@burdenoff/microfe-auth 2026.1031.1 → 2026.1101.2

package/dist/auth/hooks/useAuthOperations.js

@@ -1,11 +1,11 @@
-import { useAuth as e } from "../providers/AuthProvider.js";
-import { useAuthStore as t } from "../store/authStore.js";
+import { useAuthStore as e } from "../store/authStore.js";
+import { useAuth as t } from "../providers/AuthProvider.js";
 import { CurrentUserDocument as n, RefreshTokenDocument as r, ResendVerificationEmailDocument as i, SignInDocument as a, SignOutDocument as o, SignUpDocument as s, VerifyEmailDocument as c } from "../../generated/global-operations.js";
 import { useEffect as l, useRef as u } from "react";
 import { getProfileTokens as d, getProfileUser as f, getProfiles as p, loginProfile as m } from "@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager";
 import { useApolloClient as h, useMutation as g, useQuery as _ } from "@apollo/client/react";
 import { useEventBus as v } from "@burdenoff/fe-libs/shared/events";
-//#region src/auth/hooks/useAuthOperations.ts
+// src/auth/hooks/useAuthOperations.ts
 function y(e, t) {
 	return t === "ACCOUNT_DEACTIVATED" ? "This email belongs to a deactivated account. You can reactivate it instead of signing up again." : t === "ACCOUNT_REMOVED" ? "This account was removed by an administrator. Please contact support to restore it." : t === "ACCOUNT_SUSPENDED" ? "This account is suspended. Please contact support." : e.includes("email or username already exists") || t === "BAD_USER_INPUT" ? "An account with this email or username already exists. Please sign in or use a different email." : t === "TENANT_CREATION_FAILED" ? "We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support." : e.includes("Failed to fetch") || e.includes("NetworkError") || e.includes("Load failed") ? "Unable to reach the server. Please check your internet connection and try again." : e.includes("CORS") || e.includes("cross-origin") ? "Unable to reach the server. Please try again or contact support." : t === "INTERNAL_SERVER_ERROR" ? "Something went wrong on our end. Please try again in a few moments." : e && e !== "Sign up failed" ? e : "Sign up failed. Please try again.";
 }
@@ -40,22 +40,22 @@ function E(e) {
 	return typeof t == "string" ? t : null;
 }
 function D(S = {}) {
-	let C = t((e) => e.isLoading), D = t((e) => e.error), O = t((e) => e.errorCode), k = t((e) => e.isAuthenticated), A = t((e) => e.user), j = t((e) => e.accessToken), M = S.disableCurrentUserQuery ?? !1, N = u(!1), P = e(), F = v(), I = h(), [L] = g(a), [R] = g(s), [z] = g(o), [B] = g(r), [V] = g(c), [H] = g(i), U = async (e) => {
-		let n = t.getState();
+	let C = e((e) => e.isLoading), D = e((e) => e.error), O = e((e) => e.errorCode), k = e((e) => e.isAuthenticated), A = e((e) => e.user), j = e((e) => e.accessToken), M = S.disableCurrentUserQuery ?? !1, N = u(!1), P = t(), F = v(), I = h(), [L] = g(a), [R] = g(s), [z] = g(o), [B] = g(r), [V] = g(c), [H] = g(i), U = async (t) => {
+		let n = e.getState();
 		try {
 			n.setLoading(!0), n.setError(null);
-			let t = await L({
-				variables: { input: e },
+			let e = await L({
+				variables: { input: t },
 				errorPolicy: "none"
 			});
-			if (!t.data || !t.data.signIn) {
+			if (!e.data || !e.data.signIn) {
 				let e = "Sign in failed. Please check your credentials and try again.";
 				return n.setError(e), {
 					success: !1,
 					error: e
 				};
 			}
-			let r = t.data.signIn;
+			let r = e.data.signIn;
 			if (r.requiresMFA && r.mfaChallengeId) return n.setMfaRequired(!0, r.mfaChallengeId), {
 				success: !0,
 				requiresMFA: !0,
@@ -83,7 +83,8 @@ function D(S = {}) {
 					expiresIn: r.expiresIn,
 					requiresMFA: !1
 				};
-			} else {
+			}
+			{
 				let e = "Login failed: Invalid response from server";
 				return n.setError(e), {
 					success: !1,
@@ -103,20 +104,20 @@ function D(S = {}) {
 		} finally {
 			n.setLoading(!1);
 		}
-	}, W = async (e) => {
-		let n = t.getState();
+	}, W = async (t) => {
+		let n = e.getState();
 		try {
 			n.setLoading(!0), n.setError(null);
-			let t = await R({ variables: { input: e } }), r = w(t);
+			let e = await R({ variables: { input: t } }), r = w(e);
 			if (r.length > 0) {
 				let e = r[0].message ?? "Sign up failed";
 				throw console.error("[SignUp] GraphQL error:", e), n.setError(e), Error(e);
 			}
-			if (!t.data || !t.data.signUp) {
+			if (!e.data || !e.data.signUp) {
 				let e = "Sign up failed: No response from server";
 				throw console.error("[SignUp] No data:", e), n.setError(e), Error(e);
 			}
-			let i = t.data.signUp;
+			let i = e.data.signUp;
 			if (!i.user) throw Error("Sign up failed: No user data returned");
 			return !i.accessToken || !i.refreshToken || i.accessToken === "" || i.refreshToken === "" ? (n.setUser(i.user), n.setAuthenticated(!1), {
 				...i,
@@ -142,54 +143,54 @@ function D(S = {}) {
 			n.setLoading(!1);
 		}
 	}, G = async () => {
-		let e = t.getState(), n = e.user;
+		let t = e.getState(), n = t.user;
 		try {
 			await z();
 		} catch (e) {
 			console.error("Sign out failed:", e);
 		}
-		await I.clearStore(), e.clearAuth(), F.emit("auth.signed_out", {
+		await I.clearStore(), t.clearAuth(), F.emit("auth.signed_out", {
 			userId: n?.id,
 			tenantId: n?.tenantId,
 			workspaceId: n?.defaultWorkspaceId
 		}, { component: "useAuthOperations" });
 		let r = p().filter((e) => e.id !== n?.id);
 		if (r.length > 0) {
-			let t = r[0], n = d(t.id), i = f(t.id);
+			let e = r[0], n = d(e.id), i = f(e.id);
 			if (n?.accessToken && i) {
-				e.loadFromProfile(t.id);
+				t.loadFromProfile(e.id);
 				return;
 			}
 		}
 		P.onLogout?.();
 	}, K = async () => {
-		let e = t.getState();
+		let t = e.getState();
 		try {
-			let t = e.refreshToken;
-			if (!t) throw Error("No refresh token available");
-			let { data: n } = await B({ variables: { token: t } }), r = n.refreshToken;
+			let e = t.refreshToken;
+			if (!e) throw Error("No refresh token available");
+			let { data: n } = await B({ variables: { token: e } }), r = n.refreshToken;
 			if (!r.accessToken || !r.refreshToken || !r.user) throw Error("Token refresh failed: Invalid response from server");
-			return e.setAuthTokens(r.accessToken, r.refreshToken), e.setUser(r.user), F.emit("auth.token_refreshed", {
+			return t.setAuthTokens(r.accessToken, r.refreshToken), t.setUser(r.user), F.emit("auth.token_refreshed", {
 				userId: r.user.id,
 				tenantId: r.user.tenantId,
 				workspaceId: r.user.defaultWorkspaceId,
 				mfaEnabled: r.user.mfaEnabled,
 				emailVerified: r.user.emailVerified
 			}, { component: "useAuthOperations" }), r;
-		} catch (t) {
+		} catch (e) {
 			throw F.emit("auth.token_refresh_failed", {
-				userId: e.user?.id,
-				tenantId: e.user?.tenantId,
-				workspaceId: e.user?.defaultWorkspaceId,
-				reason: t instanceof Error ? t.message : "Token refresh failed"
-			}, { component: "useAuthOperations" }), e.clearAuth(), t;
+				userId: t.user?.id,
+				tenantId: t.user?.tenantId,
+				workspaceId: t.user?.defaultWorkspaceId,
+				reason: e instanceof Error ? e.message : "Token refresh failed"
+			}, { component: "useAuthOperations" }), t.clearAuth(), e;
 		}
 	}, { data: q, refetch: J } = _(n, {
 		skip: M || !k || N.current,
 		fetchPolicy: "network-only"
 	});
 	return l(() => {
-		q?.currentUser && t.getState().setUser(q.currentUser);
+		q?.currentUser && e.getState().setUser(q.currentUser);
 	}, [q]), l(() => {
 		if (N.current && k) {
 			let e = setTimeout(() => {
@@ -202,15 +203,15 @@ function D(S = {}) {
 		signUp: W,
 		signOut: G,
 		refreshToken: K,
-		verifyEmail: async (e) => {
-			let n = t.getState();
+		verifyEmail: async (t) => {
+			let n = e.getState();
 			try {
 				n.setLoading(!0);
-				let { data: t } = await V({ variables: { token: e } });
-				return t.verifyEmail.success && n.user && n.setUser({
+				let { data: e } = await V({ variables: { token: t } });
+				return e.verifyEmail.success && n.user && n.setUser({
 					...n.user,
 					emailVerified: !0
-				}), t.verifyEmail;
+				}), e.verifyEmail;
 			} catch (e) {
 				let t = e instanceof Error ? e.message : "Email verification failed";
 				throw n.setError(t), e;
@@ -238,7 +239,6 @@ function D(S = {}) {
 		accessToken: j
 	};
 }
-//#endregion
 export { D as useAuthOperations };
 
 //# sourceMappingURL=useAuthOperations.js.map

