@authowl/react 0.24.3 → 0.25.0

package/dist/index.js

@@ -2,10 +2,10 @@
 import {
   CreateOrganization,
   OrganizationProfile
-} from "./chunk-2HNQYORD.js";
+} from "./chunk-R6WM64IM.js";
 import {
   useSubmitAction
-} from "./chunk-SAVEQ6RC.js";
+} from "./chunk-KUNSGUZP.js";
 import {
   AuthOwlProvider,
   Bidi,
@@ -74,6 +74,13 @@ function passkeyReachableFrom(authBaseUrl, pageHost, relyingPartyId) {
   if (rpId !== "localhost" && !rpId.includes(".")) return false;
   return pageHost === rpId || pageHost.endsWith(`.${rpId}`);
 }
+function passkeyReachableForConfig(config, pageHost) {
+  return passkeyReachableFrom(
+    config?.authBaseUrl,
+    pageHost,
+    config?.authentication?.passkey?.relyingPartyId
+  );
+}
 function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
   const social = config?.socialProviders ?? [];
@@ -84,11 +91,7 @@ function resolveSignInMethods(config, pageHost) {
   const magicLink = capabilities.magicLinkSignIn;
   const emailOtp = capabilities.emailOtpSignIn && !capabilities.totp && !capabilities.mfaRequired;
   const phoneOtp = capabilities.phoneSignIn && !capabilities.mfaRequired;
-  const passkey = capabilities.passkeySignIn && passkeyReachableFrom(
-    config?.authBaseUrl,
-    pageHost,
-    config?.authentication?.passkey?.relyingPartyId
-  );
+  const passkey = capabilities.passkeySignIn && passkeyReachableForConfig(config, pageHost);
   const sso = has("sso");
   const renderable = password || username || magicLink || emailOtp || phoneOtp || passkey || sso || social.length > 0;
   const emptyReason = renderable ? null : methods.length > 0 ? "unsupported" : "none";
@@ -620,7 +623,12 @@ function OtpCodeForm({
 // src/components/MFAChallenge.tsx
 import * as React5 from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
-function MFAChallenge({ onVerified, allowTrustDevice = true }) {
+function MFAChallenge({
+  onVerified,
+  allowTrustDevice = true,
+  variant = "sign-in",
+  onCancel
+}) {
   const t = useT();
   const { config } = usePublicConfig();
   const { verifyTotp, verifyBackupCode, sendOtp, verifyOtp } = useMFA();
@@ -628,7 +636,8 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   const [mode, setMode] = React5.useState("totp");
   const [code, setCode] = React5.useState("");
   const [trustDevice, setTrustDevice] = React5.useState(false);
-  const canTrustDevice = allowTrustDevice && (config?.mfa?.trustDevice ?? true);
+  const stepUp = variant === "step-up";
+  const canTrustDevice = !stepUp && allowTrustDevice && (config?.mfa?.trustDevice ?? true);
   const canUseEmailOtp = config?.mfa?.emailOtpFallback ?? true;
   React5.useEffect(() => {
     if (!canTrustDevice) setTrustDevice(false);
@@ -661,7 +670,7 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   const hint = mode === "totp" ? t("mfa.challenge.totpHint") : mode === "backup" ? t("mfa.challenge.backupHint") : t("mfa.challenge.otpHint");
   const label2 = mode === "totp" ? t("mfa.challenge.totpLabel") : mode === "backup" ? t("mfa.challenge.backupLabel") : t("mfa.challenge.otpLabel");
   return /* @__PURE__ */ jsxs7("form", { method: "post", className: "ba-fields", "data-testid": "mfa-challenge", onSubmit: submit, children: [
-    /* @__PURE__ */ jsx7("h2", { className: "ba-title", children: t("mfa.challenge.title") }),
+    /* @__PURE__ */ jsx7("h2", { className: "ba-title", children: t(stepUp ? "mfa.stepUp.title" : "mfa.challenge.title") }),
     /* @__PURE__ */ jsx7("p", { className: "ba-muted", children: hint }),
     /* @__PURE__ */ jsxs7("label", { className: "ba-label", children: [
       label2,
@@ -692,7 +701,8 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
     /* @__PURE__ */ jsx7("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ jsx7(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.challenge.submit") }) }),
     mode !== "totp" && /* @__PURE__ */ jsx7("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("totp"), children: t("mfa.challenge.useTotp") }),
     mode !== "backup" && /* @__PURE__ */ jsx7("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("backup"), children: t("mfa.challenge.useBackup") }),
-    canUseEmailOtp && /* @__PURE__ */ jsx7("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") })
+    canUseEmailOtp && /* @__PURE__ */ jsx7("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") }),
+    onCancel && /* @__PURE__ */ jsx7("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: onCancel, children: t("common.cancel") })
   ] });
 }
 
@@ -1948,15 +1958,32 @@ function PasswordlessSignUp({ onAuthenticated }) {
   );
 }
 
-// src/components/PasskeySignUpCompletion.tsx
+// src/components/PasskeyOffer.tsx
 import { jsx as jsx22, jsxs as jsxs20 } from "react/jsx-runtime";
-function PasskeySignUpCompletion({ onComplete }) {
+var COPY = {
+  "sign-up": {
+    title: "signUp.passkeyTitle",
+    body: "signUp.passkeyDescription",
+    submit: "signUp.passkeySubmit",
+    skip: "signUp.passkeySkip",
+    failed: "signUp.error.passkeyFailed"
+  },
+  "sign-in": {
+    title: "passkeyOffer.title",
+    body: "passkeyOffer.description",
+    submit: "passkeyOffer.submit",
+    skip: "passkeyOffer.skip",
+    failed: "passkeyOffer.error"
+  }
+};
+function PasskeyOffer({ onComplete, variant, title }) {
   const t = useT();
   const { addPasskey } = usePasskeys();
   const { pending, error, run } = useSubmitAction();
-  return /* @__PURE__ */ jsxs20("div", { className: "ba-fields", "data-testid": "signup-passkey-completion", children: [
-    /* @__PURE__ */ jsx22("h3", { className: "ba-title", children: t("signUp.passkeyTitle") }),
-    /* @__PURE__ */ jsx22("p", { className: "ba-muted", children: t("signUp.passkeyDescription") }),
+  const copy = COPY[variant];
+  return /* @__PURE__ */ jsxs20("div", { className: "ba-fields", "data-testid": "passkey-offer", children: [
+    /* @__PURE__ */ jsx22("h3", { className: "ba-title", children: title ?? t(copy.title) }),
+    /* @__PURE__ */ jsx22("p", { className: "ba-muted", children: t(copy.body) }),
     /* @__PURE__ */ jsx22(FormError, { children: error }),
     /* @__PURE__ */ jsx22(
       "button",
@@ -1966,13 +1993,13 @@ function PasskeySignUpCompletion({ onComplete }) {
         disabled: pending,
         "aria-busy": pending || void 0,
         onClick: () => void run(() => addPasskey(), {
-          failure: t("signUp.error.passkeyFailed"),
-          onSuccess: onComplete
+          failure: t(copy.failed),
+          onSuccess: () => onComplete(true)
         }),
-        children: /* @__PURE__ */ jsx22(Busy, { busy: pending, label: t("passkey.waiting"), children: t("signUp.passkeySubmit") })
+        children: /* @__PURE__ */ jsx22(Busy, { busy: pending, label: t("passkey.waiting"), children: t(copy.submit) })
       }
     ),
-    /* @__PURE__ */ jsx22("button", { className: "ba-link-button", type: "button", disabled: pending, onClick: onComplete, children: t("signUp.passkeySkip") })
+    /* @__PURE__ */ jsx22("button", { className: "ba-link-button", type: "button", disabled: pending, onClick: () => onComplete(false), children: t(copy.skip) })
   ] });
 }
 
@@ -2231,7 +2258,7 @@ function SignUp({
   if (completeWithPasskey) {
     return /* @__PURE__ */ jsxs23("div", { className: "ba-form", "data-testid": "signup-passkey-step", children: [
       showBranding ? /* @__PURE__ */ jsx25(AuthOwlBranding, {}) : null,
-      /* @__PURE__ */ jsx25(PasskeySignUpCompletion, { onComplete: finishSignUp }),
+      /* @__PURE__ */ jsx25(PasskeyOffer, { variant: "sign-up", onComplete: finishSignUp }),
       /* @__PURE__ */ jsx25(AuthOwlBadge, { force: showBadge })
     ] });
   }
@@ -2442,16 +2469,66 @@ function MFARequiredGate({ children, title }) {
 }
 
 // src/components/BackupCodesManager.tsx
+import * as React19 from "react";
+
+// src/components/use-step-up-action.ts
 import * as React18 from "react";
+var SECOND_FACTOR_REQUIRED = "SECOND_FACTOR_REQUIRED";
+function useStepUpAction() {
+  const { pending, error, setError, run } = useSubmitAction();
+  const attempt = React18.useRef(null);
+  const [stepUpRequired, setStepUpRequired] = React18.useState(false);
+  const park = React18.useCallback((next) => {
+    if (next !== null && attempt.current !== null) return false;
+    attempt.current = next;
+    setStepUpRequired(next !== null);
+    return true;
+  }, []);
+  const epoch = React18.useRef(0);
+  const guardedRun = React18.useCallback(
+    (action, opts) => {
+      const send = () => {
+        const era = epoch.current;
+        return run(action, {
+          ...opts,
+          intercept: (failure) => {
+            if (failure.code !== SECOND_FACTOR_REQUIRED) return opts.intercept?.(failure) ?? false;
+            if (era !== epoch.current) return true;
+            return park(send);
+          }
+        });
+      };
+      return send();
+    },
+    [run, park]
+  );
+  const resume = React18.useCallback(() => {
+    const send = attempt.current;
+    park(null);
+    void send?.();
+  }, [park]);
+  const cancel = React18.useCallback(() => {
+    epoch.current += 1;
+    park(null);
+    setError(null);
+  }, [park, setError]);
+  return { pending, error, setError, stepUpRequired, run: guardedRun, resume, cancel };
+}
+
+// src/components/BackupCodesManager.tsx
 import { Fragment as Fragment8, jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
 function BackupCodesManager({ title }) {
   const t = useT();
   const { user } = useUser();
   const { regenerateBackupCodes } = useMFA();
-  const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React18.useState("");
-  const [codes, setCodes] = React18.useState(null);
+  const { pending, error, stepUpRequired, run, resume, cancel } = useStepUpAction();
+  const [password, setPassword] = React19.useState("");
+  const [codes, setCodes] = React19.useState(null);
   if (!user?.twoFactorEnabled) return null;
+  const cancelStepUp = () => {
+    cancel();
+    setPassword("");
+  };
   const submit = (e) => {
     e.preventDefault();
     void run(() => regenerateBackupCodes({ password }), {
@@ -2472,7 +2549,7 @@ function BackupCodesManager({ title }) {
         t("mfa.enroll.backupCodesWarningRest")
       ] }),
       /* @__PURE__ */ jsx28("ul", { className: "ba-passkey-list", "data-testid": "backup-codes-list", children: codes.map((c) => /* @__PURE__ */ jsx28("li", { className: "ba-passkey-item", children: /* @__PURE__ */ jsx28("code", { children: /* @__PURE__ */ jsx28("bdi", { children: c }) }) }, c)) })
-    ] }) : /* @__PURE__ */ jsxs26("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
+    ] }) : stepUpRequired ? /* @__PURE__ */ jsx28(MFAChallenge, { variant: "step-up", onVerified: resume, onCancel: cancelStepUp }) : /* @__PURE__ */ jsxs26("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
       /* @__PURE__ */ jsxs26("label", { className: "ba-label", children: [
         t("common.passwordLabel"),
         /* @__PURE__ */ jsx28(
@@ -2494,15 +2571,15 @@ function BackupCodesManager({ title }) {
 }
 
