@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.6

package/dist/esm/components/auth/Auth_Register.js

@@ -1,16 +1,22 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { CorePresetNames, FrontendComponentType, UserRegisterLabel } from '@wildo-ai/presets-components-models';
-import { AuthMethod, findOrganizationTypeRegistrationCreationMatches, OrganizationNameSource, RegistrationMode, UserRegisterFormDtoSchema, AuthUtils, } from '@wildo-ai/saas-models';
+import { CorePresetNames, FrontendComponentType, UserAuthLabel, UserRegisterLabel } from '@wildo-ai/presets-components-models';
+import { OnboardingSurveyQuestionType, ProfileNamesCollectionMoment, AuthMethod, findOrganizationTypeRegistrationCreationMatches, OrganizationNameSource, RegistrationMode, UserRegisterFormDtoSchema, AuthUtils, } from '@wildo-ai/saas-models';
+import { GovernedDocumentAcceptanceMode, GovernedDocumentInteractionKind, governedDocumentAcceptanceRequiresExplicitAct, requiresApprovedGovernedDocuments, resolveInForcePublicDocument, selectGovernedDocumentReleasesInForce, } from '@wildo-ai/saas-models';
 import { ValidationMode } from '@wildo-ai/zod-decorators';
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { z } from 'zod/v4';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { Navigate, useLocation } from 'react-router-dom';
 import { useFormContext } from 'react-hook-form';
 import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
+import { GovernedDocumentAcceptanceControl, } from '../../components/compliance/GovernedDocumentAcceptanceControl.js';
 import { AutomatedForm } from '../../components/form/automated/AutomatedForm.js';
 import { extractServerValidationErrors } from '../../components/form/validation-errors/form-error-extraction.utils.js';
 import { useServerErrorInjection } from '../../components/form/validation-errors/useServerErrorInjection.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
-import { OAuthProvidersSection } from '../../components/auth/utils/OAuthProvidersSection.js';
+import { OAuthProvidersSection, SSO_PROVIDER_BRAND_META } from '../../components/auth/utils/OAuthProvidersSection.js';
+import { LabeledDivider } from '../../components/auth/utils/LabeledDivider.js';
+import { AuthMethodChoiceList } from '../../components/auth/utils/AuthMethodChoiceList.js';
+import { resolveAuthMethodChoiceLabel } from '../../components/auth/methods/auth-method-presentation.js';
 import { DEFAULT_PASSWORD_POLICY, PasswordStrengthIndicator } from '../../components/auth/utils/PasswordStrengthIndicator.js';
 import { extractPasswordPolicyErrorMessage, resolvePasswordViolationsToLabels, } from '../../components/auth/utils/resolvePasswordViolationsToLabels.js';
 import { FormLayout } from '../../components/resources/skeleton/FormLayout.js';
@@ -18,30 +24,48 @@ import { FormField } from '../../components/form/automated/FormField.js';
 import { SubmitButton } from '../../components/resources/skeleton/SubmitButton.js';
 import { Heading } from '../../components/typography/heading.js';
 import { Link } from '../../components/typography/link.js';
+import { AuthSecondaryLink } from '../../components/auth/utils/AuthSecondaryLink.js';
 import { Text } from '../../components/typography/text.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { useApplication } from '../../core/runtime/useApplication.js';
 import { appendAuthRedirectToPath, extractAuthRedirectFromSearch, resolvePostAuthRedirect, } from '../../core/security/auth-redirect.frontend.utils.js';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
+import { organizationOnboardingNavigationTarget } from '../../core/security/organization-onboarding.frontend.utils.js';
+import { useAuthSession } from '../../core/security/useAuthSession.js';
+import { RegistrationOutcome } from '../../core/security/registration-outcome.frontend.utils.js';
+import { useMfaContinuationNavigation } from '../../components/auth/utils/useMfaContinuationNavigation.js';
 import { useResolvedAuthConfig } from '../../core/security/useResolvedAuthConfig.js';
 import { collectFrontendProviderDisplayLabelKeys } from '../../core/external-providers/frontend-provider-display-label.frontend.utils.js';
-import { resolvePublicOAuthProviderEntries } from '../../components/auth/utils/oauth-provider-display-label.frontend.utils.js';
+import { resolveOAuthProviderDisplayLabel, resolvePublicOAuthProviderEntries } from '../../components/auth/utils/oauth-provider-display-label.frontend.utils.js';
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
 const RESEND_COOLDOWN_SECONDS = 60;
-// =============================================================================
-// SELF-SUFFICIENT FORM TEMPLATE
-// =============================================================================
 /**
- * Module-scope template for the registration form. Fully self-sufficient — derives
- * all runtime state from standard hooks. No `useFormTemplateContext()` call.
- *
- * - Password policy → `useResolvedAuthConfig()`
- * - Root-level form errors → `useFormContext().formState.errors.root`
- * - Labels → `useI18n()`, passed directly to `<SubmitButton>` as props
- * - Conditional fields → FormField returns null for fields not in schema
+ * The sign-up methods THIS screen can carry out, in the order they are offered (#1093). The backend
+ * implements public sign-up for exactly these three (`registerUser`); social OAuth2 is a hand-off the
+ * providers section owns, and enterprise SSO signs up through the organization. A method is offered
+ * only when the user type's `registration.allowedMethods` lists it, so an application that allows
+ * MAGIC_LINK alone gets a password-less form and never a password field.