package/dist/auth/hooks/useAuthOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n  loginProfile,\n  getProfiles,\n  getProfileTokens,\n  getProfileUser,\n  type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n  SignInDocument,\n  SignUpDocument,\n  SignOutDocument,\n  RefreshTokenDocument,\n  CurrentUserDocument,\n  VerifyEmailDocument,\n  ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  SignInInput,\n  SignUpInput,\n  User,\n  AuthPayload,\n  AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n  // Non-active accounts on this email — route the user to the right recovery\n  // path. RegisterPage reads the errorCode to render the matching CTA.\n  if (errorCode === \"ACCOUNT_DEACTIVATED\") {\n    return \"This email belongs to a deactivated account. You can reactivate it instead of signing up again.\";\n  }\n  if (errorCode === \"ACCOUNT_REMOVED\") {\n    return \"This account was removed by an administrator. Please contact support to restore it.\";\n  }\n  if (errorCode === \"ACCOUNT_SUSPENDED\") {\n    return \"This account is suspended. Please contact support.\";\n  }\n\n  // Exact matches from the backend\n  if (\n    rawMessage.includes(\"email or username already exists\") ||\n    errorCode === \"BAD_USER_INPUT\"\n  ) {\n    return \"An account with this email or username already exists. Please sign in or use a different email.\";\n  }\n\n  if (errorCode === \"TENANT_CREATION_FAILED\") {\n    return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n  }\n\n  // Network / fetch failures (Apollo wraps these)\n  if (\n    rawMessage.includes(\"Failed to fetch\") ||\n    rawMessage.includes(\"NetworkError\") ||\n    rawMessage.includes(\"Load failed\")\n  ) {\n    return \"Unable to reach the server. Please check your internet connection and try again.\";\n  }\n\n  // CORS or cross-origin issues\n  if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n    return \"Unable to reach the server. Please try again or contact support.\";\n  }\n\n  // Generic server errors\n  if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n    return \"Something went wrong on our end. Please try again in a few moments.\";\n  }\n\n  // Pass through any already-descriptive message, or fall back\n  if (rawMessage && rawMessage !== \"Sign up failed\") {\n    return rawMessage;\n  }\n\n  return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({\n      id: userId,\n      origin: window.location.origin,\n    });\n    document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n    document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    // Best effort only.\n  }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n  return { ...user };\n}\n\ninterface GraphQLErrorLike {\n  message?: string;\n  extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n  if (!isRecord(error)) return [];\n  const directErrors = asGraphQLErrorArray(error.errors);\n  if (directErrors.length > 0) return directErrors;\n  return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (isRecord(error) && typeof error.message === \"string\") {\n    return error.message;\n  }\n  return undefined;\n}\n\nfunction getGraphQLErrorCode(\n  error: GraphQLErrorLike | undefined,\n): string | null {\n  const code = error?.extensions?.code;\n  return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n  signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n  input: SignInInput;\n}\n\ninterface SignUpResponse {\n  signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n  input: SignUpInput;\n}\n\ninterface SignOutResponse {\n  signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n  refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n  token: string;\n}\n\ninterface CurrentUserResponse {\n  currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n  disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n  verifyEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface VerifyEmailVariables {\n  token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n  resendVerificationEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ResendVerificationEmailVariables {\n  email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n  // Use selectors for reactive state values\n  const isLoading = useAuthStore((state) => state.isLoading);\n  const error = useAuthStore((state) => state.error);\n  const errorCode = useAuthStore((state) => state.errorCode);\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const user = useAuthStore((state) => state.user);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n  // Track whether signIn just completed — skip the CurrentUser refetch\n  // because signIn already returns the full user object.\n  const loginJustCompletedRef = useRef(false);\n\n  const context = useAuth();\n  const eventBus = useEventBus();\n  const apolloClient = useApolloClient();\n  const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n    SignInDocument,\n  );\n  const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n    SignUpDocument,\n  );\n  const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n  const [refreshTokenMutation] = useMutation<\n    RefreshTokenResponse,\n    RefreshTokenVariables\n  >(RefreshTokenDocument);\n  const [verifyEmailMutation] = useMutation<\n    VerifyEmailResponse,\n    VerifyEmailVariables\n  >(VerifyEmailDocument);\n  const [resendVerificationMutation] = useMutation<\n    ResendVerificationEmailResponse,\n    ResendVerificationEmailVariables\n  >(ResendVerificationEmailDocument);\n\n  /**\n   * Sign in with email/username and password\n   * Uses signIn mutation which returns correct token format (with 'sub' field)\n   */\n  const signIn = async (input: SignInInput): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // rememberMe is sent to the backend so the server can issue\n      // longer-lived refresh tokens (30 days instead of 7 days)\n\n      // Use signIn mutation (returns correct token format with 'sub' field)\n      const result = await signInMutation({\n        variables: { input },\n        // Override client-level errorPolicy to ensure errors are thrown\n        // and caught by our catch block for proper error message extraction\n        errorPolicy: \"none\",\n      });\n\n      // If we reach here, the mutation succeeded (no errors thrown)\n      // Check if data.signIn is present\n      if (!result.data || !result.data.signIn) {\n        const errorMessage =\n          \"Sign in failed. Please check your credentials and try again.\";\n        store.setError(errorMessage);\n        return {\n          success: false,\n          error: errorMessage,\n        } as AuthResult;\n      }\n\n      const data = result.data;\n\n      const authResult = data.signIn;\n\n      // Check if MFA is required\n      if (authResult.requiresMFA && authResult.mfaChallengeId) {\n        store.setMfaRequired(true, authResult.mfaChallengeId);\n\n        // Return success but with requiresMFA flag\n        return {\n          success: true,\n          requiresMFA: true,\n          mfaChallengeId: authResult.mfaChallengeId,\n          metadata: {\n            mfaMethod: authResult.mfaMethod,\n          },\n        } as AuthResult;\n      }\n\n      // Normal login without MFA - store the authentication result\n      if (\n        authResult.user &&\n        authResult.accessToken &&\n        authResult.refreshToken\n      ) {\n        // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n        loginJustCompletedRef.current = true;\n        store.setUser(authResult.user);\n        store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        const expiresAt = authResult.expiresIn\n          ? Date.now() + authResult.expiresIn * 1000\n          : undefined;\n        loginProfile(toProfileUser(authResult.user), {\n          accessToken: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresAt,\n        });\n        setShellSsoCookie(authResult.user.id);\n\n        eventBus.emit(\n          \"auth.signed_in\",\n          {\n            userId: authResult.user.id,\n            tenantId: authResult.user.tenantId,\n            workspaceId: authResult.user.defaultWorkspaceId,\n            mfaEnabled: authResult.user.mfaEnabled,\n            emailVerified: authResult.user.emailVerified,\n          },\n          { component: \"useAuthOperations\" },\n        );\n\n        context.onAuthSuccess?.(\n          authResult.user,\n          authResult.accessToken,\n          authResult.refreshToken,\n        );\n\n        // Convert AuthPayload to AuthResult for consistent return type\n        return {\n          success: true,\n          user: authResult.user,\n          token: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresIn: authResult.expiresIn,\n          requiresMFA: false,\n        } as AuthResult;\n      } else {\n        const errorMsg = \"Login failed: Invalid response from server\";\n        store.setError(errorMsg);\n        return {\n          success: false,\n          error: errorMsg,\n        } as AuthResult;\n      }\n    } catch (err: unknown) {\n      // Extract error message and code from GraphQL error responses.\n      // The backend sends user-friendly messages in gqlError.message and\n      // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n      // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n      // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n      // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n      // internal details that should not be shown to users.