const [error, setError] = react.useState("");
+  const [awaitingExternal, setAwaitingExternal] = react.useState(false);
   const [connectors, setConnectors] = react.useState([]);
   const socialEnabled = showSocialConnectors !== false && !(Array.isArray(socialProviders) && socialProviders.length === 0) && experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.socialConnectors) && experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.socialDirectSignIn) && typeof experienceAdapter.fetchSocialConnectors === "function" && typeof experienceAdapter.createSocialSignInRequest === "function";
   const passwordEnabled = experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.passwordSignIn) && typeof experienceAdapter.experiencePasswordSignIn === "function";
-  showRegister !== false && experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.passwordSignUp) && typeof experienceAdapter.experiencePasswordSignUp === "function";
+  const registerEnabled = showRegister !== false && (experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.passwordSignUp) && typeof experienceAdapter.experiencePasswordSignUp === "function" || experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.emailCodeSignUp) && typeof experienceAdapter.sendRegisterEmailCode === "function" && typeof experienceAdapter.experienceEmailPasswordSignUp === "function");
+  const emailRegisterEnabled = experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.emailCodeSignUp) && typeof experienceAdapter.sendRegisterEmailCode === "function" && typeof experienceAdapter.experienceEmailPasswordSignUp === "function";
+  const usernameRegisterEnabled = experienceAdapter.capabilities.includes(LOGIN_EXPERIENCE_CAPABILITIES.passwordSignUp) && typeof experienceAdapter.experiencePasswordSignUp === "function";
+  const isRegister = panelMode === "register" && registerEnabled;
+  const useEmailRegister = isRegister && registerChannel === "email" && emailRegisterEnabled;
   react.useEffect(() => {
-    const resetBusy = () => setLoading(null);
+    const resetBusy = () => {
+      setLoading(null);
+      setAwaitingExternal(false);
+    };
     window.addEventListener("pageshow", resetBusy);
     window.addEventListener("popstate", resetBusy);
     return () => {
@@ -823,6 +1145,19 @@ function HeadlessLoginPanel({
   ]);
   const runOidc = async (experienceRequest) => {
     if (!configured) throw new Error("IdP not configured");
+    if (mode === "external") {
+      if (!openExternalUrl) {
+        throw new Error('openExternalUrl is required when mode is "external"');
+      }
+      const url = await prepareSignInRequestUrl(config, {
+        returnUrl,
+        ...experienceRequest
+      });
+      setAwaitingExternal(true);
+      await openExternalUrl(url);
+      setLoading(null);
+      return;
+    }
     if (mode === "redirect") {
       await signInRedirect(config, { returnUrl, ...experienceRequest });
       return;
@@ -846,6 +1181,7 @@ function HeadlessLoginPanel({
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e));
       setLoading(null);
+      setAwaitingExternal(false);
     }
   };
   const runHostedOidc = async () => {
@@ -856,6 +1192,7 @@ function HeadlessLoginPanel({
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e));
       setLoading(null);
+      setAwaitingExternal(false);
     }
   };
   const followExperienceRedirect = (redirectTo) => {
@@ -875,6 +1212,59 @@ function HeadlessLoginPanel({
       if (!apiBase) {
         throw new Error(labels.experienceUnavailable);
       }
+      const captchaToken = getCaptchaToken ? await getCaptchaToken() : void 0;
+      if (isRegister) {
+        if (password !== confirmPassword) {
+          throw new Error(labels.passwordMismatch);
+        }
+        if (useEmailRegister) {
+          if (!experienceAdapter.experienceEmailPasswordSignUp || !emailVerificationId) {
+            throw new Error("Send and enter the email verification code first");
+          }
+          const decision = evaluateRegisterEmail(identifier.trim(), emailPolicy);
+          if (!decision.ok) throw new Error(registerEmailRejectionMessage(decision));
+          const result3 = await experienceAdapter.experienceEmailPasswordSignUp({
+            apiBase,
+            identifier: identifier.trim(),
+            email: identifier.trim(),
+            password,
+            code: verificationCode,
+            verificationId: emailVerificationId,
+            captchaToken,
+            issuer: config.issuer,
+            clientId: config.clientId,
+            redirectUri: config.redirectUri,
+            audience: config.audience,
+            scopes: config.scopes,
+            returnUrl
+          });
+          if (result3.redirectTo) {
+            followExperienceRedirect(result3.redirectTo);
+            return;
+          }
