@burdenoff/microfe-auth 2026.1107.1 → 2026.1107.2

package/dist/auth/components/AuthLayout.js

@@ -62,7 +62,8 @@ function l({ children: t, title: l, subtitle: u, productName: d, tagline: f }) {
 	let p = e(), m = n(), h = d || m.productName || "Burdenoff", g = m.brandInitial || "B", _ = f || m.tagline || "Enterprise platform", { locale: v, setLocale: y } = r();
 	return /* @__PURE__ */ a("div", {
 		className: "min-h-screen flex relative",
-		children: [/* @__PURE__ */ a("div", {
+		children: [/* @__PURE__ */ a("aside", {
+			"aria-label": h,
 			className: "auth-brand-panel hidden overflow-hidden lg:flex lg:w-1/2 relative",
 			children: [/* @__PURE__ */ a("div", {
 				className: "absolute inset-0 overflow-hidden",
@@ -88,7 +89,7 @@ function l({ children: t, title: l, subtitle: u, productName: d, tagline: f }) {
 					/* @__PURE__ */ a("div", {
 						className: "max-w-md",
 						children: [
-							/* @__PURE__ */ i("h1", {
+							/* @__PURE__ */ i("p", {
 								className: "mb-4 text-4xl font-bold leading-tight text-[var(--color-text-primary)]",
 								children: _
 							}),
@@ -210,7 +211,7 @@ function l({ children: t, title: l, subtitle: u, productName: d, tagline: f }) {
 					}),
 					/* @__PURE__ */ a("div", {
 						className: "text-center lg:text-left mb-8",
-						children: [/* @__PURE__ */ i("h2", {
+						children: [/* @__PURE__ */ i("h1", {
 							className: "text-2xl sm:text-3xl font-bold text-[var(--color-text-primary)] mb-2",
 							children: l
 						}), /* @__PURE__ */ i("p", {

package/dist/auth/components/AuthLayout.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLayout.js","names":["AUTH_LANGUAGES","BrandLogo","failed","setFailed","useState","brandInitial","AuthLayout","tr","useTr","shell","useAppShell","displayName","productName","displayTagline","tagline","useI18n","feature","LanguageSwitcher","locale","language","title","subtitle","children"],"sources":["../../../src/auth/components/AuthLayout.tsx"],"sourcesContent":["import { useState, type ReactNode } from \"react\";\nimport { LanguageSwitcher } from \"@burdenoff/fe-libs/chrome\";\nimport type { Language } from \"@burdenoff/fe-libs/chrome\";\nimport {\n  useI18n,\n  useAppShell,\n} from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport type { Locale } from \"@burdenoff/fe-libs/shared/providers/shell\";\n\ninterface AuthLayoutProps {\n  children: ReactNode;\n  title: string;\n  subtitle: string;\n  productName?: string;\n  tagline?: string;\n}\n\n/**\n * Supported languages for the auth pages.\n *\n * Must stay in sync with the locales actually seeded in\n * `i18n_translations` for the consumer products that mount microfe-auth.\n * If a locale is listed here but NOT seeded, selecting it sets\n * `setLocale(<code>)` on the I18nProvider, the next `exportTranslations`\n * call returns zero rows, every `tr()` falls back to its English default,\n * and the user gets an English UI under a non-English flag.\n *\n * Audited 2026-05-31 against alpha `i18n_translations`: only `en/ta/hi/\n * zh/es/ar` have actual translations (vibecontrols 40k+ rows each).\n * `fr` was previously listed but no product seeds it — selecting it\n * produced a half-translated UI. Removed for parity with the dashboard\n * `LanguageSwitcherSlot` (which is data-driven from `i18n_languages`).\n *\n * Adding a new locale requires updating BOTH:\n *   - this list\n *   - each consumer product's seed (e.g. vibecontrols-app/scripts/\n *     build-i18n-bundle.ts + the new `<code>.ts` translation source).\n */\nconst AUTH_LANGUAGES: Language[] = [\n  { code: \"en\", name: \"English\", nativeName: \"English\", flag: \"🇺🇸\" },\n  { code: \"ta\", name: \"Tamil\", nativeName: \"தமிழ்\", flag: \"🇮🇳\" },\n  { code: \"hi\", name: \"Hindi\", nativeName: \"हिन्दी\", flag: \"🇮🇳\" },\n  { code: \"zh\", name: \"Chinese\", nativeName: \"中文\", flag: \"🇨🇳\" },\n  { code: \"es\", name: \"Spanish\", nativeName: \"Español\", flag: \"🇪🇸\" },\n  { code: \"ar\", name: \"Arabic\", nativeName: \"العربية\", flag: \"🇸🇦\" },\n];\n\n/**\n * Brand logo for the auth pages.\n *\n * Renders the host app shell's real product logo served at `/icons/icon.svg`\n * (the same asset the marketing landing page uses) so the login screen and the\n * landing page show an identical mark instead of a generic placeholder glyph.\n * Host shells that don't ship that asset (e.g. admin-app) fall back to a\n * branded initial badge rather than a broken image.\n */\nfunction BrandLogo({ brandInitial }: { brandInitial: string }) {\n  const [failed, setFailed] = useState(false);\n\n  if (failed) {\n    return (\n      <div className=\"auth-brand-badge flex size-10 items-center justify-center rounded-xl\">\n        <span className=\"text-lg font-bold leading-none text-white\">\n          {brandInitial}\n        </span>\n      </div>\n    );\n  }\n\n  return (\n    <img\n      src=\"/icons/icon.svg\"\n      alt=\"\"\n      aria-hidden=\"true\"\n      className=\"size-10 rounded-xl object-contain\"\n      onError={() => setFailed(true)}\n    />\n  );\n}\n\n/**\n * Professional auth layout with split-screen design\n * Left side: Branding with gradient background\n * Right side: Auth form\n */\nexport function AuthLayout({\n  children,\n  title,\n  subtitle,\n  productName,\n  tagline,\n}: AuthLayoutProps) {\n  const tr = useTr();\n  const shell = useAppShell();\n  const displayName = productName || shell.productName || \"Burdenoff\";\n  const brandInitial = shell.brandInitial || \"B\";\n  const displayTagline = tagline || shell.tagline || \"Enterprise platform\";\n  const { locale, setLocale } = useI18n();\n\n  const handleLanguageChange = (language: Language) => {\n    // AUTH_LANGUAGES intentionally lists locales (e.g. \"ar\") that are seeded\n    // in consumer products but not yet present in the fe-libs Locale union.\n    // The runtime I18nProvider accepts any locale code, so we cast through\n    // unknown to Locale to keep the picker in parity until fe-libs widens the\n    // union. Keep AUTH_LANGUAGES in sync with consumer product seeds.\n    setLocale(language.code as unknown as Locale);\n  };\n\n  return (\n    <div className=\"min-h-screen flex relative\">\n      {/* Left Panel - Branding */}\n      <div className=\"auth-brand-panel hidden overflow-hidden lg:flex lg:w-1/2 relative\">\n        {/* Decorative Elements */}\n        <div className=\"absolute inset-0 overflow-hidden\">\n          <div className=\"absolute -top-40 -left-40 size-80 rounded-full bg-accent-blue/20 blur-3xl\" />\n          <div className=\"absolute top-1/2 -right-20 size-96 rounded-full bg-accent-indigo/20 blur-3xl\" />\n          <div className=\"absolute -bottom-40 left-1/4 size-72 rounded-full bg-accent-purple/20 blur-3xl\" />\n\n          {/* Grid Pattern */}\n          <div\n            className=\"absolute inset-0 opacity-5\"\n            style={{\n              backgroundImage: `url(\"data:image/svg+xml,%3Csvg width='60' height='60' viewBox='0 0 60 60' xmlns='http://www.w3.org/2000/svg'%3E%3Cg fill='none' fill-rule='evenodd'%3E%3Cg fill='%23ffffff' fill-opacity='1'%3E%3Cpath d='M36 34v-4h-2v4h-4v2h4v4h2v-4h4v-2h-4zm0-30V0h-2v4h-4v2h4v4h2V6h4V4h-4zM6 34v-4H4v4H0v2h4v4h2v-4h4v-2H6zM6 4V0H4v4H0v2h4v4h2V6h4V4H6z'/%3E%3C/g%3E%3C/g%3E%3C/svg%3E\")`,\n            }}\n          />\n        </div>\n\n        {/* Content */}\n        <div className=\"relative z-10 flex flex-col justify-between p-12 w-full\">\n          {/* Logo */}\n          <div className=\"flex items-center gap-3\">\n            <BrandLogo brandInitial={brandInitial} />\n            <span className=\"text-xl font-bold text-[var(--color-text-primary)]\">\n              {displayName}\n            </span>\n          </div>\n\n          {/* Main Content */}\n          <div className=\"max-w-md\">\n            <h1 className=\"mb-4 text-4xl font-bold leading-tight text-[var(--color-text-primary)]\">\n              {displayTagline}\n            </h1>\n            <p className=\"auth-brand-copy text-lg leading-relaxed\">\n              {tr(\n                \"auth.layout.taglineDescription\",\n                \"Unify your teams, projects, and workflows in one intelligent workspace. Built for scale with enterprise-grade security, real-time collaboration, and seamless integrations across your entire organization.\",\n              )}\n            </p>\n\n            {/* Features */}\n            <div className=\"mt-10 space-y-4\">\n              {[\n                {\n                  icon: \"workspace\",\n                  text: tr(\n                    \"auth.layout.featureWorkspace\",\n                    \"Modular workspace architecture\",\n                  ),\n                },\n                {\n                  icon: \"realtime\",\n                  text: tr(\n                    \"auth.layout.featureRealtime\",\n                    \"Real-time collaboration & sync\",\n                  ),\n                },\n                {\n                  icon: \"security\",\n                  text: tr(\n                    \"auth.layout.featureSecurity\",\n                    \"Enterprise-grade security & SSO\",\n                  ),\n                },\n                {\n                  icon: \"scale\",\n                  text: tr(\n                    \"auth.layout.featureScale\",\n                    \"Unlimited scalability & performance\",\n                  ),\n                },\n              ].map((feature) => (\n                <div key={feature.icon} className=\"flex items-center gap-3\">\n                  <div className=\"auth-highlight-chip flex size-8 items-center justify-center rounded-lg\">\n                    {feature.icon === \"workspace\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M4 5a1 1 0 011-1h14a1 1 0 011 1v2a1 1 0 01-1 1H5a1 1 0 01-1-1V5zM4 13a1 1 0 011-1h6a1 1 0 011 1v6a1 1 0 01-1 1H5a1 1 0 01-1-1v-6zM16 13a1 1 0 011-1h2a1 1 0 011 1v6a1 1 0 01-1 1h-2a1 1 0 01-1-1v-6z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"realtime\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M17 8h2a2 2 0 012 2v6a2 2 0 01-2 2h-2v4l-4-4H9a1.994 1.994 0 01-1.414-.586m0 0L11 14h4a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2v4l.586-.586z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"security\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"scale\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z\"\n                        />\n                      </svg>\n                    )}\n                  </div>\n                  <span className=\"auth-brand-copy text-sm font-medium\">\n                    {feature.text}\n                  </span>\n                </div>\n              ))}\n            </div>\n          </div>\n\n          {/* Footer */}\n          <div className=\"auth-brand-copy-muted text-sm\">\n            © {new Date().getFullYear()} Burdenoff. All rights reserved.\n          </div>\n        </div>\n      </div>\n\n      {/* Right Panel - Form */}\n      <main className=\"auth-shell-gradient relative flex flex-1 items-center justify-center bg-[var(--color-bg-canvas)] p-6 sm:p-12\">\n        {/* Language Switcher - Top Right */}\n        <div className=\"absolute top-4 right-4 sm:top-6 sm:right-6 z-10\">\n          <LanguageSwitcher\n            languages={AUTH_LANGUAGES}\n            currentLanguage={locale}\n            onLanguageChange={handleLanguageChange}\n          />\n        </div>\n        <div className=\"w-full max-w-md\">\n          {/* Mobile Logo */}\n          <div className=\"lg:hidden flex items-center justify-center gap-3 mb-8\">\n            <BrandLogo brandInitial={brandInitial} />\n            <span className=\"text-xl font-bold text-[var(--color-text-primary)]\">\n              {displayName}\n            </span>\n          </div>\n\n          {/* Header */}\n          <div className=\"text-center lg:text-left mb-8\">\n            <h2 className=\"text-2xl sm:text-3xl font-bold text-[var(--color-text-primary)] mb-2\">\n              {title}\n            </h2>\n            <p className=\"text-[var(--color-text-secondary)]\">{subtitle}</p>\n          </div>\n\n          {/* Form Content */}\n          {children}\n        </div>\n      </main>\n    </div>\n  );\n}\n"],"mappings":";;;;;;AAuCA,IAAMA,IAA6B;CACjC;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAW,MAAM;CAAO;CACnE;EAAE,MAAM;EAAM,MAAM;EAAS,YAAY;EAAS,MAAM;CAAO;CAC/D;EAAE,MAAM;EAAM,MAAM;EAAS,YAAY;EAAU,MAAM;CAAO;CAChE;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAM,MAAM;CAAO;CAC9D;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAW,MAAM;CAAO;CACnE;EAAE,MAAM;EAAM,MAAM;EAAU,YAAY;EAAW,MAAM;CAAO;AACpE;AAWA,SAASC,EAAU,EAAE,mBAA0C;CAC7D,IAAM,CAACC,GAAQC,KAAaC,EAAS,EAAK;CAY1C,OAVIF,IAEA,kBAAC,OAAD;EAAK,WAAU;EACb,UAAA,kBAAC,QAAD;GAAM,WAAU;GACb,UAAAG;EACG,CAAA;CACH,CAAA,IAKP,kBAAC,OAAD;EACE,KAAI;EACJ,KAAI;EACJ,eAAY;EACZ,WAAU;EACV,eAAeF,EAAU,EAAI;CAC9B,CAAA;AAEL;AAOA,SAAgBG,EAAW,EACzB,aACA,UACA,aACA,gBACA,cACkB;CAClB,IAAMC,IAAKC,EAAM,GACXC,IAAQC,EAAY,GACpBC,IAAcC,KAAeH,EAAM,eAAe,aAClDJ,IAAeI,EAAM,gBAAgB,KACrCI,IAAiBC,KAAWL,EAAM,WAAW,uBAC7C,EAAE,WAAQ,iBAAcM,EAAQ;CAWtC,OACE,kBAAC,OAAD;EAAK,WAAU;EAAf,UAAA,CAEE,kBAAC,OAAD;GAAK,WAAU;GAAf,UAAA,CAEE,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KACE,kBAAC,OAAD,EAAK,WAAU,4EAA6E,CAAA;KAC5F,kBAAC,OAAD,EAAK,WAAU,+EAAgF,CAAA;KAC/F,kBAAC,OAAD,EAAK,WAAU,iFAAkF,CAAA;KAGjG,kBAAC,OAAD;MACE,WAAU;MACV,OAAO,EACL,iBAAiB,oXACnB;KACD,CAAA;IACE;GAGL,CAAA,GAAA,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KAEE,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAACd,GAAD,EAAyB,gBAAe,CAAA,GACxC,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAU;MACG,CAAA,CACH;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA;OACE,kBAAC,MAAD;QAAI,WAAU;QACX,UAAAE;OACC,CAAA;OACJ,kBAAC,KAAD;QAAG,WAAU;QACV,UAAAN,EACC,kCACA,6MACF;OACC,CAAA;OAGH,kBAAC,OAAD;QAAK,WAAU;QACZ,UAAA;SACC;UACE,MAAM;UACN,MAAMA,EACJ,gCACA,gCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,+BACA,gCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,+BACA,iCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,4BACA,qCACF;SACF;QACF,CAAC,CAAC,KAAK,MACL,kBAAC,OAAD;SAAwB,WAAU;SAAlC,UAAA,CACE,kBAAC,OAAD;UAAK,WAAU;UAAf,UAAA;WACGS,EAAQ,SAAS,eAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,cAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,cAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,WAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;UAEJ;SACL,CAAA,GAAA,kBAAC,QAAD;UAAM,WAAU;UACb,UAAAA,EAAQ;SACL,CAAA,CACH;QAlEK,GAAAA,EAAQ,IAkEb,CACN;OACE,CAAA;MACF;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA;OAA+C;wBAC1C,IAAI,KAAK,EAAA,CAAE,YAAY;OAAE;MACzB;;IACF;GACF,CAAA,CAAA;EAGL,CAAA,GAAA,kBAAC,QAAD;GAAM,WAAU;GAAhB,UAAA,CAEE,kBAAC,OAAD;IAAK,WAAU;IACb,UAAA,kBAACC,GAAD;KACE,WAAWjB;KACX,iBAAiBkB;KACjB,mBAvKoB,MAAuB;MAMnD,EAAUC,EAAS,IAAyB;KAC9C;IAiKS,CAAA;GACE,CAAA,GACL,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KAEE,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAClB,GAAD,EAAyB,gBAAe,CAAA,GACxC,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAU;MACG,CAAA,CACH;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,MAAD;OAAI,WAAU;OACX,UAAAS;MACC,CAAA,GACJ,kBAAC,KAAD;OAAG,WAAU;OAAsC,UAAAC;MAAY,CAAA,CAC5D;;KAGJC;IACE;GACD,CAAA,CAAA;EACH,CAAA,CAAA;;AAET"}
+{"version":3,"file":"AuthLayout.js","names":["AUTH_LANGUAGES","BrandLogo","failed","setFailed","useState","brandInitial","AuthLayout","tr","useTr","shell","useAppShell","displayName","productName","displayTagline","tagline","useI18n","feature","LanguageSwitcher","locale","language","title","subtitle","children"],"sources":["../../../src/auth/components/AuthLayout.tsx"],"sourcesContent":["import { useState, type ReactNode } from \"react\";\nimport { LanguageSwitcher } from \"@burdenoff/fe-libs/chrome\";\nimport type { Language } from \"@burdenoff/fe-libs/chrome\";\nimport {\n  useI18n,\n  useAppShell,\n} from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport type { Locale } from \"@burdenoff/fe-libs/shared/providers/shell\";\n\ninterface AuthLayoutProps {\n  children: ReactNode;\n  title: string;\n  subtitle: string;\n  productName?: string;\n  tagline?: string;\n}\n\n/**\n * Supported languages for the auth pages.\n *\n * Must stay in sync with the locales actually seeded in\n * `i18n_translations` for the consumer products that mount microfe-auth.\n * If a locale is listed here but NOT seeded, selecting it sets\n * `setLocale(<code>)` on the I18nProvider, the next `exportTranslations`\n * call returns zero rows, every `tr()` falls back to its English default,\n * and the user gets an English UI under a non-English flag.\n *\n * Audited 2026-05-31 against alpha `i18n_translations`: only `en/ta/hi/\n * zh/es/ar` have actual translations (vibecontrols 40k+ rows each).\n * `fr` was previously listed but no product seeds it — selecting it\n * produced a half-translated UI. Removed for parity with the dashboard\n * `LanguageSwitcherSlot` (which is data-driven from `i18n_languages`).\n *\n * Adding a new locale requires updating BOTH:\n *   - this list\n *   - each consumer product's seed (e.g. vibecontrols-app/scripts/\n *     build-i18n-bundle.ts + the new `<code>.ts` translation source).\n */\nconst AUTH_LANGUAGES: Language[] = [\n  { code: \"en\", name: \"English\", nativeName: \"English\", flag: \"🇺🇸\" },\n  { code: \"ta\", name: \"Tamil\", nativeName: \"தமிழ்\", flag: \"🇮🇳\" },\n  { code: \"hi\", name: \"Hindi\", nativeName: \"हिन्दी\", flag: \"🇮🇳\" },\n  { code: \"zh\", name: \"Chinese\", nativeName: \"中文\", flag: \"🇨🇳\" },\n  { code: \"es\", name: \"Spanish\", nativeName: \"Español\", flag: \"🇪🇸\" },\n  { code: \"ar\", name: \"Arabic\", nativeName: \"العربية\", flag: \"🇸🇦\" },\n];\n\n/**\n * Brand logo for the auth pages.\n *\n * Renders the host app shell's real product logo served at `/icons/icon.svg`\n * (the same asset the marketing landing page uses) so the login screen and the\n * landing page show an identical mark instead of a generic placeholder glyph.\n * Host shells that don't ship that asset (e.g. admin-app) fall back to a\n * branded initial badge rather than a broken image.\n */\nfunction BrandLogo({ brandInitial }: { brandInitial: string }) {\n  const [failed, setFailed] = useState(false);\n\n  if (failed) {\n    return (\n      <div className=\"auth-brand-badge flex size-10 items-center justify-center rounded-xl\">\n        <span className=\"text-lg font-bold leading-none text-white\">\n          {brandInitial}\n        </span>\n      </div>\n    );\n  }\n\n  return (\n    <img\n      src=\"/icons/icon.svg\"\n      alt=\"\"\n      aria-hidden=\"true\"\n      className=\"size-10 rounded-xl object-contain\"\n      onError={() => setFailed(true)}\n    />\n  );\n}\n\n/**\n * Professional auth layout with split-screen design\n * Left side: Branding with gradient background\n * Right side: Auth form\n */\nexport function AuthLayout({\n  children,\n  title,\n  subtitle,\n  productName,\n  tagline,\n}: AuthLayoutProps) {\n  const tr = useTr();\n  const shell = useAppShell();\n  const displayName = productName || shell.productName || \"Burdenoff\";\n  const brandInitial = shell.brandInitial || \"B\";\n  const displayTagline = tagline || shell.tagline || \"Enterprise platform\";\n  const { locale, setLocale } = useI18n();\n\n  const handleLanguageChange = (language: Language) => {\n    // AUTH_LANGUAGES intentionally lists locales (e.g. \"ar\") that are seeded\n    // in consumer products but not yet present in the fe-libs Locale union.