@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/core/security/AuthSessionContext.js

@@ -1,55 +1,88 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useState, useMemo, useEffect, useCallback, useRef } from 'react';
-import { startAuthentication } from '@simplewebauthn/browser';
-import { AuthMethod, AuthFactorLevel, AuthSessionPurpose, SessionType, isWildoBackendError, } from '@wildo-ai/saas-models';
-import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { startAuthentication, WebAuthnAbortService } from '@simplewebauthn/browser';
+import { AuthNextStep, AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthenticationSessionState, SessionType, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { getManualCallsHttpClient, } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { classifyRegistrationOutcome, RegistrationOutcome } from '../../core/security/registration-outcome.frontend.utils.js';
+import { isSpentOrganizationOnboardingSession, parkedOrganizationOnboardingSessionId } from '../../core/security/organization-onboarding.frontend.utils.js';
+import { forgetPendingMfaSession, rememberPendingMfaSession } from '../../core/security/pending-mfa-session-storage.frontend.utils.js';
 import { isAuthoritativeRefreshRejection, isRefreshDevLenient } from '../../core/requests/auth-refresh-resilience.frontend.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
 import { useError } from '../../core/errors/useError.js';
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { useApplication } from '../../core/runtime/useApplication.js';
 import { useWebSocket } from '../../core/requests/websockets/useWebSocket.js';
 import { useAnonymousSession } from '../../core/security/AnonymousSessionContext.js';
-import { EMPTY_AUTH_STATE, } from './security.frontend.schemas.js';
+import { EMPTY_AUTH_STATE, authFactorLevelForUiLevel, PasskeyAutofillExpiredError, PasskeyAutofillSupersededError, PasskeySignInMediation, } from './security.frontend.schemas.js';
 import { PersistentSessionTokenStorage, } from './session-token-storage.frontend.service.js';
 import { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-ai/presets-components-models';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('AuthSessionContext');
 logger.setDebugTypeLogging('AuthSessionContext', false);
-function extractAuthErrorMessage(error, fallback) {
-    const guidanceExplanation = error?.wildoError?.userGuidance?.explanation
-        || error?.response?.data?.error?.userGuidance?.explanation;
-    if (typeof guidanceExplanation === 'string' && guidanceExplanation.length > 0) {
-        return guidanceExplanation;
-    }
-    const detailsMessage = error?.response?.data?.error?.details?.message;
-    if (typeof detailsMessage === 'string' && detailsMessage.length > 0) {
-        return detailsMessage;
-    }
-    const contextMessage = error?.context?.message;
-    if (typeof contextMessage === 'string' && contextMessage.length > 0) {
-        return contextMessage;
-    }
-    return error?.message || fallback;
-}
+/**
+ * The session states on which the server still admits second-factor work — a challenge or an enrollment
+ * ceremony. Mirrors the admission in `auth-jwt-guard.backend.service.ts` (`extractFromSessionOrJwt`), so
+ * the client never adopts a session the server would refuse to act on.
+ */
+const SECOND_FACTOR_PENDING_SESSION_STATES = new Set([
+    AuthenticationSessionState.MFA_REQUIRED,
+    AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED,
+]);
 /**
  * AuthSession Context
  * @internal - Use useAuthSession() hook instead of accessing this directly
  */
 export const AuthSessionContext = createContext(undefined);
+/**
+ * How long before its challenge expires a waiting autofill request is stopped and restarted. Long enough
+ * for the restart's request to land and a fresh challenge to be issued before the old one is gone.
+ */
+const PASSKEY_AUTOFILL_REARM_MARGIN_MS = 15_000;
+/**
+ * Tell the browser a passkey is unknown to this application, so it stops offering it.
+ *
+ * Feature-detected and best-effort: `PublicKeyCredential.signalUnknownCredential` is a WebAuthn Level 3
+ * addition not every browser ships, and a browser that cannot hear the signal loses nothing — the
+ * sign-in already failed. Called only when the server said the credential is UNKNOWN, never on a
+ * signature or user-verification refusal, which would hide a passkey the application still holds.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — `PublicKeyCredential.signalUnknownCredential()`: "Call this static method on the client-side if your server indicates that a presented credential ID is unknown."
+ */
+function signalUnknownPasskeyCredential(rpId, credentialId) {
+    const credentialApi = globalThis.PublicKeyCredential;
+    if (!rpId || typeof credentialApi?.signalUnknownCredential !== 'function')
+        return;
+    void credentialApi.signalUnknownCredential({ rpId, credentialId }).catch(() => undefined);
+}
 export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }) => {
     const tokenStorage = useMemo(() => tokenStorageProp ?? new PersistentSessionTokenStorage(), [tokenStorageProp]);
     const { setAuthToken: setResourcesAuthToken, setTokenRenewalHandler: setResourcesTokenRenewalHandler, setConsumableToken: setResourcesConsumableToken } = useResourceRegistry();
     const { handleError } = useError();
     const { tComponent, isReady } = useI18n({ component: [FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE] });
+    // `auth.error` is rendered verbatim by the auth screens, so every failure written into it goes through
+    // the shared resolver: localized, and never the error's raw `message` / server `details.message`.
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
+    /** The MFA surface's own words for a failed second factor, used where the error names nothing more precise. */
+    const mfaFailureLabel = useCallback(() => resolveComponentLabel({ tComponent, componentType: FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE, key: MfaChallengeLabel.ERROR_GENERIC }), [tComponent]);
     const { appConfig } = useApplication();
     const { connect, disconnect, refreshAuth: refreshWebSocketAuth, switchOrganization: wsSwitchOrganization } = useWebSocket();
     const { clearAnonymousSession } = useAnonymousSession();
     const hasInitializedRef = useRef(false);
     const broadcastChannelRef = useRef(null);
     const refreshInFlightRef = useRef(null);
+    // Identification owns account-specific methods, session and organization branding. Only the
+    // latest request may publish them; logout or provider disposal retires outstanding requests.
