@oxy.so/services 11.4.0 → 11.5.0

package/src/index.ts

@@ -453,8 +453,3 @@ export {
   usePersonalPlans,
   usePersonalPlanSubscriptions,
 } from './ui/hooks/queries/usePersonalPlans';
-export { AccountInvitationAcceptance } from './ui/components/AccountInvitationAcceptance';
-
-export { DisplayCurrencySelector } from './ui/components/DisplayCurrencySelector';
-export { useDisplayCurrency } from './ui/hooks/useDisplayCurrency';
-export { useDisplayPrice } from './ui/hooks/useDisplayPrice';

package/src/ui/boot/__tests__/coldBootNoIdpRedirect.test.ts

@@ -63,6 +63,22 @@ function makeEmptyAuthStore(): AuthStateStore {
   } as unknown as AuthStateStore;
 }
 
+/** An auth store holding this origin's device credential. */
+function makeCredentialAuthStore(): AuthStateStore {
+  return {
+    load: jest.fn(
+      async (): Promise<PersistedAuthState | null> => ({ deviceId: 'd1', deviceSecret: 's1' }),
+    ),
+    save: jest.fn(async () => undefined),
+    clear: jest.fn(async () => undefined),
+  } as unknown as AuthStateStore;
+}
+
+/** Put an OAuth return (`?code=`) on the address bar, as the IdP's redirect does. */
+function landWithAuthorizationCode(): void {
+  window.history.replaceState(null, '', '/?code=auth-code&state=auth-state');
+}
+
 interface Harness {
   options: RunProviderColdBootOptions;
   commitSession: jest.Mock;
@@ -120,6 +136,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
     mockTryCompleteOAuthReturn.mockClear();
     mockTryCompleteOAuthReturn.mockImplementation(async () => false);
     globalThis.sessionStorage?.clear();
+    window.history.replaceState(null, '', '/');
   });
 
   it('resolves a domain with no local credential SIGNED OUT instead of bouncing to the IdP', async () => {
@@ -160,7 +177,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
         return { kind: 'session', via: session.via, session } as const;
       },
     );
-    const { options, commitSession } = makeHarness();
+    const { options, commitSession } = makeHarness({ authStore: makeCredentialAuthStore() });
 
     await runProviderColdBoot(options);
 
@@ -176,6 +193,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
       // A popup-mode app lands here whenever the browser blocked the popup and
       // `startWebOAuthSignIn` fell back to a full-page redirect.
       mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      landWithAuthorizationCode();
       const { options, markAuthResolved, setTokenReady } = makeHarness();
 
       await runProviderColdBoot(options);
@@ -190,6 +208,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
 
     it('runs the return leg even on a boot that finds no session', async () => {
       stubSignedOutBoot();
+      landWithAuthorizationCode();
       const { options } = makeHarness();
 
       await runProviderColdBoot(options);
@@ -199,6 +218,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
 
     it('commits the OAuth return as a deliberate sign-in', async () => {
       mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      landWithAuthorizationCode();
       const { options } = makeHarness();
 
       await runProviderColdBoot(options);
@@ -225,14 +245,22 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
   });
 });
 
+// Each case lands with an OAuth return on the URL — the boot that must classify
+// before it does anything — so "nothing ran first" is a real claim. The web
+// origin with nothing to restore, which resolves before classification, is
+// covered on its own below.
 describe('registered cold-boot classification', () => {
   beforeEach(() => {
     mockRunSessionColdBoot.mockReset();
     mockTryCompleteOAuthReturn.mockReset();
     mockTryCompleteOAuthReturn.mockResolvedValue(false);
+    landWithAuthorizationCode();
+  });
+  afterEach(() => {
+    window.history.replaceState(null, '', '/');
   });
   it('external classification bypasses prior secrets, shared device and identity pin work', async () => {
-    const { options } = makeHarness();
+    const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
     (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({
       id: 'external',
       name: 'External',
@@ -298,8 +326,9 @@ describe('registered cold-boot classification', () => {
 
