@actuate-media/cms-admin 0.27.0 → 0.29.0

package/dist/views/profile/useMfaEnrollment.js

@@ -0,0 +1,103 @@
+'use client';
+import { useCallback, useEffect, useState } from 'react';
+import { cmsApi } from '../../lib/api.js';
+/**
+ * Drives the per-user MFA (TOTP) enrollment loop against the real auth API:
+ *   1. `beginSetup(password)` — password reauth → POST /auth/totp/setup, which
+ *      returns the provisioning URI + one-time backup codes.
+ *   2. `confirmSetup(code)`   — POST /auth/totp/verify to flip totpEnabled on.
+ *   3. `disable(password)`    — password reauth → POST /auth/totp/disable.
+ *
+ * The hook never holds the user's password and never persists the secret or
+ * backup codes beyond the in-memory enrollment object (cleared on cancel/finish).
+ */
+export function useMfaEnrollment() {
+    const [status, setStatus] = useState('loading');
+    const [enrollment, setEnrollment] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const refresh = useCallback(async () => {
+        const res = await cmsApi('/auth/me');
+        if (res.error || !res.data) {
+            setStatus('error');
+            return;
+        }
+        setStatus(res.data.totpEnabled ? 'enabled' : 'disabled');
+    }, []);
+    useEffect(() => {
+        void refresh();
+    }, [refresh]);
+    const beginSetup = useCallback(async (password) => {
+        if (!password)
+            return { ok: false, error: 'Enter your current password to continue.' };
+        setBusy(true);
+        try {
+            const res = await cmsApi('/auth/totp/setup', {
+                method: 'POST',
+                headers: { 'x-reauth-password': password },
+                body: JSON.stringify({}),
+            });
+            if (res.error || !res.data) {
+                return { ok: false, error: res.error ?? 'Could not start MFA setup.' };
+            }
+            setEnrollment(res.data);
+            return { ok: true };
+        }
+        finally {
+            setBusy(false);
+        }
+    }, []);
+    const confirmSetup = useCallback(async (code) => {
+        const trimmed = code.trim();
+        if (!/^\d{6}$/.test(trimmed)) {
+            return { ok: false, error: 'Enter the 6-digit code from your authenticator app.' };
+        }
+        setBusy(true);
+        try {
+            const res = await cmsApi('/auth/totp/verify', {
+                method: 'POST',
+                body: JSON.stringify({ code: trimmed }),
+            });
+            if (res.error)
+                return { ok: false, error: res.error };
+            setEnrollment(null);
+            setStatus('enabled');
+            return { ok: true };
+        }
+        finally {
+            setBusy(false);
+        }
+    }, []);
+    const cancelSetup = useCallback(() => {
+        setEnrollment(null);
+    }, []);
+    const disable = useCallback(async (password) => {
+        if (!password)
+            return { ok: false, error: 'Enter your current password to continue.' };
+        setBusy(true);
+        try {
+            const res = await cmsApi('/auth/totp/disable', {
+                method: 'POST',
+                headers: { 'x-reauth-password': password },
+                body: JSON.stringify({}),
+            });
+            if (res.error)
+                return { ok: false, error: res.error };
+            setStatus('disabled');
+            return { ok: true };
+        }
+        finally {
+            setBusy(false);
+        }
+    }, []);
+    return {
+        status,
+        enrollment,
+        busy,
+        refresh,
+        beginSetup,
+        confirmSetup,
+        cancelSetup,
+        disable,
+    };
+}
+//# sourceMappingURL=useMfaEnrollment.js.map

package/dist/views/profile/useMfaEnrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMfaEnrollment.js","sourceRoot":"","sources":["../../../src/views/profile/useMfaEnrollment.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAkBzC;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAY,SAAS,CAAC,CAAA;IAC1D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAuB,IAAI,CAAC,CAAA;IACxE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEvC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAA4B,UAAU,CAAC,CAAA;QAC/D,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,SAAS,CAAC,OAAO,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAC1D,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,OAAO,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,EAAE,QAAgB,EAAyB,EAAE;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;QACtF,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAgB,kBAAkB,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE;gBAC1C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;aACzB,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,4BAA4B,EAAE,CAAA;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,IAAY,EAAyB,EAAE;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAA;QACpF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAwB,mBAAmB,EAAE;gBACnE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACxC,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;YACrD,aAAa,CAAC,IAAI,CAAC,CAAA;YACnB,SAAS,CAAC,SAAS,CAAC,CAAA;YACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,aAAa,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAgB,EAAyB,EAAE;QAC5E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;QACtF,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAwB,oBAAoB,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE;gBAC1C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;aACzB,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;YACrD,SAAS,CAAC,UAAU,CAAC,CAAA;YACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,MAAM;QACN,UAAU;QACV,IAAI;QACJ,OAAO;QACP,UAAU;QACV,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/views/settings/AccessProtectionCard.d.ts

@@ -0,0 +1,10 @@
+import { type IpAllowlistStatus, type SecretsStatus, type SecuritySourceMetadata } from '@actuate-media/cms-core/security-center';
+export declare function AccessProtectionCard({ ipAllowlist, secrets, csrfEnabled, uploadValidation, sources, onNavigate, }: {
+    ipAllowlist: IpAllowlistStatus;
+    secrets: SecretsStatus;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    sources: Record<string, SecuritySourceMetadata>;
+    onNavigate?: (path: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=AccessProtectionCard.d.ts.map

package/dist/views/settings/AccessProtectionCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessProtectionCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/AccessProtectionCard.tsx"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAA;AAIhD,wBAAgB,oBAAoB,CAAC,EACnC,WAAW,EACX,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,UAAU,GACX,EAAE;IACD,WAAW,EAAE,iBAAiB,CAAA;IAC9B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAmHA"}