 // src/components/MagicLinkForm.tsx
-import * as React19 from "react";
+import * as React20 from "react";
 import { jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 function MagicLinkForm({ callbackURL, webauthnAutofill }) {
   const t = useT();
   const { signInMagicLink } = useSignIn();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React19.useState("");
-  const [sent, setSent] = React19.useState(false);
+  const [email, setEmail] = React20.useState("");
+  const [sent, setSent] = React20.useState(false);
   if (sent) {
     return /* @__PURE__ */ jsx29("p", { className: "ba-muted", "data-testid": "magiclink-sent", children: t("magicLink.sent") });
   }
@@ -2552,7 +2629,7 @@ function MagicLinkForm({ callbackURL, webauthnAutofill }) {
 }
 
 // src/components/EmailOtpForm.tsx
-import * as React20 from "react";
+import * as React21 from "react";
 import { jsx as jsx30, jsxs as jsxs28 } from "react/jsx-runtime";
 function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
   const t = useT();
@@ -2560,9 +2637,9 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
   const { sendEmailOtp, signInEmailOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React20.useState("");
-  const [otp, setOtp] = React20.useState("");
-  const [stage, setStage] = React20.useState("email");
+  const [email, setEmail] = React21.useState("");
+  const [otp, setOtp] = React21.useState("");
+  const [stage, setStage] = React21.useState("email");
   if (stage === "code") {
     return /* @__PURE__ */ jsx30(
       OtpCodeForm,
@@ -2636,7 +2713,7 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
 }
 
 // src/components/ResetPassword.tsx
-import * as React21 from "react";
+import * as React22 from "react";
 import { jsx as jsx31, jsxs as jsxs29 } from "react/jsx-runtime";
 function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
   const t = useT();
@@ -2645,12 +2722,12 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
   const capabilities = resolveProjectCapabilities(config);
   const { passwordMinLength, passwordMaxLength } = capabilities;
   const { pending, error, setError, run } = useSubmitAction();
-  const [token, setToken] = React21.useState(tokenProp ?? null);
-  const [ready, setReady] = React21.useState(tokenProp != null);
-  const [password, setPassword] = React21.useState("");
-  const [confirm, setConfirm] = React21.useState("");
-  const [done, setDone] = React21.useState(false);
-  React21.useEffect(() => {
+  const [token, setToken] = React22.useState(tokenProp ?? null);
+  const [ready, setReady] = React22.useState(tokenProp != null);
+  const [password, setPassword] = React22.useState("");
+  const [confirm, setConfirm] = React22.useState("");
+  const [done, setDone] = React22.useState(false);
+  React22.useEffect(() => {
     if (tokenProp != null) return;
     const params = new URLSearchParams(window.location.search);
     setToken(params.get("token"));
@@ -2737,18 +2814,18 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
 }
 
 // src/components/VerifyEmail.tsx
-import * as React22 from "react";
+import * as React23 from "react";
 import { Fragment as Fragment9, jsx as jsx32, jsxs as jsxs30 } from "react/jsx-runtime";
 function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
   const t = useT();
   const { sendVerificationEmail } = useEmailVerification();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [ready, setReady] = React22.useState(false);
-  const [failed, setFailed] = React22.useState(false);
-  const [email, setEmail] = React22.useState("");
-  const [resent, setResent] = React22.useState(false);
-  React22.useEffect(() => {
+  const [ready, setReady] = React23.useState(false);
+  const [failed, setFailed] = React23.useState(false);
+  const [email, setEmail] = React23.useState("");
+  const [resent, setResent] = React23.useState(false);
+  React23.useEffect(() => {
     const didFail = new URLSearchParams(window.location.search).has("error");
     setFailed(didFail);
     setReady(true);
@@ -2813,7 +2890,7 @@ function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
 }
 
 // src/components/PasskeyManager.tsx
-import * as React23 from "react";
+import * as React24 from "react";
 import { jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
 function PasskeyManager({ title, allowAdd = true } = {}) {
   const t = useT();
@@ -2833,12 +2910,12 @@ function PasskeyManagerBody({
   const t = useT();
   const toServerError = useServerError();
   const api = usePasskeys();
-  const apiRef = React23.useRef(api);
+  const apiRef = React24.useRef(api);
   apiRef.current = api;
   const { pending, error, setError, run } = useSubmitAction();
-  const [passkeys, setPasskeys] = React23.useState(null);
-  const loadTokenRef = React23.useRef(0);
-  const load = React23.useCallback(async () => {
+  const [passkeys, setPasskeys] = React24.useState(null);
+  const loadTokenRef = React24.useRef(0);
+  const load = React24.useCallback(async () => {
     const token = ++loadTokenRef.current;
     try {
       const res = await apiRef.current.listPasskeys();
@@ -2854,7 +2931,7 @@ function PasskeyManagerBody({
       setError(t("passkeys.error.loadFailed"));
     }
   }, [setError, toServerError, t]);
-  React23.useEffect(() => {
+  React24.useEffect(() => {
     void load();
   }, [load]);
   function onRename(id, current) {
@@ -2924,16 +3001,96 @@ function PasskeyManagerBody({
   ] });
 }
 
+// src/components/PasskeyOfferGate.tsx
+import * as React26 from "react";
+
+// src/components/use-passkey-offer.ts
+import * as React25 from "react";
+import {
+  passkeyOfferIsDue,
+  recordPasskeyOfferDismissed,
+  recordPasskeyOfferSettled
+} from "@authowl/core";
+function usePasskeyOffer() {
+  const { config } = usePublicConfig();
+  const { user, isSignedIn } = useUser();
+  const { data: sessionData } = useSession();
+  const { listPasskeys } = usePasskeys();
+  const api = React25.useRef(listPasskeys);
+  api.current = listPasskeys;
+  const projectId = config?.environmentId ?? null;
+  const eligible = projectId !== null && isSignedIn && resolveProjectCapabilities(config).passkeyAdd && user?.twoFactorEnabled !== true && typeof window !== "undefined" && "PublicKeyCredential" in window && passkeyReachableForConfig(config, window.location.hostname);
+  const userId = user?.id ?? null;
+  const sessionId = sessionData?.session?.id ?? null;
+  const subject = React25.useMemo(
+    () => eligible && userId && sessionId ? { userId, sessionKey: `${projectId}:${sessionId}:${userId}` } : null,
+    [eligible, projectId, sessionId, userId]
+  );
+  const shouldOffer = React25.useCallback(async () => {
+    if (subject === null || projectId === null || !passkeyOfferIsDue(projectId, subject.userId)) {
+      return false;
+    }
+    try {
+      const res = await api.current();
+      if (res?.error || !res?.data) return false;
+      return res.data.length === 0;
+    } catch {
+      return false;
+    }
+  }, [subject, projectId]);
+  const remember = React25.useCallback(
+    (added) => {
+      if (projectId === null || subject === null) return;
+      if (added) recordPasskeyOfferSettled(projectId, subject.userId);
+      else recordPasskeyOfferDismissed(projectId, subject.userId);
+    },
+    [projectId, subject]
+  );
+  return { subject, shouldOffer, remember };
+}
+
+// src/components/PasskeyOfferGate.tsx
+import { Fragment as Fragment10, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+function PasskeyOfferGate({ children, title }) {
+  const { subject, shouldOffer, remember } = usePasskeyOffer();
+  const [offerFor, setOfferFor] = React26.useState(null);
+  React26.useEffect(() => {
+    if (subject === null) return;
+    let cancelled = false;
+    void shouldOffer().then((due) => {
+      if (!cancelled) setOfferFor(due ? subject.sessionKey : null);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [subject, shouldOffer]);
+  if (subject === null || offerFor !== subject.sessionKey) return /* @__PURE__ */ jsx34(Fragment10, { children });
+  return /* @__PURE__ */ jsxs32("div", { className: "ba-form", "data-testid": "passkey-offer-gate", children: [
+    /* @__PURE__ */ jsx34(
+      PasskeyOffer,
+      {
+        variant: "sign-in",
+        title,
+        onComplete: (added) => {
+          remember(added);
+          setOfferFor(null);
+        }
+      }
+    ),
+    /* @__PURE__ */ jsx34(AuthOwlBadge, {})
+  ] });
+}
+
 // src/components/control.tsx
 import { membershipHas } from "@authowl/core";
-import { Fragment as Fragment10, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+import { Fragment as Fragment11, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 function SignedIn({ children }) {
   const { isLoaded, isSignedIn } = useUser();
-  return isLoaded && isSignedIn ? /* @__PURE__ */ jsx34(Fragment10, { children }) : null;
+  return isLoaded && isSignedIn ? /* @__PURE__ */ jsx35(Fragment11, { children }) : null;
 }
 function SignedOut({ children }) {
   const { isLoaded, isSignedIn } = useUser();
-  return isLoaded && !isSignedIn ? /* @__PURE__ */ jsx34(Fragment10, { children }) : null;
+  return isLoaded && !isSignedIn ? /* @__PURE__ */ jsx35(Fragment11, { children }) : null;
 }
 function Protect({
   children,
@@ -2946,36 +3103,36 @@ function Protect({
   const { user, isLoaded, isSignedIn } = useUser();
   const membership = useSession().data?.session?.membership ?? null;
   if (!isLoaded) return null;
-  if (!isSignedIn || !user) return /* @__PURE__ */ jsx34(Fragment10, { children: fallback });
+  if (!isSignedIn || !user) return /* @__PURE__ */ jsx35(Fragment11, { children: fallback });
   if ((role !== void 0 || permission !== void 0 || teamId !== void 0) && !membershipHas(membership, { role, permission, teamId })) {
-    return /* @__PURE__ */ jsx34(Fragment10, { children: fallback });
+    return /* @__PURE__ */ jsx35(Fragment11, { children: fallback });
   }
-  if (condition && !condition(user)) return /* @__PURE__ */ jsx34(Fragment10, { children: fallback });
-  return /* @__PURE__ */ jsx34(Fragment10, { children });
+  if (condition && !condition(user)) return /* @__PURE__ */ jsx35(Fragment11, { children: fallback });
+  return /* @__PURE__ */ jsx35(Fragment11, { children });
 }
 function AuthLoading({ children }) {
   const t = useT();
   const { isLoaded } = useUser();
   if (isLoaded) return null;
-  if (children !== void 0) return /* @__PURE__ */ jsx34(Fragment10, { children });
-  return /* @__PURE__ */ jsxs32("div", { className: "ba-auth-loading", role: "status", "aria-busy": "true", "data-testid": "auth-loading", children: [
-    /* @__PURE__ */ jsx34(Spinner, {}),
-    /* @__PURE__ */ jsx34("span", { className: "ba-sr-only", children: t("common.loading") })
+  if (children !== void 0) return /* @__PURE__ */ jsx35(Fragment11, { children });
+  return /* @__PURE__ */ jsxs33("div", { className: "ba-auth-loading", role: "status", "aria-busy": "true", "data-testid": "auth-loading", children: [
+    /* @__PURE__ */ jsx35(Spinner, {}),
+    /* @__PURE__ */ jsx35("span", { className: "ba-sr-only", children: t("common.loading") })
   ] });
 }
 function AuthLoaded({ children }) {
-  return useUser().isLoaded ? /* @__PURE__ */ jsx34(Fragment10, { children }) : null;
+  return useUser().isLoaded ? /* @__PURE__ */ jsx35(Fragment11, { children }) : null;
 }
 