 it('an unresponsive registry resolves signed-out without a late privileged continuation', async () => {
   jest.useFakeTimers();
+  landWithAuthorizationCode();
   try {
-    const { options } = makeHarness();
+    const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
     let release!: (app: unknown) => void;
     (options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(
       () =>
@@ -327,5 +356,139 @@ it('an unresponsive registry resolves signed-out without a late privileged conti
     expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
   } finally {
     jest.useRealTimers();
+    window.history.replaceState(null, '', '/');
   }
 });
+
+/**
+ * A web origin with nothing to restore — no warm token, no device secret, no
+ * OAuth return on the URL — ends signed out on either lane, so its routing does
+ * not wait on the registry round trip. Everything that would USE a credential
+ * still waits for the verdict.
+ */
+describe('web origin with nothing to restore', () => {
+  const official = {
+    id: 'registered-app',
+    name: 'Registered App',
+    type: 'first_party',
+    isOfficial: true,
+    isInternal: false,
+    scopes: [],
+  };
+
+  beforeEach(() => {
+    mockRunSessionColdBoot.mockReset();
+    mockTryCompleteOAuthReturn.mockReset();
+    mockTryCompleteOAuthReturn.mockResolvedValue(false);
+    window.history.replaceState(null, '', '/');
+  });
+
+  function pendingRegistry(options: RunProviderColdBootOptions): (app: unknown) => void {
+    let release!: (app: unknown) => void;
+    (options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          release = resolve;
+        }),
+    );
+    return (app) => release(app);
+  }
+
+  it('resolves auth before the registry answers, and still classifies with no cache', async () => {
+    const { options, markAuthResolved } = makeHarness();
+    const onClassified = jest.fn();
+    const release = pendingRegistry(options);
+
+    const boot = runProviderColdBoot({ ...options, onClassified });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(markAuthResolved).toHaveBeenCalled();
+    expect(options.oxyServices.apps.getPublic).toHaveBeenCalledWith(CLIENT_ID, { cache: false });
+    expect(onClassified).not.toHaveBeenCalled();
+
+    release(official);
+    await boot;
+
+    expect(onClassified).toHaveBeenCalledWith('device');
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(options.commitSession).not.toHaveBeenCalled();
+  });
+
+  it('a failed classification after the early resolution restores nothing', async () => {
+    const { options, markAuthResolved } = makeHarness();
+    (options.oxyServices.apps.getPublic as jest.Mock).mockRejectedValue(new Error('offline'));
+
+    await runProviderColdBoot(options);
+
+    expect(markAuthResolved).toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+  });
+
+  it('an origin holding a device secret still waits for the verdict before using it', async () => {
+    stubSignedOutBoot();
+    const { options, markAuthResolved } = makeHarness({ authStore: makeCredentialAuthStore() });
+    const release = pendingRegistry(options);
+
+    const boot = runProviderColdBoot(options);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(markAuthResolved).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+
+    release(official);
+    await boot;
+
+    expect(mockRunSessionColdBoot).toHaveBeenCalledTimes(1);
+    expect(markAuthResolved).toHaveBeenCalled();
+  });
+
+  it('an origin holding a device secret classified external never uses it', async () => {
+    const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
+    (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({
+      ...official,
+      type: 'third_party',
+      isOfficial: false,
+    });
+
+    await runProviderColdBoot(options);
+
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(options.authStore.save).not.toHaveBeenCalled();
+    expect(options.authStore.clear).not.toHaveBeenCalled();
+  });
+
+  it('an OAuth return on the URL waits for the verdict', async () => {
+    landWithAuthorizationCode();
+    const { options, markAuthResolved } = makeHarness();
+    const release = pendingRegistry(options);
+
+    const boot = runProviderColdBoot(options);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(markAuthResolved).not.toHaveBeenCalled();
+    expect(options.authStore.load).not.toHaveBeenCalled();
+
+    release(official);
+    await boot;
+    expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+    window.history.replaceState(null, '', '/');
+  });
+
+  it('identity mode always waits for the verdict', async () => {
+    stubSignedOutBoot();
+    const { options, markAuthResolved } = makeHarness({ sessionMode: 'identity' });
+    const release = pendingRegistry(options);
+
+    const boot = runProviderColdBoot(options);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(markAuthResolved).not.toHaveBeenCalled();
+
+    release(official);
+    await boot;
+    expect(markAuthResolved).toHaveBeenCalled();
+  });
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -14,6 +14,28 @@ import { isWebBrowser } from '../utils/isWebBrowser';
 import { isNetConnectivityExplicitlyOffline } from '../utils/netConnectivity';
 import type { CommitInput } from '../context/oxyContextTypes';
 
