@authowl/react 0.21.2 → 0.22.0

package/dist/index.cjs

@@ -933,6 +933,159 @@ var init_FormError = __esm({
   }
 });
 
+// src/components/captcha-loader.ts
+var captcha_loader_exports = {};
+__export(captcha_loader_exports, {
+  loadCaptcha: () => loadCaptcha
+});
+function providerGlobal(adapter) {
+  const api = window[adapter.globalName];
+  return typeof api?.render === "function" ? api : void 0;
+}
+function loadCaptcha(adapter) {
+  const available = providerGlobal(adapter);
+  if (available) return Promise.resolve(available);
+  const cached = loaders.get(adapter.scriptUrl);
+  if (cached) return cached;
+  const loading = new Promise((resolve, reject) => {
+    const existing = document.querySelector(
+      `script[src="${adapter.scriptUrl}"]`
+    );
+    const script = existing ?? document.createElement("script");
+    let poll;
+    const cleanup = () => {
+      clearTimeout(timeout);
+      if (poll !== void 0) clearInterval(poll);
+      script.removeEventListener("load", loaded);
+      script.removeEventListener("error", failed);
+    };
+    const resolveWhenPublished = () => {
+      const api = providerGlobal(adapter);
+      if (!api) return false;
+      cleanup();
+      resolve(api);
+      return true;
+    };
+    const loaded = () => {
+      if (!resolveWhenPublished() && poll === void 0) {
+        poll = setInterval(resolveWhenPublished, GLOBAL_POLL_INTERVAL_MS);
+      }
+    };
+    const failed = () => {
+      cleanup();
+      if (!existing) script.remove();
+      reject(new Error(`${adapter.label} failed to load`));
+    };
+    const timeout = setTimeout(failed, SCRIPT_LOAD_TIMEOUT_MS);
+    script.addEventListener("load", loaded, { once: true });
+    script.addEventListener("error", failed, { once: true });
+    if (existing) {
+      loaded();
+    } else {
+      script.src = adapter.scriptUrl;
+      script.async = true;
+      script.defer = true;
+      const nonce = document.querySelector("script[nonce]")?.nonce;
+      if (nonce) script.nonce = nonce;
+      document.head.appendChild(script);
+    }
+  });
+  const retryable = loading.catch((error) => {
+    loaders.delete(adapter.scriptUrl);
+    throw error;
+  });
+  loaders.set(adapter.scriptUrl, retryable);
+  return retryable;
+}
+var SCRIPT_LOAD_TIMEOUT_MS, GLOBAL_POLL_INTERVAL_MS, loaders;
+var init_captcha_loader = __esm({
+  "src/components/captcha-loader.ts"() {
+    "use strict";
+    "use client";
+    SCRIPT_LOAD_TIMEOUT_MS = 1e4;
+    GLOBAL_POLL_INTERVAL_MS = 25;
+    loaders = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/components/captcha-providers.ts
+var captcha_providers_exports = {};
+__export(captcha_providers_exports, {
+  CAPTCHA_ADAPTERS: () => CAPTCHA_ADAPTERS,
+  captchaAdapterFor: () => captchaAdapterFor
+});
+function preferredTheme() {
+  return typeof window !== "undefined" && window.matchMedia?.("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+}
+function teardown(api, widgetId) {
+  if (api.remove) {
+    try {
+      api.remove(widgetId);
+      return;
+    } catch {
+    }
+  }
+  try {
+    api.reset?.(widgetId);
+  } catch {
+  }
+}
+function captchaAdapterFor(provider) {
+  return CAPTCHA_ADAPTERS[provider] ?? null;
+}
+var CAPTCHA_ADAPTERS;
+var init_captcha_providers = __esm({
+  "src/components/captcha-providers.ts"() {
+    "use strict";
+    "use client";
+    CAPTCHA_ADAPTERS = {
+      turnstile: {
+        scriptUrl: "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit",
+        globalName: "turnstile",
+        label: "Cloudflare Turnstile",
+        invisibleRenderOptions: ({ siteKey, theme, action, language }) => ({
+          sitekey: siteKey,
+          theme,
+          action,
+          language,
+          execution: "execute",
+          appearance: "interaction-only",
+          size: "flexible"
+        }),
+        teardown
+      },
+      hcaptcha: {
+        scriptUrl: "https://js.hcaptcha.com/1/api.js?render=explicit",
+        globalName: "hcaptcha",
+        label: "hCaptcha",
+        invisibleRenderOptions: ({ siteKey, theme }) => ({
+          sitekey: siteKey,
+          // 'auto' is Turnstile vocabulary. hCaptcha and reCAPTCHA take light|dark
+          // only and silently fall back to light on anything else, which reads badly
+          // in a dark application.
+          theme: theme === "auto" ? preferredTheme() : theme,
+          size: "invisible"
+        }),
+        teardown
+      },
+      "recaptcha-v2": {
+        scriptUrl: "https://www.google.com/recaptcha/api.js?render=explicit",
+        globalName: "grecaptcha",
+        label: "reCAPTCHA",
+        invisibleRenderOptions: ({ siteKey, theme }) => ({
+          sitekey: siteKey,
+          // 'auto' is Turnstile vocabulary. hCaptcha and reCAPTCHA take light|dark
+          // only and silently fall back to light on anything else, which reads badly
+          // in a dark application.
+          theme: theme === "auto" ? preferredTheme() : theme,
+          size: "invisible"
+        }),
+        teardown
+      }
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/qrcode-generator@2.0.4/node_modules/qrcode-generator/dist/qrcode.mjs
 var qrcode, QRMode, QRErrorCorrectionLevel, QRMaskPattern, QRUtil, QRMath, qrPolynomial, QRRSBlock, qrBitBuffer, qrNumber, qrAlphaNum, qr8BitByte, qrKanji, byteArrayOutputStream, base64EncodeOutputStream, base64DecodeInputStream, gifImage, createDataURL, qrcode_default, stringToBytes;
 var init_qrcode = __esm({
@@ -3430,110 +3583,26 @@ function PasskeyButton({ redirectTo, onSignedIn }) {
 }
 