 // src/components/SignOutButton.tsx
-import * as React24 from "react";
-import { jsx as jsx35 } from "react/jsx-runtime";
+import * as React27 from "react";
+import { jsx as jsx36 } from "react/jsx-runtime";
 function SignOutButton({ children, redirectTo, onSignedOut, className }) {
   const t = useT();
   const { signOut } = useSignOut();
-  const [pending, setPending] = React24.useState(false);
+  const [pending, setPending] = React27.useState(false);
   const content = children ?? t("signOut.button");
-  return /* @__PURE__ */ jsx35(
+  return /* @__PURE__ */ jsx36(
     "button",
     {
       type: "button",
@@ -2993,32 +3150,32 @@ function SignOutButton({ children, redirectTo, onSignedOut, className }) {
           setPending(false);
         }
       },
-      children: /* @__PURE__ */ jsx35(Busy, { busy: pending, label: content, children: content })
+      children: /* @__PURE__ */ jsx36(Busy, { busy: pending, label: content, children: content })
     }
   );
 }
 
 // src/components/UserButton.tsx
-import * as React38 from "react";
+import * as React41 from "react";
 
 // src/components/UserProfile.tsx
-import * as React37 from "react";
+import * as React40 from "react";
 
 // src/components/user-profile/EmailSection.tsx
-import * as React25 from "react";
-import { jsx as jsx36, jsxs as jsxs33 } from "react/jsx-runtime";
+import * as React28 from "react";
+import { jsx as jsx37, jsxs as jsxs34 } from "react/jsx-runtime";
 function EmailSection({ allowChange }) {
   const t = useT();
   const account = useAccount();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [newEmail, setNewEmail] = React25.useState("");
-  const [sent, setSent] = React25.useState(false);
-  const titleId = React25.useId();
+  const [newEmail, setNewEmail] = React28.useState("");
+  const [sent, setSent] = React28.useState(false);
+  const titleId = React28.useId();
   if (!user?.email) {
-    return /* @__PURE__ */ jsxs33("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-      /* @__PURE__ */ jsx36("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
-      /* @__PURE__ */ jsx36("p", { className: "ba-muted", children: t("userProfile.email.unavailable") })
+    return /* @__PURE__ */ jsxs34("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+      /* @__PURE__ */ jsx37("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
+      /* @__PURE__ */ jsx37("p", { className: "ba-muted", children: t("userProfile.email.unavailable") })
     ] });
   }
   const submit = (event) => {
@@ -3038,19 +3195,19 @@ function EmailSection({ allowChange }) {
       }
     );
   };
-  return /* @__PURE__ */ jsxs33("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs33("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx36("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
-      /* @__PURE__ */ jsx36("p", { className: "ba-muted", children: t("userProfile.email.description") })
+  return /* @__PURE__ */ jsxs34("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs34("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx37("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
+      /* @__PURE__ */ jsx37("p", { className: "ba-muted", children: t("userProfile.email.description") })
     ] }),
-    /* @__PURE__ */ jsxs33("p", { className: "ba-profile-current", children: [
-      /* @__PURE__ */ jsx36("span", { children: t("userProfile.email.current") }),
-      /* @__PURE__ */ jsx36("strong", { children: /* @__PURE__ */ jsx36(Bidi, { children: user.email }) })
+    /* @__PURE__ */ jsxs34("p", { className: "ba-profile-current", children: [
+      /* @__PURE__ */ jsx37("span", { children: t("userProfile.email.current") }),
+      /* @__PURE__ */ jsx37("strong", { children: /* @__PURE__ */ jsx37(Bidi, { children: user.email }) })
     ] }),
-    !allowChange ? /* @__PURE__ */ jsx36("p", { className: "ba-muted", "data-testid": "email-change-disabled", children: t("userProfile.email.changeDisabled") }) : /* @__PURE__ */ jsxs33("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
-      /* @__PURE__ */ jsxs33("label", { className: "ba-label", children: [
+    !allowChange ? /* @__PURE__ */ jsx37("p", { className: "ba-muted", "data-testid": "email-change-disabled", children: t("userProfile.email.changeDisabled") }) : /* @__PURE__ */ jsxs34("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
+      /* @__PURE__ */ jsxs34("label", { className: "ba-label", children: [
         t("userProfile.email.newLabel"),
-        /* @__PURE__ */ jsx36(
+        /* @__PURE__ */ jsx37(
           "input",
           {
             className: "ba-input",
@@ -3062,16 +3219,16 @@ function EmailSection({ allowChange }) {
           }
         )
       ] }),
-      /* @__PURE__ */ jsx36(FormError, { children: error }),
-      sent && /* @__PURE__ */ jsx36("p", { className: "ba-success", role: "status", children: t("userProfile.email.sent") }),
-      /* @__PURE__ */ jsx36(
+      /* @__PURE__ */ jsx37(FormError, { children: error }),
+      sent && /* @__PURE__ */ jsx37("p", { className: "ba-success", role: "status", children: t("userProfile.email.sent") }),
+      /* @__PURE__ */ jsx37(
         "button",
         {
           className: "ba-button ba-profile-submit",
           type: "submit",
           disabled: pending || !newEmail.trim(),
           "aria-busy": pending || void 0,
-          children: /* @__PURE__ */ jsx36(Busy, { busy: pending, label: t("common.sending"), children: t("userProfile.email.submit") })
+          children: /* @__PURE__ */ jsx37(Busy, { busy: pending, label: t("common.sending"), children: t("userProfile.email.submit") })
         }
       )
     ] })
@@ -3079,16 +3236,16 @@ function EmailSection({ allowChange }) {
 }
 
 // src/components/user-profile/DeleteAccountSection.tsx
-import * as React26 from "react";
-import { jsx as jsx37, jsxs as jsxs34 } from "react/jsx-runtime";
+import * as React29 from "react";
+import { jsx as jsx38, jsxs as jsxs35 } from "react/jsx-runtime";
 function DeleteAccountSection({ onDeleted }) {
   const t = useT();
   const account = useAccount();
   const session = useSession();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [confirmation, setConfirmation] = React26.useState("");
-  const titleId = React26.useId();
+  const [confirmation, setConfirmation] = React29.useState("");
+  const titleId = React29.useId();
   const identifier = user?.email ?? user?.phoneNumber ?? user?.id ?? "";
   const confirmed = identifier.length > 0 && confirmation.trim().toLowerCase() === identifier.toLowerCase();
   const submit = (event) => {
@@ -3105,18 +3262,18 @@ function DeleteAccountSection({ onDeleted }) {
       }
     );
   };
-  return /* @__PURE__ */ jsxs34("section", { className: "ba-profile-section ba-profile-danger-zone", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs34("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx37("h2", { id: titleId, className: "ba-title", children: t("userProfile.delete.title") }),
-      /* @__PURE__ */ jsx37("p", { className: "ba-muted", children: t("userProfile.delete.description") })
+  return /* @__PURE__ */ jsxs35("section", { className: "ba-profile-section ba-profile-danger-zone", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs35("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx38("h2", { id: titleId, className: "ba-title", children: t("userProfile.delete.title") }),
+      /* @__PURE__ */ jsx38("p", { className: "ba-muted", children: t("userProfile.delete.description") })
     ] }),
-    /* @__PURE__ */ jsxs34("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
-      /* @__PURE__ */ jsx37("p", { className: "ba-profile-delete-warning", children: t("userProfile.delete.warning", { identifier }) }),
-      /* @__PURE__ */ jsxs34("label", { className: "ba-label", children: [
+    /* @__PURE__ */ jsxs35("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
+      /* @__PURE__ */ jsx38("p", { className: "ba-profile-delete-warning", children: t("userProfile.delete.warning", { identifier }) }),
+      /* @__PURE__ */ jsxs35("label", { className: "ba-label", children: [
         t("userProfile.delete.confirmLabel"),
         " ",
-        /* @__PURE__ */ jsx37(Bidi, { children: identifier }),
-        /* @__PURE__ */ jsx37(
+        /* @__PURE__ */ jsx38(Bidi, { children: identifier }),
+        /* @__PURE__ */ jsx38(
           "input",
           {
             className: "ba-input",
@@ -3130,15 +3287,15 @@ function DeleteAccountSection({ onDeleted }) {
           }
         )
       ] }),
-      /* @__PURE__ */ jsx37(FormError, { children: error }),
-      /* @__PURE__ */ jsx37(
+      /* @__PURE__ */ jsx38(FormError, { children: error }),
+      /* @__PURE__ */ jsx38(
         "button",
         {
           className: "ba-button ba-danger-button ba-profile-submit",
           type: "submit",
           disabled: pending || !confirmed,
           "aria-busy": pending || void 0,
-          children: /* @__PURE__ */ jsx37(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.delete.submit") })
+          children: /* @__PURE__ */ jsx38(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.delete.submit") })
         }
       )
     ] })
@@ -3146,26 +3303,26 @@ function DeleteAccountSection({ onDeleted }) {
 }
 