+          throw new Error("Experience API did not return redirectTo");
+        }
+        if (!usernameRegisterEnabled || !experienceAdapter.experiencePasswordSignUp) {
+          throw new Error(labels.experienceUnavailable);
+        }
+        const result2 = await experienceAdapter.experiencePasswordSignUp({
+          apiBase,
+          identifier: identifier.trim(),
+          password,
+          captchaToken,
+          issuer: config.issuer,
+          clientId: config.clientId,
+          redirectUri: config.redirectUri,
+          audience: config.audience,
+          scopes: config.scopes,
+          returnUrl
+        });
+        if (result2.redirectTo) {
+          followExperienceRedirect(result2.redirectTo);
+          return;
+        }
+        throw new Error("Experience API did not return redirectTo");
+      }
       if (!passwordEnabled || !experienceAdapter.capabilities.includes(
         LOGIN_EXPERIENCE_CAPABILITIES.passwordSignIn
       ) || !experienceAdapter.experiencePasswordSignIn) {
@@ -901,40 +1291,164 @@ function HeadlessLoginPanel({
       setLoading(null);
     }
   };
+  const runSendCode = async () => {
+    if (!configured || !useEmailRegister) return;
+    setError("");
+    setLoading("send-code");
+    try {
+      const apiBase = config.experienceApiBase?.trim();
+      if (!apiBase || !experienceAdapter.sendRegisterEmailCode) {
+        throw new Error(labels.experienceUnavailable);
+      }
+      const email = identifier.trim();
+      const decision = evaluateRegisterEmail(email, emailPolicy);
+      if (!decision.ok) throw new Error(registerEmailRejectionMessage(decision));
+      const captchaToken = getCaptchaToken ? await getCaptchaToken() : void 0;
+      const sent = await experienceAdapter.sendRegisterEmailCode({
+        apiBase,
+        identifier: email,
+        email,
+        captchaToken,
+        issuer: config.issuer,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        audience: config.audience,
+        scopes: config.scopes,
+        returnUrl
+      });
+      setEmailVerificationId(sent.verificationId);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setLoading(null);
+    }
+  };
+  const switchPanelMode = (next) => {
+    setPanelMode(next);
+    setError("");
+    setConfirmPassword("");
+    setVerificationCode("");
+    setEmailVerificationId(null);
+  };
   const busy = loading !== null;
   const showSocial = socialEnabled && connectors.length > 0;
-  const showHint = Boolean(labelsProp?.hint) || showSocial;
+  const showHint = Boolean(labelsProp?.hint) || showSocial || isRegister;
+  const formReady = Boolean(identifier.trim()) && Boolean(password) && (!isRegister || Boolean(confirmPassword)) && (!useEmailRegister || Boolean(verificationCode.trim()) && Boolean(emailVerificationId));
+  const titleText = isRegister ? labels.registerTitle : labels.title;
+  const subtitleText = isRegister ? labels.registerSubtitle : labels.subtitle;
+  const identifierPlaceholder = isRegister ? useEmailRegister ? labels.emailPlaceholder : labels.registerIdentifierPlaceholder : labels.identifierPlaceholder;
+  const submitLabel = isRegister ? labels.submitRegister : labels.submitPassword;
+  const hintText = isRegister ? labels.registerHint : labels.hint;
+  const domainsHint = useEmailRegister ? registerEmailDomainsHint(emailPolicy, {
+    allowedDomainsPrefix: labels.allowedDomainsPrefix,
+    allowedDomainsOpen: labels.allowedDomainsOpen,
+    allowedDomainsBlocklist: labels.allowedDomainsBlocklist
+  }) : null;
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: cx(HeadlessLoginPanel_module_default.panel, className), style: panelStyle, children: [
     /* @__PURE__ */ jsxRuntime.jsxs("header", { className: HeadlessLoginPanel_module_default.brand, children: [
       logoSrc ? /* @__PURE__ */ jsxRuntime.jsx("img", { src: logoSrc, alt: "", width: 48, height: 48, className: HeadlessLoginPanel_module_default.logo }) : null,
       /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
         /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.product, children: productName }),
-        /* @__PURE__ */ jsxRuntime.jsx("h2", { className: HeadlessLoginPanel_module_default.title, children: labels.title })
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { className: HeadlessLoginPanel_module_default.title, children: titleText })
       ] })
     ] }),
-    /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.subtitle, children: labels.subtitle }),
+    /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.subtitle, children: subtitleText }),
     configured ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
       passwordEnabled ? /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: (e) => void runPassword(e), className: HeadlessLoginPanel_module_default.form, children: [