package/dist/views/settings/AccessProtectionCard.js

@@ -0,0 +1,20 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId, useState } from 'react';
+import { Check, X } from 'lucide-react';
+import { validateIpRange, } from '@actuate-media/cms-core/security-center';
+import { SettingsSourceBadge } from './components.js';
+import { SecurityCard, StatusRow } from './securityPrimitives.js';
+export function AccessProtectionCard({ ipAllowlist, secrets, csrfEnabled, uploadValidation, sources, onNavigate, }) {
+    const headingId = useId();
+    const ipTestId = useId();
+    const [ipTest, setIpTest] = useState('');
+    const ipTestValid = ipTest.trim() === '' ? null : validateIpRange(ipTest);
+    const distributed = secrets.rateLimitBackend === 'distributed';
+    return (_jsxs(SecurityCard, { headingId: headingId, title: "Access & Request Protection", description: "Network-level access restrictions and request-level protections. These are enforced by the platform; edit network rules in config.", children: [_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between gap-2", children: [_jsx("span", { className: "text-foreground text-sm font-medium", children: "Admin IP allowlist" }), _jsx(SettingsSourceBadge, { meta: sources.ipAllowlist })] }), _jsx(StatusRow, { status: ipAllowlist.enabled ? 'pass' : 'unknown', label: "Status", value: ipAllowlist.enabled ? `${ipAllowlist.ranges.length} range(s)` : 'Not configured' }), ipAllowlist.currentIp && (_jsx(StatusRow, { status: ipAllowlist.currentIpAllowed === null
+                            ? 'unknown'
+                            : ipAllowlist.currentIpAllowed
+                                ? 'pass'
+                                : 'fail', label: "Your current IP", value: _jsxs("span", { className: "font-mono text-xs", children: [ipAllowlist.currentIp, ipAllowlist.currentIpAllowed === false && ' (blocked)'] }) })), ipAllowlist.enabled && (_jsx("div", { className: "text-muted-foreground flex flex-wrap gap-1.5 pt-1", children: ipAllowlist.ranges.map((r) => (_jsx("code", { className: "bg-muted rounded px-1.5 py-0.5 font-mono text-xs", children: r }, r))) })), _jsxs("div", { className: "pt-1", children: [_jsx("label", { htmlFor: ipTestId, className: "text-muted-foreground mb-1 block text-sm", children: "Validate an IP or CIDR range" }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("input", { id: ipTestId, type: "text", value: ipTest, onChange: (e) => setIpTest(e.target.value), placeholder: "e.g. 203.0.113.0/24", className: "border-border bg-input-background text-foreground focus-visible:ring-ring w-full max-w-xs rounded-md border px-3 py-1.5 font-mono text-sm focus-visible:ring-2 focus-visible:outline-none" }), ipTestValid === true && (_jsxs("span", { className: "text-success flex items-center gap-1 text-sm", children: [_jsx(Check, { size: 15, "aria-hidden": "true" }), " Valid"] })), ipTestValid === false && (_jsxs("span", { className: "text-destructive flex items-center gap-1 text-sm", children: [_jsx(X, { size: 15, "aria-hidden": "true" }), " Invalid"] }))] }), _jsxs("p", { className: "text-muted-foreground mt-1 text-xs", children: ["Add validated ranges to ", _jsx("code", { className: "font-mono", children: "admin.ipAllowlist" }), " in actuate.config.ts; the middleware enforces them."] })] })] }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: csrfEnabled ? 'pass' : 'fail', label: "CSRF protection", value: csrfEnabled ? 'Enabled' : 'Disabled', badge: _jsx(SettingsSourceBadge, { meta: sources.csrf }) }), _jsx(StatusRow, { status: distributed ? 'pass' : 'warning', label: "Rate limiting", value: distributed ? 'Distributed (Upstash)' : 'In-memory', badge: _jsx(SettingsSourceBadge, { meta: sources.rateLimiting }) }), _jsx(StatusRow, { status: uploadValidation ? 'pass' : 'warning', label: "Upload validation", value: "MIME + magic bytes + SVG sanitization", badge: _jsx(SettingsSourceBadge, { meta: sources.uploadValidation }) }), onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate('/media'), className: "text-brand mt-1 text-sm hover:underline", children: "Manage upload rules in Media \u2192" }))] })] }));
+}
+//# sourceMappingURL=AccessProtectionCard.js.map

package/dist/views/settings/AccessProtectionCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessProtectionCard.js","sourceRoot":"","sources":["../../../src/views/settings/AccessProtectionCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EACL,eAAe,GAIhB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEjE,MAAM,UAAU,oBAAoB,CAAC,EACnC,WAAW,EACX,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,UAAU,GAQX;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAA;IACxB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAEzE,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,KAAK,aAAa,CAAA;IAE9D,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,6BAA6B,EACnC,WAAW,EAAC,oIAAoI,aAGhJ,eAAK,SAAS,EAAC,WAAW,aACxB,eAAK,SAAS,EAAC,yCAAyC,aACtD,eAAM,SAAS,EAAC,qCAAqC,mCAA0B,EAC/E,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,WAAW,GAAI,IAC9C,EACN,KAAC,SAAS,IACR,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAChD,KAAK,EAAC,QAAQ,EACd,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,gBAAgB,GACvF,EACD,WAAW,CAAC,SAAS,IAAI,CACxB,KAAC,SAAS,IACR,MAAM,EACJ,WAAW,CAAC,gBAAgB,KAAK,IAAI;4BACnC,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,WAAW,CAAC,gBAAgB;gCAC5B,CAAC,CAAC,MAAM;gCACR,CAAC,CAAC,MAAM,EAEd,KAAK,EAAC,iBAAiB,EACvB,KAAK,EACH,gBAAM,SAAS,EAAC,mBAAmB,aAChC,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,gBAAgB,KAAK,KAAK,IAAI,YAAY,IAClD,GAET,CACH,EACA,WAAW,CAAC,OAAO,IAAI,CACtB,cAAK,SAAS,EAAC,mDAAmD,YAC/D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAC7B,eAAc,SAAS,EAAC,kDAAkD,YACvE,CAAC,IADO,CAAC,CAEL,CACR,CAAC,GACE,CACP,EACD,eAAK,SAAS,EAAC,MAAM,aACnB,gBAAO,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAC,0CAA0C,6CAEtE,EACR,eAAK,SAAS,EAAC,yBAAyB,aACtC,gBACE,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC1C,WAAW,EAAC,qBAAqB,EACjC,SAAS,EAAC,2LAA2L,GACrM,EACD,WAAW,KAAK,IAAI,IAAI,CACvB,gBAAM,SAAS,EAAC,8CAA8C,aAC5D,KAAC,KAAK,IAAC,IAAI,EAAE,EAAE,iBAAc,MAAM,GAAG,cACjC,CACR,EACA,WAAW,KAAK,KAAK,IAAI,CACxB,gBAAM,SAAS,EAAC,kDAAkD,aAChE,KAAC,CAAC,IAAC,IAAI,EAAE,EAAE,iBAAc,MAAM,GAAG,gBAC7B,CACR,IACG,EACN,aAAG,SAAS,EAAC,oCAAoC,yCACvB,eAAM,SAAS,EAAC,WAAW,kCAAyB,4DAE1E,IACA,IACF,EAGN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IACR,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACrC,KAAK,EAAC,iBAAiB,EACvB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAC3C,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,IAAI,GAAI,GAClD,EACF,KAAC,SAAS,IACR,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACxC,KAAK,EAAC,eAAe,EACrB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW,EAC1D,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,YAAY,GAAI,GAC1D,EACF,KAAC,SAAS,IACR,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAC7C,KAAK,EAAC,mBAAmB,EACzB,KAAK,EAAC,uCAAuC,EAC7C,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,GAAI,GAC9D,EACD,UAAU,IAAI,CACb,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EACnC,SAAS,EAAC,yCAAyC,oDAG5C,CACV,IACG,IACO,CAChB,CAAA;AACH,CAAC"}

package/dist/views/settings/AuthMfaCard.d.ts

@@ -0,0 +1,11 @@
+import type { SecurityForm } from './useSecuritySettings.js';
+export declare function AuthMfaCard({ form, setField, canEdit, viewerHasMfa, withMfa, totalAdmins, onNavigate, }: {
+    form: SecurityForm;
+    setField: <K extends keyof SecurityForm>(key: K, value: SecurityForm[K]) => void;
+    canEdit: boolean;
+    viewerHasMfa: boolean;
+    withMfa: number;
+    totalAdmins: number;
+    onNavigate?: (path: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=AuthMfaCard.d.ts.map

package/dist/views/settings/AuthMfaCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMfaCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/AuthMfaCard.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQ5D,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,OAAO,EACP,WAAW,EACX,UAAU,GACX,EAAE;IACD,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAqGA"}