+/**
+ * Whether the URL carries an OAuth return (`?code=` or `?error=`) for
+ * `tryCompleteOAuthReturn` to consume. Reads the address bar only.
+ */
+function hasOAuthReturnOnUrl(): boolean {
+  const search = (globalThis as { location?: { search?: string } }).location?.search;
+  if (!search) return false;
+  const params = new URLSearchParams(search);
+  return params.has('code') || params.has('error');
+}
+
+/**
+ * Whether this origin's own store holds anything a web boot could restore from:
+ * a warm access token to plant or a device secret to mint with. A presence
+ * check only — nothing read here is used, sent or synced before the
+ * classification allows it.
+ */
+async function hasRestorableState(store: AuthStateStore): Promise<boolean> {
+  const persisted = await store.load();
+  return Boolean(persisted?.accessToken || persisted?.deviceSecret);
+}
+
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
 export const SESSION_HANDOFF_DEADLINE_MS = 6000;
 
@@ -139,10 +161,33 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
   setTokenReady(false);
 
   try {
-    // Classification precedes every local-secret, shared-credential and identity
-    // probe. Unavailable registry metadata fails closed, including offline boot.
-    const lane = await (opts.resolveSessionLane?.() ??
-      resolveApplicationSessionLane(oxyServices, clientId));
+    // Classification precedes every USE of a local secret, the shared credential
+    // and the identity key. Unavailable registry metadata fails closed, including
+    // offline boot. It starts now, before anything else, so its round trip
+    // overlaps the local work below.
+    const classification = (async () =>
+      opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId))();
+    // Observed so a rejection that lands before it is awaited is not reported as
+    // unhandled; every path below still awaits it and sees the rejection.
+    classification.catch(() => undefined);
+
+    // The verdict decides HOW a session is restored, never WHETHER there is one.
+    // A web origin with nothing to restore and no OAuth return on the URL ends
+    // signed out on either lane, so routing need not wait a network round trip
+    // for an answer that cannot change the outcome. The classification still
+    // completes below and still gates every later sign-in
+    // (`ensureDeviceSessionLane` shares this same in-flight lookup).
+    if (!identityBound && isWebBrowser() && !hasOAuthReturnOnUrl()) {
+      if (!(await hasRestorableState(authStore))) {
+        markAuthResolved();
+        const lane = await classification;
+        await opts.onClassified?.(lane);
+        if (lane === 'oauth') setTokenReady(true);
+        return;
+      }
+    }
+
+    const lane = await classification;
     await opts.onClassified?.(lane);
     if (identityBound && lane !== 'device') return;
     // The redirect transport's RETURN leg. An app reaches it whenever the browser