 // src/components/ForgotPassword.tsx
-var React11 = __toESM(require("react"), 1);
+var React10 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
 init_Spinner();
 
 // src/components/AuthChallenge.tsx
-var React10 = __toESM(require("react"), 1);
+var React9 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
+init_FormError();
 
-// src/components/Turnstile.tsx
-var React9 = __toESM(require("react"), 1);
-var import_jsx_runtime10 = require("react/jsx-runtime");
-var SCRIPT_URL = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";
-var SCRIPT_LOAD_TIMEOUT_MS = 1e4;
-var LOCAL_TURNSTILE_TEST_TOKEN = "XXXX.DUMMY.TOKEN.XXXX";
-var loader = null;
-function loadTurnstile() {
-  if (window.turnstile) return Promise.resolve(window.turnstile);
-  if (loader) return loader;
-  loader = new Promise((resolve, reject) => {
-    const existing = document.querySelector(`script[src="${SCRIPT_URL}"]`);
-    const script = existing ?? document.createElement("script");
-    const cleanup = () => {
-      clearTimeout(timeout);
-      script.removeEventListener("load", loaded);
-      script.removeEventListener("error", failed);
-    };
-    const loaded = () => {
-      cleanup();
-      if (window.turnstile) {
-        resolve(window.turnstile);
-      } else {
-        reject(new Error("Turnstile unavailable"));
-      }
-    };
-    const failed = () => {
-      cleanup();
-      if (!existing) script.remove();
-      reject(new Error("Turnstile failed to load"));
-    };
-    const timeout = setTimeout(failed, SCRIPT_LOAD_TIMEOUT_MS);
-    script.addEventListener("load", loaded, { once: true });
-    script.addEventListener("error", failed, { once: true });
-    if (!existing) {
-      script.src = SCRIPT_URL;
-      script.async = true;
-      script.defer = true;
-      const nonce = document.querySelector("script[nonce]")?.nonce;
-      if (nonce) script.nonce = nonce;
-      document.head.appendChild(script);
-    }
-  }).catch((error) => {
-    loader = null;
-    throw error;
-  });
-  return loader;
-}
-function Turnstile({
-  siteKey,
-  theme,
-  onToken,
-  onUnavailable
-}) {
-  const container = React9.useRef(null);
-  const callbacks = React9.useRef({ onToken, onUnavailable });
-  callbacks.current = { onToken, onUnavailable };
-  React9.useEffect(() => {
-    callbacks.current.onToken(null);
-    if (!siteKey) {
-      callbacks.current.onToken(LOCAL_TURNSTILE_TEST_TOKEN);
-      return;
-    }
-    let active = true;
-    let widget = null;
-    void loadTurnstile().then((api) => {
-      if (!active || !container.current) return;
-      const id = api.render(container.current, {
-        sitekey: siteKey,
-        theme: theme === "system" ? "auto" : theme,
-        size: "flexible",
-        callback: (token) => callbacks.current.onToken(token),
-        "expired-callback": () => callbacks.current.onToken(null),
-        "error-callback": () => {
-          callbacks.current.onToken(null);
-          callbacks.current.onUnavailable();
-        }
-      });
-      widget = { api, id };
-    }).catch(() => {
-      if (active) callbacks.current.onUnavailable();
-    });
-    return () => {
-      active = false;
-      if (widget) widget.api.remove(widget.id);
-    };
-  }, [siteKey, theme]);
-  if (!siteKey) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "ba-turnstile", ref: container, "data-testid": "phoneotp-turnstile" });
+// src/components/captcha-provider-ids.ts
+var CAPTCHA_PROVIDER_IDS = ["turnstile", "hcaptcha", "recaptcha-v2"];
+function isSupportedCaptchaProvider(provider) {
+  return CAPTCHA_PROVIDER_IDS.includes(provider);
 }
 
