zooqueenandHanzo Dev 9f22a78da6 A sign-in IAM holds for an unproven address stops on Confirm your email, on every way in ...

IAM answers a sign-in of an account whose address was never proven with
RequiredEmail and the address it sent a 6-digit code to ("" when none is on
file). The client reads it as a third held state beside NextMfa and
RequiredMfa, carrying the sign-in's own OAuth parameters and never its
credential; emailConfirm and emailSend post them again to /v1/iam/login with
{passcode} or {email}, riding the challenge cookie.

EmailConfirmForm is the step: the code, a new code, a different address, and
the address field first when none is on file. The login, device-approval and
signup pages render it for password, code and wallet sign-ins. A confirmed
address continues as the sign-in would have, second factor included, and an
expired hold returns to the sign-in form with IAM's sentence.

Signup shows IAM's refusals for an address it cannot verify, or for no address,
like any other refusal; the note that such an account is made unproven is gone.

Co-authored-by: Hanzo Dev <[email protected]>

2026-10-14 14:16:31 -07:00

..

src

A sign-in IAM holds for an unproven address stops on Confirm your email, on every way in

2026-10-14 14:16:31 -07:00

package.json

State a version once

2026-09-03 12:10:41 -07:00

tsconfig.json

feat(social): wire the provider hop + return exchange (gated until creds seeded)

2026-06-20 10:46:26 -07:00