 // src/components/user-profile/MfaSection.tsx
-import * as React27 from "react";
-import { jsx as jsx38, jsxs as jsxs35 } from "react/jsx-runtime";
+import * as React30 from "react";
+import { jsx as jsx39, jsxs as jsxs36 } from "react/jsx-runtime";
 function MfaSection() {
   const t = useT();
   const { user } = useUser();
   const session = useSession();
   const { config } = usePublicConfig();
   const { disable } = useMFA();
-  const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React27.useState("");
-  const [showDisable, setShowDisable] = React27.useState(false);
-  const titleId = React27.useId();
+  const { pending, error, stepUpRequired, run, resume, cancel } = useStepUpAction();
+  const [password, setPassword] = React30.useState("");
+  const [showDisable, setShowDisable] = React30.useState(false);
+  const titleId = React30.useId();
   const required = resolveProjectCapabilities(config).mfaRequired;
   if (!user?.twoFactorEnabled) {
-    return /* @__PURE__ */ jsxs35("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-      /* @__PURE__ */ jsxs35("header", { className: "ba-profile-section-header", children: [
-        /* @__PURE__ */ jsx38("h2", { id: titleId, className: "ba-title", children: t("userProfile.mfa.title") }),
-        /* @__PURE__ */ jsx38("p", { className: "ba-muted", children: required ? t("userProfile.mfa.requiredDescription") : t("userProfile.mfa.description") })
+    return /* @__PURE__ */ jsxs36("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+      /* @__PURE__ */ jsxs36("header", { className: "ba-profile-section-header", children: [
+        /* @__PURE__ */ jsx39("h2", { id: titleId, className: "ba-title", children: t("userProfile.mfa.title") }),
+        /* @__PURE__ */ jsx39("p", { className: "ba-muted", children: required ? t("userProfile.mfa.requiredDescription") : t("userProfile.mfa.description") })
       ] }),
-      /* @__PURE__ */ jsx38(
+      /* @__PURE__ */ jsx39(
         MFAEnrollment,
         {
           title: null,
@@ -3188,16 +3345,26 @@ function MfaSection() {
       }
     );
   };
-  return /* @__PURE__ */ jsxs35("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs35("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx38("h2", { id: titleId, className: "ba-title", children: t("userProfile.mfa.title") }),
-      /* @__PURE__ */ jsx38("p", { className: "ba-muted", children: required ? t("userProfile.mfa.requiredActive") : t("userProfile.mfa.active") })
+  const cancelDisable = () => {
+    cancel();
+    setShowDisable(false);
+    setPassword("");
+  };
+  return /* @__PURE__ */ jsxs36("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs36("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx39("h2", { id: titleId, className: "ba-title", children: t("userProfile.mfa.title") }),
+      /* @__PURE__ */ jsx39("p", { className: "ba-muted", children: required ? t("userProfile.mfa.requiredActive") : t("userProfile.mfa.active") })
     ] }),
-    /* @__PURE__ */ jsxs35("div", { className: "ba-profile-status", role: "status", children: [
-      /* @__PURE__ */ jsx38("strong", { children: t("userProfile.mfa.enabled") }),
-      /* @__PURE__ */ jsx38("span", { children: t("userProfile.mfa.authenticator") })
+    /* @__PURE__ */ jsxs36("div", { className: "ba-profile-status", role: "status", children: [
+      /* @__PURE__ */ jsx39("strong", { children: t("userProfile.mfa.enabled") }),
+      /* @__PURE__ */ jsx39("span", { children: t("userProfile.mfa.authenticator") })
     ] }),
-    !showDisable ? /* @__PURE__ */ jsx38(
+    stepUpRequired ? (
+      // Turning the factor off requires PROVING it, not just knowing the
+      // password - see `useStepUpAction`. The parked attempt replays with the
+      // password already entered, so accepting a code finishes the removal.
+      /* @__PURE__ */ jsx39(MFAChallenge, { variant: "step-up", onVerified: resume, onCancel: cancelDisable })
+    ) : !showDisable ? /* @__PURE__ */ jsx39(
       "button",
       {
         className: "ba-button ba-button-secondary ba-profile-submit",
@@ -3205,11 +3372,11 @@ function MfaSection() {
         onClick: () => setShowDisable(true),
         children: required ? t("userProfile.mfa.replace") : t("userProfile.mfa.disable")
       }
-    ) : /* @__PURE__ */ jsxs35("form", { method: "post", className: "ba-fields ba-profile-security-form", onSubmit: submitDisable, children: [
-      /* @__PURE__ */ jsx38("p", { className: "ba-muted", children: required ? t("userProfile.mfa.replaceWarning") : t("userProfile.mfa.disableWarning") }),
-      /* @__PURE__ */ jsxs35("label", { className: "ba-label", children: [
+    ) : /* @__PURE__ */ jsxs36("form", { method: "post", className: "ba-fields ba-profile-security-form", onSubmit: submitDisable, children: [
+      /* @__PURE__ */ jsx39("p", { className: "ba-muted", children: required ? t("userProfile.mfa.replaceWarning") : t("userProfile.mfa.disableWarning") }),
+      /* @__PURE__ */ jsxs36("label", { className: "ba-label", children: [
         t("common.passwordLabel"),
-        /* @__PURE__ */ jsx38(
+        /* @__PURE__ */ jsx39(
           "input",
           {
             className: "ba-input",
@@ -3221,29 +3388,26 @@ function MfaSection() {
           }
         )
       ] }),
-      /* @__PURE__ */ jsx38(FormError, { children: error }),
-      /* @__PURE__ */ jsxs35("span", { className: "ba-profile-action-row", children: [
-        /* @__PURE__ */ jsx38(
+      /* @__PURE__ */ jsx39(FormError, { children: error }),
+      /* @__PURE__ */ jsxs36("span", { className: "ba-profile-action-row", children: [
+        /* @__PURE__ */ jsx39(
           "button",
           {
             className: "ba-button ba-danger-button",
             type: "submit",
             disabled: pending || !password,
             "aria-busy": pending || void 0,
-            children: /* @__PURE__ */ jsx38(Busy, { busy: pending, label: t("common.working"), children: required ? t("userProfile.mfa.replaceConfirm") : t("userProfile.mfa.disableConfirm") })
+            children: /* @__PURE__ */ jsx39(Busy, { busy: pending, label: t("common.working"), children: required ? t("userProfile.mfa.replaceConfirm") : t("userProfile.mfa.disableConfirm") })
           }
         ),
-        /* @__PURE__ */ jsx38(
+        /* @__PURE__ */ jsx39(
           "button",
           {
             className: "ba-button ba-button-secondary",
             type: "button",
             disabled: pending,
-            onClick: () => {
-              setShowDisable(false);
-              setPassword("");
-            },
-            children: t("userProfile.cancel")
+            onClick: cancelDisable,
+            children: t("common.cancel")
           }
         )
       ] })
@@ -3252,19 +3416,19 @@ function MfaSection() {
 }
 
 // src/components/user-profile/PasswordSection.tsx
-import * as React28 from "react";
-import { jsx as jsx39, jsxs as jsxs36 } from "react/jsx-runtime";
+import * as React31 from "react";
+import { jsx as jsx40, jsxs as jsxs37 } from "react/jsx-runtime";
 function PasswordSection() {
   const t = useT();
   const account = useAccount();
   const { config } = usePublicConfig();
   const { passwordMinLength, passwordMaxLength } = resolveProjectCapabilities(config);
   const { pending, error, setError, run } = useSubmitAction();
-  const [currentPassword, setCurrentPassword] = React28.useState("");
-  const [newPassword, setNewPassword] = React28.useState("");
-  const [confirmPassword, setConfirmPassword] = React28.useState("");
-  const [saved, setSaved] = React28.useState(false);
-  const titleId = React28.useId();
+  const [currentPassword, setCurrentPassword] = React31.useState("");
+  const [newPassword, setNewPassword] = React31.useState("");
+  const [confirmPassword, setConfirmPassword] = React31.useState("");
+  const [saved, setSaved] = React31.useState(false);
+  const titleId = React31.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -3289,43 +3453,43 @@ function PasswordSection() {
       }
     );
   };
-  return /* @__PURE__ */ jsxs36("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs36("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx39("h2", { id: titleId, className: "ba-title", children: t("userProfile.password.title") }),
-      /* @__PURE__ */ jsx39("p", { className: "ba-muted", children: t("userProfile.password.description") })
+  return /* @__PURE__ */ jsxs37("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs37("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx40("h2", { id: titleId, className: "ba-title", children: t("userProfile.password.title") }),
+      /* @__PURE__ */ jsx40("p", { className: "ba-muted", children: t("userProfile.password.description") })
     ] }),
-    /* @__PURE__ */ jsxs36("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
-      /* @__PURE__ */ jsxs36("label", { className: "ba-label", children: [
+    /* @__PURE__ */ jsxs37("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
+      /* @__PURE__ */ jsxs37("label", { className: "ba-label", children: [
         t("userProfile.password.currentLabel"),
-        /* @__PURE__ */ jsx39("input", { className: "ba-input", type: "password", autoComplete: "current-password", value: currentPassword, onChange: (event) => {
+        /* @__PURE__ */ jsx40("input", { className: "ba-input", type: "password", autoComplete: "current-password", value: currentPassword, onChange: (event) => {
           setCurrentPassword(event.target.value);
           setError(null);
         }, required: true })
       ] }),
-      /* @__PURE__ */ jsxs36("label", { className: "ba-label", children: [
+      /* @__PURE__ */ jsxs37("label", { className: "ba-label", children: [
         t("resetPassword.newPasswordLabel"),
-        /* @__PURE__ */ jsx39("input", { className: "ba-input", type: "password", autoComplete: "new-password", value: newPassword, onChange: (event) => {
+        /* @__PURE__ */ jsx40("input", { className: "ba-input", type: "password", autoComplete: "new-password", value: newPassword, onChange: (event) => {
           setNewPassword(event.target.value);
           setError(null);
         }, minLength: passwordMinLength, maxLength: passwordMaxLength, required: true })
       ] }),
-      /* @__PURE__ */ jsxs36("label", { className: "ba-label", children: [
+      /* @__PURE__ */ jsxs37("label", { className: "ba-label", children: [
         t("resetPassword.confirmPasswordLabel"),
-        /* @__PURE__ */ jsx39("input", { className: "ba-input", type: "password", autoComplete: "new-password", value: confirmPassword, onChange: (event) => {
+        /* @__PURE__ */ jsx40("input", { className: "ba-input", type: "password", autoComplete: "new-password", value: confirmPassword, onChange: (event) => {
           setConfirmPassword(event.target.value);
           setError(null);
         }, minLength: passwordMinLength, maxLength: passwordMaxLength, required: true })
       ] }),
-      /* @__PURE__ */ jsx39(FormError, { children: error }),
-      saved && /* @__PURE__ */ jsx39("p", { className: "ba-success", role: "status", children: t("userProfile.password.saved") }),
-      /* @__PURE__ */ jsx39(
+      /* @__PURE__ */ jsx40(FormError, { children: error }),
+      saved && /* @__PURE__ */ jsx40("p", { className: "ba-success", role: "status", children: t("userProfile.password.saved") }),
+      /* @__PURE__ */ jsx40(
         "button",
         {
           className: "ba-button ba-profile-submit",
           type: "submit",
           disabled: pending || !currentPassword || !newPassword || !confirmPassword,
           "aria-busy": pending || void 0,
-          children: /* @__PURE__ */ jsx39(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.password.submit") })
+          children: /* @__PURE__ */ jsx40(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.password.submit") })
         }
       )
     ] })
@@ -3333,23 +3497,23 @@ function PasswordSection() {
 }
 