package/dist/views/settings/AuthMfaCard.js

@@ -0,0 +1,34 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId, useState } from 'react';
+import { ShieldCheck } from 'lucide-react';
+import { MFA_GRACE_PERIOD_OPTIONS } from '@actuate-media/cms-core/security-center';
+import { ConfirmDangerousSettingDialog, SettingsToggleRow } from './components.js';
+import { SecurityCard, StatusRow } from './securityPrimitives.js';
+function graceLabel(days) {
+    if (days === 0)
+        return 'Immediately';
+    if (days === 1)
+        return '1 day';
+    return `${days} days`;
+}
+export function AuthMfaCard({ form, setField, canEdit, viewerHasMfa, withMfa, totalAdmins, onNavigate, }) {
+    const headingId = useId();
+    const graceId = useId();
+    const [confirmEnable, setConfirmEnable] = useState(false);
+    function requestMfaToggle(value) {
+        if (value && !form.mfaRequired) {
+            setConfirmEnable(true);
+            return;
+        }
+        setField('mfaRequired', value);
+    }
+    // Lockout-safe: the toggle can't be turned on until the acting admin has
+    // their own MFA configured (the server enforces this too).
+    const mfaToggleDisabled = !canEdit || (!form.mfaRequired && !viewerHasMfa);
+    return (_jsxs(SecurityCard, { headingId: headingId, title: "Authentication & MFA", description: "Require multi-factor authentication for admin accounts and control the enrollment window.", children: [_jsxs("div", { className: "space-y-4", children: [_jsx(SettingsToggleRow, { label: "Require MFA for admin users", description: "Admins must set up a TOTP authenticator app. Existing admins are prompted to enroll within the grace period.", checked: form.mfaRequired, disabled: mfaToggleDisabled, onChange: requestMfaToggle }), _jsxs("div", { className: "flex items-center justify-between gap-4", children: [_jsxs("label", { htmlFor: graceId, className: "flex-1", children: [_jsx("span", { className: "text-foreground text-base font-medium", children: "Enrollment grace period" }), _jsx("p", { className: "text-muted-foreground mt-0.5 text-sm", children: "How long existing admins have to set up MFA before it is enforced." })] }), _jsx("select", { id: graceId, value: form.mfaGracePeriodDays, disabled: !canEdit || !form.mfaRequired, onChange: (e) => setField('mfaGracePeriodDays', Number(e.target.value)), className: "border-border bg-input-background text-foreground focus-visible:ring-ring rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50", children: MFA_GRACE_PERIOD_OPTIONS.map((d) => (_jsx("option", { value: d, children: graceLabel(d) }, d))) })] })] }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: viewerHasMfa ? 'pass' : 'warning', label: "Your account", value: viewerHasMfa ? 'MFA enabled' : 'MFA not set up' }), !viewerHasMfa && (_jsxs("div", { className: "space-y-2", children: [_jsx("p", { className: "text-muted-foreground text-sm", children: "Set up MFA on your own account before requiring it for everyone, or you may lock yourself out." }), onNavigate && (_jsxs("button", { type: "button", onClick: () => onNavigate('/profile'), className: "border-border text-foreground hover:bg-accent inline-flex items-center gap-2 rounded-md border px-3 py-1.5 text-sm transition-colors", children: [_jsx(ShieldCheck, { size: 15, "aria-hidden": "true" }), "Set up MFA"] }))] })), _jsx(StatusRow, { status: totalAdmins === 0 ? 'unknown' : withMfa === totalAdmins ? 'pass' : 'warning', label: "Admin MFA coverage", value: totalAdmins === 0 ? 'No admins' : `${withMfa} of ${totalAdmins} admins` })] }), _jsx(ConfirmDangerousSettingDialog, { open: confirmEnable, title: "Require MFA for all admin users?", description: `Admins without MFA will be prompted to enroll and must complete setup within the grace period (${graceLabel(form.mfaGracePeriodDays)}). Make sure your own account has MFA configured first.`, confirmLabel: "Require MFA", onConfirm: () => {
+                    setField('mfaRequired', true);
+                    setConfirmEnable(false);
+                }, onCancel: () => setConfirmEnable(false) })] }));
+}
+//# sourceMappingURL=AuthMfaCard.js.map

package/dist/views/settings/AuthMfaCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMfaCard.js","sourceRoot":"","sources":["../../../src/views/settings/AuthMfaCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAA;AAClF,OAAO,EAAE,6BAA6B,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGjE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,aAAa,CAAA;IACpC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IAC9B,OAAO,GAAG,IAAI,OAAO,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,OAAO,EACP,WAAW,EACX,UAAU,GASX;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;IACvB,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzD,SAAS,gBAAgB,CAAC,KAAc;QACtC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,gBAAgB,CAAC,IAAI,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,CAAA;IAE1E,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,sBAAsB,EAC5B,WAAW,EAAC,2FAA2F,aAEvG,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,iBAAiB,IAChB,KAAK,EAAC,6BAA6B,EACnC,WAAW,EAAC,8GAA8G,EAC1H,OAAO,EAAE,IAAI,CAAC,WAAW,EACzB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,gBAAgB,GAC1B,EAEF,eAAK,SAAS,EAAC,yCAAyC,aACtD,iBAAO,OAAO,EAAE,OAAO,EAAE,SAAS,EAAC,QAAQ,aACzC,eAAM,SAAS,EAAC,uCAAuC,wCAA+B,EACtF,YAAG,SAAS,EAAC,sCAAsC,mFAE/C,IACE,EACR,iBACE,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAC9B,QAAQ,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EACvC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACvE,SAAS,EAAC,+MAA+M,YAExN,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACnC,iBAAgB,KAAK,EAAE,CAAC,YACrB,UAAU,CAAC,CAAC,CAAC,IADH,CAAC,CAEL,CACV,CAAC,GACK,IACL,IACF,EAEN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IACR,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACzC,KAAK,EAAC,cAAc,EACpB,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,GACtD,EACD,CAAC,YAAY,IAAI,CAChB,eAAK,SAAS,EAAC,WAAW,aACxB,YAAG,SAAS,EAAC,+BAA+B,+GAGxC,EACH,UAAU,IAAI,CACb,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EACrC,SAAS,EAAC,sIAAsI,aAEhJ,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,iBAAc,MAAM,GAAG,kBAErC,CACV,IACG,CACP,EACD,KAAC,SAAS,IACR,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACpF,KAAK,EAAC,oBAAoB,EAC1B,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,WAAW,SAAS,GAC9E,IACE,EAEN,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAC,kCAAkC,EACxC,WAAW,EAAE,kGAAkG,UAAU,CACvH,IAAI,CAAC,kBAAkB,CACxB,yDAAyD,EAC1D,YAAY,EAAC,aAAa,EAC1B,SAAS,EAAE,GAAG,EAAE;oBACd,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;oBAC7B,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBACzB,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,IACW,CAChB,CAAA;AACH,CAAC"}

package/dist/views/settings/SecretsAuditCard.d.ts

@@ -0,0 +1,11 @@
+import type { ApiKeysSecuritySummary, SecretsStatus, SecuritySourceMetadata, UsersSecuritySummary } from '@actuate-media/cms-core/security-center';
+export declare function SecretsAuditCard({ secrets, auditEnabled, failedLogins24h, users, apiKeys, sources, onNavigate, }: {
+    secrets: SecretsStatus;
+    auditEnabled: boolean;
+    failedLogins24h: number;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    sources: Record<string, SecuritySourceMetadata>;
+    onNavigate?: (path: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SecretsAuditCard.d.ts.map