  */
+const SELF_SIGNUP_METHODS = [AuthMethod.PASSWORD, AuthMethod.MAGIC_LINK, AuthMethod.PASSKEY];
+const RegisterConsentContext = React.createContext({
+    requiredReleases: [],
+    acceptanceMode: GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX,
+    requiredDocuments: [],
+    servedDocuments: [],
+    accepted: false,
+    setAccepted: () => { },
+    documentsRead: [],
+    markDocumentRead: () => { },
+    method: AuthMethod.PASSWORD,
+});
+/** The shared acceptance control, fed from the registration form's context. */
+const DocumentAcceptanceControl = ({ t, tComponent }) => {
+    const { method: _method, ...state } = React.useContext(RegisterConsentContext);
+    return _jsx(GovernedDocumentAcceptanceControl, { state: state, t: t, tComponent: tComponent });
+};
 const RegisterFormTemplate = () => {
     const resolvedAuth = useResolvedAuthConfig();
     const { formState } = useFormContext();
@@ -50,13 +74,150 @@ const RegisterFormTemplate = () => {
     });
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key);
     const passwordPolicy = resolvedAuth.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;
+    const { requiredReleases, acceptanceMode, accepted, method } = React.useContext(RegisterConsentContext);
+    const isPasswordSignup = method === AuthMethod.PASSWORD;
     if (!isReady)
         return null;
-    return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "email" }), _jsx(FormField, { name: "firstName" }), _jsx(FormField, { name: "lastName" }), _jsx(FormField, { name: "organizationName" }), _jsx(FormField, { name: "password" }), _jsx(FormField, { name: "confirmPassword" }), _jsx(PasswordStrengthIndicator, { fieldName: "password", policy: passwordPolicy, t: t }), formState.errors.root && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: formState.errors.root.message }) })), _jsx(SubmitButton, { label: t(UserRegisterLabel.REGISTER_BUTTON), submittingLabel: t(UserRegisterLabel.REGISTERING), fullWidth: true })] }));
+    // A password-less sign-up sets no password: its schema omits the fields (FormField renders nothing
+    // for a field the schema lacks), the strength indicator has nothing to measure, and the submit says
+    // what will happen instead — a sign-in link is emailed.
+    const submitLabel = isPasswordSignup
+        ? UserRegisterLabel.REGISTER_BUTTON
+        : method === AuthMethod.PASSKEY
+            ? UserRegisterLabel.PASSKEY_SIGNUP_BUTTON
+            : UserRegisterLabel.MAGIC_LINK_SIGNUP_BUTTON;
+    const submittingLabel = isPasswordSignup ? UserRegisterLabel.REGISTERING : UserRegisterLabel.MAGIC_LINK_SIGNUP_SENDING;
+    return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "email" }), _jsx(FormField, { name: "firstName" }), _jsx(FormField, { name: "lastName" }), _jsx(FormField, { name: "organizationName" }), (resolvedAuth.registrationConfig.additionalProfileQuestions ?? []).map((question) => (_jsx(FormField, { name: question.id }, question.id))), _jsx(FormField, { name: "password" }), _jsx(FormField, { name: "confirmPassword" }), isPasswordSignup && _jsx(PasswordStrengthIndicator, { fieldName: "password", policy: passwordPolicy, t: t }), formState.errors.root && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: formState.errors.root.message }) })), _jsx(DocumentAcceptanceControl, { t: t, tComponent: tComponent }), _jsx(SubmitButton, { label: t(submitLabel), submittingLabel: t(submittingLabel), fullWidth: true, 
+                /*
+                 * Unticked means the button is unavailable, not that the request is refused server-side. The
+                 * acceptance is what makes the record TRUE, so the honest place to insist on it is where the
+                 * person can act — and a registration that reached the backend without it would simply
+                 * record nothing, which is the correct behaviour there.
+                 *
+                 * Under `IMPLIED_BY_REGISTERING` nothing is withheld, because there is no second act to wait
+                 * for: pressing this button IS the acceptance. `governedDocumentAcceptanceRequiresExplicitAct`
+                 * is the same predicate `handleRegisterSubmit` decides on, so a button the person can press
+                 * and a request that carries the accepted ids are one decision rather than two.
+                 */
+                disabled: requiredReleases.length > 0 && governedDocumentAcceptanceRequiresExplicitAct(acceptanceMode) && !accepted })] }));
 };
 export const PublicLayoutPreset_UserRegister_Default = ({}) => {
     const { auth, initiateOAuth2Login } = useUserOrgs();
-    const { appConfig, frontendProviderRegistry } = useApplication();
+    const { registerAccount } = useAuthSession();
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
+    const { appConfig } = useApplication();
+    const [governedDocumentsAccepted, setGovernedDocumentsAccepted] = useState(false);
+    /*
+     * The reading EVIDENCE lives here, beside the act, and not inside the form — `AutomatedForm` is
+     * keyed on the sign-up method, so anything it owns is reset by choosing a different one. With the
+     * two at different lifetimes, switching method reset the evidence and kept the tick: the box
+     * rendered already ticked against a gate that no longer read as satisfied.