\n    // The runtime I18nProvider accepts any locale code, so we cast through\n    // unknown to Locale to keep the picker in parity until fe-libs widens the\n    // union. Keep AUTH_LANGUAGES in sync with consumer product seeds.\n    setLocale(language.code as unknown as Locale);\n  };\n\n  return (\n    <div className=\"min-h-screen flex relative\">\n      {/* Left Panel - Branding. A complementary landmark, so every piece of\n          content on the auth pages sits inside a landmark (axe `region`) and\n          screen-reader users can skip the marketing copy. */}\n      <aside\n        aria-label={displayName}\n        className=\"auth-brand-panel hidden overflow-hidden lg:flex lg:w-1/2 relative\"\n      >\n        {/* Decorative Elements */}\n        <div className=\"absolute inset-0 overflow-hidden\">\n          <div className=\"absolute -top-40 -left-40 size-80 rounded-full bg-accent-blue/20 blur-3xl\" />\n          <div className=\"absolute top-1/2 -right-20 size-96 rounded-full bg-accent-indigo/20 blur-3xl\" />\n          <div className=\"absolute -bottom-40 left-1/4 size-72 rounded-full bg-accent-purple/20 blur-3xl\" />\n\n          {/* Grid Pattern */}\n          <div\n            className=\"absolute inset-0 opacity-5\"\n            style={{\n              backgroundImage: `url(\"data:image/svg+xml,%3Csvg width='60' height='60' viewBox='0 0 60 60' xmlns='http://www.w3.org/2000/svg'%3E%3Cg fill='none' fill-rule='evenodd'%3E%3Cg fill='%23ffffff' fill-opacity='1'%3E%3Cpath d='M36 34v-4h-2v4h-4v2h4v4h2v-4h4v-2h-4zm0-30V0h-2v4h-4v2h4v4h2V6h4V4h-4zM6 34v-4H4v4H0v2h4v4h2v-4h4v-2H6zM6 4V0H4v4H0v2h4v4h2V6h4V4H6z'/%3E%3C/g%3E%3C/g%3E%3C/svg%3E\")`,\n            }}\n          />\n        </div>\n\n        {/* Content */}\n        <div className=\"relative z-10 flex flex-col justify-between p-12 w-full\">\n          {/* Logo */}\n          <div className=\"flex items-center gap-3\">\n            <BrandLogo brandInitial={brandInitial} />\n            <span className=\"text-xl font-bold text-[var(--color-text-primary)]\">\n              {displayName}\n            </span>\n          </div>\n\n          {/* Main Content */}\n          <div className=\"max-w-md\">\n            {/* Marketing tagline, not a heading: the page's single h1 is the\n                form title in <main>, which is also the only heading visible on\n                phones where this panel is hidden. */}\n            <p className=\"mb-4 text-4xl font-bold leading-tight text-[var(--color-text-primary)]\">\n              {displayTagline}\n            </p>\n            <p className=\"auth-brand-copy text-lg leading-relaxed\">\n              {tr(\n                \"auth.layout.taglineDescription\",\n                \"Unify your teams, projects, and workflows in one intelligent workspace. Built for scale with enterprise-grade security, real-time collaboration, and seamless integrations across your entire organization.\",\n              )}\n            </p>\n\n            {/* Features */}\n            <div className=\"mt-10 space-y-4\">\n              {[\n                {\n                  icon: \"workspace\",\n                  text: tr(\n                    \"auth.layout.featureWorkspace\",\n                    \"Modular workspace architecture\",\n                  ),\n                },\n                {\n                  icon: \"realtime\",\n                  text: tr(\n                    \"auth.layout.featureRealtime\",\n                    \"Real-time collaboration & sync\",\n                  ),\n                },\n                {\n                  icon: \"security\",\n                  text: tr(\n                    \"auth.layout.featureSecurity\",\n                    \"Enterprise-grade security & SSO\",\n                  ),\n                },\n                {\n                  icon: \"scale\",\n                  text: tr(\n                    \"auth.layout.featureScale\",\n                    \"Unlimited scalability & performance\",\n                  ),\n                },\n              ].map((feature) => (\n                <div key={feature.icon} className=\"flex items-center gap-3\">\n                  <div className=\"auth-highlight-chip flex size-8 items-center justify-center rounded-lg\">\n                    {feature.icon === \"workspace\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M4 5a1 1 0 011-1h14a1 1 0 011 1v2a1 1 0 01-1 1H5a1 1 0 01-1-1V5zM4 13a1 1 0 011-1h6a1 1 0 011 1v6a1 1 0 01-1 1H5a1 1 0 01-1-1v-6zM16 13a1 1 0 011-1h2a1 1 0 011 1v6a1 1 0 01-1 1h-2a1 1 0 01-1-1v-6z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"realtime\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M17 8h2a2 2 0 012 2v6a2 2 0 01-2 2h-2v4l-4-4H9a1.994 1.994 0 01-1.414-.586m0 0L11 14h4a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2v4l.586-.586z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"security\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                        />\n                      </svg>\n                    )}\n                    {feature.icon === \"scale\" && (\n                      <svg\n                        className=\"size-4 text-accent-blue\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z\"\n                        />\n                      </svg>\n                    )}\n                  </div>\n                  <span className=\"auth-brand-copy text-sm font-medium\">\n                    {feature.text}\n                  </span>\n                </div>\n              ))}\n            </div>\n          </div>\n\n          {/* Footer */}\n          <div className=\"auth-brand-copy-muted text-sm\">\n            © {new Date().getFullYear()} Burdenoff. All rights reserved.\n          </div>\n        </div>\n      </aside>\n\n      {/* Right Panel - Form */}\n      <main className=\"auth-shell-gradient relative flex flex-1 items-center justify-center bg-[var(--color-bg-canvas)] p-6 sm:p-12\">\n        {/* Language Switcher - Top Right */}\n        <div className=\"absolute top-4 right-4 sm:top-6 sm:right-6 z-10\">\n          <LanguageSwitcher\n            languages={AUTH_LANGUAGES}\n            currentLanguage={locale}\n            onLanguageChange={handleLanguageChange}\n          />\n        </div>\n        <div className=\"w-full max-w-md\">\n          {/* Mobile Logo */}\n          <div className=\"lg:hidden flex items-center justify-center gap-3 mb-8\">\n            <BrandLogo brandInitial={brandInitial} />\n            <span className=\"text-xl font-bold text-[var(--color-text-primary)]\">\n              {displayName}\n            </span>\n          </div>\n\n          {/* Header */}\n          <div className=\"text-center lg:text-left mb-8\">\n            <h1 className=\"text-2xl sm:text-3xl font-bold text-[var(--color-text-primary)] mb-2\">\n              {title}\n            </h1>\n            <p className=\"text-[var(--color-text-secondary)]\">{subtitle}</p>\n          </div>\n\n          {/* Form Content */}\n          {children}\n        </div>\n      </main>\n    </div>\n  );\n}\n"],"mappings":";;;;;;AAuCA,IAAMA,IAA6B;CACjC;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAW,MAAM;CAAO;CACnE;EAAE,MAAM;EAAM,MAAM;EAAS,YAAY;EAAS,MAAM;CAAO;CAC/D;EAAE,MAAM;EAAM,MAAM;EAAS,YAAY;EAAU,MAAM;CAAO;CAChE;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAM,MAAM;CAAO;CAC9D;EAAE,MAAM;EAAM,MAAM;EAAW,YAAY;EAAW,MAAM;CAAO;CACnE;EAAE,MAAM;EAAM,MAAM;EAAU,YAAY;EAAW,MAAM;CAAO;AACpE;AAWA,SAASC,EAAU,EAAE,mBAA0C;CAC7D,IAAM,CAACC,GAAQC,KAAaC,EAAS,EAAK;CAY1C,OAVIF,IAEA,kBAAC,OAAD;EAAK,WAAU;EACb,UAAA,kBAAC,QAAD;GAAM,WAAU;GACb,UAAAG;EACG,CAAA;CACH,CAAA,IAKP,kBAAC,OAAD;EACE,KAAI;EACJ,KAAI;EACJ,eAAY;EACZ,WAAU;EACV,eAAeF,EAAU,EAAI;CAC9B,CAAA;AAEL;AAOA,SAAgBG,EAAW,EACzB,aACA,UACA,aACA,gBACA,cACkB;CAClB,IAAMC,IAAKC,EAAM,GACXC,IAAQC,EAAY,GACpBC,IAAcC,KAAeH,EAAM,eAAe,aAClDJ,IAAeI,EAAM,gBAAgB,KACrCI,IAAiBC,KAAWL,EAAM,WAAW,uBAC7C,EAAE,WAAQ,iBAAcM,EAAQ;CAWtC,OACE,kBAAC,OAAD;EAAK,WAAU;EAAf,UAAA,CAIE,kBAAC,SAAD;GACE,cAAYJ;GACZ,WAAU;GAFZ,UAAA,CAKE,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KACE,kBAAC,OAAD,EAAK,WAAU,4EAA6E,CAAA;KAC5F,kBAAC,OAAD,EAAK,WAAU,+EAAgF,CAAA;KAC/F,kBAAC,OAAD,EAAK,WAAU,iFAAkF,CAAA;KAGjG,kBAAC,OAAD;MACE,WAAU;MACV,OAAO,EACL,iBAAiB,oXACnB;KACD,CAAA;IACE;GAGL,CAAA,GAAA,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KAEE,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAACV,GAAD,EAAyB,gBAAe,CAAA,GACxC,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAU;MACG,CAAA,CACH;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA;OAIE,kBAAC,KAAD;QAAG,WAAU;QACV,UAAAE;OACA,CAAA;OACH,kBAAC,KAAD;QAAG,WAAU;QACV,UAAAN,EACC,kCACA,6MACF;OACC,CAAA;OAGH,kBAAC,OAAD;QAAK,WAAU;QACZ,UAAA;SACC;UACE,MAAM;UACN,MAAMA,EACJ,gCACA,gCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,+BACA,gCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,+BACA,iCACF;SACF;SACA;UACE,MAAM;UACN,MAAMA,EACJ,4BACA,qCACF;SACF;QACF,CAAC,CAAC,KAAK,MACL,kBAAC,OAAD;SAAwB,WAAU;SAAlC,UAAA,CACE,kBAAC,OAAD;UAAK,WAAU;UAAf,UAAA;WACGS,EAAQ,SAAS,eAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,cAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,cAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;WAENA,EAAQ,SAAS,WAChB,kBAAC,OAAD;YACE,WAAU;YACV,MAAK;YACL,SAAQ;YACR,QAAO;YAEP,UAAA,kBAAC,QAAD;aACE,eAAc;aACd,gBAAe;aACf,aAAa;aACb,GAAE;YACH,CAAA;WACE,CAAA;UAEJ;SACL,CAAA,GAAA,kBAAC,QAAD;UAAM,WAAU;UACb,UAAAA,EAAQ;SACL,CAAA,CACH;QAlEK,GAAAA,EAAQ,IAkEb,CACN;OACE,CAAA;MACF;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA;OAA+C;wBAC1C,IAAI,KAAK,EAAA,CAAE,YAAY;OAAE;MACzB;;IACF;GACA,CAAA,CAAA;EAGP,CAAA,GAAA,kBAAC,QAAD;GAAM,WAAU;GAAhB,UAAA,CAEE,kBAAC,OAAD;IAAK,WAAU;IACb,UAAA,kBAACC,GAAD;KACE,WAAWjB;KACX,iBAAiBkB;KACjB,mBA/KoB,MAAuB;MAMnD,EAAUC,EAAS,IAAyB;KAC9C;IAyKS,CAAA;GACE,CAAA,GACL,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA;KAEE,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAClB,GAAD,EAAyB,gBAAe,CAAA,GACxC,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAU;MACG,CAAA,CACH;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,MAAD;OAAI,WAAU;OACX,UAAAS;MACC,CAAA,GACJ,kBAAC,KAAD;OAAG,WAAU;OAAsC,UAAAC;MAAY,CAAA,CAC5D;;KAGJC;IACE;GACD,CAAA,CAAA;EACH,CAAA,CAAA;;AAET"}

package/dist/auth/pages/LoginPage.js

@@ -324,6 +324,7 @@ function S() {
 				className: "space-y-5",
 				children: [
 					tt && /* @__PURE__ */ g("div", {
+						role: "status",
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border",
 						children: [/* @__PURE__ */ h("svg", {
 							className: "size-5 flex-shrink-0 mt-0.5 text-text-link",
@@ -342,6 +343,7 @@ function S() {
 						})]
 					}),
 					q && /* @__PURE__ */ g("div", {
+						role: "alert",
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border",
 						children: [/* @__PURE__ */ h(u, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ h("p", {
 							className: "text-sm text-status-warning-text",
@@ -349,6 +351,7 @@ function S() {
 						})]
 					}),
 					nt && /* @__PURE__ */ g("div", {
+						role: "alert",
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border",
 						children: [/* @__PURE__ */ h(u, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ g("div", {
 							className: "flex-1",
@@ -382,6 +385,7 @@ function S() {
 						})]
 					}),
 					E && !q && !nt && /* @__PURE__ */ g("div", {
+						role: "alert",
 						className: `flex items-start gap-3 p-4 rounded-xl border ${P || R || B ? "bg-status-warning-bg-subtle border-status-warning-border" : "bg-status-error-bg-subtle border-status-error-border"}`,
 						children: [/* @__PURE__ */ h(u, { className: `size-5 flex-shrink-0 mt-0.5 ${P || R || B ? "text-status-warning-text" : "text-status-error-text"}` }), /* @__PURE__ */ g("div", {
 							className: "flex-1",

package/dist/auth/pages/LoginPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"LoginPage.js","names":["_Fragment","isNativeShell","w","toSameOriginPath","target","url","hasValidAccessToken","raw","token","padded","payload","decodeSameOriginReturnTo","returnTo","stripStaleSsoParams","param","options","search","cleanReturnToValue","LoginPage","tr","useTr","navigate","useNavigate","location","useLocation","searchParams","useSearchParams","useAuthOperations","useMyWorkspaces","useActiveContext","navigateHost","useAuth","useOAuthOperations","mfaRequired","useAuthStore","state","executeCaptchaV3","useCaptchaV3","isCompletingAuth","setIsCompletingAuth","useState","isSsoRedirecting","setIsSsoRedirecting","buildPostLoginUrl","useCallback","intendedPath","bridge","resolveAuthBridgeConfig","bridgeUrl","currentOrigin","absoluteIntended","profileId","resolveActiveProfileId","tokens","getProfileTokens","user","getProfileUser","workspaceToken","getProfileWorkspaceToken","depositTokens","resolveGatewayUrls","minted","mintSsoSessionTokens","globalBaseUrl","markSsoDepositPending","buildSsoDepositUrl","getProfiles","redirectInitiatedRef","useRef","redirectAfterLogin","safePath","sanitizePostLoginPath","path","fragmentPath","sameOriginFragmentPath","resolve","beginSsoNavigation","showPassword","setShowPassword","isAccountInactive","setIsAccountInactive","isAccountDeleted","setIsAccountDeleted","isAccountSuspended","setIsAccountSuspended","isOAuthOnlyAccount","setIsOAuthOnlyAccount","isEmailNotVerified","setIsEmailNotVerified","isResendingVerification","setIsResendingVerification","resendSuccess","setResendSuccess","oauthError","setOauthError","infoMessage","setInfoMessage","formData","setFormData","validationError","setValidationError","isDuplicateAccount","setIsDuplicateAccount","isAddAccountMode","initialReturnToRef","reasonParam","useEffect","isSsoNavigationPending","defaultPostLoginPath","ssoUrl","getSSORedirectUrl","rememberedEmail","prev","error","checkErrorType","code","err","lowerErr","emailFromUrl","newUrl","handleSubmit","emailTrimmed","p","recaptchaToken","result","signIn","postMfaPath","MFA_REDIRECT","domain","domainPart","securePart","ssoValue","postLoginPath","authFlowResult","completeAuthFlow","setWorkspace","setOrganization","hostFragmentContinuation","authFlowError","errorMsg","storeErrorCode","errorType","errorCode","handleGoogleLogin","handleMicrosoftLogin","handleResendVerification","resendVerification","isGoogleConfigured","isProviderConfigured","isMicrosoftConfigured","oauthProviders","GoogleIcon","MicrosoftIcon","SSORedirectSpinner","AuthLayout","PagePurpose","AlertIcon","Fragment","SpinnerIcon","EmailIcon","LockIcon","jsx","EyeOffIcon","EyeIcon","Checkbox","isChecked","checked","Button","isLoading","provider","authPathWithReturnTo","sanitizeReturnPath"],"sources":["../../../src/auth/pages/LoginPage.tsx"],"sourcesContent":["import { useState, useEffect, useCallback, useRef } from \"react\";\nimport { useNavigate, useSearchParams, useLocation } from \"react-router\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport {\n  getSSORedirectUrl,\n  SSORedirectSpinner,\n} from \"@burdenoff/fe-libs/shared/components\";\nimport { resolveAuthBridgeConfig } from \"@burdenoff/fe-libs/shared/config\";\nimport { resolveGatewayUrls } from \"@burdenoff/fe-libs/shared/config/gatewayUrls\";\nimport {\n  beginSsoNavigation,\n  buildSsoDepositUrl,\n  isSsoNavigationPending,\n  markSsoDepositPending,\n  mintSsoSessionTokens,\n} from \"@burdenoff/fe-libs/shared/utils\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { Checkbox, PagePurpose } from \"@burdenoff/fe-libs/ui\";\n\nimport {\n  getProfileTokens,\n  getProfileUser,\n  getProfiles,\n  getProfileWorkspaceToken,\n  resolveActiveProfileId,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useMyWorkspaces } from \"../hooks/useMyWorkspaces\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport {\n  hostFragmentContinuation,\n  sameOriginFragmentPath,\n  sanitizePostLoginPath,\n} from \"../utils/redirect\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  // GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useCaptchaV3 } from \"../hooks/useCaptchaV3\";\nimport { MFA_REDIRECT } from \"../constants/sessionKeys\";\nimport type { SignInInput } from \"../types\";\nimport {\n  authPathWithReturnTo,\n  sanitizeReturnPath,\n} from \"../utils/pendingReturnTo\";\n\n/**\n * Detect whether the bundle is running inside a native shell (Capacitor on\n * iOS/Android, or Electron). Cross-origin SSO deposit/relay detours only make\n * sense in a multi-origin web context — in a native shell there is one product\n * origin, tokens already live in localStorage, and `window.location.assign` to\n * an external https URL escapes the embedded webview.\n *\n * Detection is runtime-only and avoids importing any platform-specific module\n * so this stays valid when microfe-auth is consumed by a pure web shell too.\n */\nfunction isNativeShell(): boolean {\n  if (typeof window === \"undefined\") return false;\n  const w = window as typeof window & {\n    Capacitor?: { isNativePlatform?: () => boolean };\n  };\n  if (typeof w.Capacitor?.isNativePlatform === \"function\") {\n    try {\n      if (w.Capacitor.isNativePlatform()) return true;\n    } catch {\n      /* fall through */\n    }\n  }\n  if (\n    typeof navigator !== \"undefined\" &&\n    /Electron/i.test(navigator.userAgent || \"\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\nfunction toSameOriginPath(target: string): string {\n  if (typeof window === \"undefined\") return target;\n  try {\n    const url = new URL(target, window.location.origin);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction hasValidAccessToken(token: string): boolean {\n  try {\n    const raw = token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n    const payload = JSON.parse(atob(padded)) as { exp?: unknown };\n    return typeof payload.exp === \"number\" && payload.exp > Date.now() / 1000;\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeSameOriginReturnTo(returnTo: string | null): string | null {\n  if (!returnTo) return null;\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    if (url.origin !== window.location.origin) return null;\n    return stripStaleSsoParams(url, { includeOrigin: false });\n  } catch {\n    return null;\n  }\n}\n\nfunction stripStaleSsoParams(\n  url: URL,\n  options: { includeOrigin: boolean },\n): string {\n  for (const param of [\"sso_failed\", \"sso-failed\", \"sso-attempted\"] as const) {\n    url.searchParams.delete(param);\n  }\n\n  if (options.includeOrigin) {\n    return url.toString();\n  }\n\n  const search = url.searchParams.toString();\n  return `${url.pathname}${search ? `?${search}` : \"\"}${url.hash}`;\n}\n\nfunction cleanReturnToValue(returnTo: string): string {\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    // Preserve cross-origin absolute returnTo values (e.g., redirects back to\n    // another product's app shell) — only strip stale SSO params.\n    const isCrossOrigin = url.origin !== window.location.origin;\n    return stripStaleSsoParams(url, { includeOrigin: isCrossOrigin });\n  } catch {\n    return returnTo;\n  }\n}\n\n/**\n * Login page with professional design\n * Provides email/password login and social OAuth options\n */\nexport function LoginPage() {\n  const tr = useTr();\n  const navigate = useNavigate();\n  const location = useLocation();\n  const [searchParams] = useSearchParams();\n\n  const { signIn, isLoading, error, errorCode, resendVerification } =\n    useAuthOperations();\n  const { completeAuthFlow } = useMyWorkspaces();\n  const { setWorkspace, setOrganization } = useActiveContext();\n  const { defaultPostLoginPath, navigate: navigateHost } = useAuth();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const mfaRequired = useAuthStore((state) => state.mfaRequired);\n  const { executeRecaptcha: executeCaptchaV3 } = useCaptchaV3();\n  const [isCompletingAuth, setIsCompletingAuth] = useState(false);\n  const [isSsoRedirecting, setIsSsoRedirecting] = useState(false);\n\n  /**\n   * Build the URL that should receive the post-login redirect.\n   *\n   * For cross-eTLD+1 SSO on alpha/prod we detour through the central bridge\n   * host (alphaapp/app.burdenoff.com) so the freshly-issued tokens land in\n   * the bridge origin's first-party (unpartitioned) localStorage. Without\n   * this step, a later direct visit to the bridge host has no local tokens\n   * and no shared cookie (cross-eTLD+1 cookies don't propagate), so the user\n   * sees the login page again.\n   *\n   * Skipped when:\n   *   - Already on the bridge host origin (would be a no-op self-redirect).\n   *   - The user's intended destination is itself on the bridge host\n   *     (likely an in-product navigation, no deposit needed).\n   *   - The freshly-stored profile snapshot can't be read (best-effort only —\n   *     login still succeeds via the direct redirect).\n   */\n  const buildPostLoginUrl = useCallback(\n    async (intendedPath: string): Promise<string> => {\n      if (typeof window === \"undefined\") return intendedPath;\n      // Native shells (Electron, Capacitor iOS/Android) run as a single origin —\n      // skip the cross-eTLD+1 deposit detour, which would otherwise navigate to\n      // an external https URL and escape the embedded webview.\n      if (isNativeShell()) return intendedPath;\n      try {\n        const bridge = resolveAuthBridgeConfig();\n        const bridgeUrl = new URL(bridge.url);\n        const currentOrigin = window.location.origin;\n        if (bridgeUrl.origin === currentOrigin) return intendedPath;\n\n        // intendedPath can be a path or an absolute URL; resolve to absolute\n        // against current origin so the bridge host knows where to send the\n        // user back.\n        const absoluteIntended = new URL(intendedPath, currentOrigin).href;\n\n        const profileId = resolveActiveProfileId();\n        if (!profileId) return intendedPath;\n        const tokens = getProfileTokens(profileId);\n        const user = getProfileUser(profileId);\n        if (!tokens || !user) return intendedPath;\n        const workspaceToken = getProfileWorkspaceToken(profileId);\n\n        // BOFF-4463: mint a DEDICATED refresh-token lineage for the bridge\n        // host. Copying this origin's pair verbatim meant the bridge (and\n        // every product it later relayed to) shared ONE rotating refresh\n        // token — the first origin to refresh revoked it for all others,\n        // surfacing as \"products log me out after minutes/hours\". Falls back\n        // to the legacy copy if the mutation is unreachable (rollout gap /\n        // transient failure) so SSO keeps working.\n        let depositTokens: Record<string, unknown> = {\n          ...tokens,\n          workspaceToken,\n        };\n        if (tokens.refreshToken) {\n          const { globalBaseUrl } = resolveGatewayUrls();\n          const { tokens: minted } = await mintSsoSessionTokens(\n            `${globalBaseUrl}/global/graphql`,\n            tokens.refreshToken,\n          );\n          if (minted) {\n            depositTokens = { ...minted, workspaceToken };\n          }\n        }\n\n        markSsoDepositPending(profileId);\n        return buildSsoDepositUrl(bridgeUrl.origin, absoluteIntended, {\n          profileId,\n          tokens: JSON.stringify(depositTokens),\n          user: JSON.stringify(user),\n          profiles: JSON.stringify(getProfiles()),\n        });\n      } catch {\n        return intendedPath;\n      }\n    },\n    [],\n  );\n\n  // Once a cross-document post-login redirect is initiated, the login page\n  // must FREEZE: resetting isCompletingAuth re-runs the auto-redirect effect\n  // and any state churn schedules same-document navigations that cancel the\n  // provisional deposit hop (BOFF-4463).\n  const redirectInitiatedRef = useRef(false);\n\n  const redirectAfterLogin = useCallback(\n    (path: string) => {\n      const safePath = sanitizePostLoginPath(path);\n      if (typeof window === \"undefined\") {\n        navigate(safePath);\n        return;\n      }\n      const fragmentPath = sameOriginFragmentPath(\n        safePath,\n        window.location.origin,\n      );\n      if (fragmentPath) {\n        // The authenticated profile is already stored on this origin. Do not\n        // copy a fragment capability into bridge payloads or return storage.\n        navigateHost(fragmentPath);\n        return;\n      }\n      try {\n        sessionStorage.setItem(\"bf-post-login-return-to\", safePath);\n      } catch {\n        // Ignore storage failures; redirect still proceeds.\n      }\n      // In native shells use SPA navigation so the embedded webview stays in\n      // the app — no full reload, no chance of the OS opening the URL\n      // externally. Tokens are already in this origin's localStorage.\n      if (isNativeShell()) {\n        navigate(toSameOriginPath(safePath));\n        return;\n      }\n      redirectInitiatedRef.current = true;\n      void (async () => {\n        // Cap the bridge URL build so a hanging SSO token mint cannot keep the\n        // login page stuck on the spinner (BOFF-6807). The sanitized path is\n        // always safe to redirect to directly.\n        const target = await Promise.race([\n          buildPostLoginUrl(safePath),\n          new Promise<string>((resolve) => {\n            window.setTimeout(() => resolve(safePath), 3000);\n          }),\n        ]);\n        if (target.includes(\"/auth/sso-deposit\")) {\n          // Cross-document deposit hop: suppress same-document navigators\n          // while it is provisional, and retry once if it still gets\n          // cancelled — on a committed navigation this document unloads and\n          // the timer never fires.\n          beginSsoNavigation();\n          window.location.assign(target);\n          window.setTimeout(() => {\n            beginSsoNavigation();\n            window.location.replace(target);\n          }, 2500);\n        } else {\n          window.location.assign(target);\n        }\n        // Fallback: if the document is still stuck on the login page after a\n        // full redirect attempt, force an in-app navigation so the spinner\n        // cannot stall forever (BOFF-6807). This only fires when the browser\n        // failed to leave /auth/login, e.g. because the computed target was\n        // still an auth URL or the location.assign was a no-op.\n        window.setTimeout(() => {\n          if (\n            typeof window !== \"undefined\" &&\n            window.location.pathname === \"/auth/login\"\n          ) {\n            navigate(\"/dashboard\");\n          }\n        }, 3500);\n      })();\n    },\n    [navigate, navigateHost, buildPostLoginUrl],\n  );\n  const [showPassword, setShowPassword] = useState(false);\n  const [isAccountInactive, setIsAccountInactive] = useState(false);\n  const [isAccountDeleted, setIsAccountDeleted] = useState(false);\n  const [isAccountSuspended, setIsAccountSuspended] = useState(false);\n  const [isOAuthOnlyAccount, setIsOAuthOnlyAccount] = useState(false);\n  const [isEmailNotVerified, setIsEmailNotVerified] = useState(false);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendSuccess, setResendSuccess] = useState(false);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [infoMessage, setInfoMessage] = useState<string | null>(null);\n  const [formData, setFormData] = useState<\n    SignInInput & { rememberMe?: boolean }\n  >({\n    email: \"\",\n    password: \"\",\n    rememberMe: false,\n  });\n  const [validationError, setValidationError] = useState<string | null>(null);\n  const [isDuplicateAccount, setIsDuplicateAccount] = useState(false);\n\n  // Detect add-account mode and returnTo from URL params\n  const isAddAccountMode = searchParams.get(\"mode\") === \"add-account\";\n  const returnTo = searchParams.get(\"returnTo\");\n  const initialReturnToRef = useRef<string | null>(returnTo);\n\n  // Tell the user WHY they are back on the login page. `session-expired` is\n  // set by the shell's forced logout (expired session whose refresh failed);\n  // `logout` covers explicit sign-outs and the SSO-clear fallback (which can\n  // rewrite a session-expired redirect's reason on the cross-product bounce).\n  // Without this the auto-logout looked like a silent, unexplained kick-out.\n  const reasonParam = searchParams.get(\"reason\");\n  useEffect(() => {\n    if (reasonParam === \"session-expired\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n    } else if (reasonParam === \"logout\") {\n      setInfoMessage(tr(\"auth.login.signedOut\", \"You have been signed out.\"));\n    }\n  }, [reasonParam, tr]);\n\n  useEffect(() => {\n    if (!initialReturnToRef.current && returnTo) {\n      initialReturnToRef.current = returnTo;\n    }\n  }, [returnTo]);\n\n  useEffect(() => {\n    if (isAddAccountMode || isCompletingAuth) return;\n    // A cross-document SSO navigation (deposit/relay hop) is already in\n    // flight — issuing another redirect here would cancel it (BOFF-4463).\n    if (redirectInitiatedRef.current || isSsoNavigationPending()) return;\n\n    const profileId = resolveActiveProfileId();\n    if (profileId) {\n      const tokens = getProfileTokens(profileId);\n      const user = getProfileUser(profileId);\n      if (\n        tokens?.accessToken &&\n        user &&\n        hasValidAccessToken(tokens.accessToken)\n      ) {\n        useAuthStore.getState().loadFromProfile(profileId);\n        redirectAfterLogin(\n          decodeSameOriginReturnTo(returnTo) ?? defaultPostLoginPath ?? \"/\",\n        );\n        return;\n      }\n    }\n\n    // A same-origin fragment continuation must remain here during\n    // sign-in too, not only after it. Only the host-declared destination can\n    // select this flow; an arbitrary returnTo query must not suppress SSO.\n    // Credential/MFA checks above and below still apply unchanged.\n    if (\n      sameOriginFragmentPath(defaultPostLoginPath ?? \"\", window.location.origin)\n    ) {\n      return;\n    }\n    const ssoUrl = getSSORedirectUrl();\n    if (ssoUrl) {\n      setIsSsoRedirecting(true);\n      window.location.replace(ssoUrl);\n    }\n  }, [\n    isAddAccountMode,\n    isCompletingAuth,\n    redirectAfterLogin,\n    returnTo,\n    defaultPostLoginPath,\n  ]);\n\n  // Load remembered email on mount and clean up any legacy plaintext password storage\n  useEffect(() => {\n    try {\n      // Security cleanup: remove any previously stored plaintext passwords\n      localStorage.removeItem(\"remembered_password\");\n\n      const rememberedEmail = localStorage.getItem(\"remembered_email\");\n\n      if (rememberedEmail) {\n        setFormData((prev) => ({\n          ...prev,\n          email: rememberedEmail,\n          rememberMe: true,\n        }));\n      }\n    } catch (error) {\n      console.warn(\"[LoginPage] Failed to load remembered email:\", error);\n    }\n  }, []);\n\n  // Check for redirect message and email from location state (e.g., from expired MFA or SSO redirect)\n  useEffect(() => {\n    const state = location.state as { message?: string; email?: string } | null;\n    if (state?.message) {\n      setInfoMessage(state.message);\n    }\n    if (state?.email) {\n      setFormData((prev) => ({ ...prev, email: state.email }));\n    }\n    // Clear state to prevent showing message on refresh\n    if (state) {\n      window.history.replaceState({}, document.title);\n    }\n  }, [location.state]);\n\n  // Determine error type from GraphQL error code (primary) or message (fallback).\n  // The backend sends structured codes in extensions.code which are propagated\n  // through useAuthOperations → authStore.errorCode.\n  const checkErrorType = (\n    err: string | null,\n    code?: string | null,\n  ):\n    | \"DELETED\"\n    | \"SUSPENDED\"\n    | \"OAUTH_ONLY\"\n    | \"INACTIVE\"\n    | \"EMAIL_NOT_VERIFIED\"\n    | null => {\n    // Primary: match on GraphQL error code from extensions\n    if (code) {\n      switch (code) {\n        case \"ACCOUNT_DELETED\":\n          return \"DELETED\";\n        case \"ACCOUNT_SUSPENDED\":\n          return \"SUSPENDED\";\n        case \"OAUTH_ONLY_ACCOUNT\":\n          return \"OAUTH_ONLY\";\n        case \"ACCOUNT_INACTIVE\":\n          return \"INACTIVE\";\n        case \"EMAIL_NOT_VERIFIED\":\n          return \"EMAIL_NOT_VERIFIED\";\n        default:\n          break;\n      }\n    }\n\n    // Fallback: match on error message for non-GraphQL errors or legacy responses\n    if (!err) return null;\n    const lowerErr = err.toLowerCase();\n\n    if (\n      lowerErr.includes(\"deleted\") ||\n      lowerErr.includes(\"permanently deleted\")\n    ) {\n      return \"DELETED\";\n    }\n    if (lowerErr.includes(\"suspended\")) {\n      return \"SUSPENDED\";\n    }\n    if (\n      lowerErr.includes(\"oauth provider\") ||\n      lowerErr.includes(\"oauth-only\") ||\n      lowerErr.includes(\"oauth only\")\n    ) {\n      return \"OAUTH_ONLY\";\n    }\n    if (\n      lowerErr.includes(\"inactive\") ||\n      lowerErr.includes(\"deactivated\") ||\n      lowerErr.includes(\"not active\")\n    ) {\n      return \"INACTIVE\";\n    }\n    if (\n      lowerErr.includes(\"verify your email\") ||\n      lowerErr.includes(\"email not verified\") ||\n      lowerErr.includes(\"email_not_verified\")\n    ) {\n      return \"EMAIL_NOT_VERIFIED\";\n    }\n    return null;\n  };\n\n  // Pre-fill email from URL query parameter (e.g., after email verification)\n  useEffect(() => {\n    const emailFromUrl = searchParams.get(\"email\");\n    if (emailFromUrl) {\n      setFormData((prev) => ({ ...prev, email: emailFromUrl }));\n    }\n\n    // Check for expired session redirect\n    const isExpired = searchParams.get(\"expired\");\n    if (isExpired === \"true\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n      // Clear the query param to prevent showing on refresh\n      const newUrl = window.location.pathname;\n      window.history.replaceState({}, document.title, newUrl);\n    }\n  }, [searchParams, tr]);\n\n  // Redirect to MFA verification when required\n  useEffect(() => {\n    if (mfaRequired) {\n      navigate(\"/auth/mfa-verify\");\n    }\n  }, [mfaRequired, navigate]);\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n    setIsAccountInactive(false);\n    setIsAccountDeleted(false);\n    setIsAccountSuspended(false);\n    setIsOAuthOnlyAccount(false);\n    setIsEmailNotVerified(false);\n    setIsDuplicateAccount(false);\n    setResendSuccess(false);\n    setValidationError(null);\n\n    // Client-side validation\n    const emailTrimmed = (formData.email ?? \"\").trim();\n    if (!emailTrimmed) {\n      setValidationError(\n        tr(\n          \"auth.login.enterEmailOrUsername\",\n          \"Please enter your email or username\",\n        ),\n      );\n      return;\n    }\n\n    // Basic email format validation (if it contains @)\n    if (emailTrimmed.includes(\"@\")) {\n      const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n      if (!emailRegex.test(emailTrimmed)) {\n        setValidationError(\n          tr(\"auth.login.invalidEmail\", \"Please enter a valid email address\"),\n        );\n        return;\n      }\n    }\n\n    if (!formData.password || formData.password.length < 1) {\n      setValidationError(\n        tr(\"auth.login.enterPassword\", \"Please enter your password\"),\n      );\n      return;\n    }\n\n    // In add-account mode, check if this email is already signed in\n    if (isAddAccountMode) {\n      const existingProfiles = getProfiles();\n      const alreadySignedIn = existingProfiles.some(\n        (p) => p.email.toLowerCase() === emailTrimmed.toLowerCase(),\n      );\n      if (alreadySignedIn) {\n        setIsDuplicateAccount(true);\n        setValidationError(null);\n        return;\n      }\n    }\n    setIsDuplicateAccount(false);\n\n    try {\n      // Get reCAPTCHA v3 token (no-op when captcha is disabled)\n      const recaptchaToken = await executeCaptchaV3(\"login\");\n\n      const result = await signIn({\n        email: emailTrimmed,\n        password: formData.password,\n        rememberMe: formData.rememberMe,\n        ...(recaptchaToken ? { recaptchaToken } : {}),\n      });\n\n      // If MFA is required, the useEffect above will handle redirect\n      if (result.requiresMFA) {\n        // Persist the post-login destination so MfaVerifyPage honors\n        // `returnTo` and `defaultPostLoginPath` after the user completes\n        // verification — otherwise the MFA path falls back to \"/\" and the\n        // host-configured home (e.g. \"/vibecontrols\") is lost.\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postMfaPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          sessionStorage.setItem(MFA_REDIRECT, postMfaPath);\n        } catch {\n          // sessionStorage may be unavailable (private mode, quota) — the\n          // MFA page still works, it just defaults to \"/\" on completion.\n        }\n        return;\n      }\n\n      // Successful login - complete auth flow (fetch workspaces + issue token)\n      if (result.success) {\n        try {\n          const profileId = result.user?.id;\n          if (profileId) {\n            const hostname = window.location.hostname;\n            const domain = hostname.endsWith(\".local.burdenoff.com\")\n              ? \".local.burdenoff.com\"\n              : undefined;\n            const domainPart = domain ? `; domain=${domain}` : \"\";\n            const securePart =\n              window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n            const ssoValue = JSON.stringify({\n              id: profileId,\n              origin: window.location.origin,\n            });\n            document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n            document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n          }\n        } catch {\n          // Best effort only. Login can continue without the fast-path cookie.\n        }\n\n        // Handle Remember Me: Save or clear email only (never store passwords)\n        try {\n          if (formData.rememberMe) {\n            localStorage.setItem(\"remembered_email\", emailTrimmed);\n          } else {\n            localStorage.removeItem(\"remembered_email\");\n          }\n        } catch (error) {\n          console.warn(\n            \"[LoginPage] Failed to save/clear remembered email:\",\n            error,\n          );\n        }\n\n        setIsCompletingAuth(true);\n        // In add-account mode, redirect back to where the user was\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postLoginPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          type AuthFlowResult = Awaited<ReturnType<typeof completeAuthFlow>>;\n          // Pass the token directly to avoid race condition with React state updates\n          const authFlowResult = await Promise.race<AuthFlowResult>([\n            completeAuthFlow(result.token),\n            new Promise<AuthFlowResult>((resolve) => {\n              window.setTimeout(() => {\n                resolve({\n                  success: false,\n                  error: \"Auth flow timed out after login\",\n                });\n              }, 5000);\n            }),\n          ]);\n\n          if (authFlowResult.success) {\n            // Sync workspace and organization to ActiveContext\n            // This is critical for global search and other workspace-scoped features\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n\n            // Full auth flow completed - redirect to dashboard or returnTo\n            redirectAfterLogin(postLoginPath);\n          } else if (authFlowResult.error?.includes(\"No workspaces found\")) {\n            // A context-free invitation can establish canonical membership after\n            // sign-in. Do not force a new organization/workspace first merely\n            // because this authenticated actor has no discovery inventory yet.\n            if (\n              hostFragmentContinuation(\n                postLoginPath,\n                defaultPostLoginPath,\n                window.location.origin,\n              )\n            ) {\n              redirectAfterLogin(postLoginPath);\n            } else {\n              navigate(\"/onboarding/create-workspace\");\n            }\n          } else {\n            // Partial success or error - still sync workspace if available and redirect\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n            console.warn(\"Auth flow warning:\", authFlowResult.error);\n            redirectAfterLogin(postLoginPath);\n          }\n        } catch (authFlowError) {\n          // Auth flow failed but login succeeded - still redirect\n          console.error(\"Auth flow error (login succeeded):\", authFlowError);\n          redirectAfterLogin(postLoginPath);\n        } finally {\n          // Keep the completing state (spinner) once a redirect is in\n          // flight: resetting it re-arms the auto-redirect effect whose\n          // competing navigation cancels the deposit hop (BOFF-4463). The\n          // page is about to unload anyway.\n          if (!redirectInitiatedRef.current) {\n            setIsCompletingAuth(false);\n          }\n        }\n      }\n    } catch (err) {\n      if (import.meta.env.DEV) {\n        console.error(\"Sign in failed:\", err);\n      }\n      // Check error type using error code (from store) and message\n      const errorMsg = err instanceof Error ? err.message : String(err);\n      if (errorMsg.includes(\"reCAPTCHA\")) {\n        setValidationError(errorMsg);\n      }\n      const storeErrorCode = useAuthStore.getState().errorCode;\n      const errorType = checkErrorType(errorMsg, storeErrorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  };\n\n  // Also check the error from useAuthOperations\n  useEffect(() => {\n    if (error) {\n      const errorType = checkErrorType(error, errorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  }, [error, errorCode]);\n\n  /**\n   * Handle Google OAuth login\n   */\n  const handleGoogleLogin = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.googleSignInFailed\",\n              \"Failed to initiate Google sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth login\n   */\n  const handleMicrosoftLogin = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.microsoftSignInFailed\",\n              \"Failed to initiate Microsoft sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle resend verification email\n   */\n  const handleResendVerification = async () => {\n    setIsResendingVerification(true);\n    setResendSuccess(false);\n    try {\n      const emailTrimmed = (formData.email ?? \"\").trim();\n      const result = await resendVerification(emailTrimmed);\n      if (result.success) {\n        setResendSuccess(true);\n      } else {\n        setValidationError(\n          tr(\n            \"auth.login.resendFailed\",\n            \"Failed to resend verification email. Please try again.\",\n          ),\n        );\n      }\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      setValidationError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.resendFailed\",\n              \"Failed to resend verification email. Please try again.\",\n            ),\n      );\n    } finally {\n      setIsResendingVerification(false);\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleLogin,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.login.googleNotConfigured\",\n            \"Google sign in is not configured\",\n          ),\n    },\n    // {\n    //   name: \"GitHub\",\n    //   icon: GitHubIcon,\n    //   onClick: () => {},\n    //   disabled: true,\n    //   tooltip: tr(\n    //     \"auth.login.githubNotConfigured\",\n    //     \"GitHub sign in is not configured\",\n    //   ),\n    // },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftLogin,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.login.microsoftNotConfigured\",\n            \"Microsoft sign in is not configured\",\n          ),\n    },\n  ];\n\n  if (isSsoRedirecting) {\n    return <SSORedirectSpinner />;\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.login.welcomeBack\", \"Welcome back\")}\n      subtitle={tr(\n        \"auth.login.enterCredentials\",\n        \"Enter your credentials to continue\",\n      )}\n    >\n      <PagePurpose className=\"mb-5\">\n        {tr(\n          \"auth.login.purpose\",\n          \"Sign in to reach your workspaces, agents, and settings. Use your email and password, a social provider, or a passwordless magic link.\",\n        )}\n      </PagePurpose>\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Info Message (e.g., from expired MFA redirect) */}\n        {infoMessage && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border\">\n            <svg\n              className=\"size-5 flex-shrink-0 mt-0.5 text-text-link\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z\"\n              />\n            </svg>\n            <p className=\"text-sm text-status-info-text\">{infoMessage}</p>\n          </div>\n        )}\n\n        {/* Validation Error */}\n        {validationError && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <p className=\"text-sm text-status-warning-text\">\n              {validationError}\n            </p>\n          </div>\n        )}\n\n        {/* Duplicate Account Warning (Add Account mode) */}\n        {isDuplicateAccount && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <div className=\"flex-1\">\n              <p className=\"text-sm font-medium text-status-warning-text\">\n                {tr(\n                  \"auth.login.duplicateAccount\",\n                  \"This account is already signed in.\",\n                )}\n              </p>\n              <p className=\"mt-1 text-sm text-status-warning-text/80\">\n                {tr(\n                  \"auth.login.duplicateAccountHint\",\n                  \"Please use a different account, or go back and switch to this account from the profile menu.\",\n                )}\n              </p>\n              {(initialReturnToRef.current || returnTo) && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\n                      decodeURIComponent(\n                        initialReturnToRef.current || returnTo || \"/dashboard\",\n                      ),\n                    )\n                  }\n                  className=\"mt-3 inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm\"\n                >\n                  <svg\n                    className=\"size-4\"\n                    fill=\"none\"\n                    viewBox=\"0 0 24 24\"\n                    stroke=\"currentColor\"\n                  >\n                    <path\n                      strokeLinecap=\"round\"\n                      strokeLinejoin=\"round\"\n                      strokeWidth={2}\n                      d=\"M10 19l-7-7m0 0l7-7m-7 7h18\"\n                    />\n                  </svg>\n                  {tr(\n                    \"auth.login.goBackSwitchAccount\",\n                    \"Go back and switch account\",\n                  )}\n                </button>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Error Alert */}\n        {error && !validationError && !isDuplicateAccount && (\n          <div\n            className={`flex items-start gap-3 p-4 rounded-xl border ${\n              isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                ? \"bg-status-warning-bg-subtle border-status-warning-border\"\n                : \"bg-status-error-bg-subtle border-status-error-border\"\n            }`}\n          >\n            <AlertIcon\n              className={`size-5 flex-shrink-0 mt-0.5 ${\n                isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                  ? \"text-status-warning-text\"\n                  : \"text-status-error-text\"\n              }`}\n            />\n            <div className=\"flex-1\">\n              <p\n                className={`text-sm ${\n                  isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                    ? \"text-status-warning-text\"\n                    : \"text-status-error-text\"\n                }`}\n              >\n                {isAccountDeleted\n                  ? tr(\n                      \"auth.login.accountDeleted\",\n                      \"This account has been permanently deleted and cannot be recovered.