package/dist/views/settings/SecretsAuditCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsAuditCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SecretsAuditCard.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EAEtB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,yCAAyC,CAAA;AAiBhD,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,EACP,YAAY,EACZ,eAAe,EACf,KAAK,EACL,OAAO,EACP,OAAO,EACP,UAAU,GACX,EAAE;IACD,OAAO,EAAE,aAAa,CAAA;IACtB,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAsFA"}

package/dist/views/settings/SecretsAuditCard.js

@@ -0,0 +1,22 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId } from 'react';
+import { SettingsSourceBadge } from './components.js';
+import { SecurityCard, StatusRow } from './securityPrimitives.js';
+function secretValue(status) {
+    switch (status) {
+        case 'pass':
+            return 'Configured';
+        case 'warning':
+            return 'Not configured';
+        case 'fail':
+            return 'Missing / invalid';
+        default:
+            return 'Unknown';
+    }
+}
+export function SecretsAuditCard({ secrets, auditEnabled, failedLogins24h, users, apiKeys, sources, onNavigate, }) {
+    const headingId = useId();
+    return (_jsxs(SecurityCard, { headingId: headingId, title: "Secrets, Encryption & Audit", description: "Platform secret status (values are never shown), audit logging, and cross-module risk.", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(StatusRow, { status: secrets.cmsSecret, label: "CMS signing secret", value: secretValue(secrets.cmsSecret), badge: _jsx(SettingsSourceBadge, { meta: sources.cmsSecret }) }), _jsx(StatusRow, { status: secrets.encryptionKey, label: "Encryption key", value: secretValue(secrets.encryptionKey), badge: _jsx(SettingsSourceBadge, { meta: sources.encryptionKey }) }), _jsx(StatusRow, { status: "pass", label: "API keys hashed at rest", value: "Yes" }), _jsx(StatusRow, { status: secrets.webhookSecretsEncrypted ? 'pass' : 'warning', label: "Webhook secrets encrypted", value: secrets.webhookSecretsEncrypted ? 'Yes' : 'Plaintext fallback' })] }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: auditEnabled ? 'pass' : 'warning', label: "Audit logging", value: auditEnabled ? 'Enabled' : 'Disabled', badge: _jsx(SettingsSourceBadge, { meta: sources.audit }) }), _jsx(StatusRow, { status: failedLogins24h >= 20 ? 'warning' : 'pass', label: "Failed logins (24h)", value: String(failedLogins24h) })] }), _jsxs("div", { className: "border-border mt-4 space-y-3 border-t pt-4", children: [_jsxs("div", { className: "flex items-start justify-between gap-3", children: [_jsxs("div", { className: "text-sm", children: [_jsx("p", { className: "text-foreground font-medium", children: "Users" }), _jsxs("p", { className: "text-muted-foreground", children: [users.totalAdmins, " admin", users.totalAdmins === 1 ? '' : 's', ",", ' ', users.adminsWithoutMfa, " without MFA", users.inactive > 0 ? `, ${users.inactive} inactive` : ''] })] }), onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate('/settings?tab=users'), className: "text-brand shrink-0 text-sm hover:underline", children: "Review users \u2192" }))] }), _jsxs("div", { className: "flex items-start justify-between gap-3", children: [_jsxs("div", { className: "text-sm", children: [_jsx("p", { className: "text-foreground font-medium", children: "API keys" }), _jsxs("p", { className: "text-muted-foreground", children: [apiKeys.active, " active, ", apiKeys.broadScope, " broad-scope, ", apiKeys.withoutExpiration, ' ', "without expiry"] })] }), onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate('/settings?tab=api-keys'), className: "text-brand shrink-0 text-sm hover:underline", children: "Review API keys \u2192" }))] })] })] }));
+}
+//# sourceMappingURL=SecretsAuditCard.js.map

package/dist/views/settings/SecretsAuditCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsAuditCard.js","sourceRoot":"","sources":["../../../src/views/settings/SecretsAuditCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAQ7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEjE,SAAS,WAAW,CAAC,MAAmB;IACtC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,YAAY,CAAA;QACrB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAA;QACzB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAA;QAC5B;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,EACP,YAAY,EACZ,eAAe,EACf,KAAK,EACL,OAAO,EACP,OAAO,EACP,UAAU,GASX;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IAEzB,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,6BAA6B,EACnC,WAAW,EAAC,wFAAwF,aAEpG,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,SAAS,IACR,MAAM,EAAE,OAAO,CAAC,SAAS,EACzB,KAAK,EAAC,oBAAoB,EAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EACrC,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,SAAS,GAAI,GACvD,EACF,KAAC,SAAS,IACR,MAAM,EAAE,OAAO,CAAC,aAAa,EAC7B,KAAK,EAAC,gBAAgB,EACtB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EACzC,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,aAAa,GAAI,GAC3D,EACF,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,yBAAyB,EAAC,KAAK,EAAC,KAAK,GAAG,EACvE,KAAC,SAAS,IACR,MAAM,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAC5D,KAAK,EAAC,2BAA2B,EACjC,KAAK,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,GACrE,IACE,EAEN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IACR,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACzC,KAAK,EAAC,eAAe,EACrB,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAC5C,KAAK,EAAE,KAAC,mBAAmB,IAAC,IAAI,EAAE,OAAO,CAAC,KAAK,GAAI,GACnD,EACF,KAAC,SAAS,IACR,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAClD,KAAK,EAAC,qBAAqB,EAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,GAC9B,IACE,EAGN,eAAK,SAAS,EAAC,4CAA4C,aACzD,eAAK,SAAS,EAAC,wCAAwC,aACrD,eAAK,SAAS,EAAC,SAAS,aACtB,YAAG,SAAS,EAAC,6BAA6B,sBAAU,EACpD,aAAG,SAAS,EAAC,uBAAuB,aACjC,KAAK,CAAC,WAAW,YAAQ,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAG,GAAG,EACjE,KAAK,CAAC,gBAAgB,kBACtB,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,WAAW,CAAC,CAAC,CAAC,EAAE,IACvD,IACA,EACL,UAAU,IAAI,CACb,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAChD,SAAS,EAAC,6CAA6C,oCAGhD,CACV,IACG,EACN,eAAK,SAAS,EAAC,wCAAwC,aACrD,eAAK,SAAS,EAAC,SAAS,aACtB,YAAG,SAAS,EAAC,6BAA6B,yBAAa,EACvD,aAAG,SAAS,EAAC,uBAAuB,aACjC,OAAO,CAAC,MAAM,eAAW,OAAO,CAAC,UAAU,oBAAgB,OAAO,CAAC,iBAAiB,EAAE,GAAG,sBAExF,IACA,EACL,UAAU,IAAI,CACb,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACnD,SAAS,EAAC,6CAA6C,uCAGhD,CACV,IACG,IACF,IACO,CAChB,CAAA;AACH,CAAC"}

package/dist/views/settings/SecurityStatusCard.d.ts

@@ -0,0 +1,6 @@
+import type { SecurityStatus } from '@actuate-media/cms-core/security-center';
+export declare function SecurityStatusCard({ status, onNavigate, }: {
+    status: SecurityStatus;
+    onNavigate?: (path: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SecurityStatusCard.d.ts.map