+     */
+    const [governedDocumentsRead, setGovernedDocumentsRead] = useState([]);
+    const markDocumentRead = useCallback((paneKey) => {
+        setGovernedDocumentsRead((read) => (read.includes(paneKey) ? read : [...read, paneKey]));
+    }, []);
+    /**
+     * How this application asks (#1258) — see {@link GovernedDocumentAcceptanceMode}.
+     *
+     * Read straight from the shared configuration, whose schema defaults it to `EXPLICIT_CHECKBOX`, so
+     * an application that has declared nothing keeps the behaviour registration shipped with. The `??`
+     * covers the config object itself being absent, which is the same answer for the same reason.
+     */
+    const acceptanceMode = appConfig.compliance?.governedDocumentAcceptanceMode ?? GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX;
+    /**
+     * The governed-document releases a registrant must ACCEPT — issue #54.
+     *
+     * Read from `compliance.governedDocumentReleases`, the same authored value the backend composes
+     * its records from, so the control and the record cannot disagree about which release was in play.
+     * `selectGovernedDocumentReleasesInForce` is the shared predicate, so "in force" means one thing
+     * across the browser, the recorder and `resolveEffectiveDocumentRelease`.
+     *
+     * Only releases permitting `CONTRACT_ACCEPTED` are here. A privacy notice permits delivery and
+     * acknowledgement, which are not things a checkbox makes true — and until an application can SERVE
+     * a document, neither is recordable at all.
+     *
+     * Evaluated once per mount rather than per render: a release taking effect mid-form would
+     * otherwise change what the registrant is agreeing to while they type.
+     */
+    const requireApprovedDocuments = requiresApprovedGovernedDocuments(appConfig.compliance);
+    const requiredGovernedDocumentReleases = useMemo(() => selectGovernedDocumentReleasesInForce(appConfig.compliance?.governedDocumentReleases ?? [], new Date().toISOString(), 
+    // The approval gate (#1565): armed, sign-up never asks for a release the public page would
+    // refuse to show.
+    { requireApproved: requireApprovedDocuments }).filter((release) => release.allowedInteractionKinds.includes(GovernedDocumentInteractionKind.CONTRACT_ACCEPTED)), 
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- pinned at mount, deliberately; see above.
+    [appConfig.compliance?.governedDocumentReleases, requireApprovedDocuments]);
+    /**
+     * Each required release paired with the public document the application publishes for it.
+     *
+     * Resolved through `resolveInForcePublicDocument`, the same function the public page uses, so a
+     * pane and the page cannot show different releases of one document. A release whose document the
+     * application does not serve publicly keeps its entry with `document: undefined` — the ABSENCE is
+     * information, and dropping the entry is what previously let a partial set look complete.
+     *
+     * Resolved in EVERY mode, not only the reading one. It costs one lookup per release and it is what
+     * lets the acceptance links name their documents whichever shape the application asked for; the
+     * text itself is only rendered under `EXPLICIT_AFTER_READING`.
+     */
+    const requiredDocuments = useMemo(() => {
+        const at = new Date().toISOString();
+        return requiredGovernedDocumentReleases.map((release) => ({
+            release,
+            document: resolveInForcePublicDocument(appConfig.compliance?.publicDocuments ?? [], release.identity.document.documentRef, at, {
+                requireApproved: requireApprovedDocuments,
+            }),
+        }));
+    }, 
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- pinned at mount with its releases, deliberately; see above.
+    [requiredGovernedDocumentReleases, appConfig.compliance?.publicDocuments, requireApprovedDocuments]);
+    /** Every public document the application serves — linked beside the control, never gated. */
+    const servedDocuments = useMemo(() => appConfig.compliance?.publicDocuments ?? [], [appConfig.compliance?.publicDocuments]);
+    /*
+     * ONE acceptance context for BOTH sign-up paths — the form and the OAuth buttons.
+     *
+     * Two provider values would be two states, and a person would tick a box on one path while the
+     * other stayed ungated. `method` is the form's own concern, so the form overrides it below; nothing
+     * the OAuth path renders reads it.
+     */
+    const acceptanceContextValue = useMemo(() => ({
+        requiredReleases: requiredGovernedDocumentReleases,
+        acceptanceMode,
+        requiredDocuments,
+        servedDocuments,
+        accepted: governedDocumentsAccepted,
+        setAccepted: setGovernedDocumentsAccepted,
+        documentsRead: governedDocumentsRead,
+        markDocumentRead,
+        method: AuthMethod.EXTERNAL_OAUTH2,
+    }), [requiredGovernedDocumentReleases, acceptanceMode, requiredDocuments, servedDocuments, governedDocumentsAccepted, governedDocumentsRead, markDocumentRead]);
+    /**
+     * Whether an act of acceptance is owed before an account may be started by ANY route.
+     *
+     * The same predicate the submit button uses, so the form and the OAuth buttons cannot disagree
+     * about whether the person has done what the application asked of them.
+     */
+    const acceptanceIsWithheld = requiredGovernedDocumentReleases.length > 0
+        && governedDocumentAcceptanceRequiresExplicitAct(acceptanceMode)
+        && !governedDocumentsAccepted;
+    /**
+     * The release ids that travel with whichever sign-up the person starts — the form, or a provider.