 // src/components/user-profile/PasskeysSection.tsx
-import * as React29 from "react";
-import { jsx as jsx40, jsxs as jsxs37 } from "react/jsx-runtime";
+import * as React32 from "react";
+import { jsx as jsx41, jsxs as jsxs38 } from "react/jsx-runtime";
 function PasskeysSection({ allowAdd }) {
   const t = useT();
-  const titleId = React29.useId();
-  return /* @__PURE__ */ jsxs37("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs37("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx40("h2", { id: titleId, className: "ba-title", children: t("userProfile.passkeys.title") }),
-      /* @__PURE__ */ jsx40("p", { className: "ba-muted", children: t("userProfile.passkeys.description") })
+  const titleId = React32.useId();
+  return /* @__PURE__ */ jsxs38("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs38("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx41("h2", { id: titleId, className: "ba-title", children: t("userProfile.passkeys.title") }),
+      /* @__PURE__ */ jsx41("p", { className: "ba-muted", children: t("userProfile.passkeys.description") })
     ] }),
-    /* @__PURE__ */ jsx40(PasskeyManager, { title: null, allowAdd })
+    /* @__PURE__ */ jsx41(PasskeyManager, { title: null, allowAdd })
   ] });
 }
 
 // src/components/user-profile/ProfileSection.tsx
-import * as React30 from "react";
-import { Fragment as Fragment11, jsx as jsx41, jsxs as jsxs38 } from "react/jsx-runtime";
+import * as React33 from "react";
+import { Fragment as Fragment12, jsx as jsx42, jsxs as jsxs39 } from "react/jsx-runtime";
 function ProfileSection({
   firstLastName,
   usernameEnabled,
@@ -3360,15 +3524,15 @@ function ProfileSection({
   const { user } = useUser();
   const session = useSession();
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React30.useState(user?.name ?? "");
-  const [firstName, setFirstName] = React30.useState(user?.firstName ?? "");
-  const [lastName, setLastName] = React30.useState(user?.lastName ?? "");
-  const [username, setUsername] = React30.useState(
+  const [name, setName] = React33.useState(user?.name ?? "");
+  const [firstName, setFirstName] = React33.useState(user?.firstName ?? "");
+  const [lastName, setLastName] = React33.useState(user?.lastName ?? "");
+  const [username, setUsername] = React33.useState(
     user?.displayUsername ?? user?.username ?? ""
   );
-  const [image, setImage] = React30.useState(user?.image ?? "");
-  const [saved, setSaved] = React30.useState(false);
-  const titleId = React30.useId();
+  const [image, setImage] = React33.useState(user?.image ?? "");
+  const [saved, setSaved] = React33.useState(false);
+  const titleId = React33.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -3391,15 +3555,15 @@ function ProfileSection({
       }
     );
   };
-  return /* @__PURE__ */ jsxs38("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs38("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx41("h2", { id: titleId, className: "ba-title", children: t("userProfile.profile.title") }),
-      /* @__PURE__ */ jsx41("p", { className: "ba-muted", children: t("userProfile.profile.description") })
+  return /* @__PURE__ */ jsxs39("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs39("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx42("h2", { id: titleId, className: "ba-title", children: t("userProfile.profile.title") }),
+      /* @__PURE__ */ jsx42("p", { className: "ba-muted", children: t("userProfile.profile.description") })
     ] }),
-    /* @__PURE__ */ jsxs38("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
-      legacyNameField && /* @__PURE__ */ jsxs38("label", { className: "ba-label", children: [
+    /* @__PURE__ */ jsxs39("form", { method: "post", className: "ba-fields", onSubmit: submit, children: [
+      legacyNameField && /* @__PURE__ */ jsxs39("label", { className: "ba-label", children: [
         t("signUp.nameLabel"),
-        /* @__PURE__ */ jsx41(
+        /* @__PURE__ */ jsx42(
           "input",
           {
             className: "ba-input",
@@ -3410,10 +3574,10 @@ function ProfileSection({
           }
         )
       ] }),
-      firstLastName && /* @__PURE__ */ jsxs38(Fragment11, { children: [
-        /* @__PURE__ */ jsxs38("label", { className: "ba-label", children: [
+      firstLastName && /* @__PURE__ */ jsxs39(Fragment12, { children: [
+        /* @__PURE__ */ jsxs39("label", { className: "ba-label", children: [
           t("signUp.firstNameLabel"),
-          /* @__PURE__ */ jsx41(
+          /* @__PURE__ */ jsx42(
             "input",
             {
               className: "ba-input",
@@ -3423,9 +3587,9 @@ function ProfileSection({
             }
           )
         ] }),
-        /* @__PURE__ */ jsxs38("label", { className: "ba-label", children: [
+        /* @__PURE__ */ jsxs39("label", { className: "ba-label", children: [
           t("signUp.lastNameLabel"),
-          /* @__PURE__ */ jsx41(
+          /* @__PURE__ */ jsx42(
             "input",
             {
               className: "ba-input",
@@ -3436,9 +3600,9 @@ function ProfileSection({
           )
         ] })
       ] }),
-      usernameEnabled && /* @__PURE__ */ jsxs38("label", { className: "ba-label", children: [
+      usernameEnabled && /* @__PURE__ */ jsxs39("label", { className: "ba-label", children: [
         t("common.usernameLabel"),
-        /* @__PURE__ */ jsx41(
+        /* @__PURE__ */ jsx42(
           "input",
           {
             className: "ba-input",
@@ -3448,9 +3612,9 @@ function ProfileSection({
           }
         )
       ] }),
-      /* @__PURE__ */ jsxs38("label", { className: "ba-label", children: [
+      /* @__PURE__ */ jsxs39("label", { className: "ba-label", children: [
         t("userProfile.profile.imageLabel"),
-        /* @__PURE__ */ jsx41(
+        /* @__PURE__ */ jsx42(
           "input",
           {
             className: "ba-input",
@@ -3461,16 +3625,16 @@ function ProfileSection({
           }
         )
       ] }),
-      /* @__PURE__ */ jsx41(FormError, { children: error }),
-      saved && /* @__PURE__ */ jsx41("p", { className: "ba-success", role: "status", children: t("userProfile.profile.saved") }),
-      /* @__PURE__ */ jsx41(
+      /* @__PURE__ */ jsx42(FormError, { children: error }),
+      saved && /* @__PURE__ */ jsx42("p", { className: "ba-success", role: "status", children: t("userProfile.profile.saved") }),
+      /* @__PURE__ */ jsx42(
         "button",
         {
           className: "ba-button ba-profile-submit",
           type: "submit",
           disabled: pending || legacyNameField && !name.trim(),
           "aria-busy": pending || void 0,
-          children: /* @__PURE__ */ jsx41(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.save") })
+          children: /* @__PURE__ */ jsx42(Busy, { busy: pending, label: t("common.working"), children: t("userProfile.save") })
         }
       )
     ] })
@@ -3478,30 +3642,30 @@ function ProfileSection({
 }
 
 // src/components/user-profile/RecoverySection.tsx
-import * as React31 from "react";
-import { Fragment as Fragment12, jsx as jsx42, jsxs as jsxs39 } from "react/jsx-runtime";
+import * as React34 from "react";
+import { Fragment as Fragment13, jsx as jsx43, jsxs as jsxs40 } from "react/jsx-runtime";
 function RecoverySection() {
   const t = useT();
   const { user } = useUser();
-  const titleId = React31.useId();
-  return /* @__PURE__ */ jsxs39("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs39("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx42("h2", { id: titleId, className: "ba-title", children: t("userProfile.recovery.title") }),
-      /* @__PURE__ */ jsx42("p", { className: "ba-muted", children: t("userProfile.recovery.description") })
+  const titleId = React34.useId();
+  return /* @__PURE__ */ jsxs40("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs40("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx43("h2", { id: titleId, className: "ba-title", children: t("userProfile.recovery.title") }),
+      /* @__PURE__ */ jsx43("p", { className: "ba-muted", children: t("userProfile.recovery.description") })
     ] }),
-    /* @__PURE__ */ jsxs39("div", { className: "ba-profile-recovery-card", children: [
-      /* @__PURE__ */ jsx42("strong", { children: t("userProfile.recovery.emailTitle") }),
-      user?.email && user.emailVerified ? /* @__PURE__ */ jsxs39(Fragment12, { children: [
-        /* @__PURE__ */ jsx42("p", { children: t("userProfile.recovery.emailDescription") }),
-        /* @__PURE__ */ jsx42(Bidi, { children: user.email })
-      ] }) : /* @__PURE__ */ jsx42("p", { children: t("userProfile.recovery.emailUnavailable") })
+    /* @__PURE__ */ jsxs40("div", { className: "ba-profile-recovery-card", children: [
+      /* @__PURE__ */ jsx43("strong", { children: t("userProfile.recovery.emailTitle") }),
+      user?.email && user.emailVerified ? /* @__PURE__ */ jsxs40(Fragment13, { children: [
+        /* @__PURE__ */ jsx43("p", { children: t("userProfile.recovery.emailDescription") }),
+        /* @__PURE__ */ jsx43(Bidi, { children: user.email })
+      ] }) : /* @__PURE__ */ jsx43("p", { children: t("userProfile.recovery.emailUnavailable") })
     ] }),
-    /* @__PURE__ */ jsx42(BackupCodesManager, { title: null })
+    /* @__PURE__ */ jsx43(BackupCodesManager, { title: null })
   ] });
 }
 
 // src/components/user-profile/SessionsSection.tsx
-import * as React33 from "react";
+import * as React36 from "react";
 
 // src/components/user-profile/model.ts
 var USER_PROFILE_SECTIONS = [
@@ -3550,18 +3714,18 @@ function formatSessionTime(date, locale) {
 }
 