\n      let message = \"Sign in failed\";\n      let errorCode: string | null = null;\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        // Apollo v4 CombinedGraphQLErrors\n        // Apollo v3 ApolloError — use message only, never originalError\n        const gqlError = graphQLErrors[0];\n        message = gqlError.message || message;\n        errorCode = getGraphQLErrorCode(gqlError);\n      } else {\n        message = getUnknownErrorMessage(err) ?? message;\n      }\n\n      console.error(\n        \"[SignIn] Error:\",\n        message,\n        errorCode ? `(${errorCode})` : \"\",\n      );\n      store.setError(message, errorCode);\n      return {\n        success: false,\n        error: message,\n      } as AuthResult;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign up new user\n   */\n  const signUp = async (input: SignUpInput) => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const mutationResult = await signUpMutation({\n        variables: { input },\n      });\n\n      // With errorPolicy: 'all', errors are returned in result, not thrown\n      // Check for GraphQL errors first\n      const graphQLErrors = getGraphQLErrors(mutationResult);\n      if (graphQLErrors.length > 0) {\n        const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n        console.error(\"[SignUp] GraphQL error:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      // Check if data.signUp is null (indicates GraphQL error without explicit error)\n      if (!mutationResult.data || !mutationResult.data.signUp) {\n        const errorMessage = \"Sign up failed: No response from server\";\n        console.error(\"[SignUp] No data:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      const result = mutationResult.data.signUp;\n\n      // Check if user was created\n      if (!result.user) {\n        throw new Error(\"Sign up failed: No user data returned\");\n      }\n\n      // Check if email verification is required (empty tokens)\n      if (\n        !result.accessToken ||\n        !result.refreshToken ||\n        result.accessToken === \"\" ||\n        result.refreshToken === \"\"\n      ) {\n        // User created successfully but needs to verify email\n        // Don't set authenticated state, but store the user for display\n        store.setUser(result.user);\n        store.setAuthenticated(false);\n\n        // Return special result indicating email verification needed\n        return {\n          ...result,\n          requiresEmailVerification: true,\n        };\n      }\n\n      // Normal sign up with immediate access (tokens provided)\n      store.setUser(result.user);\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setAuthenticated(true);\n\n      eventBus.emit(\n        \"auth.signed_up\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      context.onAuthSuccess?.(\n        result.user,\n        result.accessToken,\n        result.refreshToken,\n      );\n\n      return result;\n    } catch (err: unknown) {\n      // Extract error message from Apollo error or regular error\n      let message = \"Sign up failed. Please try again.\";\n      let errorCode: string | undefined;\n\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        const gqlError = graphQLErrors[0];\n        errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n        const rawMessage = gqlError.message ?? \"\";\n\n        // Map backend error codes to user-friendly messages\n        message = mapSignUpError(rawMessage, errorCode);\n      } else {\n        const rawMessage = getUnknownErrorMessage(err);\n        if (rawMessage) {\n          message = mapSignUpError(rawMessage);\n        }\n      }\n\n      store.setError(message, errorCode ?? null);\n      throw new Error(message);\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign out current session\n   */\n  const signOut = async () => {\n    const store = useAuthStore.getState();\n    const signedOutUser = store.user;\n\n    try {\n      await signOutMutation();\n    } catch (err) {\n      console.error(\"Sign out failed:\", err);\n    }\n\n    // Always clear Apollo cache so stale user data doesn't survive re-login\n    await apolloClient.clearStore();\n    store.clearAuth();\n    eventBus.emit(\n      \"auth.signed_out\",\n      {\n        userId: signedOutUser?.id,\n        tenantId: signedOutUser?.tenantId,\n        workspaceId: signedOutUser?.defaultWorkspaceId,\n      },\n      { component: \"useAuthOperations\" },\n    );\n\n    // If other profiles exist after clearing the current one, switch to the first\n    // remaining profile instead of fully logging out.\n    const remainingProfiles = getProfiles().filter(\n      (p) => p.id !== signedOutUser?.id,\n    );\n    if (remainingProfiles.length > 0) {\n      const nextProfile = remainingProfiles[0];\n      const nextTokens = getProfileTokens(nextProfile.id);\n      const nextUser = getProfileUser(nextProfile.id);\n      if (nextTokens?.accessToken && nextUser) {\n        // Switch to next profile instead of fully logging out\n        store.loadFromProfile(nextProfile.id);\n        return;\n      }\n    }\n\n    context.onLogout?.();\n  };\n\n  /**\n   * Refresh access token\n   */\n  const refreshToken = async () => {\n    const store = useAuthStore.getState();\n\n    try {\n      const token = store.refreshToken;\n      if (!token) throw new Error(\"No refresh token available\");\n\n      const { data } = await refreshTokenMutation({\n        variables: { token },\n      });\n\n      const result = data!.refreshToken;\n\n      // Refresh token should always return valid tokens and user\n      if (!result.accessToken || !result.refreshToken || !result.user) {\n        throw new Error(\"Token refresh failed: Invalid response from server\");\n      }\n\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setUser(result.user);\n\n      eventBus.emit(\n        \"auth.token_refreshed\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      return result;\n    } catch (err) {\n      // Refresh failed, logout user\n      eventBus.emit(\n        \"auth.token_refresh_failed\",\n        {\n          userId: store.user?.id,\n          tenantId: store.user?.tenantId,\n          workspaceId: store.user?.defaultWorkspaceId,\n          reason: err instanceof Error ? err.message : \"Token refresh failed\",\n        },\n        { component: \"useAuthOperations\" },\n      );\n      store.clearAuth();\n      throw err;\n    }\n  };\n\n  /**\n   * Get current user.\n   * Skip when:\n   *  - Not authenticated\n   *  - Login just completed (user data is already fresh from signIn response)\n   *\n   * The loginJustCompletedRef is cleared after the first successful fetch\n   * or on the next render cycle after navigation.\n   */\n  const { data: currentUserData, refetch: refetchCurrentUser } =\n    useQuery<CurrentUserResponse>(CurrentUserDocument, {\n      skip:\n        disableCurrentUserQuery ||\n        !isAuthenticated ||\n        loginJustCompletedRef.current,\n      fetchPolicy: \"network-only\",\n    });\n\n  // Handle currentUser data updates (replaces onCompleted callback)\n  useEffect(() => {\n    if (currentUserData?.currentUser) {\n      useAuthStore.getState().setUser(currentUserData.currentUser);\n    }\n  }, [currentUserData]);\n\n  // Clear loginJustCompletedRef after navigation away from login page\n  // so subsequent CurrentUser queries work normally (e.g., profile page).