+     *
+     * ONE derivation for both, because the two must agree: a submit the person can press without the
+     * ids being sent records nothing while reporting success, and that asymmetry is exactly what left
+     * a social sign-up binding people with no evidence they had been asked (#1383). Under
+     * `IMPLIED_BY_REGISTERING` there is no tick to wait for, so the act of starting the sign-up IS the
+     * assent and the ids travel from the first keystroke.
+     *
+     * Empty rather than `undefined` when nothing is owed, so a caller cannot mistake "nothing to
+     * accept" for "something to accept that I forgot to read".
+     */
+    const acceptedReleaseIdsToCarry = useMemo(() => {
+        if (requiredGovernedDocumentReleases.length === 0)
+            return [];
+        if (governedDocumentAcceptanceRequiresExplicitAct(acceptanceMode) && !governedDocumentsAccepted)
+            return [];
+        return requiredGovernedDocumentReleases.map((release) => release.identity.releaseId);
+    }, [requiredGovernedDocumentReleases, acceptanceMode, governedDocumentsAccepted]);
     const resolvedAuth = useResolvedAuthConfig();
     const location = useLocation();
     const enabledSocialOAuth2Providers = useMemo(() => {
@@ -65,33 +226,35 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
         }
         return resolvePublicOAuthProviderEntries({
             publicProviders: resolvedAuth.globalAuth?.socialOAuth2Providers,
-            frontendProviderRegistry,
         });
     }, [
-        frontendProviderRegistry,
         resolvedAuth.globalAuth?.socialOAuth2Providers,
         resolvedAuth.registrationConfig.allowedMethods,
     ]);
     const socialOAuth2ProviderLabelKeys = useMemo(() => {
         return collectFrontendProviderDisplayLabelKeys(enabledSocialOAuth2Providers.map((provider) => provider.displayNameLabelKey));
     }, [enabledSocialOAuth2Providers]);
+    // Two label namespaces: this screen's own, and the sign-in screen's for the method words (#1093).
+    const i18nComponents = useMemo(() => [FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH], []);
     const { t: translate, tComponent, isReady } = useI18n({
-        component: FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER,
+        component: i18nComponents,
         keys: socialOAuth2ProviderLabelKeys,
     });
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key);
+    const tAuth = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key);
     const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);
     const loginPath = useMemo(() => appendAuthRedirectToPath(CommonRoutePaths.login, authRedirectTarget), [authRedirectTarget]);
+    const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);
     // ─── Social OAuth2 providers from resolved config ───
     const hasSocialOAuth2Providers = enabledSocialOAuth2Providers.length > 0;
     const handleOAuth2Click = useCallback(async (providerRef) => {
         try {
-            await initiateOAuth2Login(providerRef, authRedirectTarget);
+            await initiateOAuth2Login(providerRef, authRedirectTarget, acceptedReleaseIdsToCarry);
         }
         catch {
             // Error handled in AuthSessionContext
         }
-    }, [authRedirectTarget, initiateOAuth2Login]);
+    }, [acceptedReleaseIdsToCarry, authRedirectTarget, initiateOAuth2Login]);
     // ─── Form methods ref for server error injection ───
     const formMethodsRef = useRef(null);
     const { initAutoClearing, injectServerErrors, clearServerErrors } = useServerErrorInjection(formMethodsRef);
@@ -101,9 +264,26 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
     }, [initAutoClearing]);
     // ─── State ───
     const [isLoading, setIsLoading] = useState(false);
-    const [registrationComplete, setRegistrationComplete] = useState(false);
+    /**
+     * What the registration answer MEANT (#972), classified once by `registerAccount`. `null` until the
+     * form is submitted. This replaced a `registrationComplete` boolean that was set for every answer and
+     * rendered "check your email" — false for a registrant who had been signed in, and a dead end for one
+     * who owed a second-factor enrollment.
+     */
+    const [registrationOutcome, setRegistrationOutcome] = useState(null);
     const [registeredEmail, setRegisteredEmail] = useState('');
-    const [ssoRedirectHint, setSsoRedirectHint] = useState(false);
+    /*
+     * A registration session parked at the enrollment gate is routed exactly as the login screen routes
+     * the same auth state — the hook IS the login screen's routing. Gated on THIS submission's outcome so
+     * a stale `mfaRequired` left by an abandoned sign-in cannot pull a visitor off the sign-up form.
+     */
+    useMfaContinuationNavigation({
+        mfaRequired: registrationOutcome === RegistrationOutcome.MFA_ENROLLMENT_REQUIRED && auth.mfaRequired,
+        mfaSessionId: auth.mfaSessionId,
+        usableSecondFactorMethods: auth.usableSecondFactorMethods,
+        email: registeredEmail,
+        authRedirectTarget,
+    });
     // ─── Resend state ───
     const [resendStatus, setResendStatus] = useState('idle');
     const [resendCooldown, setResendCooldown] = useState(0);
@@ -134,7 +314,7 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
         }
         catch (e) {
             setResendStatus('error');
-            setResendError(e?.message || t(UserRegisterLabel.UNEXPECTED_ERROR));
+            setResendError(toUserFacingErrorMessage(e, t(UserRegisterLabel.UNEXPECTED_ERROR)));
         }
     }, [registeredEmail, resendCooldown]); // eslint-disable-line react-hooks/exhaustive-deps
     // ─── Password policy from resolved user type config ───
@@ -155,26 +335,135 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
         return resolvedAuth.registrationConfig;
     }, [resolvedAuth.registrationConfig]);
     const allowedMethods = registrationConfig.allowedMethods;
-    const showPasswordFields = allowedMethods.includes(AuthMethod.PASSWORD);
-    const showDivider = hasSocialOAuth2Providers && showPasswordFields;
+    /*
+     * The sign-up methods offered (#1093): the ones this screen carries out that the user type allows, in
+     * the screen's order — so PASSWORD is the form shown first when it is allowed, exactly as before, and a
+     * user type allowing only a password-less method gets that form with no password field at all.
+     */
+    const offeredMethods = useMemo(() => SELF_SIGNUP_METHODS.filter((method) => allowedMethods.includes(method)), [allowedMethods]);
+    const [selectedMethod, setSelectedMethod] = useState(null);
+    const activeMethod = selectedMethod !== null && offeredMethods.includes(selectedMethod) ? selectedMethod : (offeredMethods[0] ?? null);
+    const alternativeMethods = offeredMethods.filter((method) => method !== activeMethod);
+    const showForm = activeMethod !== null;
+    /*
+     * ONE control on the page, never two.
+     *
+     * The form renders the acceptance control whenever it renders at all, and both paths share one
+     * state — so where a form exists, its control is what the OAuth buttons wait on too. Rendering a
+     * second one beside the providers put two boxes, two reading panes and two sets of document links
+     * on the same screen: driven live, the terms document was paned TWICE.
+     *
+     * The OAuth-path control therefore exists for exactly the case that had nothing: an application
+     * offering only social sign-up, where `SELF_SIGNUP_METHODS` leaves no active method and no form.
+     */
+    const formCarriesAcceptance = showForm && activeMethod !== null;
+    const showPasswordFields = activeMethod === AuthMethod.PASSWORD;
+    const showDivider = hasSocialOAuth2Providers && showForm;
+    /**
+     * The application's own sign-up questions (#1371), in declaration order.
+     *
+     * This is the field set the engine does NOT own. Everything above is fixed; these come from the
+     * resolved user type's `registration.additionalProfileQuestions`.
+     */
+    /*
+     * `?? []` is not defensive noise. This screen is preset-overridable and its resolved config
+     * arrives from a boundary, so an absent list must mean "this user type asks nothing" — the same
+     * thing an empty one means. Reading it unguarded took the ENTIRE sign-up screen down with
+     * `declaredProfileQuestions is not iterable` when the field was missing, which is the worst
+     * possible failure direction for an optional question nobody declared.
+     */
+    const declaredProfileQuestions = resolvedAuth.registrationConfig.additionalProfileQuestions ?? [];
+    /*
+     * Whether this form asks for the person's names (#1374). A user type that collects them at onboarding leaves them
+     * out: they are asked once the address is proven, at the onboarding step, and the server neither requires nor
+     * expects them here. Omitted from the SCHEMA, so the template's `FormField`s render nothing — the same mechanism
+     * that makes the organization and password fields conditional.
+     */
+    const collectsNamesAtSignUp = resolvedAuth.registrationConfig.profileNamesCollectedAt !== ProfileNamesCollectionMoment.ONBOARDING;
     const registerFormSchema = useMemo(() => {
-        const baseSchema = showOrgNameField
-            ? UserRegisterFormDtoSchema
-            : UserRegisterFormDtoSchema.omit({ organizationName: true });
-        return baseSchema.refine((data) => !data.password || data.password === data.confirmPassword, { message: t(UserRegisterLabel.PASSWORD_MISMATCH), path: ['confirmPassword'] });
-    }, [t, showOrgNameField]);
+        /*
+         * The application's declared questions become real schema entries (#1371).
+         *
+         * This is what the form schema had to stop being a module constant FOR. The acceptance control
+         * above records the same constraint from the other side — it had to be built as a context
+         * BESIDE the form precisely because "a Zod form schema cannot declare a field per document
+         * without being built at render time". It is built at render time now.
+         *
+         * Extended FIRST, before the conditional omissions, so both branches below derive from one
+         * object type. Extending after the `showOrgNameField` ternary would widen it to a union and
+         * neither `.omit` nor `.refine` would narrow.
+         *
+         * The type map is total over the bindable set: the config schema restricts a sign-up question
+         * to the types whose answer IS a value, so there is no option-ref case to represent here.
+         */
+        const declaredFields = {};
+        for (const question of declaredProfileQuestions) {
+            const base = question.type === OnboardingSurveyQuestionType.RATING
+                ? z.number()
+                : z.string().min(1);
+            declaredFields[question.id] = question.required ? base : base.optional();
+        }
+        const withDeclaredQuestions = UserRegisterFormDtoSchema.extend(declaredFields);
+        const withNames = collectsNamesAtSignUp
+            ? withDeclaredQuestions
+            : withDeclaredQuestions.omit({ firstName: true, lastName: true });
+        const withOrganization = showOrgNameField
+            ? withNames
+            : withNames.omit({ organizationName: true });
+        // A password-less sign-up has no password to ask for: the fields leave the schema, so the form
+        // renders none, validates none, and has no confirmation to match.