 // src/components/AuthChallenge.tsx
-var import_jsx_runtime11 = require("react/jsx-runtime");
+var import_jsx_runtime10 = require("react/jsx-runtime");
 var AUTH_CHALLENGE_ACTIONS = {
   signUp: "auth_signup",
   signIn: "auth_signin",
@@ -3548,38 +3617,53 @@ var challengeError = {
   code: "BOT_CHALLENGE_FAILED",
   message: "Human verification failed."
 };
-function turnstileTheme(root, fallback) {
+function captchaTheme(root, fallback) {
   const rendered = root?.dataset.authowlTheme;
   if (rendered === "light" || rendered === "dark") return rendered;
   if (fallback === "light" || fallback === "dark") return fallback;
   return "auto";
 }
 function useAuthChallenge() {
-  const { config, isLoading } = usePublicConfig();
+  const { config, isLoading, retry } = usePublicConfig();
   const t = useT();
-  const container = React10.useRef(null);
-  const active = React10.useRef(null);
-  const [status, setStatus] = React10.useState("idle");
-  const siteKey = config?.authTurnstileSiteKey ?? null;
-  const removeActive = React10.useCallback((reason) => {
+  const container = React9.useRef(null);
+  const active = React9.useRef(null);
+  const [status, setStatus] = React9.useState("idle");
+  const captcha = config?.captcha ?? null;
+  const providerSupported = captcha ? isSupportedCaptchaProvider(captcha.provider) : false;
+  const unavailableProvider = captcha && !providerSupported ? captcha.provider : null;
+  const refetched = React9.useRef(null);
+  const refetchIfConfigMayBeStale = React9.useCallback(() => {
+    if (!config || refetched.current === config) return;
+    refetched.current = config;
+    retry();
+  }, [config, retry]);
+  const removeActive = React9.useCallback((reason) => {
     const current = active.current;
     active.current = null;
     if (!current) return;
-    current.api.remove(current.id);
+    current.adapter.teardown(current.api, current.id);
     if (reason) current.reject(reason);
   }, []);
-  React10.useEffect(
-    () => () => removeActive(new Error("Turnstile challenge was cancelled")),
+  React9.useEffect(
+    () => () => removeActive(new Error("Captcha challenge was cancelled")),
     [removeActive]
   );
-  const tokenFor = React10.useCallback(
+  const tokenFor = React9.useCallback(
     async (action) => {
-      if (!siteKey) return null;
+      if (!captcha) return null;
+      if (!providerSupported) throw new Error(`Unsupported captcha provider: ${captcha.provider}`);
       setStatus("checking");
-      removeActive(new Error("Turnstile challenge was replaced"));
+      removeActive(new Error("Captcha challenge was replaced"));
       try {
-        const api = await loadTurnstile();
-        if (!container.current) throw new Error("Turnstile container unavailable");
+        const [{ loadCaptcha: loadCaptcha2 }, { captchaAdapterFor: captchaAdapterFor2 }] = await Promise.all([
+          Promise.resolve().then(() => (init_captcha_loader(), captcha_loader_exports)),
+          Promise.resolve().then(() => (init_captcha_providers(), captcha_providers_exports))
+        ]);
+        const adapter = captchaAdapterFor2(captcha.provider);
+        if (!adapter) throw new Error(`Unsupported captcha provider: ${captcha.provider}`);
+        const api = await loadCaptcha2(adapter);
+        if (!container.current) throw new Error("Captcha container unavailable");
         return await new Promise((resolve, reject) => {
           let settled = false;
           const finish = (outcome) => {
@@ -3587,27 +3671,29 @@ function useAuthChallenge() {
             settled = true;
             const current = active.current;
             active.current = null;
-            if (current) current.api.remove(current.id);
+            if (current) current.adapter.teardown(current.api, current.id);
             if ("token" in outcome) resolve(outcome.token);
             else reject(outcome.error);
           };
-          const fail = () => finish({ error: new Error("Turnstile challenge failed") });
+          const fail = () => finish({ error: new Error("Captcha challenge failed") });
           const root = container.current.closest(".authowl-root");
+          const optionalFailureCallbacks = captcha.provider === "turnstile" ? {
+            "timeout-callback": fail,
+            "unsupported-callback": fail
+          } : {};
           const id = api.render(container.current, {
-            sitekey: siteKey,
-            theme: turnstileTheme(root, config?.branding?.theme),
-            action,
-            execution: "execute",
-            appearance: "interaction-only",
-            size: "flexible",
-            language: root?.dataset.authowlLocale ?? config?.locale,
+            ...adapter.invisibleRenderOptions({
+              siteKey: captcha.siteKey,
+              theme: captchaTheme(root, config?.branding?.theme),
+              action,
+              language: root?.dataset.authowlLocale ?? config?.locale
+            }),
             callback: (token) => finish({ token }),
             "expired-callback": fail,
             "error-callback": fail,
-            "timeout-callback": fail,
-            "unsupported-callback": fail
+            ...optionalFailureCallbacks
           });
-          active.current = { api, id, reject };
+          active.current = { adapter, api, id, reject };
           try {
             api.execute(id);
           } catch {
@@ -3618,9 +3704,9 @@ function useAuthChallenge() {
         setStatus("idle");
       }
     },
-    [config?.branding?.theme, config?.locale, removeActive, siteKey]
+    [captcha, config?.branding?.theme, config?.locale, providerSupported, removeActive]
   );
-  const run = React10.useCallback(
+  const run = React9.useCallback(
     async (action, request) => {
       if (isLoading) {
         return {
@@ -3630,41 +3716,44 @@ function useAuthChallenge() {
       }
       try {
         const token = await tokenFor(action);
-        return await request(token ? { authChallengeToken: token } : void 0);
+        const result = await request(token ? { authChallengeToken: token } : void 0);
+        if (result?.error?.code === challengeError.code) refetchIfConfigMayBeStale();
+        return result;
       } catch {
         setStatus("failed");
+        refetchIfConfigMayBeStale();
         return {
           data: null,
           error: challengeError
         };
       }
     },
-    [isLoading, tokenFor]
+    [isLoading, refetchIfConfigMayBeStale, tokenFor]
   );
-  const control = siteKey ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "ba-auth-challenge", "data-testid": "auth-challenge", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { className: "ba-turnstile", ref: container }),
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "ba-sr-only", role: "status", "aria-live": "polite", children: status === "checking" ? t("authChallenge.checking") : status === "failed" ? t("authChallenge.error.failed") : "" })
+  const control = captcha ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "ba-auth-challenge", "data-testid": "auth-challenge", children: [
+    providerSupported ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "ba-turnstile", ref: container }) : null,
+    unavailableProvider ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(FormError, { "data-testid": "auth-challenge-unsupported", children: t("authChallenge.error.unsupportedProvider", { provider: unavailableProvider }) }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "ba-sr-only", role: "status", "aria-live": "polite", children: status === "checking" ? t("authChallenge.checking") : status === "failed" ? t("authChallenge.error.failed") : "" })
   ] }) : null;
   return { run, control, configPending: isLoading };
 }
 