\n  useEffect(() => {\n    if (loginJustCompletedRef.current && isAuthenticated) {\n      const timer = setTimeout(() => {\n        loginJustCompletedRef.current = false;\n      }, 2000);\n      return () => clearTimeout(timer);\n    }\n  }, [isAuthenticated]);\n\n  /**\n   * Verify email with token\n   * Returns { success, message, email } on success\n   */\n  const verifyEmail = async (\n    token: string,\n  ): Promise<{ success: boolean; message: string; email?: string }> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      const { data } = await verifyEmailMutation({ variables: { token } });\n\n      if (data!.verifyEmail.success && store.user) {\n        store.setUser({ ...store.user, emailVerified: true });\n      }\n\n      return data!.verifyEmail;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Email verification failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Resend verification email\n   */\n  const resendVerification = async (email: string) => {\n    try {\n      const { data } = await resendVerificationMutation({\n        variables: { email },\n      });\n      return data!.resendVerificationEmail;\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      throw err;\n    }\n  };\n\n  // Legacy aliases for backwards compatibility\n  const login = signIn;\n  const register = signUp;\n  const logout = signOut;\n\n  return {\n    // New API\n    signIn,\n    signUp,\n    signOut,\n    refreshToken,\n    verifyEmail,\n    resendVerification,\n    refetchCurrentUser,\n    // Legacy aliases\n    login,\n    register,\n    logout,\n    // State (reactive via selectors)\n    isLoading,\n    error,\n    errorCode,\n    isAuthenticated,\n    user,\n    accessToken,\n  };\n}\n"],"mappings":";;;;;;;;AAqCA,SAAS,EAAe,GAAoB,GAA4B;CAiDtE,OA9CI,MAAc,wBACT,oGAEL,MAAc,oBACT,wFAEL,MAAc,sBACT,uDAKP,EAAW,SAAS,kCAAkC,KACtD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,iBAAiB,KACrC,EAAW,SAAS,cAAc,KAClC,EAAW,SAAS,aAAa,IAE1B,qFAIL,EAAW,SAAS,MAAM,KAAK,EAAW,SAAS,cAAc,IAC5D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;AACT;AAEA,SAAS,EAAkB,GAAsB;CAC/C,IAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,sBAAsB,IACnD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;EAC1B,CAAC;EAED,AADA,SAAS,SAAS,UAAU,mBAAmB,CAAQ,IAAI,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,CAAQ,IAAI,EAAW,wBAAwB,EAAW;CACnH,QAAQ,CAER;AACF;AAEA,SAAS,EAAc,GAAyB;CAC9C,OAAO,EAAE,GAAG,EAAK;AACnB;AAOA,SAAS,EAAS,GAAkD;CAClE,OAAO,OAAO,KAAU,cAAY;AACtC;AAEA,SAAS,EAAoB,GAAoC;CAE/D,OADK,MAAM,QAAQ,CAAK,IACjB,EAAM,QAAQ,MAAmC,EAAS,CAAI,CAAC,IADpC,CAAC;AAErC;AAEA,SAAS,EAAiB,GAAoC;CAC5D,IAAI,CAAC,EAAS,CAAK,GAAG,OAAO,CAAC;CAC9B,IAAM,IAAe,EAAoB,EAAM,MAAM;CAErD,OADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,aAAa;AAChD;AAEA,SAAS,EAAuB,GAAoC;CAElE,IADI,aAAiB,SACjB,EAAS,CAAK,KAAK,OAAO,EAAM,WAAY,UAC9C,OAAO,EAAM;AAGjB;AAEA,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;CAChC,OAAO,OAAO,KAAS,WAAW,IAAO;AAC3C;AAwEA,SAAgB,EAAkB,IAAoC,CAAC,GAAG;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,SAAS,GACnD,IAAQ,GAAc,MAAU,EAAM,KAAK,GAC3C,IAAY,GAAc,MAAU,EAAM,SAAS,GACnD,IAAkB,GAAc,MAAU,EAAM,eAAe,GAC/D,IAAO,GAAc,MAAU,EAAM,IAAI,GACzC,IAAc,GAAc,MAAU,EAAM,WAAW,GACvD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,EAAK,GAEpC,IAAU,EAAQ,GAClB,IAAW,EAAY,GACvB,IAAe,EAAgB,GAC/B,CAAC,KAAkB,EACvB,CACF,GACM,CAAC,KAAkB,EACvB,CACF,GACM,CAAC,KAAmB,EAA6B,CAAe,GAChE,CAAC,KAAwB,EAG7B,CAAoB,GAChB,CAAC,KAAuB,EAG5B,CAAmB,GACf,CAAC,KAA8B,EAGnC,CAA+B,GAM3B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,SAAS;EAEpC,IAAI;GAEF,AADA,EAAM,WAAW,EAAI,GACrB,EAAM,SAAS,IAAI;GAMnB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,SAAM;IAGnB,aAAa;GACf,CAAC;GAID,IAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;IAEF,OADA,EAAM,SAAS,CAAY,GACpB;KACL,SAAS;KACT,OAAO;IACT;GACF;GAIA,IAAM,IAFO,EAAO,KAEI;GAGxB,IAAI,EAAW,eAAe,EAAW,gBAIvC,OAHA,EAAM,eAAe,IAAM,EAAW,cAAc,GAG7C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,UACxB;GACF;GAIF,IACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;IAMA,AAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,IAAI,GAC7B,EAAM,cAAc,EAAW,aAAa,EAAW,YAAY,GACnE,EAAM,iBAAiB,EAAI,GAC3B,EAAM,eAAe,EAAK;IAE1B,IAAM,IAAY,EAAW,YACzB,KAAK,IAAI,IAAI,EAAW,YAAY,MACpC,KAAA;IA2BJ,OA1BA,EAAa,EAAc,EAAW,IAAI,GAAG;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;IACF,CAAC,GACD,EAAkB,EAAW,KAAK,EAAE,GAEpC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;IACjC,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEA,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,YACb,GAGO;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;IACf;GACF,OAAO;IACL,IAAM,IAAW;IAEjB,OADA,EAAM,SAAS,CAAQ,GAChB;KACL,SAAS;KACT,OAAO;IACT;GACF;EACF,SAAS,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,CAAG;GAC1C,IAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;IAE/B,AADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,CAAQ;GAC1C,OACE,IAAU,EAAuB,CAAG,KAAK;GAS3C,OANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,EACjC,GACA,EAAM,SAAS,GAAS,CAAS,GAC1B;IACL,SAAS;IACT,OAAO;GACT;EACF,UAAU;GACR,EAAM,WAAW,EAAK;EACxB;CACF,GAKM,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,SAAS;EAEpC,IAAI;GAEF,AADA,EAAM,WAAW,EAAI,GACrB,EAAM,SAAS,IAAI;GAEnB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,SAAM,EACrB,CAAC,GAIK,IAAgB,EAAiB,CAAc;GACrD,IAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;IAGjD,MAFA,QAAQ,MAAM,2BAA2B,CAAY,GACrD,EAAM,SAAS,CAAY,GACjB,MAAM,CAAY;GAC9B;GAGA,IAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;IAGrB,MAFA,QAAQ,MAAM,qBAAqB,CAAY,GAC/C,EAAM,SAAS,CAAY,GACjB,MAAM,CAAY;GAC9B;GAEA,IAAM,IAAS,EAAe,KAAK;GAGnC,IAAI,CAAC,EAAO,MACV,MAAU,MAAM,uCAAuC;GA6CzD,OAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,IAAI,GACzB,EAAM,iBAAiB,EAAK,GAGrB;IACL,GAAG;IACH,2BAA2B;GAC7B,MAIF,EAAM,QAAQ,EAAO,IAAI,GACzB,EAAM,cAAc,EAAO,aAAa,EAAO,YAAY,GAC3D,EAAM,iBAAiB,EAAI,GAE3B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;GAC7B,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEA,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,YACT,GAEO;EACT,SAAS,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,CAAG;GAC1C,IAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;IAK/B,AAJA,IAAY,EAAoB,CAAQ,KAAK,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,CAAS;GAChD,OAAO;IACL,IAAM,IAAa,EAAuB,CAAG;IAC7C,AAAI,MACF,IAAU,EAAe,CAAU;GAEvC;GAGA,MADA,EAAM,SAAS,GAAS,KAAa,IAAI,GAC/B,MAAM,CAAO;EACzB,UAAU;GACR,EAAM,WAAW,EAAK;EACxB;CACF,GAKM,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAgB,EAAM;EAE5B,IAAI;GACF,MAAM,EAAgB;EACxB,SAAS,GAAK;GACZ,QAAQ,MAAM,oBAAoB,CAAG;EACvC;EAKA,AAFA,MAAM,EAAa,WAAW,GAC9B,EAAM,UAAU,GAChB,EAAS,KACP,mBACA;GACE,QAAQ,GAAe;GACvB,UAAU,GAAe;GACzB,aAAa,GAAe;EAC9B,GACA,EAAE,WAAW,oBAAoB,CACnC;EAIA,IAAM,IAAoB,EAAY,EAAE,QACrC,MAAM,EAAE,OAAO,GAAe,EACjC;EACA,IAAI,EAAkB,SAAS,GAAG;GAChC,IAAM,IAAc,EAAkB,IAChC,IAAa,EAAiB,EAAY,EAAE,GAC5C,IAAW,EAAe,EAAY,EAAE;GAC9C,IAAI,GAAY,eAAe,GAAU;IAEvC,EAAM,gBAAgB,EAAY,EAAE;IACpC;GACF;EACF;EAEA,EAAQ,WAAW;CACrB,GAKM,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,SAAS;EAEpC,IAAI;GACF,IAAM,IAAQ,EAAM;GACpB,IAAI,CAAC,GAAO,MAAU,MAAM,4BAA4B;GAExD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,SAAM,EACrB,CAAC,GAEK,IAAS,EAAM;GAGrB,IAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,MACzD,MAAU,MAAM,oDAAoD;GAkBtE,OAfA,EAAM,cAAc,EAAO,aAAa,EAAO,YAAY,GAC3D,EAAM,QAAQ,EAAO,IAAI,GAEzB,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;GAC7B,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEO;EACT,SAAS,GAAK;GAaZ,MAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;GAC/C,GACA,EAAE,WAAW,oBAAoB,CACnC,GACA,EAAM,UAAU,GACV;EACR;CACF,GAWM,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;CACf,CAAC;CAoEH,OAjEA,QAAgB;EACd,AAAI,GAAiB,eACnB,EAAa,SAAS,EAAE,QAAQ,EAAgB,WAAW;CAE/D,GAAG,CAAC,CAAe,CAAC,GAIpB,QAAgB;EACd,IAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;IAC7B,EAAsB,UAAU;GAClC,GAAG,GAAI;GACP,aAAa,aAAa,CAAK;EACjC;CACF,GAAG,CAAC,CAAe,CAAC,GAkDb;EAEL;EACA;EACA;EACA;EACA,oBAjDA,MACmE;GACnE,IAAM,IAAQ,EAAa,SAAS;GAEpC,IAAI;IACF,EAAM,WAAW,EAAI;IACrB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,SAAM,EAAE,CAAC;IAMnE,OAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;IAAK,CAAC,GAG/C,EAAM;GACf,SAAS,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;IAEvC,MADA,EAAM,SAAS,CAAO,GAChB;GACR,UAAU;IACR,EAAM,WAAW,EAAK;GACxB;EACF;EA6BE,2BAxBgC,MAAkB;GAClD,IAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,SAAM,EACrB,CAAC;IACD,OAAO,EAAM;GACf,SAAS,GAAK;IAEZ,MADA,QAAQ,MAAM,wCAAwC,CAAG,GACnD;GACR;EACF;EAeE;EAEA,OAAA;EACA,UAAA;EACA,QAAA;EAEA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"useAuthOperations.js","names":["mapSignUpError","errorCode","rawMessage","setShellSsoCookie","domain","domainPart","securePart","ssoValue","userId","toProfileUser","user","isRecord","value","asGraphQLErrorArray","item","getGraphQLErrors","error","directErrors","getUnknownErrorMessage","getGraphQLErrorCode","code","useAuthOperations","isLoading","useAuthStore","state","isAuthenticated","accessToken","disableCurrentUserQuery","options","loginJustCompletedRef","useRef","context","useAuth","eventBus","useEventBus","apolloClient","useApolloClient","signInMutation","useMutation","SignInDocument","signUpMutation","SignUpDocument","signOutMutation","SignOutDocument","refreshTokenMutation","RefreshTokenDocument","verifyEmailMutation","VerifyEmailDocument","resendVerificationMutation","ResendVerificationEmailDocument","signIn","store","result","errorMessage","authResult","expiresAt","loginProfile","errorMsg","err","message","graphQLErrors","gqlError","signUp","mutationResult","signOut","signedOutUser","remainingProfiles","getProfiles","p","nextProfile","nextTokens","getProfileTokens","nextUser","getProfileUser","refreshToken","token","data","currentUserData","refetchCurrentUser","useQuery","CurrentUserDocument","useEffect","timer"],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n  loginProfile,\n  getProfiles,\n  getProfileTokens,\n  getProfileUser,\n  type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n  SignInDocument,\n  SignUpDocument,\n  SignOutDocument,\n  RefreshTokenDocument,\n  CurrentUserDocument,\n  VerifyEmailDocument,\n  ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  SignInInput,\n  SignUpInput,\n  User,\n  AuthPayload,\n  AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n  // Non-active accounts on this email — route the user to the right recovery\n  // path. RegisterPage reads the errorCode to render the matching CTA.