 // src/components/user-profile/use-account-resource.ts
-import * as React32 from "react";
+import * as React35 from "react";
 function useAccountResource(loader, failure) {
-  const loaderRef = React32.useRef(loader);
+  const loaderRef = React35.useRef(loader);
   loaderRef.current = loader;
-  const failureRef = React32.useRef(failure);
+  const failureRef = React35.useRef(failure);
   failureRef.current = failure;
   const toServerError = useServerError();
-  const [data, setData] = React32.useState(null);
-  const [error, setError] = React32.useState(null);
-  const [loading, setLoading] = React32.useState(true);
-  const requestRef = React32.useRef(0);
-  const load = React32.useCallback(async () => {
+  const [data, setData] = React35.useState(null);
+  const [error, setError] = React35.useState(null);
+  const [loading, setLoading] = React35.useState(true);
+  const requestRef = React35.useRef(0);
+  const load = React35.useCallback(async () => {
     const request = ++requestRef.current;
     setLoading(true);
     try {
@@ -3580,7 +3744,7 @@ function useAccountResource(loader, failure) {
       if (request === requestRef.current) setLoading(false);
     }
   }, [toServerError]);
-  React32.useEffect(() => {
+  React35.useEffect(() => {
     void load();
     return () => {
       requestRef.current += 1;
@@ -3590,14 +3754,14 @@ function useAccountResource(loader, failure) {
 }
 
 // src/components/user-profile/SessionsSection.tsx
-import { jsx as jsx43, jsxs as jsxs40 } from "react/jsx-runtime";
+import { jsx as jsx44, jsxs as jsxs41 } from "react/jsx-runtime";
 function SessionsSection() {
   const t = useT();
   const locale = useLocale();
   const account = useAccount();
   const sessionState = useSession();
   const mutation = useSubmitAction();
-  const titleId = React33.useId();
+  const titleId = React36.useId();
   const resource = useAccountResource(
     () => account.listSessions(),
     t("userProfile.sessions.loadError")
@@ -3619,31 +3783,31 @@ function SessionsSection() {
       }
     );
   };
-  return /* @__PURE__ */ jsxs40("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs40("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx43("h2", { id: titleId, className: "ba-title", children: t("userProfile.sessions.title") }),
-      /* @__PURE__ */ jsx43("p", { className: "ba-muted", children: t("userProfile.sessions.description") })
+  return /* @__PURE__ */ jsxs41("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs41("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx44("h2", { id: titleId, className: "ba-title", children: t("userProfile.sessions.title") }),
+      /* @__PURE__ */ jsx44("p", { className: "ba-muted", children: t("userProfile.sessions.description") })
     ] }),
-    resource.data === null ? resource.loading ? /* @__PURE__ */ jsxs40("div", { className: "ba-profile-list-skeleton", "aria-busy": "true", children: [
-      /* @__PURE__ */ jsx43("div", { className: "ba-skeleton" }),
-      /* @__PURE__ */ jsx43("div", { className: "ba-skeleton" })
-    ] }) : null : /* @__PURE__ */ jsxs40("ul", { className: "ba-profile-list", children: [
+    resource.data === null ? resource.loading ? /* @__PURE__ */ jsxs41("div", { className: "ba-profile-list-skeleton", "aria-busy": "true", children: [
+      /* @__PURE__ */ jsx44("div", { className: "ba-skeleton" }),
+      /* @__PURE__ */ jsx44("div", { className: "ba-skeleton" })
+    ] }) : null : /* @__PURE__ */ jsxs41("ul", { className: "ba-profile-list", children: [
       sessions.map((session) => {
         const label2 = session.userAgent?.trim() || t("userProfile.sessions.unknownDevice");
-        return /* @__PURE__ */ jsxs40("li", { className: "ba-profile-list-item", children: [
-          /* @__PURE__ */ jsxs40("span", { children: [
-            /* @__PURE__ */ jsx43("strong", { children: label2 }),
-            /* @__PURE__ */ jsxs40("small", { children: [
-              session.id === currentId && /* @__PURE__ */ jsx43("em", { children: t("userProfile.sessions.current") }),
+        return /* @__PURE__ */ jsxs41("li", { className: "ba-profile-list-item", children: [
+          /* @__PURE__ */ jsxs41("span", { children: [
+            /* @__PURE__ */ jsx44("strong", { children: label2 }),
+            /* @__PURE__ */ jsxs41("small", { children: [
+              session.id === currentId && /* @__PURE__ */ jsx44("em", { children: t("userProfile.sessions.current") }),
               formatSessionTime(session.updatedAt, locale)
             ] })
           ] }),
-          /* @__PURE__ */ jsx43("button", { className: "ba-link-button ba-danger", type: "button", disabled: mutation.pending, onClick: () => revoke(session.id, label2), children: t("userProfile.sessions.revoke") })
+          /* @__PURE__ */ jsx44("button", { className: "ba-link-button ba-danger", type: "button", disabled: mutation.pending, onClick: () => revoke(session.id, label2), children: t("userProfile.sessions.revoke") })
         ] }, session.id);
       }),
-      sessions.length === 0 && /* @__PURE__ */ jsx43("li", { className: "ba-muted", children: t("userProfile.sessions.empty") })
+      sessions.length === 0 && /* @__PURE__ */ jsx44("li", { className: "ba-muted", children: t("userProfile.sessions.empty") })
     ] }),
-    sessions.some((session) => session.id !== currentId) && /* @__PURE__ */ jsx43(
+    sessions.some((session) => session.id !== currentId) && /* @__PURE__ */ jsx44(
       "button",
       {
         className: "ba-button ba-button-secondary ba-profile-submit",
@@ -3659,17 +3823,17 @@ function SessionsSection() {
         children: t("userProfile.sessions.revokeOthers")
       }
     ),
-    resource.error && /* @__PURE__ */ jsxs40("div", { className: "ba-profile-inline-error", children: [
-      /* @__PURE__ */ jsx43(FormError, { children: resource.error }),
-      /* @__PURE__ */ jsx43("button", { className: "ba-link-button", type: "button", onClick: () => void resource.load(), children: t("userProfile.retry") })
+    resource.error && /* @__PURE__ */ jsxs41("div", { className: "ba-profile-inline-error", children: [
+      /* @__PURE__ */ jsx44(FormError, { children: resource.error }),
+      /* @__PURE__ */ jsx44("button", { className: "ba-link-button", type: "button", onClick: () => void resource.load(), children: t("userProfile.retry") })
     ] }),
-    /* @__PURE__ */ jsx43(FormError, { children: mutation.error })
+    /* @__PURE__ */ jsx44(FormError, { children: mutation.error })
   ] });
 }
 
 // src/components/user-profile/SocialSection.tsx
-import * as React34 from "react";
-import { jsx as jsx44, jsxs as jsxs41 } from "react/jsx-runtime";
+import * as React37 from "react";
+import { jsx as jsx45, jsxs as jsxs42 } from "react/jsx-runtime";
 function providerLabel(provider) {
   return provider.charAt(0).toUpperCase() + provider.slice(1);
 }
@@ -3678,7 +3842,7 @@ function SocialSection() {
   const account = useAccount();
   const { config } = usePublicConfig();
   const mutation = useSubmitAction();
-  const titleId = React34.useId();
+  const titleId = React37.useId();
   const resource = useAccountResource(
     () => account.listSocialAccounts(),
     t("userProfile.social.loadError")
@@ -3709,18 +3873,18 @@ function SocialSection() {
       { failure: t("userProfile.social.unlinkError"), onSuccess: resource.load }
     );
   };
-  return /* @__PURE__ */ jsxs41("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
-    /* @__PURE__ */ jsxs41("header", { className: "ba-profile-section-header", children: [
-      /* @__PURE__ */ jsx44("h2", { id: titleId, className: "ba-title", children: t("userProfile.social.title") }),
-      /* @__PURE__ */ jsx44("p", { className: "ba-muted", children: t("userProfile.social.description") })
+  return /* @__PURE__ */ jsxs42("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
+    /* @__PURE__ */ jsxs42("header", { className: "ba-profile-section-header", children: [
+      /* @__PURE__ */ jsx45("h2", { id: titleId, className: "ba-title", children: t("userProfile.social.title") }),
+      /* @__PURE__ */ jsx45("p", { className: "ba-muted", children: t("userProfile.social.description") })
     ] }),
-    resource.data === null ? resource.loading ? /* @__PURE__ */ jsx44("div", { className: "ba-profile-list-skeleton", "aria-busy": "true", children: /* @__PURE__ */ jsx44("div", { className: "ba-skeleton" }) }) : null : /* @__PURE__ */ jsxs41("ul", { className: "ba-profile-list", children: [
-      linked.map((item) => /* @__PURE__ */ jsxs41("li", { className: "ba-profile-list-item", children: [
-        /* @__PURE__ */ jsxs41("span", { children: [
-          /* @__PURE__ */ jsx44("strong", { children: providerLabel(item.providerId) }),
-          /* @__PURE__ */ jsx44("small", { children: item.canUnlink ? t("userProfile.social.connected") : t("userProfile.social.lastMethod") })
+    resource.data === null ? resource.loading ? /* @__PURE__ */ jsx45("div", { className: "ba-profile-list-skeleton", "aria-busy": "true", children: /* @__PURE__ */ jsx45("div", { className: "ba-skeleton" }) }) : null : /* @__PURE__ */ jsxs42("ul", { className: "ba-profile-list", children: [
+      linked.map((item) => /* @__PURE__ */ jsxs42("li", { className: "ba-profile-list-item", children: [
+        /* @__PURE__ */ jsxs42("span", { children: [
+          /* @__PURE__ */ jsx45("strong", { children: providerLabel(item.providerId) }),
+          /* @__PURE__ */ jsx45("small", { children: item.canUnlink ? t("userProfile.social.connected") : t("userProfile.social.lastMethod") })
         ] }),
-        /* @__PURE__ */ jsx44(
+        /* @__PURE__ */ jsx45(
           "button",
           {
             className: "ba-link-button ba-danger",
@@ -3735,31 +3899,31 @@ function SocialSection() {
           }
         )
       ] }, item.id)),
-      linked.length === 0 && /* @__PURE__ */ jsx44("li", { className: "ba-muted", children: t("userProfile.social.empty") })
+      linked.length === 0 && /* @__PURE__ */ jsx45("li", { className: "ba-muted", children: t("userProfile.social.empty") })
     ] }),
-    available.length > 0 && /* @__PURE__ */ jsxs41("div", { className: "ba-profile-provider-actions", children: [
-      /* @__PURE__ */ jsx44("p", { className: "ba-profile-subtitle", children: t("userProfile.social.add") }),
-      available.map((provider) => /* @__PURE__ */ jsx44("button", { type: "button", className: "ba-button ba-button-secondary", disabled: mutation.pending, onClick: () => link(provider), children: t("userProfile.social.connectProvider", { provider: providerLabel(provider) }) }, provider))
+    available.length > 0 && /* @__PURE__ */ jsxs42("div", { className: "ba-profile-provider-actions", children: [
+      /* @__PURE__ */ jsx45("p", { className: "ba-profile-subtitle", children: t("userProfile.social.add") }),
+      available.map((provider) => /* @__PURE__ */ jsx45("button", { type: "button", className: "ba-button ba-button-secondary", disabled: mutation.pending, onClick: () => link(provider), children: t("userProfile.social.connectProvider", { provider: providerLabel(provider) }) }, provider))
     ] }),
-    resource.error && /* @__PURE__ */ jsxs41("div", { className: "ba-profile-inline-error", children: [
-      /* @__PURE__ */ jsx44(FormError, { children: resource.error }),
-      /* @__PURE__ */ jsx44("button", { className: "ba-link-button", type: "button", onClick: () => void resource.load(), children: t("userProfile.retry") })
+    resource.error && /* @__PURE__ */ jsxs42("div", { className: "ba-profile-inline-error", children: [
+      /* @__PURE__ */ jsx45(FormError, { children: resource.error }),
+      /* @__PURE__ */ jsx45("button", { className: "ba-link-button", type: "button", onClick: () => void resource.load(), children: t("userProfile.retry") })
     ] }),
-    /* @__PURE__ */ jsx44(FormError, { children: mutation.error })
+    /* @__PURE__ */ jsx45(FormError, { children: mutation.error })
   ] });
 }
 