+    const identificationGenerationRef = useRef(0);
+    /**
+     * How many passkey ceremonies the PERSON started are open (the button, a second-factor passkey step).
+     * An autofill ceremony checks it after its options arrive and steps aside rather than starting a
+     * WebAuthn request that would abort their prompt.
+     */
+    const personStartedPasskeyCeremoniesRef = useRef(0);
+    useEffect(() => () => { identificationGenerationRef.current += 1; }, []);
     // Holds the latest `tokenRenewalHandler` so `connectWebSocket` (defined far
     // earlier in this component) can hand the WebSocket layer a stable
     // `onAuthenticationError` callback without a definition-order / stale-closure
@@ -82,6 +115,26 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             clearAnonymousSession();
         }
     };
+    /**
+     * An answer parked the account at organization onboarding (#1090): remember the session the onboarding step
+     * completes on, and drop every second-factor continuation — nothing more is owed there, and a leftover
+     * `mfaRequired` would send the screens to a challenge. Nothing is signed in and no token is touched.
+     */
+    const adoptOrganizationOnboardingSession = (sessionId) => {
+        setAuth(a => ({
+            ...a,
+            isLoading: false,
+            error: null,
+            sessionId: null,
+            onboardingSessionId: sessionId,
+            mfaRequired: false,
+            mfaSessionId: null,
+            availableMfaMethods: [],
+            availableEnrollmentMethods: [],
+            enrolledSecondFactorMethods: [],
+            usableSecondFactorMethods: [],
+        }));
+    };
     /**
      * Derive WebSocket URL from appConfig runtime endpoints
      *
@@ -162,12 +215,32 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         wsSwitchOrganization(newOrgId, previousOrgId);
     }, [wsSwitchOrganization]);
     const identifyByEmail = async (email) => {
-        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        const generation = ++identificationGenerationRef.current;
+        // Starting a sign-in abandons any session this tab still remembers as owing a factor — possibly another
+        // person's, in a shared tab. Explicit for the same hard-load reason `logout` gives (#1068).
+        forgetPendingMfaSession();
+        setAuth(a => ({
+            ...a,
+            isLoading: true,
+            error: null,
+            identification: null,
+            sessionId: null,
+            sessionState: null,
+            onboardingSessionId: null,
+            mfaRequired: false,
+            mfaSessionId: null,
+            availableMfaMethods: [],
+            availableEnrollmentMethods: [],
+            enrolledSecondFactorMethods: [],
+            usableSecondFactorMethods: [],
+        }));
         logDebug('Identifying user by email', { email });
         try {
             const resp = await getManualCallsHttpClient().identifyByEmail(email);
+            if (generation !== identificationGenerationRef.current)
+                return resp;
             logDebug('User identification successful', { sessionId: resp.sessionId });
-            setAuth(a => ({
+            setAuth(a => generation !== identificationGenerationRef.current ? a : ({
                 ...a,
                 isLoading: false,
                 identification: resp,
@@ -177,12 +250,64 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             return resp;
         }
         catch (e) {
-            const msg = extractAuthErrorMessage(e, 'Identification failed');
+            if (generation !== identificationGenerationRef.current)
+                throw e;
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Identification failed', { email, message: msg });
-            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            setAuth(a => generation !== identificationGenerationRef.current ? a : ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
     };
+    /**
+     * Adopt a factor-completion response that did not stop at an MFA challenge — shared by
+     * `authenticateWithPassword` and `authenticate`, which carried two copies of this until #1009.
+     *
+     * ## A response without a token never removes one (#1009)
+     *
+     * Since #971 exactly one of two concurrent completions of the same factor mints; the other answers
+     * `success: false, retryAllowed: false`. One tab can send both — a double click, a retried request — and
+     * nothing orders their responses. The copies this replaces wrote `storeAuthTokens(resp.accessToken || null)`
+     * and `accessToken: null` on EVERY response, so a losing answer arriving after the winning one erased the
+     * token the winner had just stored and the screen read as signed out (the HttpOnly refresh cookie recovered
+     * it on the next refresh, which is why it was degraded rather than a lockout).
+     *
+     * A token-less response carries no information about a session this tab already holds — it only says this
+     * one request did not mint — so it changes nothing but the loading flag while a token is held. Removing a
+     * token belongs to the two paths that DO carry that information: an explicit sign-out (including the
+     * cross-tab `LOGOUT` broadcast) and a failed refresh. Held is read from the updater's own state, never from
+     * the `auth` closure, which is the render the losing call was issued from and predates the winner.