package/src/ui/components/signIn/OxyEmailAccountChoice.tsx

@@ -0,0 +1,116 @@
+/**
+ * "Choose an account" after an email was proven — the email holds several
+ * accounts, and the code or the link just proved the mailbox they share.
+ *
+ * Presentational, and the same rounded list as `OxyAccountPicker`: each row is
+ * the account's name and `@handle` on the left, its avatar and a chevron on the
+ * right. The host signs the chosen account in (`oxy.auth.email.choose`).
+ */
+
+import type React from 'react';
+import { Fragment, useState } from 'react';
+import { ScrollView } from 'react-native';
+import { Pressable, View } from 'react-native-css/components';
+import { Avatar } from '@oxy.so/bloom/avatar';
+import { RiArrowRightSLine } from '@oxy.so/bloom/icons/RiArrowRightSLine';
+import { SpinnerIcon } from '@oxy.so/bloom/loading';
+import { useTheme } from '@oxy.so/bloom/theme';
+import { Text } from '@oxy.so/bloom/typography';
+import type { EmailSignInAccountOption } from '@oxy.so/contracts';
+import { getNormalizedUserHandle } from '@oxy.so/core';
+import { useOxy } from '../../context/OxyContext';
+
+/** The list scrolls past this height (`max-h-96`). */
+const LIST_MAX_HEIGHT = 384;
+const AVATAR_SIZE = 40;
+
+export interface OxyEmailAccountChoiceProps {
+  accounts: EmailSignInAccountOption[];
+  onChoose: (account: EmailSignInAccountOption) => void;
+  /** The account being signed in, whose row shows it is busy. */
+  pendingId?: string | null;
+  /** Disables every row while a choice is in flight. */
+  disabled?: boolean;
+}
+
+export const OxyEmailAccountChoice: React.FC<OxyEmailAccountChoiceProps> = ({
+  accounts,
+  onChoose,
+  pendingId = null,
+  disabled = false,
+}) => {
+  const theme = useTheme();
+  const { oxyServices } = useOxy();
+  const [hovered, setHovered] = useState<number | null>(null);
+
+  /** The hairline under row `index`, hidden while either neighbour is hovered. */
+  const divider = (index: number) =>
+    index === accounts.length - 1 ? null : hovered === index || hovered === index + 1 ? (
+      <View className="h-px mx-[8px]" />
+    ) : (
+      <View className="h-px mx-[8px] bg-border opacity-50" />
+    );
+
+  return (
+    <View
+      className="bg-fill-secondary rounded-[22px] overflow-hidden"
+      testID="email-account-choice"
+    >
+      <ScrollView style={{ maxHeight: LIST_MAX_HEIGHT }} contentContainerStyle={{ padding: 8 }}>
+        {accounts.map((account, index) => {
+          const handle = getNormalizedUserHandle({ username: account.username });
+          const name = account.displayName ?? (handle ? `@${handle}` : account.id);
+          const busy = pendingId === account.id;
+          return (
+            <Fragment key={account.id}>
+              <Pressable
+                className={`flex-row items-center gap-[12px] rounded-[14px] p-[8px] ${hovered === index && !disabled ? 'bg-fill' : ''} ${disabled && !busy ? 'opacity-50' : ''}`}
+                onPress={() => onChoose(account)}
+                onHoverIn={() => setHovered(index)}
+                onHoverOut={() => setHovered((value) => (value === index ? null : value))}
+                disabled={disabled}
+                accessibilityRole="button"
+                accessibilityLabel={name}
+                accessibilityState={{ disabled, busy }}
+                testID={`email-account-${account.id}`}
+              >
+                <View className="flex-1 min-w-0">
+                  <Text
+                    className="text-body text-text"
+                    style={{ fontWeight: '500' }}
+                    numberOfLines={1}
+                  >
+                    {name}
+                  </Text>
+                  {account.displayName && handle ? (
+                    <Text className="text-bodySmall text-text-secondary" numberOfLines={1}>
+                      @{handle}
+                    </Text>
+                  ) : null}
+                </View>
+                <View className="flex-row items-center gap-[8px] shrink-0">
+                  <Avatar
+                    source={
+                      account.avatar
+                        ? oxyServices.assets.publicUrl(account.avatar, 'thumb')
+                        : undefined
+                    }
+                    variant="thumb"
+                    name={name}
+                    size={AVATAR_SIZE}
+                  />
+                  {busy ? (
+                    <SpinnerIcon size={20} color={theme.colors.primary} />
+                  ) : (
+                    <RiArrowRightSLine size="sm" fill={theme.colors.textSecondary} />
+                  )}
+                </View>
+              </Pressable>
+              {divider(index)}
+            </Fragment>
+          );
+        })}
+      </ScrollView>
+    </View>
+  );
+};

package/src/ui/components/signIn/OxySignInPanel.tsx

@@ -16,6 +16,8 @@
  *                 (the start response does not say which, by design); meanwhile
  *                 the screen asks whether the link was opened in this browser,
  *                 and signs in when it was.
+ *   choose        the email holds several accounts, and the code or the link just
+ *                 proved it: which one signs in (a username never gets here).
  *   password      the alternative for an account that has one.
  *   second-factor the authenticator's code, or a backup code, when the account has one.
  *
@@ -39,9 +41,11 @@ import {
   EMAIL_SIGNIN_LONG_CODE_LENGTH,
   SIGN_IN_ERROR_CODES,
   TOTP_DIGITS,
+  isEmailSignInChooseAccount,
   isSecondFactorRequired,
+  type EmailSignInAccountOption,
+  type EmailSignInStepResult,
   type LoginResult,
-  type SignInStepResult,
 } from '@oxy.so/contracts';
 import { useQueryClient } from '@tanstack/react-query';
 import { useOxy } from '../../context/OxyContext';
@@ -56,6 +60,7 @@ import { SIGN_IN_SLIDES } from './artwork';
 import { InlineCommonsQr } from './InlineCommonsQr';
 import { OxyAccountPicker } from './OxyAccountPicker';
 import { OxyAuthScreen, OxyAuthScreenHeader, OxyAuthSplit, OxyAuthTerms } from './OxyAuthScreen';
+import { OxyEmailAccountChoice } from './OxyEmailAccountChoice';
 import {
   AccountFlowAction,
   AccountFlowCodeField,
@@ -94,6 +99,13 @@ const SIGN_IN_FLOW_KEY = 'signin';
 type Step =
   | { name: 'start' }
   | { name: 'check-email'; identifier: string; requestId: string; requestSecret: string }
+  | {
+      name: 'choose';
+      identifier: string;
+      requestId: string;
+      requestSecret: string;
+      accounts: EmailSignInAccountOption[];
+    }
   | { name: 'password'; identifier: string }
   | { name: 'second-factor'; challengeId: string; identifier: string };
 