 // src/components/user-profile/UserProfileModal.tsx
-import * as React35 from "react";
-import { jsx as jsx45, jsxs as jsxs42 } from "react/jsx-runtime";
+import * as React38 from "react";
+import { jsx as jsx46, jsxs as jsxs43 } from "react/jsx-runtime";
 function UserProfileModal({
   children,
   onClose,
   branding
 }) {
   const t = useT();
-  const titleId = React35.useId();
-  return /* @__PURE__ */ jsxs42(
+  const titleId = React38.useId();
+  return /* @__PURE__ */ jsxs43(
     ModalSurface,
     {
       overlayClassName: "ba-profile-overlay",
@@ -3768,13 +3932,13 @@ function UserProfileModal({
       testId: "user-profile-modal",
       onClose,
       children: [
-        /* @__PURE__ */ jsxs42("div", { className: "ba-profile-modal-header", children: [
-          /* @__PURE__ */ jsxs42("span", { children: [
+        /* @__PURE__ */ jsxs43("div", { className: "ba-profile-modal-header", children: [
+          /* @__PURE__ */ jsxs43("span", { children: [
             branding,
-            /* @__PURE__ */ jsx45("h1", { id: titleId, children: t("userProfile.title") }),
-            /* @__PURE__ */ jsx45("p", { children: t("userProfile.description") })
+            /* @__PURE__ */ jsx46("h1", { id: titleId, children: t("userProfile.title") }),
+            /* @__PURE__ */ jsx46("p", { children: t("userProfile.description") })
           ] }),
-          /* @__PURE__ */ jsx45(
+          /* @__PURE__ */ jsx46(
             "button",
             {
               type: "button",
@@ -3782,7 +3946,7 @@ function UserProfileModal({
               "aria-label": t("userProfile.close"),
               onClick: onClose,
               autoFocus: true,
-              children: /* @__PURE__ */ jsx45("svg", { viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: /* @__PURE__ */ jsx45(
+              children: /* @__PURE__ */ jsx46("svg", { viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: /* @__PURE__ */ jsx46(
                 "path",
                 {
                   d: "M6 6l12 12M18 6L6 18",
@@ -3795,39 +3959,39 @@ function UserProfileModal({
           )
         ] }),
         children,
-        /* @__PURE__ */ jsx45("footer", { className: "ba-profile-modal-footer", children: /* @__PURE__ */ jsx45(AuthOwlBadge, {}) })
+        /* @__PURE__ */ jsx46("footer", { className: "ba-profile-modal-footer", children: /* @__PURE__ */ jsx46(AuthOwlBadge, {}) })
       ]
     }
   );
 }
 
 // src/components/PrivacyCenter.tsx
-import * as React36 from "react";
-import { jsx as jsx46, jsxs as jsxs43 } from "react/jsx-runtime";
-var PrivacyCenterContent = React36.lazy(async () => {
+import * as React39 from "react";
+import { jsx as jsx47, jsxs as jsxs44 } from "react/jsx-runtime";
+var PrivacyCenterContent = React39.lazy(async () => {
   const module = await import("./PrivacyCenterContent-EQEXXSLA.js");
   return { default: module.PrivacyCenterContent };
 });
 function PrivacyCenter(props = {}) {
-  return /* @__PURE__ */ jsx46(React36.Suspense, { fallback: /* @__PURE__ */ jsx46(PrivacyCenterFallback, { className: props.className }), children: /* @__PURE__ */ jsx46(PrivacyCenterContent, { ...props }) });
+  return /* @__PURE__ */ jsx47(React39.Suspense, { fallback: /* @__PURE__ */ jsx47(PrivacyCenterFallback, { className: props.className }), children: /* @__PURE__ */ jsx47(PrivacyCenterContent, { ...props }) });
 }
 function PrivacyCenterFallback({ className }) {
-  return /* @__PURE__ */ jsxs43(
+  return /* @__PURE__ */ jsxs44(
     "section",
     {
       className: ["ba-profile-section ba-privacy-center", className].filter(Boolean).join(" "),
       "aria-busy": "true",
       children: [
-        /* @__PURE__ */ jsx46("div", { className: "ba-skeleton" }),
-        /* @__PURE__ */ jsx46("div", { className: "ba-skeleton" }),
-        /* @__PURE__ */ jsx46("div", { className: "ba-skeleton" })
+        /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" }),
+        /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" }),
+        /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" })
       ]
     }
   );
 }
 
 // src/components/UserProfile.tsx
-import { jsx as jsx47, jsxs as jsxs44 } from "react/jsx-runtime";
+import { jsx as jsx48, jsxs as jsxs45 } from "react/jsx-runtime";
 var SECTION_KEYS = {
   profile: "userProfile.nav.profile",
   email: "userProfile.nav.email",
@@ -3857,7 +4021,7 @@ function UserProfile(props = {}) {
   const t = useT();
   const { user, isLoaded, isSignedIn } = useUser();
   const { config } = usePublicConfig();
-  const [internalSection, setInternalSection] = React37.useState(() => initialSection(defaultSection));
+  const [internalSection, setInternalSection] = React40.useState(() => initialSection(defaultSection));
   const active = section ?? internalSection;
   const capabilities = resolveProjectCapabilities(config);
   const passwordEnabled = config !== null && capabilities.passwordSignIn;
@@ -3867,7 +4031,7 @@ function UserProfile(props = {}) {
   const deletionEnabled = capabilities.accountDeletion;
   const socialEnabled = (config?.socialProviders?.length ?? 0) > 0;
   const privacyEnabled = config?.privacy !== void 0;
-  const sections = React37.useMemo(
+  const sections = React40.useMemo(
     () => userProfileSectionsFor({
       password: passwordEnabled,
       passkeys: passkeysEnabled,
@@ -3879,7 +4043,7 @@ function UserProfile(props = {}) {
     }),
     [deletionEnabled, mfaEnabled, passkeysEnabled, passwordEnabled, privacyEnabled, recoveryEnabled, socialEnabled]
   );
-  React37.useEffect(() => {
+  React40.useEffect(() => {
     if (section || mode !== "page") return;
     const onHashChange = () => {
       const next = userProfileSectionFromHash(window.location.hash);
@@ -3896,11 +4060,11 @@ function UserProfile(props = {}) {
       window.history.replaceState(null, "", userProfileSectionHash(next));
     }
   };
-  const content = !isLoaded ? /* @__PURE__ */ jsxs44("div", { className: "ba-profile-loading", "aria-busy": "true", children: [
-    /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" }),
-    /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" }),
-    /* @__PURE__ */ jsx47("div", { className: "ba-skeleton" })
-  ] }) : !isSignedIn || !user ? /* @__PURE__ */ jsx47("p", { className: "ba-muted", children: t("userProfile.signedOut") }) : /* @__PURE__ */ jsx47(
+  const content = !isLoaded ? /* @__PURE__ */ jsxs45("div", { className: "ba-profile-loading", "aria-busy": "true", children: [
+    /* @__PURE__ */ jsx48("div", { className: "ba-skeleton" }),
+    /* @__PURE__ */ jsx48("div", { className: "ba-skeleton" }),
+    /* @__PURE__ */ jsx48("div", { className: "ba-skeleton" })
+  ] }) : !isSignedIn || !user ? /* @__PURE__ */ jsx48("p", { className: "ba-muted", children: t("userProfile.signedOut") }) : /* @__PURE__ */ jsx48(
     UserProfileBody,
     {
       active: visibleActive,
@@ -3912,23 +4076,23 @@ function UserProfile(props = {}) {
     user.id
   );
   if (props.mode === "modal") {
-    return /* @__PURE__ */ jsx47(
+    return /* @__PURE__ */ jsx48(
       UserProfileModal,
       {
         onClose: props.onClose,
-        branding: showBranding ? /* @__PURE__ */ jsx47(AuthOwlBranding, {}) : null,
+        branding: showBranding ? /* @__PURE__ */ jsx48(AuthOwlBranding, {}) : null,
         children: content
       }
     );
   }
-  return /* @__PURE__ */ jsxs44("article", { className: "ba-profile ba-profile-page", "data-testid": "user-profile", children: [
-    /* @__PURE__ */ jsxs44("header", { className: "ba-profile-heading", children: [
-      showBranding ? /* @__PURE__ */ jsx47(AuthOwlBranding, {}) : null,
-      /* @__PURE__ */ jsx47("h1", { children: t("userProfile.title") }),
-      /* @__PURE__ */ jsx47("p", { children: t("userProfile.description") })
+  return /* @__PURE__ */ jsxs45("article", { className: "ba-profile ba-profile-page", "data-testid": "user-profile", children: [
+    /* @__PURE__ */ jsxs45("header", { className: "ba-profile-heading", children: [
+      showBranding ? /* @__PURE__ */ jsx48(AuthOwlBranding, {}) : null,
+      /* @__PURE__ */ jsx48("h1", { children: t("userProfile.title") }),
+      /* @__PURE__ */ jsx48("p", { children: t("userProfile.description") })
     ] }),
     content,
-    /* @__PURE__ */ jsx47("footer", { className: "ba-profile-modal-footer", children: /* @__PURE__ */ jsx47(AuthOwlBadge, {}) })
+    /* @__PURE__ */ jsx48("footer", { className: "ba-profile-modal-footer", children: /* @__PURE__ */ jsx48(AuthOwlBadge, {}) })
   ] });
 }
 function UserProfileBody({
@@ -3939,8 +4103,8 @@ function UserProfileBody({
   capabilities
 }) {
   const t = useT();
-  return /* @__PURE__ */ jsxs44("div", { className: "ba-profile-layout", children: [
-    /* @__PURE__ */ jsx47("nav", { className: "ba-profile-nav", "aria-label": t("userProfile.nav.aria"), children: sections.map((item) => /* @__PURE__ */ jsx47(
+  return /* @__PURE__ */ jsxs45("div", { className: "ba-profile-layout", children: [
+    /* @__PURE__ */ jsx48("nav", { className: "ba-profile-nav", "aria-label": t("userProfile.nav.aria"), children: sections.map((item) => /* @__PURE__ */ jsx48(
       "button",
       {
         type: "button",
@@ -3951,8 +4115,8 @@ function UserProfileBody({
       },
       item
     )) }),
-    /* @__PURE__ */ jsxs44("div", { className: "ba-profile-content", "data-section": active, children: [
-      active === "profile" && /* @__PURE__ */ jsx47(
+    /* @__PURE__ */ jsxs45("div", { className: "ba-profile-content", "data-section": active, children: [
+      active === "profile" && /* @__PURE__ */ jsx48(
         ProfileSection,
         {
           firstLastName: capabilities.firstLastName,
@@ -3960,41 +4124,41 @@ function UserProfileBody({
           legacyNameField: capabilities.legacyNameField
         }
       ),
-      active === "email" && /* @__PURE__ */ jsx47(EmailSection, { allowChange: capabilities.emailChange }),
-      active === "password" && /* @__PURE__ */ jsx47(PasswordSection, {}),
-      active === "social" && /* @__PURE__ */ jsx47(SocialSection, {}),
-      active === "sessions" && /* @__PURE__ */ jsx47(SessionsSection, {}),
-      active === "passkeys" && /* @__PURE__ */ jsx47(PasskeysSection, { allowAdd: capabilities.passkeyAdd }),
-      active === "mfa" && /* @__PURE__ */ jsx47(MfaSection, {}),
-      active === "recovery" && /* @__PURE__ */ jsx47(RecoverySection, {}),
-      active === "privacy" && /* @__PURE__ */ jsx47(PrivacyCenter, {}),
-      active === "danger" && /* @__PURE__ */ jsx47(DeleteAccountSection, { onDeleted })
+      active === "email" && /* @__PURE__ */ jsx48(EmailSection, { allowChange: capabilities.emailChange }),
+      active === "password" && /* @__PURE__ */ jsx48(PasswordSection, {}),
+      active === "social" && /* @__PURE__ */ jsx48(SocialSection, {}),
+      active === "sessions" && /* @__PURE__ */ jsx48(SessionsSection, {}),
+      active === "passkeys" && /* @__PURE__ */ jsx48(PasskeysSection, { allowAdd: capabilities.passkeyAdd }),
+      active === "mfa" && /* @__PURE__ */ jsx48(MfaSection, {}),
+      active === "recovery" && /* @__PURE__ */ jsx48(RecoverySection, {}),
+      active === "privacy" && /* @__PURE__ */ jsx48(PrivacyCenter, {}),
+      active === "danger" && /* @__PURE__ */ jsx48(DeleteAccountSection, { onDeleted })
     ] })
   ] });
 }
 