+        isRegister && emailRegisterEnabled && usernameRegisterEnabled ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.channelTabs, role: "tablist", "aria-label": "Register method", children: [
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "button",
+            {
+              type: "button",
+              role: "tab",
+              className: cx(
+                HeadlessLoginPanel_module_default.channelTab,
+                registerChannel === "email" && HeadlessLoginPanel_module_default.channelTabActive
+              ),
+              "aria-selected": registerChannel === "email",
+              disabled: busy,
+              onClick: () => {
+                setRegisterChannel("email");
+                setEmailVerificationId(null);
+                setVerificationCode("");
+                setError("");
+              },
+              children: labels.registerWithEmail
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "button",
+            {
+              type: "button",
+              role: "tab",
+              className: cx(
+                HeadlessLoginPanel_module_default.channelTab,
+                registerChannel === "username" && HeadlessLoginPanel_module_default.channelTabActive
+              ),
+              "aria-selected": registerChannel === "username",
+              disabled: busy,
+              onClick: () => {
+                setRegisterChannel("username");
+                setEmailVerificationId(null);
+                setVerificationCode("");
+                setError("");
+              },
+              children: labels.registerWithUsername
+            }
+          )
+        ] }) : null,
         /* @__PURE__ */ jsxRuntime.jsx(
           "input",
           {
-            type: "text",
+            type: useEmailRegister ? "email" : "text",
             name: "identifier",
-            autoComplete: "username",
-            placeholder: labels.identifierPlaceholder,
+            autoComplete: isRegister ? "username" : "username",
+            placeholder: identifierPlaceholder,
             value: identifier,
-            onChange: (e) => setIdentifier(e.target.value),
+            onChange: (e) => {
+              setIdentifier(e.target.value);
+              if (useEmailRegister) {
+                setEmailVerificationId(null);
+              }
+            },
             className: HeadlessLoginPanel_module_default.input,
             disabled: busy
           }
         ),
+        domainsHint ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.domainsHint, "data-testid": "register-allowed-domains", children: domainsHint }) : null,
+        useEmailRegister ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.codeRow, children: [
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              type: "text",
+              name: "verificationCode",
+              inputMode: "numeric",
+              autoComplete: "one-time-code",
+              placeholder: labels.verificationCodePlaceholder,
+              value: verificationCode,
+              onChange: (e) => setVerificationCode(e.target.value),
+              className: cx(HeadlessLoginPanel_module_default.input, HeadlessLoginPanel_module_default.codeInput),
+              disabled: busy
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "button",
+            {
+              type: "button",
+              className: HeadlessLoginPanel_module_default.secondaryBtn,
+              disabled: busy || !identifier.trim(),
+              onClick: () => void runSendCode(),
+              children: loading === "send-code" ? "\u2026" : emailVerificationId ? labels.resendCode : labels.sendCode
+            }
+          )
+        ] }) : null,
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.passwordField, children: [
           /* @__PURE__ */ jsxRuntime.jsx(
             "input",
             {
               type: passwordVisible ? "text" : "password",
               name: "password",
-              autoComplete: "current-password",
+              autoComplete: isRegister ? "new-password" : "current-password",
               placeholder: labels.passwordPlaceholder,
               value: password,
               onChange: (e) => setPassword(e.target.value),
@@ -955,7 +1469,20 @@ function HeadlessLoginPanel({
             }
           )
         ] }),
-        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: HeadlessLoginPanel_module_default.primaryBtn, disabled: busy || !identifier || !password, children: loading === "password" ? "\u2026" : labels.submitPassword })
+        isRegister ? /* @__PURE__ */ jsxRuntime.jsx("div", { className: HeadlessLoginPanel_module_default.passwordField, children: /* @__PURE__ */ jsxRuntime.jsx(
+          "input",
+          {
+            type: passwordVisible ? "text" : "password",
+            name: "confirmPassword",