@@ -153,6 +165,7 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
   const [useBackupCode, setUseBackupCode] = useState(saved?.useBackupCode ?? false);
   const [longCode, setLongCode] = useState(saved?.longCode ?? false);
   const [pending, setPending] = useState(false);
+  const [choosingId, setChoosingId] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [notice, setNotice] = useState<string | null>(null);
   const [rateLimitSeconds, setRateLimitSeconds] = useState(0);
@@ -225,8 +238,25 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
   // One sign-in ends once: the typed code and the opened link can race.
   const finishingRef = useRef(false);
   const finish = useCallback(
-    async (result: SignInStepResult, from: string): Promise<void> => {
+    async (
+      result: EmailSignInStepResult,
+      from: string,
+      request?: { requestId: string; requestSecret: string },
+    ): Promise<void> => {
       if (finishingRef.current) return;
+      if (isEmailSignInChooseAccount(result)) {
+        if (!request) return;
+        setError(null);
+        setNotice(null);
+        setStep({
+          name: 'choose',
+          identifier: from,
+          requestId: request.requestId,
+          requestSecret: request.requestSecret,
+          accounts: result.accounts,
+        });
+        return;
+      }
       if (isSecondFactorRequired(result)) {
         setError(null);
         setSecondFactorCode('');
@@ -301,7 +331,7 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
         requestSecret: request.requestSecret,
         code: typed.trim(),
       })
-      .then((result) => finish(result, request.identifier))
+      .then((result) => finish(result, request.identifier, request))
       .catch((reason: unknown) => {
         setCode('');
         fail(reason);
@@ -309,6 +339,27 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
       .finally(() => setPending(false));
   };
 
+  const chooseAccount = (account: EmailSignInAccountOption) => {
+    if (step.name !== 'choose' || blocked) return;
+    const request = step;
+    const name = account.username ?? request.identifier;
+    setError(null);
+    setPending(true);
+    setChoosingId(account.id);
+    oxyServices.auth.email
+      .choose({
+        requestId: request.requestId,
+        requestSecret: request.requestSecret,
+        userId: account.id,
+      })
+      .then((result) => finish(result, name))
+      .catch(fail)
+      .finally(() => {
+        setPending(false);
+        setChoosingId(null);
+      });
+  };
+
   const submitPassword = () => {
     if (step.name !== 'password' || blocked) return;
     if (!password) {
@@ -369,7 +420,7 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
       try {
         const result = await oxyServices.auth.email.collect({ requestId, requestSecret });
         if (!('status' in result)) {
-          await finishRef.current(result, requestIdentifier);
+          await finishRef.current(result, requestIdentifier, { requestId, requestSecret });
           return;
         }
         if (stopped) return;
@@ -550,6 +601,40 @@ export const OxySignInPanel: React.FC<OxySignInPanelProps> = ({
       );
       break;
     }
+    case 'choose': {
+      const request = step;
+      form = (
+        <OxyAuthScreen className={splits ? 'md:max-w-none' : undefined}>
+          <OxyAuthScreenHeader
+            title={t('signin.emailAccounts.title')}
+            description={t('signin.emailAccounts.description', {
+              identifier: request.identifier,
+            })}
+          />
+          <OxyEmailAccountChoice
+            accounts={request.accounts}
+            onChoose={chooseAccount}
+            pendingId={choosingId}
+            disabled={blocked}
+          />
+          {error ? (
+            <AccountFlowNotice type="error" testID="signin-choose-error">
+              {error}
+            </AccountFlowNotice>
+          ) : null}
+          {rateLimitNotice}
+          <View style={styles.links}>
+            <SubtleLink
+              label={t('signin.checkEmail.differentAccount')}
+              onPress={backToIdentifier}
+              disabled={pending}
+              testID="signin-different-account"
+            />
+          </View>
+        </OxyAuthScreen>
+      );
+      break;
+    }
     case 'password': {
       const request = step;
       form = (

package/src/ui/components/signIn/accountFlowParts.tsx

@@ -85,6 +85,8 @@ export function describeSignInError(error: unknown, t: Translate): string {
       return t('signin.errors.originNotAllowed');
     case SIGN_IN_ERROR_CODES.usernameTaken:
       return t('signup.username.taken');
+    case SIGN_IN_ERROR_CODES.emailAccountsFull:
+      return t('signin.errors.emailAccountsFull');
     case EMAIL_VERIFICATION_ERROR_CODES.codeInvalid:
       return t('emailCode.errors.codeInvalid');
     case EMAIL_VERIFICATION_ERROR_CODES.tooManyAttempts: