cauthy-auth 0.30.0 → 0.31.0

package/dist/react.js

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/react.tsx
 var react_exports = {};
 __export(react_exports, {
+  AcceptInvite: () => AcceptInvite,
   Account: () => Account,
   CauthyProvider: () => CauthyProvider,
   ForgotPassword: () => ForgotPassword,
@@ -411,11 +412,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -562,6 +563,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {
@@ -798,6 +813,13 @@ var TEXTS = {
     passwordChanged: "Your password was changed. You can sign in with it now.",
     confirming: "Confirming your address\u2026",
     emailConfirmed: "Your address is confirmed. You can sign in now.",
+    invitedTo: "You've been invited to {workspace}",
+    invitedToOrganization: "You've been invited to {organization} on {workspace}",
+    invitedAs: "You will sign in as {email}.",
+    choosePassword: "Choose a password",
+    acceptInvite: "Accept and sign in",
+    openingInvitation: "Opening your invitation\u2026",
+    invitationInvalid: "This invitation is not valid: it was already used, or it has expired. Ask whoever invited you to send it again.",
     profile: "Profile",
     save: "Save",
     saved: "Saved.",
@@ -912,7 +934,9 @@ var TEXTS = {
       invalid_assertion: "Your company's answer could not be checked. Try again.",
       provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
       connection_inactive: "Your company's sign-in is turned off for this workspace.",
-      invalid_grant: "That sign-in expired. Try again."
+      invalid_grant: "That sign-in expired. Try again.",
+      password_disabled: "This workspace does not sign in with a password. Use one of the other ways.",
+      passkeys_disabled: "Passkeys are turned off for this workspace."
     }
   },
   es: {
@@ -965,6 +989,13 @@ var TEXTS = {
     passwordChanged: "Tu contrase\xF1a se cambi\xF3. Ya puedes entrar con ella.",
     confirming: "Confirmando tu correo\u2026",
     emailConfirmed: "Tu correo qued\xF3 confirmado. Ya puedes entrar.",
+    invitedTo: "Te invitaron a {workspace}",
+    invitedToOrganization: "Te invitaron a {organization} en {workspace}",
+    invitedAs: "Vas a entrar como {email}.",
+    choosePassword: "Elige una contrase\xF1a",
+    acceptInvite: "Aceptar y entrar",
+    openingInvitation: "Abriendo tu invitaci\xF3n\u2026",
+    invitationInvalid: "Esta invitaci\xF3n no es v\xE1lida: ya se us\xF3 o venci\xF3. P\xEDdele a quien te invit\xF3 que te la env\xEDe de nuevo.",
     profile: "Perfil",
     save: "Guardar",
     saved: "Guardado.",
@@ -1079,7 +1110,9 @@ var TEXTS = {
       invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
       provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
       connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
-      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo.",
+      password_disabled: "En este workspace no se entra con contrase\xF1a. Usa una de las otras formas.",
+      passkeys_disabled: "Las llaves de acceso est\xE1n desactivadas en este workspace."
     }
   }
 };
@@ -1274,23 +1307,16 @@ function useMailedToken(name, open) {
     open(takeToken(name));
   }, []);
 }
-function SignIn(props) {
-  const auth = useAuth();
-  const f = useForm(props);
-  const [methods, setMethods] = (0, import_react.useState)(null);
-  const [email, setEmail] = (0, import_react.useState)("");
-  const [password, setPassword] = (0, import_react.useState)("");
+function SecondStepForm(p) {
+  const { f, auth } = p;
   const [code, setCode] = (0, import_react.useState)("");
-  const [step, setStep] = (0, import_react.useState)("password");
-  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
   const [phoneWay, setPhoneWay] = (0, import_react.useState)(null);
   const [phoneSent, setPhoneSent] = (0, import_react.useState)("");
   (0, import_react.useEffect)(() => {
-    if (step !== "code") return;
     void auth.signIn.mfaMethods().then((r) => {
       if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push, email: r.email });
     });
-  }, [step]);
+  }, []);
   const sendEmail = async () => {
     f.setBusy(true);
     f.setError(null);
@@ -1326,6 +1352,55 @@ function SignIn(props) {
     if (!r.ok) return f.setError(r.error);
     setPhoneSent(r.sentTo);
   };
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.signIn.mfa({ code });
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const to = phoneWay?.phone?.number ?? "";
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
+    pushNumber > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushWaiting })
+    ] }) : phoneWay?.push && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
+    phoneWay?.phone && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+  ] });
+}
+function ProviderButtons(p) {
+  const { f } = p;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: p.providers.map((provider) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => p.onPick(provider.id), children: [
+    provider.iconUrl && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("img", { src: provider.iconUrl, alt: "", width: 18, height: 18, className: f.cx("providerIcon") }),
+    f.t.continueWith,
+    " ",
+    provider.name
+  ] }, provider.id)) });
+}
+function signInOffers(methods) {
+  const password = methods?.passwordSignIn !== false;
+  return { password, email: password || methods?.magicLink === true || methods?.sso === true, passkey: methods?.passkey === true };
+}
+function SignIn(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [methods, setMethods] = (0, import_react.useState)(null);
+  const [email, setEmail] = (0, import_react.useState)("");
+  const [password, setPassword] = (0, import_react.useState)("");
+  const [code, setCode] = (0, import_react.useState)("");
+  const [step, setStep] = (0, import_react.useState)("password");
+  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const offers = signInOffers(methods);
+  const passwordOn = offers.password;
   const autofill = (0, import_react.useRef)(null);
   const [offer, setOffer] = (0, import_react.useState)(0);
   const [company, setCompany] = (0, import_react.useState)(null);
@@ -1377,10 +1452,18 @@ function SignIn(props) {
   const submit = async (e) => {
     e.preventDefault();
     autofill.current?.abort();
+    if (step === "password" && company?.enforced) {
+      f.setError(null);
+      return toCompany();
+    }
+    if (step === "password" && !passwordOn) {
+      if (company) return toCompany();
+      if (methods?.magicLink) return sendLink();
+      return;
+    }
     f.setBusy(true);
     f.setError(null);
-    if (step === "password" && company?.enforced) return toCompany();
-    const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
+    const r = step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
     if (!r.ok && r.error.code === "sso_required") return toCompany();
@@ -1414,6 +1497,7 @@ function SignIn(props) {
     setStep("sent");
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const asksEmail = offers.email;
   if (step === "opening") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("form"), ...f.root, "aria-busy": "true" });
   if (step === "sent") {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
@@ -1424,39 +1508,20 @@ function SignIn(props) {
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
     ] });
   }
-  if (step === "code") {
-    const to = phoneWay?.phone?.number ?? "";
-    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
-      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-      phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
-      pushNumber > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushWaiting })
-      ] }) : phoneWay?.push && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
-      phoneWay?.phone && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
-    ] });
-  }
+  if (step === "code") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepForm, { f, auth });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
     general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-    (methods?.providers ?? []).map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => auth.signIn.social(p.id, { returnTo: props.returnTo }), children: [
-      f.t.continueWith,
-      " ",
-      p.name
-    ] }, p.id)),
-    methods?.passkey && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
-    ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers: methods?.providers ?? [], onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    offers.passkey && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
+    asksEmail && ((methods?.providers.length ?? 0) > 0 || offers.passkey) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
+    asksEmail && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
     company && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
       f.t.continueWith,
       " ",
       company.name
     ] }),
     company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
-    !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    !company?.enforced && passwordOn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
         Field,
         {
@@ -1474,6 +1539,7 @@ function SignIn(props) {
       challenge.node,
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
     ] }),
+    !company?.enforced && !passwordOn && methods?.magicLink && challenge.node,
     methods?.magicLink && !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
     methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
       f.t.noAccount,
@@ -1533,14 +1599,30 @@ function SignUp(props) {
     f.done();
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const passwordOn = methods?.passwordSignIn !== false;
+  const providers = auth.session?.user.isAnonymous === true || methods?.organization?.required ? [] : methods?.providers ?? [];
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.checkEmail }),
       props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
     ] });
   }
+  const footer = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
+    f.t.haveAccount,
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.signIn })
+  ] });
+  if (!passwordOn) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
+      general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+      footer
+    ] });
+  }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
     general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    providers.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
     methods?.organization?.ask && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "organization", type: "text", label: f.t.company, value: organization, autoComplete: "organization", required: methods.organization.required, onChange: setOrganization }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
@@ -1566,11 +1648,7 @@ function SignUp(props) {
     ] }, p.key)),
     challenge.node,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
-    props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
-      f.t.haveAccount,
-      " ",
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.signIn })
-    ] })
+    footer
   ] });
 }
 function ForgotPassword(props) {
@@ -1667,6 +1745,62 @@ function VerifyEmail(props) {
     state !== "confirming" && props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
   ] });
 }
+function AcceptInvite(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [token, setToken] = (0, import_react.useState)("");
+  const [invitation, setInvitation] = (0, import_react.useState)(null);
+  const [state, setState] = (0, import_react.useState)("opening");
+  const [password, setPassword] = (0, import_react.useState)("");
+  usePasswordPolicy(f, useMethods(auth));
+  useMailedToken("token", (t) => {
+    if (!t) return setState("invalid");
+    setToken(t);
+    void auth.invitation(t).then((r) => {
+      if (r.ok) {
+        setInvitation(r.invitation);
+        return setState("ready");
+      }
+      if (r.error.code !== "invalid_token") f.setError(r.error);
+      setState("invalid");
+    });
+  });
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.acceptInvitation(token, password);
+    f.setBusy(false);
+    if (!r.ok) {
+      if (r.error.code === "invalid_token") return setState("invalid");
+      return f.setError(r.error);
+    }
+    if (r.status === "mfa_required") return setState("code");
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn });
+  if (state === "opening") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("form"), ...f.root, "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.openingInvitation }) });
+  }
+  if (state === "invalid") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("form"), ...f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: general ? f.say(general) : f.t.invitationInvalid }),
+      back
+    ] });
+  }
+  if (state === "code") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepForm, { f, auth });
+  const workspace = invitation?.workspace ?? "";
+  const heading = invitation?.organization ? f.t.invitedToOrganization.replace("{organization}", invitation.organization).replace("{workspace}", workspace) : f.t.invitedTo.replace("{workspace}", workspace);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: heading }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.invitedAs.replace("{email}", invitation?.email ?? "") }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "email", name: "username", autoComplete: "username", value: invitation?.email ?? "", readOnly: true, hidden: true }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.choosePassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.acceptInvite })
+  ] });
+}
 function useSection(props) {
   const f = useForm({ ...props, unstyled: true });
   const [done, setDone] = (0, import_react.useState)(null);
@@ -2314,6 +2448,8 @@ function useAuth() {
         googleOneTap: (o) => then(client.signIn.googleOneTap(o))
       },
       signUp: { email: (f) => then(client.signUp.email(f)) },
+      // The invited person is signed in once they accept.
+      acceptInvitation: (token, password) => then(client.acceptInvitation(token, password)),
       signOut: () => then(client.signOut()),
       account: {
         ...client.account,
@@ -2332,6 +2468,7 @@ function useAuth() {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AcceptInvite,
   Account,
   CauthyProvider,
   ForgotPassword,