+            autoComplete: "new-password",
+            placeholder: labels.confirmPasswordPlaceholder,
+            value: confirmPassword,
+            onChange: (e) => setConfirmPassword(e.target.value),
+            className: cx(HeadlessLoginPanel_module_default.input, HeadlessLoginPanel_module_default.passwordInput),
+            disabled: busy
+          }
+        ) }) : null,
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: HeadlessLoginPanel_module_default.primaryBtn, disabled: busy || !formReady, children: loading === "password" ? "\u2026" : submitLabel })
       ] }) : /* @__PURE__ */ jsxRuntime.jsx("div", { className: HeadlessLoginPanel_module_default.form, children: /* @__PURE__ */ jsxRuntime.jsx(
         "button",
         {
@@ -966,7 +1493,18 @@ function HeadlessLoginPanel({
           children: loading === "sso" ? "\u2026" : labels.submitSso
         }
       ) }),
-      showHint ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.hint, children: labels.hint }) : null,
+      showHint ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.hint, children: hintText }) : null,
+      registerEnabled && passwordEnabled ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.switchMode, children: /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          className: HeadlessLoginPanel_module_default.switchModeBtn,
+          disabled: busy,
+          onClick: () => switchPanelMode(isRegister ? "sign-in" : "register"),
+          children: isRegister ? labels.loginLink : labels.registerLink
+        }
+      ) }) : null,
+      awaitingExternal ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.hint, role: "status", children: labels.waitingExternalBrowser }) : null,
       showSocial ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.divider, "aria-hidden": true, children: [
         /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.dividerLine }),
         /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.dividerText, children: labels.socialDivider }),
@@ -1060,6 +1598,7 @@ function ReauthOverlay({
           },
           returnUrl: resolvedReturnUrl,
           mode: "popup",
+          showRegister: false,
           showCancel: dismissible,
           onCancel: handleCancel,
           onOidcSession: handleSession
@@ -1190,7 +1729,9 @@ function createPostLoginPathHelpers(options) {
 }
 
 exports.AuthGateProvider = AuthGateProvider;
+exports.DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST = DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST;
 exports.DEFAULT_LOGIN_THEME_COLOR = DEFAULT_LOGIN_THEME_COLOR;
+exports.DEFAULT_REGISTER_EMAIL_ALLOWLIST = DEFAULT_REGISTER_EMAIL_ALLOWLIST;
 exports.HeadlessLoginPanel = HeadlessLoginPanel;
 exports.HostedOidcExperienceAdapter = HostedOidcExperienceAdapter;
 exports.LOGIN_EXPERIENCE_CAPABILITIES = LOGIN_EXPERIENCE_CAPABILITIES;
@@ -1203,8 +1744,12 @@ exports.createLoginExperienceAdapter = createLoginExperienceAdapter;
 exports.createLogtoDirectSignInRequest = createLogtoDirectSignInRequest;
 exports.createPostLoginPathHelpers = createPostLoginPathHelpers;
 exports.createUserManager = createUserManager;
+exports.emailDomain = emailDomain;
+exports.evaluateRegisterEmail = evaluateRegisterEmail;
 exports.experiencePasswordSignIn = experiencePasswordSignIn;
+exports.fetchRegisterEmailPolicy = fetchRegisterEmailPolicy;
 exports.fetchSocialConnectors = fetchSocialConnectors;
+exports.formatAllowedEmailDomains = formatAllowedEmailDomains;
 exports.getCurrentUser = getCurrentUser;
 exports.getStoredAccessToken = getStoredAccessToken;
 exports.handleSignInCallback = handleSignInCallback;
@@ -1212,13 +1757,19 @@ exports.handleSignInPopupCallback = handleSignInPopupCallback;
 exports.isIdpConfigured = isIdpConfigured;
 exports.isLogtoRegisterUsername = isLogtoRegisterUsername;
 exports.isOidcPopupWindow = isOidcPopupWindow;
+exports.isValidEmailShape = isValidEmailShape;
+exports.normalizeRegisterEmailMode = normalizeRegisterEmailMode;
 exports.prepareSignInRequestUrl = prepareSignInRequestUrl;
 exports.readIdpConfigFromEnv = readIdpConfigFromEnv;
+exports.readRegisterEmailPolicyFromEnv = readRegisterEmailPolicyFromEnv;
+exports.registerEmailDomainsHint = registerEmailDomainsHint;
+exports.registerEmailRejectionMessage = registerEmailRejectionMessage;
 exports.resetUserManager = resetUserManager;
 exports.resolveExperienceApiBase = resolveExperienceApiBase;
 exports.resolveIssuer = resolveIssuer;
 exports.resolveLoginExperienceAdapter = resolveLoginExperienceAdapter;
 exports.resolveLoginExperienceProviderFromEnv = resolveLoginExperienceProviderFromEnv;
+exports.resolveRegisterEmailPolicy = resolveRegisterEmailPolicy;
 exports.sameOriginAuthorizeUrl = sameOriginAuthorizeUrl;
 exports.signInPopup = signInPopup;
 exports.signInRedirect = signInRedirect;