 // src/components/ForgotPassword.tsx
 init_FormError();
-var import_jsx_runtime12 = require("react/jsx-runtime");
+var import_jsx_runtime11 = require("react/jsx-runtime");
 function ForgotPassword({ resetPasswordUrl, onBack }) {
   const t = useT();
   const { requestPasswordReset } = usePasswordReset();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React11.useState("");
-  const [sent, setSent] = React11.useState(false);
+  const [email, setEmail] = React10.useState("");
+  const [sent, setSent] = React10.useState(false);
   if (sent) {
-    return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "ba-fields", "data-testid": "forgot-sent", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { className: "ba-muted", children: richMessage(t("forgotPassword.sent"), { email: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Bidi, { children: email }) }) }),
-      onBack && /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
+    return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "ba-fields", "data-testid": "forgot-sent", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "ba-muted", children: richMessage(t("forgotPassword.sent"), { email: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Bidi, { children: email }) }) }),
+      onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
     ] });
   }
-  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
     "form",
     {
       method: "post",
@@ -3678,9 +3767,9 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
         });
       },
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("label", { className: "ba-label", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("label", { className: "ba-label", children: [
           t("common.emailLabel"),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
             "input",
             {
               className: "ba-input",
@@ -3693,18 +3782,18 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
           )
         ] }),
         authChallenge.control,
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(FormError, { children: error }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(FormError, { children: error }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
           "button",
           {
             className: "ba-button",
             type: "submit",
             disabled: pending || authChallenge.configPending,
             "aria-busy": pending || void 0,
-            children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Busy, { busy: pending, label: t("common.sending"), children: t("forgotPassword.submit") })
+            children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Busy, { busy: pending, label: t("common.sending"), children: t("forgotPassword.submit") })
           }
         ),
-        onBack && /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
+        onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
       ]
     }
   );
@@ -3714,7 +3803,7 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
 init_i18n();
 init_Spinner();
 init_FormError();
-var import_jsx_runtime13 = require("react/jsx-runtime");
+var import_jsx_runtime12 = require("react/jsx-runtime");
 function OtpCodeForm({
   email,
   code,
@@ -3725,7 +3814,7 @@ function OtpCodeForm({
   error
 }) {
   const t = useT();
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
     "form",
     {
       method: "post",
@@ -3736,9 +3825,9 @@ function OtpCodeForm({
         onSubmit();
       },
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-label", children: [
-          richMessage(t("emailOtp.codeLabel"), { email: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Bidi, { children: email }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("label", { className: "ba-label", children: [
+          richMessage(t("emailOtp.codeLabel"), { email: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Bidi, { children: email }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             "input",
             {
               className: "ba-input",
@@ -3751,29 +3840,29 @@ function OtpCodeForm({
             }
           )
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(FormError, { children: error }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { className: "ba-button", type: "submit", disabled: pending, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("emailOtp.verifySubmit") }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: onChangeEmail, children: t("emailOtp.changeEmail") })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(FormError, { children: error }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { className: "ba-button", type: "submit", disabled: pending, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("emailOtp.verifySubmit") }) }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onChangeEmail, children: t("emailOtp.changeEmail") })
       ]
     }
   );
 }
 