\n  if (errorCode === \"ACCOUNT_DEACTIVATED\") {\n    return \"This email belongs to a deactivated account. You can reactivate it instead of signing up again.\";\n  }\n  if (errorCode === \"ACCOUNT_REMOVED\") {\n    return \"This account was removed by an administrator. Please contact support to restore it.\";\n  }\n  if (errorCode === \"ACCOUNT_SUSPENDED\") {\n    return \"This account is suspended. Please contact support.\";\n  }\n\n  // Exact matches from the backend\n  if (\n    rawMessage.includes(\"email or username already exists\") ||\n    errorCode === \"BAD_USER_INPUT\"\n  ) {\n    return \"An account with this email or username already exists. Please sign in or use a different email.\";\n  }\n\n  if (errorCode === \"TENANT_CREATION_FAILED\") {\n    return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n  }\n\n  // Network / fetch failures (Apollo wraps these)\n  if (\n    rawMessage.includes(\"Failed to fetch\") ||\n    rawMessage.includes(\"NetworkError\") ||\n    rawMessage.includes(\"Load failed\")\n  ) {\n    return \"Unable to reach the server. Please check your internet connection and try again.\";\n  }\n\n  // CORS or cross-origin issues\n  if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n    return \"Unable to reach the server. Please try again or contact support.\";\n  }\n\n  // Generic server errors\n  if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n    return \"Something went wrong on our end. Please try again in a few moments.\";\n  }\n\n  // Pass through any already-descriptive message, or fall back\n  if (rawMessage && rawMessage !== \"Sign up failed\") {\n    return rawMessage;\n  }\n\n  return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({\n      id: userId,\n      origin: window.location.origin,\n    });\n    document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n    document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    // Best effort only.\n  }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n  return { ...user };\n}\n\ninterface GraphQLErrorLike {\n  message?: string;\n  extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n  if (!isRecord(error)) return [];\n  const directErrors = asGraphQLErrorArray(error.errors);\n  if (directErrors.length > 0) return directErrors;\n  return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (isRecord(error) && typeof error.message === \"string\") {\n    return error.message;\n  }\n  return undefined;\n}\n\nfunction getGraphQLErrorCode(\n  error: GraphQLErrorLike | undefined,\n): string | null {\n  const code = error?.extensions?.code;\n  return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n  signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n  input: SignInInput;\n}\n\ninterface SignUpResponse {\n  signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n  input: SignUpInput;\n}\n\ninterface SignOutResponse {\n  signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n  refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n  token: string;\n}\n\ninterface CurrentUserResponse {\n  currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n  disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n  verifyEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface VerifyEmailVariables {\n  token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n  resendVerificationEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ResendVerificationEmailVariables {\n  email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n  // Use selectors for reactive state values\n  const isLoading = useAuthStore((state) => state.isLoading);\n  const error = useAuthStore((state) => state.error);\n  const errorCode = useAuthStore((state) => state.errorCode);\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const user = useAuthStore((state) => state.user);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n  // Track whether signIn just completed — skip the CurrentUser refetch\n  // because signIn already returns the full user object.\n  const loginJustCompletedRef = useRef(false);\n\n  const context = useAuth();\n  const eventBus = useEventBus();\n  const apolloClient = useApolloClient();\n  const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n    SignInDocument,\n  );\n  const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n    SignUpDocument,\n  );\n  const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n  const [refreshTokenMutation] = useMutation<\n    RefreshTokenResponse,\n    RefreshTokenVariables\n  >(RefreshTokenDocument);\n  const [verifyEmailMutation] = useMutation<\n    VerifyEmailResponse,\n    VerifyEmailVariables\n  >(VerifyEmailDocument);\n  const [resendVerificationMutation] = useMutation<\n    ResendVerificationEmailResponse,\n    ResendVerificationEmailVariables\n  >(ResendVerificationEmailDocument);\n\n  /**\n   * Sign in with email/username and password\n   * Uses signIn mutation which returns correct token format (with 'sub' field)\n   */\n  const signIn = async (input: SignInInput): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // rememberMe is sent to the backend so the server can issue\n      // longer-lived refresh tokens (30 days instead of 7 days)\n\n      // Use signIn mutation (returns correct token format with 'sub' field)\n      const result = await signInMutation({\n        variables: { input },\n        // Override client-level errorPolicy to ensure errors are thrown\n        // and caught by our catch block for proper error message extraction\n        errorPolicy: \"none\",\n      });\n\n      // If we reach here, the mutation succeeded (no errors thrown)\n      // Check if data.signIn is present\n      if (!result.data || !result.data.signIn) {\n        const errorMessage =\n          \"Sign in failed. Please check your credentials and try again.\";\n        store.setError(errorMessage);\n        return {\n          success: false,\n          error: errorMessage,\n        } as AuthResult;\n      }\n\n      const data = result.data;\n\n      const authResult = data.signIn;\n\n      // Check if MFA is required\n      if (authResult.requiresMFA && authResult.mfaChallengeId) {\n        store.setMfaRequired(true, authResult.mfaChallengeId);\n\n        // Return success but with requiresMFA flag\n        return {\n          success: true,\n          requiresMFA: true,\n          mfaChallengeId: authResult.mfaChallengeId,\n          metadata: {\n            mfaMethod: authResult.mfaMethod,\n          },\n        } as AuthResult;\n      }\n\n      // Normal login without MFA - store the authentication result\n      if (\n        authResult.user &&\n        authResult.accessToken &&\n        authResult.refreshToken\n      ) {\n        // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n        loginJustCompletedRef.current = true;\n        store.setUser(authResult.user);\n        store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        const expiresAt = authResult.expiresIn\n          ? Date.now() + authResult.expiresIn * 1000\n          : undefined;\n        loginProfile(toProfileUser(authResult.user), {\n          accessToken: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresAt,\n        });\n        setShellSsoCookie(authResult.user.id);\n\n        eventBus.emit(\n          \"auth.signed_in\",\n          {\n            userId: authResult.user.id,\n            tenantId: authResult.user.tenantId,\n            workspaceId: authResult.user.defaultWorkspaceId,\n            mfaEnabled: authResult.user.mfaEnabled,\n            emailVerified: authResult.user.emailVerified,\n          },\n          { component: \"useAuthOperations\" },\n        );\n\n        context.onAuthSuccess?.(\n          authResult.user,\n          authResult.accessToken,\n          authResult.refreshToken,\n        );\n\n        // Convert AuthPayload to AuthResult for consistent return type\n        return {\n          success: true,\n          user: authResult.user,\n          token: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresIn: authResult.expiresIn,\n          requiresMFA: false,\n        } as AuthResult;\n      } else {\n        const errorMsg = \"Login failed: Invalid response from server\";\n        store.setError(errorMsg);\n        return {\n          success: false,\n          error: errorMsg,\n        } as AuthResult;\n      }\n    } catch (err: unknown) {\n      // Extract error message and code from GraphQL error responses.