+     */
+    const adoptFactorCompletionResponse = (resp, sessionId) => {
+        const accessToken = resp.accessToken || null;
+        if (!accessToken) {
+            setAuth(a => (a.accessToken
+                ? { ...a, isLoading: false }
+                : { ...a, isLoading: false, sessionId: resp.success ? null : sessionId }));
+            return;
+        }
+        storeAuthTokens(accessToken);
+        getManualCallsHttpClient().setAuthToken(accessToken);
+        setResourcesAuthToken(accessToken);
+        if (resp.success) {
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken,
+                isRestoringSession: true,
+                sessionRestored: false,
+                sessionId: null,
+            }));
+            hasInitializedRef.current = true;
+        }
+        else {
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken,
+                sessionId,
+            }));
+        }
+    };
     const authenticateWithPassword = async (email, password) => {
         setAuth(a => ({ ...a, isLoading: true, error: null }));
         logDebug('Authenticating with password', { email, sessionId: auth.sessionId });
@@ -203,6 +328,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 requestedIntegrations: []
             };
             const resp = await getManualCallsHttpClient().authenticate(authRequest);
+            // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(resp);
+            if (parkedOnboardingSessionId) {
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return resp;
+            }
             if (resp.requiresMFA && !resp.accessToken) {
                 setAuth(a => ({
                     ...a,
@@ -216,36 +347,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 }));
                 return resp;
             }
-            const accessToken = resp.accessToken || null;
-            storeAuthTokens(accessToken);
-            if (accessToken) {
-                getManualCallsHttpClient().setAuthToken(accessToken);
-                setResourcesAuthToken(accessToken);
-            }
-            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken });
-            if (resp.success && accessToken) {
-                setAuth(a => ({
-                    ...a,
-                    isLoading: false,
-                    accessToken,
-                    isRestoringSession: true,
-                    sessionRestored: false,
-                    sessionId: null,
-                }));
-                hasInitializedRef.current = true;
-            }
-            else {
-                setAuth(a => ({
-                    ...a,
-                    isLoading: false,
-                    accessToken,
-                    sessionId: resp.success ? null : sessionId,
-                }));
-            }
+            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!resp.accessToken });
+            adoptFactorCompletionResponse(resp, sessionId);
             return resp;
         }
         catch (e) {
-            const msg = extractAuthErrorMessage(e, 'Authentication failed');
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Authentication failed', { email, message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
@@ -263,6 +370,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             }
             const withSession = { ...request, sessionId };
             const resp = await getManualCallsHttpClient().authenticate(withSession);
+            // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(resp);
+            if (parkedOnboardingSessionId) {
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return resp;
+            }
             if (resp.requiresMFA && !resp.accessToken) {
                 setAuth(a => ({
                     ...a,
@@ -276,36 +389,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 }));
                 return resp;
             }
-            const accessToken = resp.accessToken || null;
-            storeAuthTokens(accessToken);
-            if (accessToken) {
-                getManualCallsHttpClient().setAuthToken(accessToken);
-                setResourcesAuthToken(accessToken);
-            }
-            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken, method: request.method });
-            if (resp.success && accessToken) {
-                setAuth(a => ({
-                    ...a,
-                    isLoading: false,
-                    accessToken,
-                    isRestoringSession: true,
-                    sessionRestored: false,
-                    sessionId: null,
-                }));
-                hasInitializedRef.current = true;
-            }
-            else {
-                setAuth(a => ({
-                    ...a,
-                    isLoading: false,
-                    accessToken,
-                    sessionId: resp.success ? null : sessionId,
-                }));
-            }
+            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!resp.accessToken, method: request.method });
+            adoptFactorCompletionResponse(resp, sessionId);
             return resp;
         }
         catch (e) {
-            const msg = extractAuthErrorMessage(e, 'Authentication failed');
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Authentication failed', { method: request.method, message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
@@ -337,24 +426,27 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
      * STATIC_WEBSITE, TECH_DOC), so no native-SDK / Capacitor / Electron variants
      * exist for this method.
      */
-    const initiateOAuth2Login = useCallback(async (providerRef, returnUrl) => {
+    const initiateOAuth2Login = useCallback(async (providerRef, returnUrl, acceptedGovernedDocumentReleaseIds) => {
         logDebug('Initiating OAuth2 login', { providerRef, returnUrl });
         setAuth(a => ({ ...a, isLoading: true, error: null }));
         try {
-            const { authorizationUrl } = await getManualCallsHttpClient().getOAuth2AuthorizationUrl(providerRef, returnUrl);
+            const { authorizationUrl } = await getManualCallsHttpClient()
+                .getOAuth2AuthorizationUrl(providerRef, returnUrl, undefined, acceptedGovernedDocumentReleaseIds);
             logDebug('Redirecting to OAuth2 provider', { providerRef, authorizationUrl });
             window.location.href = authorizationUrl;
         }
         catch (e) {
-            const msg = e?.message || 'Failed to initiate OAuth2 login';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'OAuth2 login initiation failed', { providerRef, message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [handleError]);
+    }, [handleError, toUserFacingErrorMessage]);
     /**
      * Exchange a single-use AUTH_CODE_EXCHANGE consumable token for a JWT pair
-     * via `POST /auth/token/exchange`.
+     * via `POST /auth/token/exchange` — or, for a federated sign-in the backend
+     * parked because the account still owes its organization (#1103), for the
+     * onboarding session it must complete (`auth.onboardingSessionId`; no token).
      *
      * Renamed from `handleOAuth2Callback` in cross-app-jwt-propagation
      * Step 5's deferred refactor pass — the method handles BOTH issuance
@@ -392,6 +484,16 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         setAuth(a => ({ ...a, isLoading: true, error: null }));
         try {
             const response = await getManualCallsHttpClient().exchangeAuthCode(code);
+            // #1103: a federated sign-in by an account that still owes its organization — onboarding comes first.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
+            if (parkedOnboardingSessionId) {
+                logDebug('Code exchange parked the federated sign-in at organization onboarding');
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return;
+            }
+            if (!('accessToken' in response)) {
+                throw new Error('The code exchange answered with neither a sign-in nor a parked onboarding session.');
+            }
             const { accessToken, returnPath, sourceFrontendServiceName, targetServiceKey } = response;
             storeAuthTokens(accessToken);
             getManualCallsHttpClient().setAuthToken(accessToken);
@@ -442,12 +544,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             hasInitializedRef.current = true;
         }
         catch (e) {
-            const msg = e?.message || 'OAuth2 authentication failed';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'OAuth2 callback failed', { message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError]);
+    }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);
     /**
      * Handle email verification by exchanging the verification token for JWT tokens.