+        if (!showPasswordFields) {
+            return withOrganization.omit({ password: true, confirmPassword: true });
+        }
+        return withOrganization.refine((data) => !data.password || data.password === data.confirmPassword, { message: t(UserRegisterLabel.PASSWORD_MISMATCH), path: ['confirmPassword'] });
+    }, [t, showOrgNameField, showPasswordFields, declaredProfileQuestions, collectsNamesAtSignUp]);
+    // Parked at organization onboarding (#1090): the organization is the only step left, whatever this screen was doing.
+    const organizationOnboardingTarget = organizationOnboardingNavigationTarget(auth, authRedirectTarget);
+    if (organizationOnboardingTarget) {
+        return _jsx(Navigate, { to: organizationOnboardingTarget, replace: true });
+    }
     if (!isReady)
         return null;
     // ═══════════════════════════════════════════════════════════════
-    // Registration Success — email sent (or SSO redirect hint)
+    // Registration answered — one branch per `RegistrationOutcome`
     // ═══════════════════════════════════════════════════════════════
-    if (registrationComplete) {
-        const isSsoRedirectHint = ssoRedirectHint === true;
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-primary", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" }) }) }), _jsx(Heading, { children: t(UserRegisterLabel.SUCCESS_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: isSsoRedirectHint ? t(UserRegisterLabel.SSO_REDIRECT_HINT) : t(UserRegisterLabel.SUCCESS_MESSAGE) })] }), !isSsoRedirectHint && (_jsxs("div", { className: "text-center space-y-item-xs", children: [_jsxs(Text, { className: "text-sm text-muted-foreground", children: [t(UserRegisterLabel.RESEND_PROMPT), ' ', _jsx(Button, { variant: ButtonVariants_Variant.LINK, className: "p-0 h-auto text-sm", onClick: handleResend, disabled: resendStatus === 'sending' || resendCooldown > 0, children: resendStatus === 'sending'
+    if (registrationOutcome === RegistrationOutcome.SIGNED_IN) {
+        // The native `Auth_Register` wrapper also forwards on `auth.accessToken`; this covers a preset rendered without it.
+        return auth.accessToken ? _jsx(Navigate, { to: postAuthRedirect, replace: true }) : null;
+    }
+    if (registrationOutcome === RegistrationOutcome.MFA_ENROLLMENT_REQUIRED) {
+        // `useMfaContinuationNavigation` above takes the registrant, with their session, to the enrollment gate.
+        return null;
+    }
+    if (registrationOutcome !== null) {
+        /*
+         * An SSO-enforced domain is a REFUSAL, not a success: the backend returns before creating anything
+         * (`registerUser`, `blockForSSODomains`), and nothing redirects. So it has its own heading and body —
+         * "Account created" and "you'll be redirected" were both false there. The sign-in link below is the
+         * way forward: the sign-in screen resolves the address's domain to its organization's SSO.
+         */
+        const isSsoRegistration = registrationOutcome === RegistrationOutcome.SSO_REDIRECT_REQUIRED;
+        const title = isSsoRegistration ? UserRegisterLabel.SSO_REGISTRATION_TITLE : UserRegisterLabel.SUCCESS_TITLE;
+        const message = isSsoRegistration
+            ? UserRegisterLabel.SSO_REGISTRATION_MESSAGE
+            : registrationOutcome === RegistrationOutcome.UNFINISHED
+                ? UserRegisterLabel.REGISTRATION_UNFINISHED
+                : registrationOutcome === RegistrationOutcome.MAGIC_LINK_SENT
+                    ? UserRegisterLabel.MAGIC_LINK_SENT_MESSAGE
+                    : registrationOutcome === RegistrationOutcome.PASSKEY_ENROLLMENT_PENDING
+                        ? UserRegisterLabel.PASSKEY_ENROLLMENT_PENDING_MESSAGE
+                        : UserRegisterLabel.SUCCESS_MESSAGE;
+        /*
+         * Resend re-sends a VERIFICATION email, so it is offered only when one is what the registrant is
+         * waiting for. A magic-link signup's link is not a verification mail, and an unfinished one is not
+         * waiting on email at all.
+         */
+        const offersVerificationResend = registrationOutcome === RegistrationOutcome.EMAIL_VERIFICATION_PENDING;
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx("div", { className: "mx-auto flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 mb-element", children: _jsx("svg", { className: "h-6 w-6 text-primary", fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: "2", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" }) }) }), _jsx(Heading, { children: t(title) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(message) })] }), offersVerificationResend && (_jsxs("div", { className: "text-center space-y-item-xs", children: [_jsxs(Text, { className: "text-sm text-muted-foreground", children: [t(UserRegisterLabel.RESEND_PROMPT), ' ', _jsx(Button, { variant: ButtonVariants_Variant.LINK, className: "p-0 h-auto text-sm", onClick: handleResend, disabled: resendStatus === 'sending' || resendCooldown > 0, children: resendStatus === 'sending'
                                         ? t(UserRegisterLabel.RESEND_SENDING)
                                         : resendCooldown > 0
                                             ? `${t(UserRegisterLabel.RESEND_COOLDOWN)} (${resendCooldown}s)`
-                                            : t(UserRegisterLabel.RESEND_LINK) })] }), resendStatus === 'sent' && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserRegisterLabel.RESEND_SUCCESS) }) })), resendStatus === 'error' && resendError && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: resendError }) }))] })), _jsx("div", { className: "text-center mt-group", children: _jsx(Link, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
+                                            : t(UserRegisterLabel.RESEND_LINK) })] }), resendStatus === 'sent' && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserRegisterLabel.RESEND_SUCCESS) }) })), resendStatus === 'error' && resendError && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: resendError }) }))] })), _jsx("div", { className: "text-center mt-group", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
     }
     // ═══════════════════════════════════════════════════════════════
     // Registration Form
@@ -183,7 +472,8 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
         setIsLoading(true);
         formMethodsRef.current?.clearErrors('root');
         clearServerErrors();
-        if (data.password) {
+        const method = activeMethod ?? AuthMethod.PASSWORD;
+        if (method === AuthMethod.PASSWORD && data.password) {
             const policyResult = AuthUtils.validatePasswordAgainstPolicy(data.password, passwordPolicy);
             if (!policyResult.valid) {
                 formMethodsRef.current?.setError('root', {
@@ -195,16 +485,44 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
             }
         }
         try {
-            const result = await getManualCallsHttpClient().register({
+            const outcome = await registerAccount({
                 email: data.email,
-                firstName: data.firstName,
-                lastName: data.lastName,
-                password: data.password?.trim() || undefined,
+                // Absent when the names are collected at onboarding (#1374): the schema does not ask for them.