\n      // The backend sends user-friendly messages in gqlError.message and\n      // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n      // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n      // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n      // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n      // internal details that should not be shown to users.\n      let message = \"Sign in failed\";\n      let errorCode: string | null = null;\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        // Apollo v4 CombinedGraphQLErrors\n        // Apollo v3 ApolloError — use message only, never originalError\n        const gqlError = graphQLErrors[0];\n        message = gqlError.message || message;\n        errorCode = getGraphQLErrorCode(gqlError);\n      } else {\n        message = getUnknownErrorMessage(err) ?? message;\n      }\n\n      console.error(\n        \"[SignIn] Error:\",\n        message,\n        errorCode ? `(${errorCode})` : \"\",\n      );\n      store.setError(message, errorCode);\n      return {\n        success: false,\n        error: message,\n      } as AuthResult;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign up new user\n   */\n  const signUp = async (input: SignUpInput) => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const mutationResult = await signUpMutation({\n        variables: { input },\n      });\n\n      // With errorPolicy: 'all', errors are returned in result, not thrown\n      // Check for GraphQL errors first\n      const graphQLErrors = getGraphQLErrors(mutationResult);\n      if (graphQLErrors.length > 0) {\n        const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n        console.error(\"[SignUp] GraphQL error:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      // Check if data.signUp is null (indicates GraphQL error without explicit error)\n      if (!mutationResult.data || !mutationResult.data.signUp) {\n        const errorMessage = \"Sign up failed: No response from server\";\n        console.error(\"[SignUp] No data:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      const result = mutationResult.data.signUp;\n\n      // Check if user was created\n      if (!result.user) {\n        throw new Error(\"Sign up failed: No user data returned\");\n      }\n\n      // Check if email verification is required (empty tokens)\n      if (\n        !result.accessToken ||\n        !result.refreshToken ||\n        result.accessToken === \"\" ||\n        result.refreshToken === \"\"\n      ) {\n        // User created successfully but needs to verify email\n        // Don't set authenticated state, but store the user for display\n        store.setUser(result.user);\n        store.setAuthenticated(false);\n\n        // Return special result indicating email verification needed\n        return {\n          ...result,\n          requiresEmailVerification: true,\n        };\n      }\n\n      // Normal sign up with immediate access (tokens provided)\n      store.setUser(result.user);\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setAuthenticated(true);\n\n      eventBus.emit(\n        \"auth.signed_up\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      context.onAuthSuccess?.(\n        result.user,\n        result.accessToken,\n        result.refreshToken,\n      );\n\n      return result;\n    } catch (err: unknown) {\n      // Extract error message from Apollo error or regular error\n      let message = \"Sign up failed. Please try again.\";\n      let errorCode: string | undefined;\n\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        const gqlError = graphQLErrors[0];\n        errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n        const rawMessage = gqlError.message ?? \"\";\n\n        // Map backend error codes to user-friendly messages\n        message = mapSignUpError(rawMessage, errorCode);\n      } else {\n        const rawMessage = getUnknownErrorMessage(err);\n        if (rawMessage) {\n          message = mapSignUpError(rawMessage);\n        }\n      }\n\n      store.setError(message, errorCode ?? null);\n      throw new Error(message);\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign out current session\n   */\n  const signOut = async () => {\n    const store = useAuthStore.getState();\n    const signedOutUser = store.user;\n\n    try {\n      await signOutMutation();\n    } catch (err) {\n      console.error(\"Sign out failed:\", err);\n    }\n\n    // Always clear Apollo cache so stale user data doesn't survive re-login\n    await apolloClient.clearStore();\n    store.clearAuth();\n    eventBus.emit(\n      \"auth.signed_out\",\n      {\n        userId: signedOutUser?.id,\n        tenantId: signedOutUser?.tenantId,\n        workspaceId: signedOutUser?.defaultWorkspaceId,\n      },\n      { component: \"useAuthOperations\" },\n    );\n\n    // If other profiles exist after clearing the current one, switch to the first\n    // remaining profile instead of fully logging out.\n    const remainingProfiles = getProfiles().filter(\n      (p) => p.id !== signedOutUser?.id,\n    );\n    if (remainingProfiles.length > 0) {\n      const nextProfile = remainingProfiles[0];\n      const nextTokens = getProfileTokens(nextProfile.id);\n      const nextUser = getProfileUser(nextProfile.id);\n      if (nextTokens?.accessToken && nextUser) {\n        // Switch to next profile instead of fully logging out\n        store.loadFromProfile(nextProfile.id);\n        return;\n      }\n    }\n\n    context.onLogout?.();\n  };\n\n  /**\n   * Refresh access token\n   */\n  const refreshToken = async () => {\n    const store = useAuthStore.getState();\n\n    try {\n      const token = store.refreshToken;\n      if (!token) throw new Error(\"No refresh token available\");\n\n      const { data } = await refreshTokenMutation({\n        variables: { token },\n      });\n\n      const result = data!.refreshToken;\n\n      // Refresh token should always return valid tokens and user\n      if (!result.accessToken || !result.refreshToken || !result.user) {\n        throw new Error(\"Token refresh failed: Invalid response from server\");\n      }\n\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setUser(result.user);\n\n      eventBus.emit(\n        \"auth.token_refreshed\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      return result;\n    } catch (err) {\n      // Refresh failed, logout user\n      eventBus.emit(\n        \"auth.token_refresh_failed\",\n        {\n          userId: store.user?.id,\n          tenantId: store.user?.tenantId,\n          workspaceId: store.user?.defaultWorkspaceId,\n          reason: err instanceof Error ? err.message : \"Token refresh failed\",\n        },\n        { component: \"useAuthOperations\" },\n      );\n      store.clearAuth();\n      throw err;\n    }\n  };\n\n  /**\n   * Get current user.\n   * Skip when:\n   *  - Not authenticated\n   *  - Login just completed (user data is already fresh from signIn response)\n   *\n   * The loginJustCompletedRef is cleared after the first successful fetch\n   * or on the next render cycle after navigation.\n   */\n  const { data: currentUserData, refetch: refetchCurrentUser } =\n    useQuery<CurrentUserResponse>(CurrentUserDocument, {\n      skip:\n        disableCurrentUserQuery ||\n        !isAuthenticated ||\n        loginJustCompletedRef.current,\n      fetchPolicy: \"network-only\",\n    });\n\n  // Handle currentUser data updates (replaces onCompleted callback)\n  useEffect(() => {\n    if (currentUserData?.currentUser) {\n      useAuthStore.getState().setUser(currentUserData.currentUser);\n    }\n  }, [currentUserData]);\n\n  // Clear loginJustCompletedRef after navigation away from login page\n  // so subsequent CurrentUser queries work normally (e.g., profile page).