      * Called from the /confirm-email page after the user clicks the verification link.
@@ -475,6 +577,10 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 }));
                 hasInitializedRef.current = true;
             }
+            else if (parkedOrganizationOnboardingSessionId(response)) {
+                logDebug('Email verification parked the registrant at organization onboarding', { state: response.state });
+                adoptOrganizationOnboardingSession(response.sessionId);
+            }
             else {
                 logDebug('Email verification succeeded but tokens not issued — pipeline requires further steps', {
                     state: response.state,
@@ -495,12 +601,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             }
         }
         catch (e) {
-            const msg = e?.message || 'Email verification failed';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Email verification failed', { message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError]);
+    }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);
     const acceptInvitation = useCallback(async (params) => {
         logDebug('Handling invitation acceptance', { hasPassword: !!params.password, credentialMethod: params.credentialMethod });
         setAuth(a => ({ ...a, isLoading: true, error: null }));
@@ -550,15 +656,86 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             // the caller so it can run the browser ceremony and complete it against the authenticated
             // `/auth/passkey/register/verify` route (the access token was just set on the HTTP client
             // above). Present only on the passkey path's session-issued branch; undefined otherwise.
-            return { passkeyRegistrationOptions: response.passkeyRegistrationOptions };
+            // `signInRequired` (#1158): the invitation was accepted and no session was issued; the caller sends the invitee to sign in.
+            return { passkeyRegistrationOptions: response.passkeyRegistrationOptions, signInRequired: response.nextStep === AuthNextStep.SIGN_IN_REQUIRED };
         }
         catch (e) {
-            const msg = e?.message || 'Invitation acceptance failed';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Invitation acceptance failed', { message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError]);
+    }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);
+    /*
+     * Public registration (#972). The registration screen used to call the HTTP client itself and
+     * announce "check your email" whatever came back, so the two outcomes that carry a SESSION were lost:
+     * a deferred-verification registrant who had just been signed in, and one whose user type requires a
+     * second factor they must enroll first — who never reached the enrollment gate that completes their
+     * registration session (#603).
+     *
+     * The answer is classified ONCE, by `classifyRegistrationOutcome`, and the screen renders from the same
+     * value — so what the context adopted and what the screen shows cannot disagree.
+     *
+     * Deliberately NOT routed through `handleError`, and `auth.isLoading` / `auth.error` are left alone:
+     * a refused registration is a form outcome (a taken slug, a password policy) the screen shows inline,
+     * and a global error surface would duplicate it.
+     */
+    const registerAccount = useCallback(async (params) => {
+        logDebug('Handling public registration', { hasPassword: !!params.password });
+        const response = await getManualCallsHttpClient().register(params);
+        const outcome = classifyRegistrationOutcome(response);
+        if (outcome === RegistrationOutcome.SIGNED_IN) {
+            const accessToken = response.accessToken;
+            storeAuthTokens(accessToken);
+            getManualCallsHttpClient().setAuthToken(accessToken);
+            setResourcesAuthToken(accessToken);
+            logDebug('Registration signed the registrant in, tokens stored', { state: response.state });
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken,
+                isRestoringSession: true,
+                sessionRestored: false,
+                sessionId: null,
+                mfaRequired: false,
+                mfaSessionId: null,
+                availableMfaMethods: [],
+                availableEnrollmentMethods: [],
+                enrolledSecondFactorMethods: [],
+                usableSecondFactorMethods: [],
+                error: null,
+            }));
+            hasInitializedRef.current = true;
+        }
+        else if (outcome === RegistrationOutcome.MFA_ENROLLMENT_REQUIRED) {
+            logDebug('Registration owes a second-factor enrollment before sign-in', { state: response.state, nextStep: response.nextStep });
+            /*
+             * The same continuation state `handleEmailVerification` and `acceptInvitation` set for this answer.
+             * A brand-new account has enrolled nothing, so nothing is usable — which is precisely what sends
+             * `useMfaContinuationNavigation` to the enrollment gate rather than to a challenge.
+             */
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                sessionId: null,
+                mfaRequired: true,
+                mfaSessionId: response.sessionId,
+                availableMfaMethods: [],
+                availableEnrollmentMethods: response.availableEnrollmentMethods || [],
+                enrolledSecondFactorMethods: [],
+                usableSecondFactorMethods: [],
+                error: null,
+            }));
+        }
+        else if (outcome === RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED) {
+            logDebug('Registration parked the registrant at organization onboarding', { state: response.state });
+            adoptOrganizationOnboardingSession(response.sessionId);
+        }
+        else {
+            logDebug('Registration answered without a session to adopt', { outcome, state: response.state, nextStep: response.nextStep });
+        }
+        return outcome;
+    }, [setResourcesAuthToken]);
     /**
      * Handle magic link verification — verifies the token and auto-logs in the user.
      * Called from the /auth/magic-link/verify page after the user clicks the email link.
@@ -569,6 +746,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         setAuth(a => ({ ...a, isLoading: true, error: null }));
         try {
             const response = await getManualCallsHttpClient().magicLinkVerify(token, email);
+            // #1091 / #1089: the link signs in an account that still owes its organization — onboarding comes first.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
+            if (parkedOnboardingSessionId) {
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return response;
+            }
             if (response.requiresMFA && !response.accessToken) {
                 setAuth(a => ({
                     ...a,
@@ -608,12 +791,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             return response;
         }
         catch (e) {
-            const msg = e?.message || 'Magic link verification failed';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'Magic link verification failed', { message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError]);
+    }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);
     /**
      * Handle MFA second-factor verification.