+                ...(collectsNamesAtSignUp ? { firstName: data.firstName, lastName: data.lastName } : {}),
+                // The credential ONLY for the method that takes one; a password-less sign-up sends none.
+                password: method === AuthMethod.PASSWORD ? data.password?.trim() || undefined : undefined,
                 organizationName: data.organizationName?.trim() || undefined,
+                /*
+                 * The declared sign-up answers (#1371), keyed by QUESTION ID — the server re-reads the same
+                 * declaration and refuses a key this user type does not declare, so the mapping from
+                 * question to profile field is made in one place, on the side that owns the write.
+                 *
+                 * Omitted entirely when nothing is declared, so a registration from an application that
+                 * asks nothing is byte-identical to what it was.
+                 */
+                profileAnswers: declaredProfileQuestions.length > 0
+                    ? Object.fromEntries(declaredProfileQuestions
+                        .map((question) => [question.id, data[question.id]])
+                        .filter(([, value]) => value !== undefined && value !== ''))
+                    : undefined,
+                /*
+                 * The chosen method, and the deep link this screen was opened with (#1093). The backend keeps
+                 * the redirect only when same-origin and within bounds, and carries it into the emailed sign-in
+                 * link of a password-less sign-up — the one register outcome that signs the person in elsewhere.
+                 */
+                method,
+                ...(authRedirectTarget ? { redirect: authRedirectTarget } : {}),
+                /*
+                 * IDS only. The server resolves which releases are in force and matches these against them,
+                 * so this cannot choose a VERSION, invent a release, or accept a document the application
+                 * does not publish — see `UserRegisterApiDtoSchema.acceptedGovernedDocumentReleaseIds`.
+                 */
+                ...(acceptedReleaseIdsToCarry.length > 0
+                    ? { acceptedGovernedDocumentReleaseIds: acceptedReleaseIdsToCarry }
+                    : {}),
             });
             setRegisteredEmail(data.email);
-            setSsoRedirectHint(result.ssoRedirectHint === true);
-            setRegistrationComplete(true);
+            setRegistrationOutcome(outcome);
         }
         catch (e) {
             const serverErrors = extractServerValidationErrors(e);
@@ -215,7 +533,7 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
                 const passwordPolicyMsg = extractPasswordPolicyErrorMessage(e, t, passwordPolicy);
                 formMethodsRef.current?.setError('root', {
                     type: 'server',
-                    message: passwordPolicyMsg ?? e?.message ?? t(UserRegisterLabel.UNEXPECTED_ERROR),
+                    message: passwordPolicyMsg ?? toUserFacingErrorMessage(e, t(UserRegisterLabel.UNEXPECTED_ERROR)),
                 });
             }
         }
@@ -223,19 +541,47 @@ export const PublicLayoutPreset_UserRegister_Default = ({}) => {
             setIsLoading(false);
         }
     };
-    if (!hasSocialOAuth2Providers && !showPasswordFields) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserRegisterLabel.REGISTRATION_DISABLED) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
+    if (!hasSocialOAuth2Providers && !showForm) {
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserRegisterLabel.REGISTRATION_DISABLED) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
     }
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserRegisterLabel.SUB_TITLE) })] }), _jsx(OAuthProvidersSection, { providers: enabledSocialOAuth2Providers, onProviderClick: handleOAuth2Click, isLoading: isLoading || auth.isLoading, continueWithLabel: t(UserRegisterLabel.CONTINUE_WITH), translate: translate, dividerLabel: t(UserRegisterLabel.DIVIDER_OR), showDivider: showDivider }), showPasswordFields && (_jsx(AutomatedForm, { schema: registerFormSchema, defaultValues: { email: '', firstName: '', lastName: '', ...(showOrgNameField && { organizationName: '' }), password: '', confirmPassword: '' }, onSubmit: handleRegisterSubmit, onFormReady: handleFormReady, validationMode: ValidationMode.ON_BLUR, disabled: isLoading, layoutTemplate: RegisterFormTemplate, labels: {
-                    fields: {
-                        email: t(UserRegisterLabel.EMAIL_ADDRESS),
-                        firstName: t(UserRegisterLabel.FIRST_NAME),
-                        lastName: t(UserRegisterLabel.LAST_NAME),
-                        ...(showOrgNameField && { organizationName: t(UserRegisterLabel.ORGANIZATION_NAME) }),
-                        password: t(UserRegisterLabel.PASSWORD),
-                        confirmPassword: t(UserRegisterLabel.CONFIRM_PASSWORD),
-                    },