 // src/components/MFAChallenge.tsx
-var React12 = __toESM(require("react"), 1);
+var React11 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
 init_Spinner();
 init_FormError();
-var import_jsx_runtime14 = require("react/jsx-runtime");
+var import_jsx_runtime13 = require("react/jsx-runtime");
 function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   const t = useT();
   const { verifyTotp, verifyBackupCode, sendOtp, verifyOtp } = useMFA();
   const { pending, error, setError, run } = useSubmitAction();
-  const [mode, setMode] = React12.useState("totp");
-  const [code, setCode] = React12.useState("");
-  const [trustDevice, setTrustDevice] = React12.useState(false);
+  const [mode, setMode] = React11.useState("totp");
+  const [code, setCode] = React11.useState("");
+  const [trustDevice, setTrustDevice] = React11.useState(false);
   const switchMode = (next) => {
     setMode(next);
     setCode("");
@@ -3796,12 +3885,12 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   };
   const hint = mode === "totp" ? t("mfa.challenge.totpHint") : mode === "backup" ? t("mfa.challenge.backupHint") : t("mfa.challenge.otpHint");
   const label2 = mode === "totp" ? t("mfa.challenge.totpLabel") : mode === "backup" ? t("mfa.challenge.backupLabel") : t("mfa.challenge.otpLabel");
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("form", { method: "post", className: "ba-fields", "data-testid": "mfa-challenge", onSubmit: submit, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("h2", { className: "ba-title", children: t("mfa.challenge.title") }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "ba-muted", children: hint }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("label", { className: "ba-label", children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("form", { method: "post", className: "ba-fields", "data-testid": "mfa-challenge", onSubmit: submit, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("h2", { className: "ba-title", children: t("mfa.challenge.title") }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "ba-muted", children: hint }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-label", children: [
       label2,
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
         "input",
         {
           className: "ba-input",
@@ -3817,28 +3906,28 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
         }
       )
     ] }),
-    mode !== "backup" && allowTrustDevice && /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("label", { className: "ba-consent ba-consent-centered", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { className: "ba-checkbox-control", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("input", { className: "ba-checkbox", type: "checkbox", checked: trustDevice, onChange: (e) => setTrustDevice(e.target.checked) }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "ba-checkbox-check" }) })
+    mode !== "backup" && allowTrustDevice && /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-consent ba-consent-centered", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "ba-checkbox-control", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("input", { className: "ba-checkbox", type: "checkbox", checked: trustDevice, onChange: (e) => setTrustDevice(e.target.checked) }),
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "ba-checkbox-check" }) })
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { children: t("mfa.challenge.trustDevice", { days: 30 }) })
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { children: t("mfa.challenge.trustDevice", { days: 30 }) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(FormError, { children: error }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.challenge.submit") }) }),
-    mode !== "totp" && /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("totp"), children: t("mfa.challenge.useTotp") }),
-    mode !== "backup" && /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("backup"), children: t("mfa.challenge.useBackup") }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") })
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(FormError, { children: error }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.challenge.submit") }) }),
+    mode !== "totp" && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("totp"), children: t("mfa.challenge.useTotp") }),
+    mode !== "backup" && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("backup"), children: t("mfa.challenge.useBackup") }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") })
   ] });
 }
 
 // src/components/mfa-enrollment-step.tsx
-var React15 = __toESM(require("react"), 1);
+var React14 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/MFAEnrollment.tsx
-var React14 = __toESM(require("react"), 1);
+var React13 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -3851,13 +3940,13 @@ function shouldDiscardSetup(args) {
 }
 