package/dist/views/settings/SecurityStatusCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityStatusCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SecurityStatusCard.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,yCAAyC,CAAA;AA+B9F,wBAAgB,kBAAkB,CAAC,EACjC,MAAM,EACN,UAAU,GACX,EAAE;IACD,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAoEA"}

package/dist/views/settings/SecurityStatusCard.js

@@ -0,0 +1,35 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId } from 'react';
+import { Shield, ShieldAlert, ShieldCheck, ShieldX } from 'lucide-react';
+import { CheckIcon } from './securityPrimitives.js';
+const LEVEL_STYLES = {
+    secure: {
+        pill: 'bg-success/15 text-success border-success/30',
+        Icon: ShieldCheck,
+        word: 'Secure',
+    },
+    needs_attention: {
+        pill: 'bg-warning/15 text-warning border-warning/30',
+        Icon: ShieldAlert,
+        word: 'Needs attention',
+    },
+    at_risk: {
+        pill: 'bg-destructive/15 text-destructive border-destructive/30',
+        Icon: ShieldX,
+        word: 'At risk',
+    },
+    unknown: { pill: 'bg-muted text-muted-foreground border-border', Icon: Shield, word: 'Unknown' },
+};
+const SEVERITY_STYLES = {
+    critical: 'border-destructive/30 bg-destructive/10 text-destructive',
+    warning: 'border-warning/30 bg-warning/10 text-warning',
+    info: 'border-border bg-muted text-muted-foreground',
+};
+export function SecurityStatusCard({ status, onNavigate, }) {
+    const headingId = useId();
+    const style = LEVEL_STYLES[status.status];
+    const { Icon } = style;
+    return (_jsxs("section", { "aria-labelledby": headingId, className: "border-border bg-card rounded-lg border p-4", children: [_jsxs("div", { className: "mb-1 flex items-start justify-between gap-3", children: [_jsx("h3", { id: headingId, className: "text-foreground text-base font-medium", children: "Security Status" }), _jsxs("span", { className: `inline-flex items-center gap-1.5 rounded-full border px-2.5 py-1 text-sm font-medium ${style.pill}`, children: [_jsx(Icon, { size: 15, "aria-hidden": "true" }), style.word] })] }), _jsx("p", { className: "text-muted-foreground mb-4 text-sm", children: status.description }), _jsx("div", { className: "grid grid-cols-1 gap-x-6 gap-y-1 sm:grid-cols-2", children: status.checks.map((check) => (_jsxs("button", { type: "button", disabled: !check.actionHref || !onNavigate, onClick: () => check.actionHref && onNavigate?.(check.actionHref), className: "enabled:hover:bg-accent/50 flex items-center justify-between gap-3 rounded-md py-1.5 text-left text-sm disabled:cursor-default", children: [_jsxs("span", { className: "flex items-center gap-2", children: [_jsx(CheckIcon, { status: check.status }), _jsx("span", { className: "text-foreground", children: check.label })] }), check.value !== undefined && (_jsx("span", { className: "text-muted-foreground text-right", children: check.value }))] }, check.key))) }), status.warnings.length > 0 && (_jsx("div", { className: "mt-4 space-y-2", "aria-live": "polite", children: status.warnings.map((w) => (_jsxs("div", { role: "note", className: `flex items-start justify-between gap-3 rounded-lg border p-3 text-sm ${SEVERITY_STYLES[w.severity]}`, children: [_jsxs("div", { children: [_jsx("p", { className: "font-medium", children: w.title }), _jsx("p", { className: "mt-0.5 opacity-90", children: w.description })] }), w.actionHref && w.actionLabel && onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate(w.actionHref), className: "shrink-0 self-center rounded-md border border-current/30 px-2.5 py-1 text-xs font-medium hover:opacity-80", children: w.actionLabel }))] }, w.id))) }))] }));
+}
+//# sourceMappingURL=SecurityStatusCard.js.map

package/dist/views/settings/SecurityStatusCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityStatusCard.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityStatusCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,YAAY,GAGd;IACF,MAAM,EAAE;QACN,IAAI,EAAE,8CAA8C;QACpD,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,QAAQ;KACf;IACD,eAAe,EAAE;QACf,IAAI,EAAE,8CAA8C;QACpD,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,iBAAiB;KACxB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,0DAA0D;QAChE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,SAAS;KAChB;IACD,OAAO,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;CACjG,CAAA;AAED,MAAM,eAAe,GAAgD;IACnE,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,8CAA8C;CACrD,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,EACjC,MAAM,EACN,UAAU,GAIX;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAEtB,OAAO,CACL,sCAA0B,SAAS,EAAE,SAAS,EAAC,6CAA6C,aAC1F,eAAK,SAAS,EAAC,6CAA6C,aAC1D,aAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAC,uCAAuC,gCAE/D,EACL,gBACE,SAAS,EAAE,wFAAwF,KAAK,CAAC,IAAI,EAAE,aAE/G,KAAC,IAAI,IAAC,IAAI,EAAE,EAAE,iBAAc,MAAM,GAAG,EAEpC,KAAK,CAAC,IAAI,IACN,IACH,EACN,YAAG,SAAS,EAAC,oCAAoC,YAAE,MAAM,CAAC,WAAW,GAAK,EAE1E,cAAK,SAAS,EAAC,iDAAiD,YAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC5B,kBAEE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,UAAU,EAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EACjE,SAAS,EAAC,gIAAgI,aAE1I,gBAAM,SAAS,EAAC,yBAAyB,aACvC,KAAC,SAAS,IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAI,EACnC,eAAM,SAAS,EAAC,iBAAiB,YAAE,KAAK,CAAC,KAAK,GAAQ,IACjD,EACN,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAC5B,eAAM,SAAS,EAAC,kCAAkC,YAAE,KAAK,CAAC,KAAK,GAAQ,CACxE,KAZI,KAAK,CAAC,GAAG,CAaP,CACV,CAAC,GACE,EAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC7B,cAAK,SAAS,EAAC,gBAAgB,eAAW,QAAQ,YAC/C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAC1B,eAEE,IAAI,EAAC,MAAM,EACX,SAAS,EAAE,wEAAwE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,aAEhH,0BACE,YAAG,SAAS,EAAC,aAAa,YAAE,CAAC,CAAC,KAAK,GAAK,EACxC,YAAG,SAAS,EAAC,mBAAmB,YAAE,CAAC,CAAC,WAAW,GAAK,IAChD,EACL,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,UAAU,IAAI,CAC9C,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,UAAW,CAAC,EACxC,SAAS,EAAC,2GAA2G,YAEpH,CAAC,CAAC,WAAW,GACP,CACV,KAhBI,CAAC,CAAC,EAAE,CAiBL,CACP,CAAC,GACE,CACP,IACO,CACX,CAAA;AACH,CAAC"}

package/dist/views/settings/SecurityTab.d.ts

@@ -0,0 +1,5 @@
+export declare function SecurityTab({ role, onNavigate, }: {
+    role?: string;
+    onNavigate?: (path: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SecurityTab.d.ts.map

package/dist/views/settings/SecurityTab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityTab.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAyBA,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GACX,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAmIA"}