      * Dispatches to the appropriate OTP verify method based on the selected auth method.
@@ -632,6 +815,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 rememberMe: false,
                 requestedIntegrations: [],
             });
+            // #1091: the second factor completed a sign-in whose account still owes its organization.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
+            if (parkedOnboardingSessionId) {
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return response;
+            }
             // Auth-hardening Slice A Step 6 (2026-04-13): cookie-only contract
             // — see the magic-link gate above for the full rationale.
             if (response.success && response.accessToken) {
@@ -655,20 +844,196 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 hasInitializedRef.current = true;
             }
             else {
-                setAuth(a => ({ ...a, isLoading: false, error: response.error || 'MFA verification failed' }));
+                // `response.error` is server-authored English; the MFA surface says what failed.
+                setAuth(a => ({ ...a, isLoading: false, error: toUserFacingErrorMessage(null, mfaFailureLabel()) }));
             }
             return response;
         }
         catch (e) {
-            const msg = e?.message || 'MFA verification failed';
+            const msg = toUserFacingErrorMessage(e, mfaFailureLabel());
             handleError(e, 'MFA verification failed', { method, message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError]);
-    const handlePasskeyAuth = useCallback(async (sessionId, factorLevel = 'first') => {
-        logDebug('Handling passkey authentication', { sessionId, factorLevel });
+    }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage, mfaFailureLabel]);
+    /*
+     * The enrollment gate's recovery after a hard load (#1033). The MFA challenge URL is self-sufficient —
+     * it carries `sessionId` and re-reads the session from the server — but the gate it hands off to read
+     * its session ONLY from this context, which a hard load leaves empty, so it bounced a valid
+     * enrollment-pending session to sign-in.
+     *
+     * Keyed on the session's STATE, the same question the server asks before it lets an enrollment
+     * ceremony run on a session (`auth-jwt-guard.backend.service.ts`, `extractFromSessionOrJwt`). NOT on
+     * `requiresMFA`: that flag is cleared when a LOGIN's second factor completes, but a registration's
+     * completion writes its terminal state without clearing it, so keying on the flag would re-open a
+     * finished session as one that owes a factor — and offer enrollments the server then refuses.
+     */
+    const adoptPendingMfaSession = useCallback((sessionId, sessionState) => {
+        if (!sessionState?.state || !SECOND_FACTOR_PENDING_SESSION_STATES.has(sessionState.state)) {
+            return false;
+        }
+        setAuth(a => ({
+            ...a,
+            mfaRequired: true,
+            mfaSessionId: sessionId,
+            availableMfaMethods: sessionState.availableSecondFactorMethods || [],
+            availableEnrollmentMethods: sessionState.availableEnrollmentMethods || [],
+            enrolledSecondFactorMethods: sessionState.enrolledSecondFactorMethods || [],
+            usableSecondFactorMethods: sessionState.usableSecondFactorMethods || [],
+        }));
+        return true;
+    }, []);
+    /*
+     * The registration-time MFA enrollment's sign-in (#603). A registrant who must enroll a second factor
+     * before their first session has already proven the factor by enrolling it, so the backend completes
+     * the registration session inside the enrollment ceremony and returns the access token there — there
+     * is no challenge to answer. This is the ONE place that token is adopted, with the same state
+     * transition `handleMfaVerify` applies on a completed challenge, so the enrollment screen does not
+     * re-implement token storage and the two ways of finishing MFA leave identical auth state.
+     */
+    const completeEnrollmentSession = useCallback((settlement) => {
+        // The enrollment settled a registration session at ONBOARDING_PENDING (#1011): the organization comes next.
+        const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(settlement);
+        if (parkedOnboardingSessionId) {
+            logDebug('Enrollment parked the registration session at organization onboarding');
+            adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+            return true;
+        }
+        if (!settlement?.accessToken || settlement.state !== AuthenticationSessionState.COMPLETED) {
+            return false;
+        }
+        const client = getManualCallsHttpClient();
+        storeAuthTokens(settlement.accessToken);
+        client.setAuthToken(settlement.accessToken);
+        setResourcesAuthToken(settlement.accessToken);
+        logDebug('Enrollment completed the registration session, tokens stored');
+        setAuth(a => ({
+            ...a,
+            isLoading: false,
+            accessToken: settlement.accessToken,
+            isRestoringSession: true,
+            sessionRestored: false,
+            sessionId: null,
+            mfaRequired: false,
+            mfaSessionId: null,
+            availableMfaMethods: [],
+            availableEnrollmentMethods: [],
+            enrolledSecondFactorMethods: [],
+            usableSecondFactorMethods: [],
+            error: null,
+        }));
+        hasInitializedRef.current = true;
+        return true;
+    }, [setResourcesAuthToken]);
+    /*
+     * The organization-onboarding step's completion (#1090). The parked session is the context's own
+     * (`auth.onboardingSessionId`), never a screen's argument: every answer that parks one adopts it here, so the
+     * step cannot be pointed at a session this tab did not receive. The completion consumes the session and mints
+     * exactly once (#1008), so the tokens are adopted with the same transition every other completed sign-in
+     * applies, and the parked session is cleared in the same write.
+     */
+    /**
+     * Run one onboarding completion and adopt its answer (#1090, #1374). Both completion doors share it: an answer
+     * carrying a token signs the account in exactly as a completed sign-in does, and clears the parked session; an
+     * answer without one is the session still parked on another obligation — no longer an error since #1374 — and
+     * the step moves on to what `pendingObligations` names.