-                } })), _jsx("div", { className: "text-center mt-group", children: _jsxs(Text, { className: "text-sm", children: [t(UserRegisterLabel.ALREADY_HAVE_ACCOUNT), ' ', _jsx(Link, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) })] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserRegisterLabel.SUB_TITLE) })] }), enabledSocialOAuth2Providers.length > 0 && requiredGovernedDocumentReleases.length > 0 && !formCarriesAcceptance && (_jsx(RegisterConsentContext.Provider, { value: acceptanceContextValue, children: _jsx(DocumentAcceptanceControl, { t: t, tComponent: tComponent }) })), _jsx(OAuthProvidersSection, { providers: enabledSocialOAuth2Providers, onProviderClick: handleOAuth2Click, isLoading: isLoading || auth.isLoading, disabled: acceptanceIsWithheld, continueWithLabel: t(UserRegisterLabel.CONTINUE_WITH), translate: translate, dividerLabel: t(UserRegisterLabel.DIVIDER_OR), showDivider: showDivider }), showForm && activeMethod !== null && (_jsx(RegisterConsentContext.Provider, { value: {
+                    requiredReleases: requiredGovernedDocumentReleases,
+                    acceptanceMode,
+                    requiredDocuments,
+                    servedDocuments,
+                    accepted: governedDocumentsAccepted,
+                    setAccepted: setGovernedDocumentsAccepted,
+                    documentsRead: governedDocumentsRead,
+                    markDocumentRead,
+                    method: activeMethod,
+                }, children: _jsx(AutomatedForm
+                // One form per method: switching remounts it with that method's schema and defaults.
+                , { schema: registerFormSchema, defaultValues: { email: '', ...(collectsNamesAtSignUp && { firstName: '', lastName: '' }), ...(showOrgNameField && { organizationName: '' }), ...(showPasswordFields && { password: '', confirmPassword: '' }) }, onSubmit: handleRegisterSubmit, onFormReady: handleFormReady, validationMode: ValidationMode.ON_BLUR, disabled: isLoading, layoutTemplate: RegisterFormTemplate, labels: {
+                        fields: {
+                            email: t(UserRegisterLabel.EMAIL_ADDRESS),
+                            ...(collectsNamesAtSignUp && { firstName: t(UserRegisterLabel.FIRST_NAME), lastName: t(UserRegisterLabel.LAST_NAME) }),
+                            ...(showOrgNameField && { organizationName: t(UserRegisterLabel.ORGANIZATION_NAME) }),
+                            ...(showPasswordFields && { password: t(UserRegisterLabel.PASSWORD), confirmPassword: t(UserRegisterLabel.CONFIRM_PASSWORD) }),
+                        },
+                    } }, activeMethod) })), alternativeMethods.length > 0 && (_jsxs(_Fragment, { children: [_jsx(LabeledDivider, { label: tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER) }), _jsx(Text, { className: "text-sm text-muted-foreground text-center mb-element", children: t(UserRegisterLabel.METHOD_CHOICE_HINT) }), _jsx(AuthMethodChoiceList, { methods: alternativeMethods, 
+                        /*
+                         * Registration offers a method before anyone is identified, so there is no descriptor and
+                         * no enterprise connection to name — but the application's social providers are known, and
+                         * they are the same ones this screen's own provider buttons render. Where exactly one is
+                         * configured the button reads "Continue with Google" instead of the kind.
+                         */
+                        labelFor: (method) => resolveAuthMethodChoiceLabel(method, {
+                            socialProviders: enabledSocialOAuth2Providers,
+                            continueWithTemplate: tAuth(UserAuthLabel.CONTINUE_WITH),
+                            translateLabel: (label) => tAuth(label),
+                            resolveSocialProviderLabel: (provider) => resolveOAuthProviderDisplayLabel({
+                                providerRef: provider.providerRef,
+                                displayName: provider.displayName,
+                                displayNameLabelKey: provider.displayNameLabelKey,
+                                brandLabel: SSO_PROVIDER_BRAND_META[provider.providerRef]?.label,
+                                translate,
+                            }),
+                        }), onSelect: setSelectedMethod, disabled: isLoading })] })), _jsx("div", { className: "text-center mt-group", children: _jsxs(Text, { className: "text-sm", children: [t(UserRegisterLabel.ALREADY_HAVE_ACCOUNT), ' ', _jsx(Link, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) })] }) })] }));
 };
 function RegistrationUnavailable({ mode, }) {
     const location = useLocation();
@@ -252,7 +598,7 @@ function RegistrationUnavailable({ mode, }) {
             ? UserRegisterLabel.ADMIN_ONLY
             : UserRegisterLabel.REGISTRATION_DISABLED;
     const t = (key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_REGISTER, key);
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(message) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserRegisterLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(message) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserRegisterLabel.SIGNIN_LINK) }) })] }));
 }
 export function Auth_Register({ preset = CorePresetNames.DEFAULT, ...props }) {
     const { auth } = useUserOrgs();