package/dist/views/settings/SecurityTab.js

@@ -0,0 +1,41 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect } from 'react';
+import { ShieldAlert } from 'lucide-react';
+import { SettingsSaveBar, SettingsValidationSummary } from './components.js';
+import { AccessProtectionCard } from './AccessProtectionCard.js';
+import { AuthMfaCard } from './AuthMfaCard.js';
+import { SecretsAuditCard } from './SecretsAuditCard.js';
+import { SecurityStatusCard } from './SecurityStatusCard.js';
+import { SessionPolicyCard } from './SessionPolicyCard.js';
+import { useSecuritySettings } from './useSecuritySettings.js';
+function CardSkeleton() {
+    return (_jsxs("div", { className: "border-border bg-card animate-pulse rounded-lg border p-4", children: [_jsx("div", { className: "bg-muted mb-3 h-4 w-40 rounded" }), _jsx("div", { className: "bg-muted mb-4 h-3 w-72 rounded" }), _jsxs("div", { className: "space-y-3", children: [_jsx("div", { className: "bg-muted h-3 w-full rounded" }), _jsx("div", { className: "bg-muted h-3 w-2/3 rounded" })] })] }));
+}
+export function SecurityTab({ role, onNavigate, }) {
+    const canEdit = role === 'ADMIN';
+    const { loading, loadError, data, form, setField, dirty, issues, hasErrors, saveState, save, reset, revokeState, revokeAllOtherSessions, } = useSecuritySettings(canEdit);
+    // Deep-link support: /settings?tab=security&section=sessions|ip-allowlist|audit
+    useEffect(() => {
+        if (loading || typeof window === 'undefined')
+            return;
+        const section = new URLSearchParams(window.location.search).get('section');
+        if (!section)
+            return;
+        const el = document.getElementById(`security-${section}`);
+        el?.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }, [loading]);
+    if (loading) {
+        return (_jsxs("div", { className: "space-y-4", children: [_jsx(CardSkeleton, {}), _jsx(CardSkeleton, {}), _jsx(CardSkeleton, {})] }));
+    }
+    if (loadError || !data) {
+        const forbidden = /forbidden|permission|insufficient/i.test(loadError ?? '');
+        return (_jsxs("div", { className: "border-border bg-card text-muted-foreground flex items-start gap-3 rounded-lg border p-6 text-sm", children: [_jsx(ShieldAlert, { size: 20, className: "text-warning mt-0.5 shrink-0", "aria-hidden": "true" }), _jsxs("div", { children: [_jsx("p", { className: "text-foreground font-medium", children: forbidden
+                                ? 'You do not have access to security settings'
+                                : 'Security settings unavailable' }), _jsx("p", { className: "mt-1", children: forbidden
+                                ? 'Ask an administrator to review the Security tab.'
+                                : (loadError ?? 'The security service could not be reached. Try again shortly.') })] })] }));
+    }
+    return (_jsxs("div", { className: "space-y-4 pb-4", children: [_jsx(SecurityStatusCard, { status: data.status, onNavigate: onNavigate }), issues.length > 0 && _jsx(SettingsValidationSummary, { issues: issues }), !canEdit && (_jsx("p", { className: "text-muted-foreground text-sm", children: "You have read-only access. Only administrators can change security settings." })), _jsx(AuthMfaCard, { form: form, setField: setField, canEdit: canEdit, viewerHasMfa: data.viewerHasMfa, withMfa: data.users.withMfa, totalAdmins: data.users.totalAdmins, onNavigate: onNavigate }), _jsx("div", { id: "security-sessions", children: _jsx(SessionPolicyCard, { form: form, setField: setField, canEdit: canEdit, sessionMaxAgeHours: data.sessionMaxAgeHours, activeSessions: data.activeSessions, revokeState: revokeState, onRevokeAll: () => void revokeAllOtherSessions() }) }), _jsx("div", { id: "security-ip-allowlist", children: _jsx(AccessProtectionCard, { ipAllowlist: data.ipAllowlist, secrets: data.secrets, csrfEnabled: data.csrfEnabled, uploadValidation: data.uploadValidation, sources: data.sources, onNavigate: onNavigate }) }), _jsx("div", { id: "security-audit", children: _jsx(SecretsAuditCard, { secrets: data.secrets, auditEnabled: data.auditEnabled, failedLogins24h: data.failedLogins24h, users: data.users, apiKeys: data.apiKeys, sources: data.sources, onNavigate: onNavigate }) }), saveState === 'error' && (_jsx("p", { className: "text-destructive text-sm", role: "alert", children: "Failed to save security settings. Please try again." })), _jsx(SettingsSaveBar, { dirty: dirty, canEdit: canEdit, hasErrors: hasErrors, saveState: saveState, onSave: () => void save(), onReset: reset })] }));
+}
+//# sourceMappingURL=SecurityTab.js.map

package/dist/views/settings/SecurityTab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityTab.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,SAAS,YAAY;IACnB,OAAO,CACL,eAAK,SAAS,EAAC,2DAA2D,aACxE,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,eAAK,SAAS,EAAC,WAAW,aACxB,cAAK,SAAS,EAAC,6BAA6B,GAAG,EAC/C,cAAK,SAAS,EAAC,4BAA4B,GAAG,IAC1C,IACF,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAA;IAChC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,WAAW,EACX,sBAAsB,GACvB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEhC,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACpD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QACzD,EAAE,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,IACZ,CACP,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,CACL,eAAK,SAAS,EAAC,kGAAkG,aAC/G,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,8BAA8B,iBAAa,MAAM,GAAG,EACrF,0BACE,YAAG,SAAS,EAAC,6BAA6B,YACvC,SAAS;gCACR,CAAC,CAAC,6CAA6C;gCAC/C,CAAC,CAAC,+BAA+B,GACjC,EACJ,YAAG,SAAS,EAAC,MAAM,YAChB,SAAS;gCACR,CAAC,CAAC,kDAAkD;gCACpD,CAAC,CAAC,CAAC,SAAS,IAAI,+DAA+D,CAAC,GAChF,IACA,IACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,kBAAkB,IAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,GAAI,EAElE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,yBAAyB,IAAC,MAAM,EAAE,MAAM,GAAI,EAElE,CAAC,OAAO,IAAI,CACX,YAAG,SAAS,EAAC,+BAA+B,6FAExC,CACL,EAED,KAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EACnC,UAAU,EAAE,UAAU,GACtB,EAEF,cAAK,EAAE,EAAC,mBAAmB,YACzB,KAAC,iBAAiB,IAChB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAC3C,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,sBAAsB,EAAE,GAChD,GACE,EAEN,cAAK,EAAE,EAAC,uBAAuB,YAC7B,KAAC,oBAAoB,IACnB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEN,cAAK,EAAE,EAAC,gBAAgB,YACtB,KAAC,gBAAgB,IACf,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,EACrC,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEL,SAAS,KAAK,OAAO,IAAI,CACxB,YAAG,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,oEAEhD,CACL,EAED,KAAC,eAAe,IACd,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EACzB,OAAO,EAAE,KAAK,GACd,IACE,CACP,CAAA;AACH,CAAC"}

package/dist/views/settings/SessionPolicyCard.d.ts

@@ -0,0 +1,11 @@
+import type { SecurityForm } from './useSecuritySettings.js';
+export declare function SessionPolicyCard({ form, setField, canEdit, sessionMaxAgeHours, activeSessions, revokeState, onRevokeAll, }: {
+    form: SecurityForm;
+    setField: <K extends keyof SecurityForm>(key: K, value: SecurityForm[K]) => void;
+    canEdit: boolean;
+    sessionMaxAgeHours: number;
+    activeSessions: number;
+    revokeState: 'idle' | 'working' | 'done' | 'error';
+    onRevokeAll: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SessionPolicyCard.d.ts.map