+     */
+    const runOnboardingCompletion = useCallback(async (complete) => {
+        const sessionId = auth.onboardingSessionId;
+        if (!sessionId) {
+            throw new Error('No session is parked at onboarding.');
+        }
         setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const client = getManualCallsHttpClient();
+            const response = await complete(sessionId);
+            if (!response.accessToken) {
+                setAuth(a => ({ ...a, isLoading: false }));
+                logDebug('Onboarding obligation completed; the session stays parked on the rest', { pendingObligations: response.pendingObligations });
+                return { signedIn: false, pendingObligations: response.pendingObligations ?? [] };
+            }
+            storeAuthTokens(response.accessToken);
+            client.setAuthToken(response.accessToken);
+            setResourcesAuthToken(response.accessToken);
+            logDebug('Onboarding completed, tokens stored', { organizationId: response.organizationId });
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken: response.accessToken,
+                isRestoringSession: true,
+                sessionRestored: false,
+                sessionId: null,
+                onboardingSessionId: null,
+                mfaRequired: false,
+                mfaSessionId: null,
+                availableMfaMethods: [],
+                availableEnrollmentMethods: [],
+                enrolledSecondFactorMethods: [],
+                usableSecondFactorMethods: [],
+                error: null,
+            }));
+            hasInitializedRef.current = true;
+            return { signedIn: true, pendingObligations: [] };
+        }
+        catch (e) {
+            // Rendered by the onboarding step itself; `auth.error` is left alone so no global surface duplicates it.
+            // A spent session can never complete, so it is forgotten — otherwise every guarded screen would keep
+            // routing back to a form whose every submission is refused.
+            if (isSpentOrganizationOnboardingSession(e)) {
+                leaveOrganizationOnboardingForSignIn();
+            }
+            else {
+                setAuth(a => ({ ...a, isLoading: false }));
+            }
+            throw e;
+        }
+    }, [auth.onboardingSessionId, setResourcesAuthToken]);
+    const completeOrganizationOnboarding = useCallback((organizationName) => runOnboardingCompletion((sessionId) => getManualCallsHttpClient().completeOrgOnboarding(sessionId, organizationName)), [runOnboardingCompletion]);
+    const completeProfileOnboarding = useCallback((firstName, lastName) => runOnboardingCompletion((sessionId) => getManualCallsHttpClient().completeProfileOnboarding(sessionId, firstName, lastName)), [runOnboardingCompletion]);
+    /*
+     * Leaving onboarding without completing it is a return to a FRESH sign-in, not just forgetting the parked
+     * session. A sign-in that was parked still holds the identification it started from (email, the old session
+     * id), and the sign-in screen renders straight to that account's credential form when an identification is
+     * present — a form whose every submission is refused, because the parked session replaced the one it needs.
+     * So this resets the sign-in state exactly as starting a new identification does (`identifyByEmail`): it
+     * invalidates any in-flight identification, forgets a remembered pending second factor, and clears the
+     * identification with the parked session.
+     */
+    const leaveOrganizationOnboardingForSignIn = () => {
+        identificationGenerationRef.current += 1;
+        forgetPendingMfaSession();
+        setAuth(a => ({
+            ...a,
+            isLoading: false,
+            error: null,
+            identification: null,
+            sessionId: null,
+            sessionState: null,
+            onboardingSessionId: null,
+        }));
+    };
+    const abandonOrganizationOnboarding = useCallback(() => {
+        leaveOrganizationOnboardingForSignIn();
+    }, []);
+    /**
+     * The ONE passkey sign-in ceremony, behind three entries: an identified session's passkey method
+     * (`handlePasskeyAuth`), the sign-in-with-a-passkey button and passkey autofill (`signInWithPasskey`).
+     *
+     * The server answers `{ sessionId, options }`, and the verification presents THAT session: without a
+     * `sessionId` the options door opens the sign-in itself, and the challenge is bound to the session it
+     * opened. The account that signs in is the one the chosen passkey belongs to.
+     *
+     * Autofill (`conditional`) differs in one respect: until the person picks a passkey nothing they did
+     * has failed, so a refusal before then — the page moving on, a network error, a browser that aborts —
+     * is re-thrown without touching the page's error or loading state.
+     */
+    const runPasskeyCeremony = useCallback(async ({ sessionId, factorLevel, conditional, }) => {
+        logDebug('Handling passkey authentication', { sessionId, factorLevel, conditional });
+        if (!conditional) {
+            setAuth(a => ({ ...a, isLoading: true, error: null }));
+        }
+        let credentialPresented = false;
+        let autofillExpired = false;
         const componentType = factorLevel === 'first' ? FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH : FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE;
         const t = (key) => resolveComponentLabel({
             tComponent,
@@ -679,10 +1044,75 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         const passkeyCancelledLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_CANCELLED : MfaChallengeLabel.PASSKEY_CANCELLED;
         try {
             const client = getManualCallsHttpClient();
-            const options = await client.passkeyAuthOptions(sessionId);
-            const credential = await startAuthentication({ optionsJSON: options });
-            const verifyBody = { response: credential, sessionId, factorLevel };
-            const response = await client.passkeyAuthVerify(verifyBody);
+            const begun = await client.passkeyAuthOptions(sessionId);
+            const optionsJSON = begun.options;
+            if (conditional && personStartedPasskeyCeremoniesRef.current > 0) {
+                // The person opened a passkey prompt while this autofill was still loading its options. Starting
+                // our request now would abort theirs (`startAuthentication` cancels any pending ceremony), so step
+                // aside. Residual: `startAuthentication` awaits the browser's `isConditionalMediationAvailable()`
+                // before it creates its abort signal, so a button prompt opened DURING that browser call could
+                // still be aborted. It is practically unreachable: the counter rises before the button's own
+                // options request, so the button would need its whole network round trip to finish inside it.