 // src/components/QrCode.tsx
-var React13 = __toESM(require("react"), 1);
+var React12 = __toESM(require("react"), 1);
 init_i18n();
-var import_jsx_runtime15 = require("react/jsx-runtime");
+var import_jsx_runtime14 = require("react/jsx-runtime");
 function QrCode({ value, size = 200 }) {
   const t = useT();
-  const [path, setPath] = React13.useState(null);
-  React13.useEffect(() => {
+  const [path, setPath] = React12.useState(null);
+  React12.useEffect(() => {
     let active = true;
     setPath(null);
     void Promise.resolve().then(() => (init_qr(), qr_exports)).then(
@@ -3875,7 +3964,7 @@ function QrCode({ value, size = 200 }) {
   if (!path) return null;
   const margin = 4;
   const dim = path.count + margin * 2;
-  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
     "svg",
     {
       width: size,
@@ -3886,8 +3975,8 @@ function QrCode({ value, size = 200 }) {
       shapeRendering: "crispEdges",
       className: "ba-qr",
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("rect", { width: dim, height: dim, fill: "#ffffff" }),
-        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("g", { transform: `translate(${margin} ${margin})`, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("path", { d: path.d, fill: "#000000" }) })
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("rect", { width: dim, height: dim, fill: "#ffffff" }),
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("g", { transform: `translate(${margin} ${margin})`, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("path", { d: path.d, fill: "#000000" }) })
       ]
     }
   );
@@ -3895,7 +3984,7 @@ function QrCode({ value, size = 200 }) {
 
 // src/components/MFAEnrollment.tsx
 init_FormError();
-var import_jsx_runtime16 = require("react/jsx-runtime");
+var import_jsx_runtime15 = require("react/jsx-runtime");
 function secretFromUri(uri) {
   try {
     return new URL(uri).searchParams.get("secret");
@@ -3908,11 +3997,11 @@ function MFAEnrollment({ onEnrolled, title }) {
   const { enable, verifyTotp } = useMFA();
   const { user, isLoaded } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React14.useState("");
-  const [setup, setSetup] = React14.useState(null);
-  const [code, setCode] = React14.useState("");
-  const [done, setDone] = React14.useState(false);
-  const setupOwnerId = React14.useRef(null);
+  const [password, setPassword] = React13.useState("");
+  const [setup, setSetup] = React13.useState(null);
+  const [code, setCode] = React13.useState("");
+  const [done, setDone] = React13.useState(false);
+  const setupOwnerId = React13.useRef(null);
   const userId = user?.id ?? null;
   const stale = shouldDiscardSetup({
     isLoaded,
@@ -3921,7 +4010,7 @@ function MFAEnrollment({ onEnrolled, title }) {
     currentUserId: userId
   });
   const activeSetup = stale ? null : setup;
-  React14.useEffect(() => {
+  React13.useEffect(() => {
     if (stale) {
       setSetup(null);
       setPassword("");
@@ -3929,22 +4018,22 @@ function MFAEnrollment({ onEnrolled, title }) {
     }
   }, [stale]);
   if (done) {
-    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-done", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.doneTitle") }),
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.doneBody") })
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-done", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.doneTitle") }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.doneBody") })
     ] });
   }
   if (!activeSetup) {
     if (!isLoaded) {
-      return /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { className: "ba-fields", "data-testid": "mfa-enroll-loading", "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { className: "ba-skeleton" }) });
+      return /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "ba-fields", "data-testid": "mfa-enroll-loading", "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "ba-skeleton" }) });
     }
     if (user?.twoFactorEnabled) {
-      return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-active", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.activeTitle") }),
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.activeBody") })
+      return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-active", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.activeTitle") }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.activeBody") })
       ] });
     }
-    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
       "form",
       {
         method: "post",
@@ -3961,11 +4050,11 @@ function MFAEnrollment({ onEnrolled, title }) {
           });
         },
         children: [
-          title !== null && /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: title ?? t("mfa.enroll.title") }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.passwordHint") }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("label", { className: "ba-label", children: [
+          title !== null && /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: title ?? t("mfa.enroll.title") }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.passwordHint") }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("label", { className: "ba-label", children: [
             t("common.passwordLabel"),
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
               "input",
               {
                 className: "ba-input",
@@ -3977,29 +4066,29 @@ function MFAEnrollment({ onEnrolled, title }) {
               }
             )
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(FormError, { children: error }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !password, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Busy, { busy: pending, label: t("mfa.enroll.startPending"), children: t("common.continue") }) })
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(FormError, { children: error }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !password, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Busy, { busy: pending, label: t("mfa.enroll.startPending"), children: t("common.continue") }) })
         ]
       }
     );
   }
   const secret = secretFromUri(activeSetup.totpURI);
-  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-verify", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.scanQrTitle") }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.scanQrHint") }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(QrCode, { value: activeSetup.totpURI }),
-    secret && /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: richMessage(t("mfa.enroll.manualKey"), {
-      secret: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("code", { className: "ba-code", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Bidi, { children: secret }) })
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-verify", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.scanQrTitle") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.scanQrHint") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(QrCode, { value: activeSetup.totpURI }),
+    secret && /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: richMessage(t("mfa.enroll.manualKey"), {
+      secret: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("code", { className: "ba-code", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Bidi, { children: secret }) })
     }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("p", { className: "ba-muted", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("strong", { children: t("mfa.enroll.backupCodesWarningStrong") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("p", { className: "ba-muted", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("strong", { children: t("mfa.enroll.backupCodesWarningStrong") }),
         " ",
         t("mfa.enroll.backupCodesWarningRest")
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("ul", { className: "ba-backup-codes", "data-testid": "mfa-backup-codes", children: activeSetup.backupCodes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("code", { className: "ba-code", children: c }) }, c)) })
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("ul", { className: "ba-backup-codes", "data-testid": "mfa-backup-codes", children: activeSetup.backupCodes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("code", { className: "ba-code", children: c }) }, c)) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
       "form",
       {
         method: "post",
@@ -4017,9 +4106,9 @@ function MFAEnrollment({ onEnrolled, title }) {
           });
         },
         children: [
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("label", { className: "ba-label", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("label", { className: "ba-label", children: [
             t("mfa.enroll.codeLabel"),
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
               "input",
               {
                 className: "ba-input",
@@ -4031,8 +4120,8 @@ function MFAEnrollment({ onEnrolled, title }) {
               }
             )
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(FormError, { children: error }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.enroll.activateSubmit") }) })
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(FormError, { children: error }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.enroll.activateSubmit") }) })
         ]
       }
     )
@@ -4040,13 +4129,13 @@ function MFAEnrollment({ onEnrolled, title }) {
 }
 