\n  useEffect(() => {\n    if (loginJustCompletedRef.current && isAuthenticated) {\n      const timer = setTimeout(() => {\n        loginJustCompletedRef.current = false;\n      }, 2000);\n      return () => clearTimeout(timer);\n    }\n  }, [isAuthenticated]);\n\n  /**\n   * Verify email with token\n   * Returns { success, message, email } on success\n   */\n  const verifyEmail = async (\n    token: string,\n  ): Promise<{ success: boolean; message: string; email?: string }> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      const { data } = await verifyEmailMutation({ variables: { token } });\n\n      if (data!.verifyEmail.success && store.user) {\n        store.setUser({ ...store.user, emailVerified: true });\n      }\n\n      return data!.verifyEmail;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Email verification failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Resend verification email\n   */\n  const resendVerification = async (email: string) => {\n    try {\n      const { data } = await resendVerificationMutation({\n        variables: { email },\n      });\n      return data!.resendVerificationEmail;\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      throw err;\n    }\n  };\n\n  // Legacy aliases for backwards compatibility\n  const login = signIn;\n  const register = signUp;\n  const logout = signOut;\n\n  return {\n    // New API\n    signIn,\n    signUp,\n    signOut,\n    refreshToken,\n    verifyEmail,\n    resendVerification,\n    refetchCurrentUser,\n    // Legacy aliases\n    login,\n    register,\n    logout,\n    // State (reactive via selectors)\n    isLoading,\n    error,\n    errorCode,\n    isAuthenticated,\n    user,\n    accessToken,\n  };\n}\n"],"mappings":";;;;;;;;AAqCA,SAASA,EAAe,GAAoB,GAA4B;CAiDtE,OA9CIC,MAAc,wBACT,oGAELA,MAAc,oBACT,wFAELA,MAAc,sBACT,uDAKPC,EAAW,SAAS,kCAAkC,KACtDD,MAAc,mBAEP,oGAGLA,MAAc,2BACT,sHAKPC,EAAW,SAAS,iBAAiB,KACrCA,EAAW,SAAS,cAAc,KAClCA,EAAW,SAAS,aAAa,IAE1B,qFAILA,EAAW,SAAS,MAAM,KAAKA,EAAW,SAAS,cAAc,IAC5D,qEAILD,MAAc,0BACT,wEAILC,KAAcA,MAAe,mBACxBA,IAGF;AACT;AAEA,SAASC,EAAkB,GAAsB;CAC/C,IAAI;EAEF,IAAMC,IADW,OAAO,SAAS,SACT,SAAS,sBAAsB,IACnD,yBACA,KAAA,GACEC,IAAaD,IAAS,YAAYA,MAAW,IAC7CE,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClEC,IAAW,KAAK,UAAU;GAC9B,IAAIC;GACJ,QAAQ,OAAO,SAAS;EAC1B,CAAC;EAED,AADA,SAAS,SAAS,UAAU,mBAAmBD,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmBC,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW;CACnH,QAAQ,CAER;AACF;AAEA,SAASG,EAAc,GAAyB;CAC9C,OAAO,EAAE,GAAGC,EAAK;AACnB;AAOA,SAASC,EAAS,GAAkD;CAClE,OAAO,OAAOC,KAAU,cAAYA;AACtC;AAEA,SAASC,EAAoB,GAAoC;CAE/D,OADK,MAAM,QAAQD,CAAK,IACjBA,EAAM,QAAQ,MAAmCD,EAASG,CAAI,CAAC,IADpC,CAAC;AAErC;AAEA,SAASC,EAAiB,GAAoC;CAC5D,IAAI,CAACJ,EAASK,CAAK,GAAG,OAAO,CAAC;CAC9B,IAAMC,IAAeJ,EAAoBG,EAAM,MAAM;CAErD,OADIC,EAAa,SAAS,IAAUA,IAC7BJ,EAAoBG,EAAM,aAAa;AAChD;AAEA,SAASE,EAAuB,GAAoC;CAElE,IADIF,aAAiB,SACjBL,EAASK,CAAK,KAAK,OAAOA,EAAM,WAAY,UAC9C,OAAOA,EAAM;AAGjB;AAEA,SAASG,EACP,GACe;CACf,IAAMC,IAAOJ,GAAO,YAAY;CAChC,OAAO,OAAOI,KAAS,WAAWA,IAAO;AAC3C;AAwEA,SAAgBC,EAAkB,IAAoC,CAAC,GAAG;CAExE,IAAMC,IAAYC,GAAc,MAAUC,EAAM,SAAS,GACnDR,IAAQO,GAAc,MAAUC,EAAM,KAAK,GAC3CvB,IAAYsB,GAAc,MAAUC,EAAM,SAAS,GACnDC,IAAkBF,GAAc,MAAUC,EAAM,eAAe,GAC/Dd,IAAOa,GAAc,MAAUC,EAAM,IAAI,GACzCE,IAAcH,GAAc,MAAUC,EAAM,WAAW,GACvDG,IAA0BC,EAAQ,2BAA2B,IAI7DC,IAAwBC,EAAO,EAAK,GAEpCC,IAAUC,EAAQ,GAClBC,IAAWC,EAAY,GACvBC,IAAeC,EAAgB,GAC/B,CAACC,KAAkBC,EACvBC,CACF,GACM,CAACC,KAAkBF,EACvBG,CACF,GACM,CAACC,KAAmBJ,EAA6BK,CAAe,GAChE,CAACC,KAAwBN,EAG7BO,CAAoB,GAChB,CAACC,KAAuBR,EAG5BS,CAAmB,GACf,CAACC,KAA8BV,EAGnCW,CAA+B,GAM3BC,IAAS,OAAO,MAA4C;EAChE,IAAMC,IAAQ5B,EAAa,SAAS;EAEpC,IAAI;GAEF,AADA4B,EAAM,WAAW,EAAI,GACrBA,EAAM,SAAS,IAAI;GAMnB,IAAMC,IAAS,MAAMf,EAAe;IAClC,WAAW,EAAE,SAAM;IAGnB,aAAa;GACf,CAAC;GAID,IAAI,CAACe,EAAO,QAAQ,CAACA,EAAO,KAAK,QAAQ;IACvC,IAAMC,IACJ;IAEF,OADAF,EAAM,SAASE,CAAY,GACpB;KACL,SAAS;KACT,OAAOA;IACT;GACF;GAIA,IAAMC,IAFOF,EAAO,KAEI;GAGxB,IAAIE,EAAW,eAAeA,EAAW,gBAIvC,OAHAH,EAAM,eAAe,IAAMG,EAAW,cAAc,GAG7C;IACL,SAAS;IACT,aAAa;IACb,gBAAgBA,EAAW;IAC3B,UAAU,EACR,WAAWA,EAAW,UACxB;GACF;GAIF,IACEA,EAAW,QACXA,EAAW,eACXA,EAAW,cACX;IAMA,AAJA,EAAsB,UAAU,IAChCH,EAAM,QAAQG,EAAW,IAAI,GAC7BH,EAAM,cAAcG,EAAW,aAAaA,EAAW,YAAY,GACnEH,EAAM,iBAAiB,EAAI,GAC3BA,EAAM,eAAe,EAAK;IAE1B,IAAMI,IAAYD,EAAW,YACzB,KAAK,IAAI,IAAIA,EAAW,YAAY,MACpC,KAAA;IA2BJ,OA1BAE,EAAa/C,EAAc6C,EAAW,IAAI,GAAG;KAC3C,aAAaA,EAAW;KACxB,cAAcA,EAAW;KACzB;IACF,CAAC,GACDnD,EAAkBmD,EAAW,KAAK,EAAE,GAEpCrB,EAAS,KACP,kBACA;KACE,QAAQqB,EAAW,KAAK;KACxB,UAAUA,EAAW,KAAK;KAC1B,aAAaA,EAAW,KAAK;KAC7B,YAAYA,EAAW,KAAK;KAC5B,eAAeA,EAAW,KAAK;IACjC,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEAvB,EAAQ,gBACNuB,EAAW,MACXA,EAAW,aACXA,EAAW,YACb,GAGO;KACL,SAAS;KACT,MAAMA,EAAW;KACjB,OAAOA,EAAW;KAClB,cAAcA,EAAW;KACzB,WAAWA,EAAW;KACtB,aAAa;IACf;GACF;GAAO;IACL,IAAMG,IAAW;IAEjB,OADAN,EAAM,SAASM,CAAQ,GAChB;KACL,SAAS;KACT,OAAOA;IACT;GACF;EACF,SAASC,GAAc;GAQrB,IAAIC,IAAU,kBACV1D,IAA2B,MACzB2D,IAAgB7C,EAAiB2C,CAAG;GAC1C,IAAIE,EAAc,SAAS,GAAG;IAG5B,IAAMC,IAAWD,EAAc;IAE/B,AADA,IAAUC,EAAS,WAAWF,GAC9B,IAAYxC,EAAoB0C,CAAQ;GAC1C,OACE,IAAU3C,EAAuBwC,CAAG,KAAKC;GAS3C,OANA,QAAQ,MACN,mBACAA,GACA1D,IAAY,IAAIA,EAAU,KAAK,EACjC,GACAkD,EAAM,SAASQ,GAAS1D,CAAS,GAC1B;IACL,SAAS;IACT,OAAO0D;GACT;EACF,UAAU;GACR,EAAM,WAAW,EAAK;EACxB;CACF,GAKMG,IAAS,OAAO,MAAuB;EAC3C,IAAMX,IAAQ5B,EAAa,SAAS;EAEpC,IAAI;GAEF,AADA4B,EAAM,WAAW,EAAI,GACrBA,EAAM,SAAS,IAAI;GAEnB,IAAMY,IAAiB,MAAMvB,EAAe,EAC1C,WAAW,EAAE,SAAM,EACrB,CAAC,GAIKoB,IAAgB7C,EAAiBgD,CAAc;GACrD,IAAIH,EAAc,SAAS,GAAG;IAC5B,IAAMP,IAAeO,EAAc,EAAE,CAAC,WAAW;IAGjD,MAFA,QAAQ,MAAM,2BAA2BP,CAAY,GACrDF,EAAM,SAASE,CAAY,GACjB,MAAMA,CAAY;GAC9B;GAGA,IAAI,CAACU,EAAe,QAAQ,CAACA,EAAe,KAAK,QAAQ;IACvD,IAAMV,IAAe;IAGrB,MAFA,QAAQ,MAAM,qBAAqBA,CAAY,GAC/CF,EAAM,SAASE,CAAY,GACjB,MAAMA,CAAY;GAC9B;GAEA,IAAMD,IAASW,EAAe,KAAK;GAGnC,IAAI,CAACX,EAAO,MACV,MAAU,MAAM,uCAAuC;GA6CzD,OAxCE,CAACA,EAAO,eACR,CAACA,EAAO,gBACRA,EAAO,gBAAgB,MACvBA,EAAO,iBAAiB,MAIxBD,EAAM,QAAQC,EAAO,IAAI,GACzBD,EAAM,iBAAiB,EAAK,GAGrB;IACL,GAAGC;IACH,2BAA2B;GAC7B,MAIFD,EAAM,QAAQC,EAAO,IAAI,GACzBD,EAAM,cAAcC,EAAO,aAAaA,EAAO,YAAY,GAC3DD,EAAM,iBAAiB,EAAI,GAE3BlB,EAAS,KACP,kBACA;IACE,QAAQmB,EAAO,KAAK;IACpB,UAAUA,EAAO,KAAK;IACtB,aAAaA,EAAO,KAAK;IACzB,YAAYA,EAAO,KAAK;IACxB,eAAeA,EAAO,KAAK;GAC7B,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEArB,EAAQ,gBACNqB,EAAO,MACPA,EAAO,aACPA,EAAO,YACT,GAEOA;EACT,SAASM,GAAc;GAErB,IAAIC,IAAU,qCACV1D,GAEE2D,IAAgB7C,EAAiB2C,CAAG;GAC1C,IAAIE,EAAc,SAAS,GAAG;IAC5B,IAAMC,IAAWD,EAAc;IAK/B,AAJA,IAAYzC,EAAoB0C,CAAQ,KAAK,KAAA,GAI7C,IAAU7D,EAHS6D,EAAS,WAAW,IAGF5D,CAAS;GAChD,OAAO;IACL,IAAMC,IAAagB,EAAuBwC,CAAG;IAC7C,AAAIxD,MACF,IAAUF,EAAeE,CAAU;GAEvC;GAGA,MADAiD,EAAM,SAASQ,GAAS1D,KAAa,IAAI,GAC/B,MAAM0D,CAAO;EACzB,UAAU;GACR,EAAM,WAAW,EAAK;EACxB;CACF,GAKMK,IAAU,YAAY;EAC1B,IAAMb,IAAQ5B,EAAa,SAAS,GAC9B0C,IAAgBd,EAAM;EAE5B,IAAI;GACF,MAAMT,EAAgB;EACxB,SAASgB,GAAK;GACZ,QAAQ,MAAM,oBAAoBA,CAAG;EACvC;EAKA,AAFA,MAAMvB,EAAa,WAAW,GAC9BgB,EAAM,UAAU,GAChBlB,EAAS,KACP,mBACA;GACE,QAAQgC,GAAe;GACvB,UAAUA,GAAe;GACzB,aAAaA,GAAe;EAC9B,GACA,EAAE,WAAW,oBAAoB,CACnC;EAIA,IAAMC,IAAoBC,EAAY,CAAC,CAAC,QACrC,MAAMC,EAAE,OAAOH,GAAe,EACjC;EACA,IAAIC,EAAkB,SAAS,GAAG;GAChC,IAAMG,IAAcH,EAAkB,IAChCI,IAAaC,EAAiBF,EAAY,EAAE,GAC5CG,IAAWC,EAAeJ,EAAY,EAAE;GAC9C,IAAIC,GAAY,eAAeE,GAAU;IAEvC,EAAM,gBAAgBH,EAAY,EAAE;IACpC;GACF;EACF;EAEA,EAAQ,WAAW;CACrB,GAKMK,IAAe,YAAY;EAC/B,IAAMvB,IAAQ5B,EAAa,SAAS;EAEpC,IAAI;GACF,IAAMoD,IAAQxB,EAAM;GACpB,IAAI,CAACwB,GAAO,MAAU,MAAM,4BAA4B;GAExD,IAAM,EAAE,YAAS,MAAM/B,EAAqB,EAC1C,WAAW,EAAE,SAAM,EACrB,CAAC,GAEKQ,IAASwB,EAAM;GAGrB,IAAI,CAACxB,EAAO,eAAe,CAACA,EAAO,gBAAgB,CAACA,EAAO,MACzD,MAAU,MAAM,oDAAoD;GAkBtE,OAfAD,EAAM,cAAcC,EAAO,aAAaA,EAAO,YAAY,GAC3DD,EAAM,QAAQC,EAAO,IAAI,GAEzBnB,EAAS,KACP,wBACA;IACE,QAAQmB,EAAO,KAAK;IACpB,UAAUA,EAAO,KAAK;IACtB,aAAaA,EAAO,KAAK;IACzB,YAAYA,EAAO,KAAK;IACxB,eAAeA,EAAO,KAAK;GAC7B,GACA,EAAE,WAAW,oBAAoB,CACnC,GAEOA;EACT,SAASM,GAAK;GAaZ,MAXAzB,EAAS,KACP,6BACA;IACE,QAAQkB,EAAM,MAAM;IACpB,UAAUA,EAAM,MAAM;IACtB,aAAaA,EAAM,MAAM;IACzB,QAAQO,aAAe,QAAQA,EAAI,UAAU;GAC/C,GACA,EAAE,WAAW,oBAAoB,CACnC,GACAP,EAAM,UAAU,GACVO;EACR;CACF,GAWM,EAAE,MAAMmB,GAAiB,SAASC,MACtCC,EAA8BC,GAAqB;EACjD,MACErD,KACA,CAACF,KACDI,EAAsB;EACxB,aAAa;CACf,CAAC;CAoEH,OAjEAoD,QAAgB;EACd,AAAIJ,GAAiB,eACnBtD,EAAa,SAAS,CAAC,CAAC,QAAQsD,EAAgB,WAAW;CAE/D,GAAG,CAACA,CAAe,CAAC,GAIpBI,QAAgB;EACd,IAAIpD,EAAsB,WAAWJ,GAAiB;GACpD,IAAMyD,IAAQ,iBAAiB;IAC7B,EAAsB,UAAU;GAClC,GAAG,GAAI;GACP,aAAa,aAAaA,CAAK;EACjC;CACF,GAAG,CAACzD,CAAe,CAAC,GAkDb;EAEL;EACA;EACA;EACA;EACA,oBAjDA,MACmE;GACnE,IAAM0B,IAAQ5B,EAAa,SAAS;GAEpC,IAAI;IACF,EAAM,WAAW,EAAI;IACrB,IAAM,EAAE,YAAS,MAAMuB,EAAoB,EAAE,WAAW,EAAE,SAAM,EAAE,CAAC;IAMnE,OAJI8B,EAAM,YAAY,WAAWzB,EAAM,QACrCA,EAAM,QAAQ;KAAE,GAAGA,EAAM;KAAM,eAAe;IAAK,CAAC,GAG/CyB,EAAM;GACf,SAASlB,GAAK;IACZ,IAAMC,IACJD,aAAe,QAAQA,EAAI,UAAU;IAEvC,MADAP,EAAM,SAASQ,CAAO,GAChBD;GACR,UAAU;IACR,EAAM,WAAW,EAAK;GACxB;EACF;EA6BE,2BAxBgC,MAAkB;GAClD,IAAI;IACF,IAAM,EAAE,YAAS,MAAMV,EAA2B,EAChD,WAAW,EAAE,SAAM,EACrB,CAAC;IACD,OAAO4B,EAAM;GACf,SAASlB,GAAK;IAEZ,MADA,QAAQ,MAAM,wCAAwCA,CAAG,GACnDA;GACR;EACF;EAeE;EAEA,OAAAR;EACA,UAAAY;EACA,QAAAE;EAEA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/auth/hooks/useAuthPermissions.js

@@ -1,6 +1,6 @@
 import { AUTH_PERMISSIONS as e } from "../constants/permissions.js";
 import { usePermissions as t } from "@burdenoff/fe-libs/shared/providers/shell";
-//#region src/auth/hooks/useAuthPermissions.ts
+// src/auth/hooks/useAuthPermissions.ts
 function n() {
 	let { hasPermission: n, isLoading: r } = t();
 	return {
@@ -16,7 +16,6 @@ function n() {
 		isLoading: r
 	};
 }
-//#endregion
 export { n as useAuthPermissions };
 
 //# sourceMappingURL=useAuthPermissions.js.map

