# Tasks — Add @suaveplan/react-auth — forms (Wave 2)

> No retroactive ticks. Each box reflects work done in this change.

## 1. Spec authoring

- [ ] 1.1 Read `../suaveplan/enterprise/react-auth.md` end-to-end
- [ ] 1.2 Read `openspec/specs/react-auth/spec.md` (Wave 1 canonical)
- [ ] 1.3 Read `openspec/AGENTS.md` §§ 0c, 2a, 6a, 7, 12, 13, 14
- [ ] 1.4 Draft `proposal.md` from template with `## Source mapping` + `### Excluded`
- [ ] 1.5 Draft `specs/react-auth/spec.md` delta with `## ADDED Requirements`, one per form
- [ ] 1.6 Every requirement carries a `**Verified by:**` line at draft time

## 2. Implementation

- [ ] 2.1 Add `@suaveplan/react-ui` + `react-hook-form` + `@hookform/resolvers` deps to `package.json`
- [ ] 2.2 Add 5 subpath exports to `package.json` `exports` block
- [ ] 2.3 Extend `vite.config.ts` `lib.entry` with 5 new entries; extend `rollupOptions.external`
- [ ] 2.4 Ship `src/components/login-form/` (`login-form.tsx`, `.types.ts`, `.md`, `.stories.tsx`, `index.ts`)
- [ ] 2.5 Ship `src/components/register-form/` (split into `register-form.tsx` + `register-form-fields.tsx` to honour the 300-line cap)
- [ ] 2.6 Ship `src/components/forgot-password-form/`
- [ ] 2.7 Ship `src/components/reset-password-form/`
- [ ] 2.8 Ship `src/components/email-verification-view/`
- [ ] 2.9 Add `src/components/index.ts` barrel with explicit named re-exports for every form symbol
- [ ] 2.10 Extend `src/index.ts` with the 5 new components (named re-exports only)
- [ ] 2.11 Extend `src/index.test.ts` expected-keys list with the 5 new symbols

## 3. Tests

- [ ] 3.1 `src/components/login-form/login-form.test.tsx` — Zod errors, happy path, password toggle, `error`, `isLoading`, `translations` override
- [ ] 3.2 `src/components/register-form/register-form.test.tsx` — same matrix + username regex + `confirmPassword` refinement + sex select
- [ ] 3.3 `src/components/forgot-password-form/forgot-password-form.test.tsx`
- [ ] 3.4 `src/components/reset-password-form/reset-password-form.test.tsx`
- [ ] 3.5 `src/components/email-verification-view/email-verification-view.test.tsx`
- [ ] 3.6 Every `it(...)` carries `{ timeout: 5000 }`
- [ ] 3.7 All tests import from `@suaveplan/testing/runner`

## 4. Documentation

- [ ] 4.1 Sibling `.md` for every form (≥200 words, Basic + Advanced examples, full API reference)
- [ ] 4.2 No README changes (Wave 1's README already lists components/ subpaths generically)

## 5. Pre-archive 5-gate verification

- [ ] 5.1 `bun run check` — Biome clean across the monorepo
- [ ] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/react-auth --force` — green
- [ ] 5.3 `bunx turbo test:coverage --filter=@suaveplan/react-auth` — 100/100/100/100 istanbul
- [ ] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/react-auth` — exit 0
- [ ] 5.5 `bunx turbo build --filter=@suaveplan/react-auth --force` — green
- [ ] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — exit 0

## 6. Pre-archive 7-row checklist

- [ ] 6.1 Generics threaded — `useForm<TForm>` typed end-to-end, no `as any`
- [ ] 6.2 Zod schemas wired at every form's submit boundary
- [ ] 6.3 No new error codes introduced (Wave 1's registry unchanged); Zod parse failures surface through react-hook-form's `formState.errors`
- [ ] 6.4 N/A — no strict-mode behaviour toggle in this wave
- [ ] 6.5 N/A — no new OTel instruments in this wave (forms are pure UI; metrics live on the Wave 1 actions)
- [ ] 6.6 N/A — no lifecycle dedup claims on forms
- [ ] 6.7 No retroactive ticks

## 7. Archive

- [ ] 7.1 Fold spec delta — APPEND new requirements to `openspec/specs/react-auth/spec.md` under `## ADDED Requirements`; do NOT modify Wave 1 requirements
- [ ] 7.2 Move `openspec/changes/add-react-auth-forms/` → `openspec/archive/2026-05-19-add-react-auth-forms/`
- [ ] 7.3 No MANIFEST.md / STATUS.md updates (not a new package)