 // src/components/mfa-enrollment-step.tsx
-var import_jsx_runtime17 = require("react/jsx-runtime");
+var import_jsx_runtime16 = require("react/jsx-runtime");
 function useConfirmedMfaPending(onUnknown = "pending") {
   const client = useAuthClient();
   const { needsMfaEnrollment } = useUser();
   const { refetch } = useSession();
-  const [confirmed, setConfirmed] = React15.useState(null);
-  React15.useEffect(() => {
+  const [confirmed, setConfirmed] = React14.useState(null);
+  React14.useEffect(() => {
     if (!needsMfaEnrollment) {
       setConfirmed(null);
       return;
@@ -4070,32 +4159,32 @@ function useConfirmedMfaPending(onUnknown = "pending") {
 function MfaEnrollmentStep({ title }) {
   const t = useT();
   const { refetch } = useSession();
-  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("h2", { className: "ba-title", children: title ?? t("mfaGate.title") }),
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "ba-muted", children: t("mfaGate.body") }),
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(MFAEnrollment, { onEnrolled: () => refetch({ query: { disableCookieCache: true } }) })
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: title ?? t("mfaGate.title") }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfaGate.body") }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(MFAEnrollment, { onEnrolled: () => refetch({ query: { disableCookieCache: true } }) })
   ] });
 }
 
 // src/components/AuthOwlBadge.tsx
 init_hooks();
 init_i18n();
-var import_jsx_runtime18 = require("react/jsx-runtime");
+var import_jsx_runtime17 = require("react/jsx-runtime");
 function OwlMark() {
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)("svg", { className: "ba-badge-mark", viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "12", cy: "12", r: "11", fill: "#F5B84C" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "8.4", cy: "10", r: "3", fill: "#fff" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "15.6", cy: "10", r: "3", fill: "#fff" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "8.4", cy: "10", r: "1.4", fill: "#1f1300" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "15.6", cy: "10", r: "1.4", fill: "#1f1300" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("path", { d: "M12 13.1l1.5 2.1h-3z", fill: "#1f1300" })
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("svg", { className: "ba-badge-mark", viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "12", cy: "12", r: "11", fill: "#F5B84C" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "8.4", cy: "10", r: "3", fill: "#fff" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "15.6", cy: "10", r: "3", fill: "#fff" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "8.4", cy: "10", r: "1.4", fill: "#1f1300" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "15.6", cy: "10", r: "1.4", fill: "#1f1300" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("path", { d: "M12 13.1l1.5 2.1h-3z", fill: "#1f1300" })
   ] });
 }
 function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
   const t = useT();
   const { config } = usePublicConfig();
   if (!force && !config?.badge) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(
     "a",
     {
       className: "ba-badge",
@@ -4104,9 +4193,9 @@ function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
       rel: "noopener noreferrer",
       "data-testid": "authowl-badge",
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(OwlMark, {}),
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { children: richMessage(t("badge.securedBy"), {
-          brand: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "ba-badge-brand", children: "AuthOwl" })
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(OwlMark, {}),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { children: richMessage(t("badge.securedBy"), {
+          brand: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "ba-badge-brand", children: "AuthOwl" })
         }) })
       ]
     }
@@ -4127,19 +4216,19 @@ init_i18n();
 