+                throw new PasskeyAutofillSupersededError();
+            }
+            // Autofill waits indefinitely; its challenge does not. Stop the wait just before the server's
+            // challenge (and the session bound to it) runs out, so the page can start a fresh one instead of
+            // letting the person pick a passkey that can no longer be redeemed.
+            let autofillExpiredTimer;
+            const rearmInMs = (begun.expiresInSeconds ?? 0) * 1000 - PASSKEY_AUTOFILL_REARM_MARGIN_MS;
+            const armAutofillExpiry = conditional && rearmInMs > 0;
+            // A WALL-CLOCK deadline as well as the timer: timers do not run while a laptop sleeps and are
+            // throttled in background tabs, so a tab woken past its deadline would offer a passkey whose
+            // session is already gone. The page becoming visible or focused re-checks the clock.
+            const autofillDeadline = Date.now() + rearmInMs;
+            const expireAutofill = () => {
+                if (autofillExpired)
+                    return;
+                autofillExpired = true;
+                WebAuthnAbortService.cancelCeremony();
+            };
+            const onPageResumed = () => {
+                if (Date.now() >= autofillDeadline)
+                    expireAutofill();
+            };
+            if (armAutofillExpiry) {
+                autofillExpiredTimer = setTimeout(expireAutofill, rearmInMs);
+                if (typeof document !== 'undefined')
+                    document.addEventListener('visibilitychange', onPageResumed);
+                if (typeof window !== 'undefined')
+                    window.addEventListener('focus', onPageResumed);
+            }
+            let credential;
+            try {
+                credential = await startAuthentication({ optionsJSON, useBrowserAutofill: conditional });
+            }
+            finally {
+                clearTimeout(autofillExpiredTimer);
+                if (armAutofillExpiry) {
+                    if (typeof document !== 'undefined')
+                        document.removeEventListener('visibilitychange', onPageResumed);
+                    if (typeof window !== 'undefined')
+                        window.removeEventListener('focus', onPageResumed);
+                }
+            }
+            credentialPresented = true;
+            if (conditional) {
+                setAuth(a => ({ ...a, isLoading: true, error: null }));
+            }
+            // `factorLevel` here is the UI vocabulary; the wire carries `AuthFactorLevel`. Forwarding it
+            // verbatim was a 400 on every passkey sign-in (see `authFactorLevelForUiLevel`).
+            const response = await client.passkeyAuthVerify({ response: credential, sessionId: begun.sessionId, factorLevel: authFactorLevelForUiLevel(factorLevel) });
+            // The application no longer holds this passkey (deleted, or the account is gone): tell the browser,
+            // so it stops offering a credential that can never sign in.
+            if (response.passkeyCredentialUnknown) {
+                signalUnknownPasskeyCredential(optionsJSON?.rpId, credential.id);
+            }
+            // #1091: a passkey sign-in by an account that still owes its organization resumes onboarding.
+            const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
+            if (parkedOnboardingSessionId) {
+                adoptOrganizationOnboardingSession(parkedOnboardingSessionId);
+                return response;
+            }
             if (response.requiresMFA && !response.accessToken) {
                 setAuth(a => ({
                     ...a,
@@ -720,28 +1150,42 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 hasInitializedRef.current = true;
             }
             else {
-                setAuth(a => ({ ...a, isLoading: false, error: response.error || t(passkeyErrorLabel) }));
+                // `response.error` is server-authored English; the passkey surface says what failed.
+                setAuth(a => ({ ...a, isLoading: false, error: toUserFacingErrorMessage(null, t(passkeyErrorLabel)) }));
             }
             return response;
         }
         catch (e) {
-            const err = e;
-            let msg;
-            if (err?.name === 'NotAllowedError') {
-                msg = t(passkeyCancelledLabel);
-            }
-            else if (isWildoBackendError(e)) {
-                const wErr = e;
-                msg = wErr.userGuidance?.explanation || wErr.message || t(passkeyErrorLabel);
-            }
-            else {
-                msg = err?.message || t(passkeyErrorLabel);
+            if (conditional && !credentialPresented) {
+                // Autofill that never produced a passkey: the page moved on, the browser aborted the wait, or
+                // its challenge was about to expire. Nothing the person did failed, so the page is left exactly
+                // as it was — and only the expiry case asks the page to start again.
+                throw autofillExpired ? new PasskeyAutofillExpiredError() : e;
             }
+            // A cancelled browser prompt is the one failure this surface names itself. Everything else goes
+            // through the shared resolver — a `400 validation` used to reach the screen as the word `validation`.
+            const msg = e?.name === 'NotAllowedError'
+                ? t(passkeyCancelledLabel)
+                : toUserFacingErrorMessage(e, t(passkeyErrorLabel));
             handleError(e, 'Passkey authentication failed', { sessionId, message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [setResourcesAuthToken, handleError, tComponent]);
+    }, [setResourcesAuthToken, handleError, tComponent, toUserFacingErrorMessage]);
+    /** A ceremony the person started: counted while open, so a loading autofill steps aside for it. */
+    const runPersonStartedPasskeyCeremony = useCallback(async (input) => {
+        personStartedPasskeyCeremoniesRef.current += 1;
+        try {
+            return await runPasskeyCeremony({ ...input, conditional: false });
+        }
+        finally {
+            personStartedPasskeyCeremoniesRef.current -= 1;
+        }
+    }, [runPasskeyCeremony]);
+    const handlePasskeyAuth = useCallback((sessionId, factorLevel = 'first') => runPersonStartedPasskeyCeremony({ sessionId, factorLevel }), [runPersonStartedPasskeyCeremony]);
+    const signInWithPasskey = useCallback((mediation = PasskeySignInMediation.MODAL) => mediation === PasskeySignInMediation.CONDITIONAL
+        ? runPasskeyCeremony({ factorLevel: 'first', conditional: true })
+        : runPersonStartedPasskeyCeremony({ factorLevel: 'first' }), [runPasskeyCeremony, runPersonStartedPasskeyCeremony]);
     /**
      * W7.3b: Exchange a consumable token for a one-off session.