 // src/components/UserButton.tsx
-import { jsx as jsx48, jsxs as jsxs45 } from "react/jsx-runtime";
+import { jsx as jsx49, jsxs as jsxs46 } from "react/jsx-runtime";
 function UserButton() {
   const t = useT();
   const { user, isLoaded } = useUser();
   const { signOut } = useSignOut();
-  const [open, setOpen] = React38.useState(false);
-  const [profileOpen, setProfileOpen] = React38.useState(false);
-  const [failedImage, setFailedImage] = React38.useState(null);
-  const triggerRef = React38.useRef(null);
+  const [open, setOpen] = React41.useState(false);
+  const [profileOpen, setProfileOpen] = React41.useState(false);
+  const [failedImage, setFailedImage] = React41.useState(null);
+  const triggerRef = React41.useRef(null);
   if (!isLoaded || !user) return null;
   const identity = user.email ?? user.phoneNumber ?? user.name ?? "?";
   const image = user.image ?? null;
-  return /* @__PURE__ */ jsxs45("div", { className: "ba-user-button", "data-testid": "user-button", children: [
-    /* @__PURE__ */ jsx48(
+  return /* @__PURE__ */ jsxs46("div", { className: "ba-user-button", "data-testid": "user-button", children: [
+    /* @__PURE__ */ jsx49(
       "button",
       {
         ref: triggerRef,
         className: "ba-user-button-trigger",
         "aria-label": t("userButton.openMenuAria"),
         onClick: () => setOpen((v) => !v),
-        children: image && failedImage !== image ? /* @__PURE__ */ jsx48(
+        children: image && failedImage !== image ? /* @__PURE__ */ jsx49(
           "img",
           {
             className: "ba-avatar",
@@ -4003,12 +4167,12 @@ function UserButton() {
             referrerPolicy: "no-referrer",
             onError: () => setFailedImage(image)
           }
-        ) : /* @__PURE__ */ jsx48("span", { className: "ba-avatar ba-avatar-fallback", children: identity[0]?.toUpperCase() })
+        ) : /* @__PURE__ */ jsx49("span", { className: "ba-avatar ba-avatar-fallback", children: identity[0]?.toUpperCase() })
       }
     ),
-    open && /* @__PURE__ */ jsxs45("div", { className: "ba-menu", children: [
-      /* @__PURE__ */ jsx48("p", { className: "ba-menu-label", children: identity }),
-      /* @__PURE__ */ jsx48(
+    open && /* @__PURE__ */ jsxs46("div", { className: "ba-menu", children: [
+      /* @__PURE__ */ jsx49("p", { className: "ba-menu-label", children: identity }),
+      /* @__PURE__ */ jsx49(
         "button",
         {
           className: "ba-menu-item",
@@ -4019,10 +4183,10 @@ function UserButton() {
           children: t("userButton.manageAccount")
         }
       ),
-      /* @__PURE__ */ jsx48("button", { className: "ba-menu-item", onClick: () => signOut(), children: t("userButton.signOut") }),
-      /* @__PURE__ */ jsx48("div", { className: "ba-menu-badge", children: /* @__PURE__ */ jsx48(AuthOwlBadge, {}) })
+      /* @__PURE__ */ jsx49("button", { className: "ba-menu-item", onClick: () => signOut(), children: t("userButton.signOut") }),
+      /* @__PURE__ */ jsx49("div", { className: "ba-menu-badge", children: /* @__PURE__ */ jsx49(AuthOwlBadge, {}) })
     ] }),
-    profileOpen && /* @__PURE__ */ jsx48(
+    profileOpen && /* @__PURE__ */ jsx49(
       UserProfile,
       {
         mode: "modal",
@@ -4038,35 +4202,35 @@ function UserButton() {
 }
 
 // src/components/OrganizationSwitcher.tsx
-import * as React39 from "react";
-import { jsx as jsx49 } from "react/jsx-runtime";
-var OrganizationSwitcherContent = React39.lazy(async () => {
-  const module = await import("./OrganizationSwitcherContent-2TJ76HZM.js");
+import * as React42 from "react";
+import { jsx as jsx50 } from "react/jsx-runtime";
+var OrganizationSwitcherContent = React42.lazy(async () => {
+  const module = await import("./OrganizationSwitcherContent-6G6ASVYZ.js");
   return { default: module.OrganizationSwitcherContent };
 });
 function OrganizationSwitcher(props = {}) {
-  return /* @__PURE__ */ jsx49(
-    React39.Suspense,
+  return /* @__PURE__ */ jsx50(
+    React42.Suspense,
     {
-      fallback: /* @__PURE__ */ jsx49("div", { className: "ba-skeleton ba-organization-switcher-skeleton", "aria-busy": "true" }),
-      children: /* @__PURE__ */ jsx49(OrganizationSwitcherContent, { ...props })
+      fallback: /* @__PURE__ */ jsx50("div", { className: "ba-skeleton ba-organization-switcher-skeleton", "aria-busy": "true" }),
+      children: /* @__PURE__ */ jsx50(OrganizationSwitcherContent, { ...props })
     }
   );
 }
 
 // src/components/OrganizationList.tsx
-import * as React40 from "react";
-import { jsx as jsx50 } from "react/jsx-runtime";
-var OrganizationListContent = React40.lazy(async () => {
-  const module = await import("./OrganizationListContent-BSGDHYAC.js");
+import * as React43 from "react";
+import { jsx as jsx51 } from "react/jsx-runtime";
+var OrganizationListContent = React43.lazy(async () => {
+  const module = await import("./OrganizationListContent-HMRK4ZSI.js");
   return { default: module.OrganizationListContent };
 });
 function OrganizationList(props = {}) {
-  return /* @__PURE__ */ jsx50(React40.Suspense, { fallback: /* @__PURE__ */ jsx50("div", { className: "ba-skeleton", "aria-busy": "true" }), children: /* @__PURE__ */ jsx50(OrganizationListContent, { ...props }) });
+  return /* @__PURE__ */ jsx51(React43.Suspense, { fallback: /* @__PURE__ */ jsx51("div", { className: "ba-skeleton", "aria-busy": "true" }), children: /* @__PURE__ */ jsx51(OrganizationListContent, { ...props }) });
 }
 
 // src/components/GoogleOneTap.tsx
-import * as React41 from "react";
+import * as React44 from "react";
 
 // src/components/google-one-tap.ts
 var GOOGLE_IDENTITY_SCRIPT = "https://accounts.google.com/gsi/client";
@@ -4242,16 +4406,16 @@ function GoogleOneTap({
   const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
   const { user, isLoaded: sessionLoaded } = useUser();
   const { signInSocial } = useSignIn();
-  const callbacks = React41.useRef({ onSignedIn, onSkipped, onDismissed, onError });
+  const callbacks = React44.useRef({ onSignedIn, onSkipped, onDismissed, onError });
   callbacks.current = { onSignedIn, onSkipped, onDismissed, onError };
   const googleEnabled = config?.socialProviders.includes("google") === true;
   const clientId = config?.socialProviderClientIds?.google;
-  React41.useEffect(() => {
+  React44.useEffect(() => {
     if (process.env.NODE_ENV === "production") return;
     if (disabled || !googleEnabled || !clientId || nonce) return;
     warnOneTapWithoutNonce(clientId);
   }, [clientId, disabled, googleEnabled, nonce]);
-  React41.useEffect(() => {
+  React44.useEffect(() => {
     if (configLoading || !sessionLoaded) return;
     if (disabled) {
       callbacks.current.onSkipped?.("disabled");
@@ -4397,11 +4561,13 @@ export {
   OrganizationSwitcher,
   PasskeyButton,
   PasskeyManager,
+  PasskeyOfferGate,
   PhoneOTP,
   PrivacyCenter,
   Protect,
   RateLimitedError,
   ResetPassword,
+  SECOND_FACTOR_REQUIRED,
   SignIn,
   SignOutButton,
   SignUp,
@@ -4440,6 +4606,7 @@ export {
   useSignIn,
   useSignOut,
   useSignUp,
+  useStepUpAction,
   useUser,
   useWaitlist
 };