package/dist/views/settings/SessionPolicyCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPolicyCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SessionPolicyCard.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAM5D,wBAAgB,iBAAiB,CAAC,EAChC,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,OAAO,EAAE,OAAO,CAAA;IAChB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,WAAW,EAAE,MAAM,IAAI,CAAA;CACxB,2CA6FA"}

package/dist/views/settings/SessionPolicyCard.js

@@ -0,0 +1,21 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId, useState } from 'react';
+import { Loader2 } from 'lucide-react';
+import { MAX_CONCURRENT_SESSION_OPTIONS } from '@actuate-media/cms-core/security-center';
+import { ConfirmDangerousSettingDialog } from './components.js';
+import { SecurityCard, StatusRow } from './securityPrimitives.js';
+function sessionsLabel(n) {
+    return n === 0 ? 'Unlimited' : String(n);
+}
+export function SessionPolicyCard({ form, setField, canEdit, sessionMaxAgeHours, activeSessions, revokeState, onRevokeAll, }) {
+    const headingId = useId();
+    const maxId = useId();
+    const [confirmRevoke, setConfirmRevoke] = useState(false);
+    const maxAgeDays = Math.round(sessionMaxAgeHours / 24);
+    return (_jsxs(SecurityCard, { headingId: headingId, title: "Session Policy", description: "Control how many sessions an account can hold and revoke active sessions.", children: [_jsx("div", { className: "space-y-4", children: _jsxs("div", { className: "flex items-center justify-between gap-4", children: [_jsxs("label", { htmlFor: maxId, className: "flex-1", children: [_jsx("span", { className: "text-foreground text-base font-medium", children: "Maximum concurrent sessions" }), _jsx("p", { className: "text-muted-foreground mt-0.5 text-sm", children: "Oldest sessions are signed out when a user exceeds this. Choose Unlimited to disable the cap." })] }), _jsx("select", { id: maxId, value: form.maxConcurrentSessions, disabled: !canEdit, onChange: (e) => setField('maxConcurrentSessions', Number(e.target.value)), className: "border-border bg-input-background text-foreground focus-visible:ring-ring rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50", children: MAX_CONCURRENT_SESSION_OPTIONS.map((n) => (_jsx("option", { value: n, children: sessionsLabel(n) }, n))) })] }) }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: "pass", label: "Active admin sessions", value: String(activeSessions) }), _jsx(StatusRow, { status: "pass", label: "Maximum session age", value: `${maxAgeDays} day${maxAgeDays === 1 ? '' : 's'}` }), _jsx(StatusRow, { status: "pass", label: "Revoke sessions on password change", value: "Enabled" })] }), _jsxs("div", { className: "border-border mt-4 flex items-center justify-between gap-3 border-t pt-4", children: [_jsxs("div", { children: [_jsx("p", { className: "text-foreground text-sm font-medium", children: "Revoke other sessions" }), _jsx("p", { className: "text-muted-foreground text-sm", children: "Sign out every session except this one. Useful after a suspected compromise." }), revokeState === 'done' && (_jsx("p", { className: "text-success mt-1 text-sm", "aria-live": "polite", children: "Other sessions revoked." })), revokeState === 'error' && (_jsx("p", { className: "text-destructive mt-1 text-sm", "aria-live": "polite", children: "Could not revoke sessions. Try again." }))] }), _jsxs("button", { type: "button", disabled: !canEdit || revokeState === 'working', onClick: () => setConfirmRevoke(true), className: "border-border text-foreground hover:bg-accent inline-flex shrink-0 items-center gap-2 rounded-md border px-3 py-2 text-sm font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-50", children: [revokeState === 'working' && (_jsx(Loader2, { size: 15, className: "animate-spin", "aria-hidden": "true" })), "Revoke other sessions"] })] }), _jsx(ConfirmDangerousSettingDialog, { open: confirmRevoke, title: "Revoke all other sessions?", description: "Every active session except your current one will be signed out immediately. Those users (and your other devices) will need to sign in again.", confirmLabel: "Revoke sessions", onConfirm: () => {
+                    setConfirmRevoke(false);
+                    onRevokeAll();
+                }, onCancel: () => setConfirmRevoke(false) })] }));
+}
+//# sourceMappingURL=SessionPolicyCard.js.map

package/dist/views/settings/SessionPolicyCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPolicyCard.js","sourceRoot":"","sources":["../../../src/views/settings/SessionPolicyCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAA;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGjE,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,WAAW,GASZ;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;IACrB,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAA;IAEtD,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,gBAAgB,EACtB,WAAW,EAAC,2EAA2E,aAEvF,cAAK,SAAS,EAAC,WAAW,YACxB,eAAK,SAAS,EAAC,yCAAyC,aACtD,iBAAO,OAAO,EAAE,KAAK,EAAE,SAAS,EAAC,QAAQ,aACvC,eAAM,SAAS,EAAC,uCAAuC,4CAEhD,EACP,YAAG,SAAS,EAAC,sCAAsC,8GAG/C,IACE,EACR,iBACE,EAAE,EAAE,KAAK,EACT,KAAK,EAAE,IAAI,CAAC,qBAAqB,EACjC,QAAQ,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC1E,SAAS,EAAC,+MAA+M,YAExN,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACzC,iBAAgB,KAAK,EAAE,CAAC,YACrB,aAAa,CAAC,CAAC,CAAC,IADN,CAAC,CAEL,CACV,CAAC,GACK,IACL,GACF,EAEN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,uBAAuB,EAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,GAAI,EACxF,KAAC,SAAS,IACR,MAAM,EAAC,MAAM,EACb,KAAK,EAAC,qBAAqB,EAC3B,KAAK,EAAE,GAAG,UAAU,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GACxD,EACF,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,oCAAoC,EAAC,KAAK,EAAC,SAAS,GAAG,IAClF,EAEN,eAAK,SAAS,EAAC,0EAA0E,aACvF,0BACE,YAAG,SAAS,EAAC,qCAAqC,sCAA0B,EAC5E,YAAG,SAAS,EAAC,+BAA+B,6FAExC,EACH,WAAW,KAAK,MAAM,IAAI,CACzB,YAAG,SAAS,EAAC,2BAA2B,eAAW,QAAQ,wCAEvD,CACL,EACA,WAAW,KAAK,OAAO,IAAI,CAC1B,YAAG,SAAS,EAAC,+BAA+B,eAAW,QAAQ,sDAE3D,CACL,IACG,EACN,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,OAAO,IAAI,WAAW,KAAK,SAAS,EAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAC,yMAAyM,aAElN,WAAW,KAAK,SAAS,IAAI,CAC5B,KAAC,OAAO,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,iBAAa,MAAM,GAAG,CAClE,6BAEM,IACL,EAEN,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAC,4BAA4B,EAClC,WAAW,EAAC,+IAA+I,EAC3J,YAAY,EAAC,iBAAiB,EAC9B,SAAS,EAAE,GAAG,EAAE;oBACd,gBAAgB,CAAC,KAAK,CAAC,CAAA;oBACvB,WAAW,EAAE,CAAA;gBACf,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,IACW,CAChB,CAAA;AACH,CAAC"}