      * Authenticates via the backend exchange endpoint, sets up HTTP clients
@@ -765,6 +1209,7 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 tokenStorage.setOrganizationId(context.organizationId);
             }
             connectWebSocket(accessToken, context.organizationId, consumableTokenValue);
+            identificationGenerationRef.current += 1;
             setAuth({
                 ...EMPTY_AUTH_STATE,
                 accessToken,
@@ -783,14 +1228,42 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             logDebug('One-off token exchange successful', { tokenType: context.tokenType });
         }
         catch (e) {
-            const msg = e?.message || 'One-off token exchange failed';
+            const msg = toUserFacingErrorMessage(e);
             handleError(e, 'One-off token exchange failed', { message: msg });
             setAuth(a => ({ ...a, isLoading: false, error: msg }));
             throw e;
         }
-    }, [tokenStorage, setResourcesAuthToken, setResourcesConsumableToken, connectWebSocket, handleError]);
+    }, [tokenStorage, setResourcesAuthToken, setResourcesConsumableToken, connectWebSocket, handleError, toUserFacingErrorMessage]);
+    /*
+     * The ONE writer of the tab-scoped pending-MFA-session copy (#1068) — see
+     * `pending-mfa-session-storage.frontend.utils.ts` for why the copy lives in `sessionStorage`.
+     *
+     * Driven by auth-state TRANSITIONS rather than by the ~six call sites that set `mfaSessionId`, so a path
+     * added tomorrow is remembered without anyone remembering to remember it:
+     * - a session that owes a second factor and has no token → remember it;
+     * - that session going away (completion, identification restarting, logout) or a token arriving → forget.
+     *
+     * The ref makes "going away" a transition rather than a state. On a hard load the context starts empty
+     * with nothing remembered in memory, and forgetting on that EMPTY state would erase the very entry the
+     * enrollment gate is about to recover. Terminal acts that must forget even then (logout, a new
+     * identification) forget explicitly.
+     */
+    const rememberedPendingMfaSessionIdRef = useRef(null);
+    useEffect(() => {
+        const pendingSessionId = auth.mfaRequired && !auth.accessToken ? auth.mfaSessionId : null;
+        if (pendingSessionId) {
+            rememberPendingMfaSession({ sessionId: pendingSessionId, email: auth.identification?.email ?? '' });
+            rememberedPendingMfaSessionIdRef.current = pendingSessionId;
+            return;
+        }
+        if (rememberedPendingMfaSessionIdRef.current !== null || auth.accessToken) {
+            forgetPendingMfaSession();
+            rememberedPendingMfaSessionIdRef.current = null;
+        }
+    }, [auth.mfaRequired, auth.mfaSessionId, auth.accessToken, auth.identification?.email]);
     const logout = useCallback(() => {
         logDebug('Logging out user');
+        identificationGenerationRef.current += 1;
         // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token now travels
         // via the `__wildo_refresh` `HttpOnly` cookie. JS can't read it (and
         // doesn't need to): the cookie auto-attaches via `withCredentials: true`
@@ -813,6 +1286,9 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         setResourcesConsumableToken(null);
         setResourcesAuthToken(null);
         tokenStorage.clear();
+        // Explicit, not left to the transition effect: after a hard load nothing is remembered in memory, so
+        // the effect would not see a session going away — and a signed-out tab must not recover one (#1068).
+        forgetPendingMfaSession();
         setAuth(EMPTY_AUTH_STATE);
         hasInitializedRef.current = false;
         logger.info('User logged out successfully');
@@ -1017,6 +1493,7 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             }
             if (type === 'LOGOUT') {
                 logDebug('Received logout signal from another tab');
+                identificationGenerationRef.current += 1;
                 disconnect();
                 tokenStorage.clear();
                 getManualCallsHttpClient().setConsumableToken(null);
@@ -1077,11 +1554,18 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         // Email verification
         handleEmailVerification,
         acceptInvitation,
+        registerAccount,
         // Magic link verification
         handleMagicLinkVerify,
         // MFA verification
         handleMfaVerify,
+        completeEnrollmentSession,
+        adoptPendingMfaSession,
+        completeOrganizationOnboarding,
+        completeProfileOnboarding,
+        abandonOrganizationOnboarding,
         handlePasskeyAuth,
+        signInWithPasskey,
         // One-off session exchange (W7.3b)
         handleOneOffTokenExchange,
         // Cross-frontend handoff context (cross-app-jwt-propagation Step 5)
@@ -1100,9 +1584,16 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         handleAuthCodeExchange,
         handleEmailVerification,
         acceptInvitation,
+        registerAccount,
         handleMagicLinkVerify,
         handleMfaVerify,
+        completeEnrollmentSession,
+        adoptPendingMfaSession,
+        completeOrganizationOnboarding,
+        completeProfileOnboarding,
+        abandonOrganizationOnboarding,
         handlePasskeyAuth,
+        signInWithPasskey,
         handleOneOffTokenExchange,
         clearCrossFrontendHandoffContext,
         markSessionRestored,