package/dist/auth/hooks/useAuthPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthPermissions.js","names":[],"sources":["../../../src/auth/hooks/useAuthPermissions.ts"],"sourcesContent":["import { usePermissions } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { AUTH_PERMISSIONS } from \"../constants/permissions\";\n\n/**\n * Hook for auth admin RBAC permissions.\n *\n * Only covers admin-facing operations. Public auth flows and self-service\n * operations don't need RBAC checks — they're either @rbac(public: true)\n * or scoped to the current user's own data.\n */\nexport function useAuthPermissions() {\n  const { hasPermission, isLoading } = usePermissions();\n\n  return {\n    // User management (admin pages)\n    canViewUsers: hasPermission(AUTH_PERMISSIONS.USER_READ),\n    canUpdateUsers: hasPermission(AUTH_PERMISSIONS.USER_UPDATE),\n    canDeleteUsers: hasPermission(AUTH_PERMISSIONS.USER_DELETE),\n\n    // OAuth app management\n    canViewApps: hasPermission(AUTH_PERMISSIONS.APP_READ),\n    canCreateApps: hasPermission(AUTH_PERMISSIONS.APP_CREATE),\n    canUpdateApps: hasPermission(AUTH_PERMISSIONS.APP_UPDATE),\n\n    // SSO/OIDC configuration\n    canManageSsoConfig: hasPermission(AUTH_PERMISSIONS.SSO_CONFIG_MANAGE),\n    canManageOidcConfig: hasPermission(AUTH_PERMISSIONS.OIDC_CONFIG_MANAGE),\n\n    // Auth method configuration\n    canManageAuthMethods: hasPermission(AUTH_PERMISSIONS.AUTH_METHOD_UPDATE),\n\n    isLoading,\n  };\n}\n"],"mappings":";;;AAUA,SAAgB,IAAqB;CACnC,IAAM,EAAE,kBAAe,iBAAc,EAAe;CAEpD,OAAO;EAEL,cAAc,EAAc,EAAiB,SAAS;EACtD,gBAAgB,EAAc,EAAiB,WAAW;EAC1D,gBAAgB,EAAc,EAAiB,WAAW;EAG1D,aAAa,EAAc,EAAiB,QAAQ;EACpD,eAAe,EAAc,EAAiB,UAAU;EACxD,eAAe,EAAc,EAAiB,UAAU;EAGxD,oBAAoB,EAAc,EAAiB,iBAAiB;EACpE,qBAAqB,EAAc,EAAiB,kBAAkB;EAGtE,sBAAsB,EAAc,EAAiB,kBAAkB;EAEvE;CACF;AACF"}
+{"version":3,"file":"useAuthPermissions.js","names":["useAuthPermissions","usePermissions","hasPermission","AUTH_PERMISSIONS"],"sources":["../../../src/auth/hooks/useAuthPermissions.ts"],"sourcesContent":["import { usePermissions } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { AUTH_PERMISSIONS } from \"../constants/permissions\";\n\n/**\n * Hook for auth admin RBAC permissions.\n *\n * Only covers admin-facing operations. Public auth flows and self-service\n * operations don't need RBAC checks — they're either @rbac(public: true)\n * or scoped to the current user's own data.\n */\nexport function useAuthPermissions() {\n  const { hasPermission, isLoading } = usePermissions();\n\n  return {\n    // User management (admin pages)\n    canViewUsers: hasPermission(AUTH_PERMISSIONS.USER_READ),\n    canUpdateUsers: hasPermission(AUTH_PERMISSIONS.USER_UPDATE),\n    canDeleteUsers: hasPermission(AUTH_PERMISSIONS.USER_DELETE),\n\n    // OAuth app management\n    canViewApps: hasPermission(AUTH_PERMISSIONS.APP_READ),\n    canCreateApps: hasPermission(AUTH_PERMISSIONS.APP_CREATE),\n    canUpdateApps: hasPermission(AUTH_PERMISSIONS.APP_UPDATE),\n\n    // SSO/OIDC configuration\n    canManageSsoConfig: hasPermission(AUTH_PERMISSIONS.SSO_CONFIG_MANAGE),\n    canManageOidcConfig: hasPermission(AUTH_PERMISSIONS.OIDC_CONFIG_MANAGE),\n\n    // Auth method configuration\n    canManageAuthMethods: hasPermission(AUTH_PERMISSIONS.AUTH_METHOD_UPDATE),\n\n    isLoading,\n  };\n}\n"],"mappings":";;;AAUA,SAAgBA,IAAqB;CACnC,IAAM,EAAE,kBAAe,iBAAcC,EAAe;CAEpD,OAAO;EAEL,cAAcC,EAAcC,EAAiB,SAAS;EACtD,gBAAgBD,EAAcC,EAAiB,WAAW;EAC1D,gBAAgBD,EAAcC,EAAiB,WAAW;EAG1D,aAAaD,EAAcC,EAAiB,QAAQ;EACpD,eAAeD,EAAcC,EAAiB,UAAU;EACxD,eAAeD,EAAcC,EAAiB,UAAU;EAGxD,oBAAoBD,EAAcC,EAAiB,iBAAiB;EACpE,qBAAqBD,EAAcC,EAAiB,kBAAkB;EAGtE,sBAAsBD,EAAcC,EAAiB,kBAAkB;EAEvE;CACF;AACF"}

package/dist/auth/hooks/useCaptchaV3.js

@@ -1,6 +1,6 @@
 import { isCaptchaEnabled as e, requireRecaptchaSiteKey as t } from "../utils/captchaConfig.js";
 import { useCallback as n, useEffect as r } from "react";
-//#region src/auth/hooks/useCaptchaV3.ts
+// src/auth/hooks/useCaptchaV3.ts
 function i() {
 	return r(() => {
 		e() && import("react-google-recaptcha-v3").catch(() => {
@@ -13,7 +13,6 @@ function i() {
 		console.warn("[captcha-v3] grecaptcha not yet available");
 	}, []) };
 }
-//#endregion
 export { i as useCaptchaV3 };
 
 //# sourceMappingURL=useCaptchaV3.js.map

package/dist/auth/hooks/useCaptchaV3.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCaptchaV3.js","names":[],"sources":["../../../src/auth/hooks/useCaptchaV3.ts"],"sourcesContent":["import { useCallback, useEffect } from \"react\";\nimport {\n  isCaptchaEnabled,\n  requireRecaptchaSiteKey,\n} from \"../utils/captchaConfig\";\n\n/**\n * Hook for reCAPTCHA v3 invisible verification.\n * Returns a no-op when VITE_CAPTCHA_ENABLED is not \"true\".\n *\n * When enabled, dynamically imports `react-google-recaptcha-v3` and uses\n * the `useGoogleReCaptcha` hook from the `GoogleReCaptchaProvider` context.\n * The provider must be mounted above this hook in the component tree\n * (handled by CaptchaProvider in AuthRoot).\n */\nexport function useCaptchaV3() {\n  useEffect(() => {\n    if (!isCaptchaEnabled()) return;\n\n    // Dynamically import react-google-recaptcha-v3 so the provider's global\n    // grecaptcha object is initialized. We don't use the module export\n    // directly — execute() below reads from window.grecaptcha instead.\n    import(\"react-google-recaptcha-v3\").catch(() => {\n      console.warn(\"[captcha-v3] Failed to load react-google-recaptcha-v3\");\n    });\n  }, []);\n\n  const execute = useCallback(\n    async (action: string): Promise<string | undefined> => {\n      if (!isCaptchaEnabled()) {\n        return undefined;\n      }\n\n      const siteKey = requireRecaptchaSiteKey();\n\n      // Use the global grecaptcha object that GoogleReCaptchaProvider sets up\n      const grecaptcha = (window as unknown as Record<string, unknown>)[\n        \"grecaptcha\"\n      ] as\n        | {\n            execute?: (\n              siteKey: string,\n              options: { action: string },\n            ) => Promise<string>;\n          }\n        | undefined;\n\n      if (grecaptcha?.execute) {\n        return grecaptcha.execute(siteKey, { action });\n      }\n\n      console.warn(\"[captcha-v3] grecaptcha not yet available\");\n      return undefined;\n    },\n    [],\n  );\n\n  return { executeRecaptcha: execute };\n}\n"],"mappings":";;;AAeA,SAAgB,IAAe;CA0C7B,OAzCA,QAAgB;EACT,EAAiB,KAKtB,OAAO,6BAA6B,YAAY;GAC9C,QAAQ,KAAK,uDAAuD;EACtE,CAAC;CACH,GAAG,CAAC,CAAC,GAgCE,EAAE,kBA9BO,EACd,OAAO,MAAgD;EACrD,IAAI,CAAC,EAAiB,GACpB;EAGF,IAAM,IAAU,EAAwB,GAGlC,IAAc,OAClB;EAUF,IAAI,GAAY,SACd,OAAO,EAAW,QAAQ,GAAS,EAAE,UAAO,CAAC;EAG/C,QAAQ,KAAK,2CAA2C;CAE1D,GACA,CAAC,CAGwB,EAAQ;AACrC"}
+{"version":3,"file":"useCaptchaV3.js","names":["useCaptchaV3","useEffect","isCaptchaEnabled","useCallback","siteKey","requireRecaptchaSiteKey","grecaptcha","\"grecaptcha\""],"sources":["../../../src/auth/hooks/useCaptchaV3.ts"],"sourcesContent":["import { useCallback, useEffect } from \"react\";\nimport {\n  isCaptchaEnabled,\n  requireRecaptchaSiteKey,\n} from \"../utils/captchaConfig\";\n\n/**\n * Hook for reCAPTCHA v3 invisible verification.\n * Returns a no-op when VITE_CAPTCHA_ENABLED is not \"true\".\n *\n * When enabled, dynamically imports `react-google-recaptcha-v3` and uses\n * the `useGoogleReCaptcha` hook from the `GoogleReCaptchaProvider` context.\n * The provider must be mounted above this hook in the component tree\n * (handled by CaptchaProvider in AuthRoot).\n */\nexport function useCaptchaV3() {\n  useEffect(() => {\n    if (!isCaptchaEnabled()) return;\n\n    // Dynamically import react-google-recaptcha-v3 so the provider's global\n    // grecaptcha object is initialized. We don't use the module export\n    // directly — execute() below reads from window.grecaptcha instead.\n    import(\"react-google-recaptcha-v3\").catch(() => {\n      console.warn(\"[captcha-v3] Failed to load react-google-recaptcha-v3\");\n    });\n  }, []);\n\n  const execute = useCallback(\n    async (action: string): Promise<string | undefined> => {\n      if (!isCaptchaEnabled()) {\n        return undefined;\n      }\n\n      const siteKey = requireRecaptchaSiteKey();\n\n      // Use the global grecaptcha object that GoogleReCaptchaProvider sets up\n      const grecaptcha = (window as unknown as Record<string, unknown>)[\n        \"grecaptcha\"\n      ] as\n        | {\n            execute?: (\n              siteKey: string,\n              options: { action: string },\n            ) => Promise<string>;\n          }\n        | undefined;\n\n      if (grecaptcha?.execute) {\n        return grecaptcha.execute(siteKey, { action });\n      }\n\n      console.warn(\"[captcha-v3] grecaptcha not yet available\");\n      return undefined;\n    },\n    [],\n  );\n\n  return { executeRecaptcha: execute };\n}\n"],"mappings":";;;AAeA,SAAgBA,IAAe;CA0C7B,OAzCAC,QAAgB;EACd,AAAKC,EAAiB,KAKtB,OAAO,4BAA4B,CAAC,YAAY;GAC9C,QAAQ,KAAK,uDAAuD;EACtE,CAAC;CACH,GAAG,CAAC,CAAC,GAgCE,EAAE,kBA9BOC,EACd,OAAO,MAAgD;EACrD,IAAI,CAACD,EAAiB,GACpB;EAGF,IAAME,IAAUC,EAAwB,GAGlCC,IAAc,OAClBC;EAUF,IAAID,GAAY,SACd,OAAOA,EAAW,QAAQF,GAAS,EAAE,UAAO,CAAC;EAG/C,QAAQ,KAAK,2CAA2C;CAE1D,GACA,CAAC,CAGwB,EAAQ;AACrC"}