package/dist/views/settings/securityPrimitives.d.ts

@@ -0,0 +1,21 @@
+import type { ReactNode } from 'react';
+import type { CheckStatus } from '@actuate-media/cms-core/security-center';
+/** Small status icon used in check/summary rows. Text label always accompanies it. */
+export declare function CheckIcon({ status }: {
+    status: CheckStatus;
+}): import("react/jsx-runtime").JSX.Element;
+/** A status row: icon + label on the left, value on the right. */
+export declare function StatusRow({ status, label, value, badge, }: {
+    status: CheckStatus;
+    label: string;
+    value?: ReactNode;
+    badge?: ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+/** Section wrapper matching the other settings cards. */
+export declare function SecurityCard({ headingId, title, description, children, }: {
+    headingId: string;
+    title: string;
+    description: string;
+    children: ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=securityPrimitives.d.ts.map

package/dist/views/settings/securityPrimitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityPrimitives.d.ts","sourceRoot":"","sources":["../../../src/views/settings/securityPrimitives.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAA;AAE1E,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,2CAW5D;AASD,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,EACxB,MAAM,EACN,KAAK,EACL,KAAK,EACL,KAAK,GACN,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,2CAaA;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,KAAK,EACL,WAAW,EACX,QAAQ,GACT,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;CACpB,2CAUA"}

package/dist/views/settings/securityPrimitives.js

@@ -0,0 +1,31 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AlertTriangle, Check, CircleHelp, X } from 'lucide-react';
+/** Small status icon used in check/summary rows. Text label always accompanies it. */
+export function CheckIcon({ status }) {
+    switch (status) {
+        case 'pass':
+            return _jsx(Check, { size: 15, className: "text-success shrink-0", "aria-hidden": "true" });
+        case 'warning':
+            return _jsx(AlertTriangle, { size: 15, className: "text-warning shrink-0", "aria-hidden": "true" });
+        case 'fail':
+            return _jsx(X, { size: 15, className: "text-destructive shrink-0", "aria-hidden": "true" });
+        default:
+            return _jsx(CircleHelp, { size: 15, className: "text-muted-foreground shrink-0", "aria-hidden": "true" });
+    }
+}
+const STATUS_WORD = {
+    pass: 'Pass',
+    warning: 'Warning',
+    fail: 'Fail',
+    unknown: 'Unknown',
+};
+/** A status row: icon + label on the left, value on the right. */
+export function StatusRow({ status, label, value, badge, }) {
+    return (_jsxs("div", { className: "flex items-center justify-between gap-3 py-1.5 text-sm", children: [_jsxs("span", { className: "flex items-center gap-2", children: [_jsx(CheckIcon, { status: status }), _jsxs("span", { className: "sr-only", children: [STATUS_WORD[status], ": "] }), _jsx("span", { className: "text-foreground", children: label }), badge] }), value !== undefined && _jsx("span", { className: "text-muted-foreground text-right", children: value })] }));
+}
+/** Section wrapper matching the other settings cards. */
+export function SecurityCard({ headingId, title, description, children, }) {
+    return (_jsxs("section", { "aria-labelledby": headingId, className: "border-border bg-card rounded-lg border p-4", children: [_jsx("h3", { id: headingId, className: "text-foreground mb-1 text-base font-medium", children: title }), _jsx("p", { className: "text-muted-foreground mb-4 text-sm", children: description }), children] }));
+}
+//# sourceMappingURL=securityPrimitives.js.map

package/dist/views/settings/securityPrimitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityPrimitives.js","sourceRoot":"","sources":["../../../src/views/settings/securityPrimitives.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,cAAc,CAAA;AAIlE,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,EAA2B;IAC3D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAC,KAAK,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,uBAAuB,iBAAa,MAAM,GAAG,CAAA;QACjF,KAAK,SAAS;YACZ,OAAO,KAAC,aAAa,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,uBAAuB,iBAAa,MAAM,GAAG,CAAA;QACzF,KAAK,MAAM;YACT,OAAO,KAAC,CAAC,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,2BAA2B,iBAAa,MAAM,GAAG,CAAA;QACjF;YACE,OAAO,KAAC,UAAU,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,gCAAgC,iBAAa,MAAM,GAAG,CAAA;IACjG,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAgC;IAC/C,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;CACnB,CAAA;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,EACxB,MAAM,EACN,KAAK,EACL,KAAK,EACL,KAAK,GAMN;IACC,OAAO,CACL,eAAK,SAAS,EAAC,wDAAwD,aACrE,gBAAM,SAAS,EAAC,yBAAyB,aACvC,KAAC,SAAS,IAAC,MAAM,EAAE,MAAM,GAAI,EAE7B,gBAAM,SAAS,EAAC,SAAS,aAAE,WAAW,CAAC,MAAM,CAAC,UAAU,EACxD,eAAM,SAAS,EAAC,iBAAiB,YAAE,KAAK,GAAQ,EAC/C,KAAK,IACD,EACN,KAAK,KAAK,SAAS,IAAI,eAAM,SAAS,EAAC,kCAAkC,YAAE,KAAK,GAAQ,IACrF,CACP,CAAA;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,EAC3B,SAAS,EACT,KAAK,EACL,WAAW,EACX,QAAQ,GAMT;IACC,OAAO,CACL,sCAA0B,SAAS,EAAE,SAAS,EAAC,6CAA6C,aAC1F,aAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAC,4CAA4C,YACtE,KAAK,GACH,EACL,YAAG,SAAS,EAAC,oCAAoC,YAAE,WAAW,GAAK,EAClE,QAAQ,IACD,CACX,CAAA;AACH,CAAC"}

package/dist/views/settings/useSecuritySettings.d.ts

@@ -0,0 +1,37 @@
+import { type SecurityCenterData } from '@actuate-media/cms-core/security-center';
+import type { ValidationIssue } from './useGeneralSettings.js';
+/** The subset of security policy the tab can actually edit + enforce. */
+export interface SecurityForm {
+    mfaRequired: boolean;
+    mfaGracePeriodDays: number;
+    maxConcurrentSessions: number;
+}
+type SaveState = 'idle' | 'saving' | 'success' | 'error';
+export interface UseSecuritySettings {
+    loading: boolean;
+    loadError: string | null;
+    data: SecurityCenterData | null;
+    form: SecurityForm;
+    setField: <K extends keyof SecurityForm>(key: K, value: SecurityForm[K]) => void;
+    dirty: boolean;
+    issues: ValidationIssue[];
+    hasErrors: boolean;
+    canEdit: boolean;
+    saveState: SaveState;
+    saveError: string | null;
+    save: () => Promise<void>;
+    reset: () => void;
+    refetch: () => void;
+    revokeState: 'idle' | 'working' | 'done' | 'error';
+    revokeAllOtherSessions: () => Promise<number | null>;
+}
+/**
+ * Loads the Security Center (`GET /security`) — computed posture, cross-module
+ * summaries, secret/encryption verdicts — and tracks the small editable policy
+ * (MFA requirement + grace, concurrent-session cap). Save is lockout-safe: the
+ * client mirrors the server's MFA guard so the operator gets immediate feedback,
+ * and the server re-checks authoritatively.
+ */
+export declare function useSecuritySettings(canEdit: boolean): UseSecuritySettings;
+export {};
+//# sourceMappingURL=useSecuritySettings.d.ts.map

package/dist/views/settings/useSecuritySettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAuBxD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAiIzE"}