 // src/components/ConsentDocLinks.tsx
 init_i18n();
-var import_jsx_runtime19 = require("react/jsx-runtime");
+var import_jsx_runtime18 = require("react/jsx-runtime");
 function ConsentDocLinks({ termsUrl, privacyUrl }) {
   const t = useT();
   if (!termsUrl && !privacyUrl) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
-    termsUrl && /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("a", { href: termsUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.termsOfService") }),
+  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
+    termsUrl && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("a", { href: termsUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.termsOfService") }),
     termsUrl && privacyUrl && t("consent.docJoiner"),
-    privacyUrl && /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("a", { href: privacyUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.privacyPolicy") })
+    privacyUrl && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("a", { href: privacyUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.privacyPolicy") })
   ] });
 }
 
 // src/components/LegalConsentCheckbox.tsx
-var import_jsx_runtime20 = require("react/jsx-runtime");
+var import_jsx_runtime19 = require("react/jsx-runtime");
 function LegalConsentCheckbox({
   legal,
   accepted,
@@ -4148,9 +4237,9 @@ function LegalConsentCheckbox({
 }) {
   const t = useT();
   if (!legal.required) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)("label", { className: "ba-consent", "data-testid": testId, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)("span", { className: "ba-checkbox-control", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("label", { className: "ba-consent", "data-testid": testId, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("span", { className: "ba-checkbox-control", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
         "input",
         {
           className: "ba-checkbox",
@@ -4159,14 +4248,69 @@ function LegalConsentCheckbox({
           onChange: (event) => onAcceptedChange(event.target.checked)
         }
       ),
-      /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { className: "ba-checkbox-check" }) })
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "ba-checkbox-check" }) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { children: richMessage(t("signUp.consentLabel"), {
-      links: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(ConsentDocLinks, { termsUrl: legal.termsUrl, privacyUrl: legal.privacyUrl })
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { children: richMessage(t("signUp.consentLabel"), {
+      links: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ConsentDocLinks, { termsUrl: legal.termsUrl, privacyUrl: legal.privacyUrl })
     }) })
   ] });
 }
 
+// src/components/Turnstile.tsx
+var React15 = __toESM(require("react"), 1);
+var import_jsx_runtime20 = require("react/jsx-runtime");
+var LOCAL_TURNSTILE_TEST_TOKEN = "XXXX.DUMMY.TOKEN.XXXX";
+async function loadTurnstile() {
+  const [{ loadCaptcha: loadCaptcha2 }, { CAPTCHA_ADAPTERS: CAPTCHA_ADAPTERS2 }] = await Promise.all([
+    Promise.resolve().then(() => (init_captcha_loader(), captcha_loader_exports)),
+    Promise.resolve().then(() => (init_captcha_providers(), captcha_providers_exports))
+  ]);
+  const adapter = CAPTCHA_ADAPTERS2.turnstile;
+  return { api: await loadCaptcha2(adapter), adapter };
+}
+function Turnstile({
+  siteKey,
+  theme,
+  onToken,
+  onUnavailable
+}) {
+  const container = React15.useRef(null);
+  const callbacks = React15.useRef({ onToken, onUnavailable });
+  callbacks.current = { onToken, onUnavailable };
+  React15.useEffect(() => {
+    callbacks.current.onToken(null);
+    if (!siteKey) {
+      callbacks.current.onToken(LOCAL_TURNSTILE_TEST_TOKEN);
+      return;
+    }
+    let active = true;
+    let widget = null;
+    void loadTurnstile().then(({ api, adapter }) => {
+      if (!active || !container.current) return;
+      const id = api.render(container.current, {
+        sitekey: siteKey,
+        theme: theme === "system" ? "auto" : theme,
+        size: "flexible",
+        callback: (token) => callbacks.current.onToken(token),
+        "expired-callback": () => callbacks.current.onToken(null),
+        "error-callback": () => {
+          callbacks.current.onToken(null);
+          callbacks.current.onUnavailable();
+        }
+      });
+      widget = { api, adapter, id };
+    }).catch(() => {
+      if (active) callbacks.current.onUnavailable();
+    });
+    return () => {
+      active = false;
+      if (widget) widget.adapter.teardown(widget.api, widget.id);
+    };
+  }, [siteKey, theme]);
+  if (!siteKey) return null;
+  return /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("div", { className: "ba-turnstile", ref: container, "data-testid": "phoneotp-turnstile" });
+}
+
 // src/components/PhoneOTP.tsx
 init_use_submit_action();
 init_Spinner();
@@ -6671,9 +6815,9 @@ function formatSessionTime(date, locale) {
 // src/components/user-profile/use-account-resource.ts
 var React38 = __toESM(require("react"), 1);
 init_i18n();
-function useAccountResource(loader2, failure) {
-  const loaderRef = React38.useRef(loader2);
-  loaderRef.current = loader2;
+function useAccountResource(loader, failure) {
+  const loaderRef = React38.useRef(loader);
+  loaderRef.current = loader;
   const failureRef = React38.useRef(failure);
   failureRef.current = failure;
   const toServerError = useServerError();