\",\n                    )\n                  : isAccountSuspended\n                    ? tr(\n                        \"auth.login.accountSuspended\",\n                        \"Your account has been suspended. Please contact support for assistance.\",\n                      )\n                    : isAccountInactive\n                      ? tr(\n                          \"auth.login.accountDeactivated\",\n                          \"Your account has been deactivated.\",\n                        )\n                      : isOAuthOnlyAccount\n                        ? tr(\n                            \"auth.login.oauthOnly\",\n                            \"This account uses OAuth sign-in. Please use Google or Microsoft to sign in.\",\n                          )\n                        : isEmailNotVerified\n                          ? tr(\n                              \"auth.login.emailNotVerified\",\n                              \"Please verify your email before signing in. Check your inbox for the verification link.\",\n                            )\n                          : error}\n              </p>\n              {isAccountInactive && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\"/auth/reactivate\", {\n                      state: { email: formData.email },\n                    })\n                  }\n                  className=\"mt-2 text-sm font-semibold text-status-warning-text hover:text-status-warning-text underline underline-offset-2\"\n                >\n                  {tr(\n                    \"auth.login.clickReactivate\",\n                    \"Click here to reactivate your account\",\n                  )}\n                </button>\n              )}\n              {isEmailNotVerified && (\n                <div className=\"mt-3\">\n                  {resendSuccess ? (\n                    <div className=\"flex items-center gap-2 text-sm text-status-success-text\">\n                      <svg\n                        className=\"size-4\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M5 13l4 4L19 7\"\n                        />\n                      </svg>\n                      {tr(\n                        \"auth.login.verificationSent\",\n                        \"Verification email sent! Please check your inbox.\",\n                      )}\n                    </div>\n                  ) : (\n                    <button\n                      type=\"button\"\n                      onClick={handleResendVerification}\n                      disabled={isResendingVerification}\n                      className=\"inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm disabled:opacity-50 disabled:cursor-not-allowed\"\n                    >\n                      {isResendingVerification ? (\n                        <>\n                          <SpinnerIcon className=\"size-4 animate-spin\" />\n                          {tr(\"auth.login.sending\", \"Sending...\")}\n                        </>\n                      ) : (\n                        <>\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                            />\n                          </svg>\n                          {tr(\n                            \"auth.login.resendVerification\",\n                            \"Resend verification email\",\n                          )}\n                        </>\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n              {isOAuthOnlyAccount && (\n                <div className=\"mt-3 flex flex-col gap-2\">\n                  {isProviderConfigured(\"google\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleGoogleLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <GoogleIcon className=\"size-5\" />\n                      {tr(\"auth.login.signInWithGoogle\", \"Sign in with Google\")}\n                    </button>\n                  )}\n                  {isProviderConfigured(\"microsoft\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleMicrosoftLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <MicrosoftIcon className=\"size-5\" />\n                      {tr(\n                        \"auth.login.signInWithMicrosoft\",\n                        \"Sign in with Microsoft\",\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.emailLabel\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.emailLabel\", \"Email\")}\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\"auth.login.emailPlaceholder\", \"you@example.com\")}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.passwordLabel\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              autoComplete=\"current-password\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.passwordLabel\", \"Password\")}\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.login.passwordPlaceholder\",\n                \"Enter your password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={\n                showPassword\n                  ? tr(\"auth.login.hidePassword\", \"Hide password\")\n                  : tr(\"auth.login.showPassword\", \"Show password\")\n              }\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"size-5\" />\n              ) : (\n                <EyeIcon className=\"size-5\" />\n              )}\n            </button>\n          </div>\n        </div>\n\n        {/* Remember & Forgot */}\n        <div className=\"flex items-center justify-between\">\n          <label\n            htmlFor=\"remember-me\"\n            className=\"flex items-center gap-2 cursor-pointer group\"\n          >\n            <Checkbox\n              id=\"remember-me\"\n              checked={formData.rememberMe}\n              onCheckedChange={(checked: boolean | \"indeterminate\") => {\n                const isChecked = checked === true;\n                setFormData({ ...formData, rememberMe: isChecked });\n\n                // Clear saved email immediately when unchecked\n                if (!isChecked) {\n                  try {\n                    localStorage.removeItem(\"remembered_email\");\n                  } catch (error) {\n                    console.warn(\n                      \"[LoginPage] Failed to clear remembered email:\",\n                      error,\n                    );\n                  }\n                }\n              }}\n              aria-label={tr(\"auth.login.rememberMe\", \"Remember me\")}\n            />\n            <span className=\"text-sm text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)] transition-colors\">\n              {tr(\"auth.login.rememberMe\", \"Remember me\")}\n            </span>\n          </label>\n          <button\n            type=\"button\"\n            onClick={() => navigate(\"/auth/reset-password\")}\n            className=\"text-sm font-medium text-text-link hover:text-text-linkHover transition-colors\"\n          >\n            {tr(\"auth.login.forgotPassword\", \"Forgot password?\")}\n          </button>\n        </div>\n\n        {/* Submit Button */}\n        <Button\n          type=\"submit\"\n          disabled={isLoading || isCompletingAuth}\n          variant=\"default\"\n          size=\"lg\"\n          className=\"w-full font-semibold\"\n        >\n          {isLoading || isCompletingAuth ? (\n            <>\n              <SpinnerIcon className=\"size-5 animate-spin\" />\n              <span>\n                {isCompletingAuth\n                  ? tr(\n                      \"auth.login.settingUpWorkspace\",\n                      \"Setting up workspace...\",\n                    )\n                  : tr(\"auth.login.signingIn\", \"Signing in...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.login.signIn\", \"Sign in\")\n          )}\n        </Button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.login.orContinueWith\", \"or continue with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            aria-label={provider.name}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`size-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Enterprise SSO Option — temporarily hidden */}\n      {/* <div className=\"mt-6\">\n        <button type=\"button\"\n          onClick={() => navigate(\"/auth/sso/login\")}\n          className=\"w-full flex items-center justify-center gap-3 px-4 py-3 rounded-xl border-2 border-dashed border-[var(--color-border-default)] hover:border-action-primary-bg bg-[var(--color-bg-surface)] hover:bg-status-info-bg-subtle transition-all duration-200 group\"\n        >\n          <svg\n            className=\"size-5 text-[var(--color-text-tertiary)] group-hover:text-text-link\"\n            fill=\"none\"\n            viewBox=\"0 0 24 24\"\n            stroke=\"currentColor\"\n          >\n            <path\n              strokeLinecap=\"round\"\n              strokeLinejoin=\"round\"\n              strokeWidth={1.5}\n              d=\"M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4\"\n            />\n          </svg>\n          <span className=\"text-sm font-medium text-[var(--color-text-secondary)] group-hover:text-text-link\">\n            {tr(\"auth.login.enterpriseSso\", \"Sign in with Enterprise SSO\")}\n          </span>\n        </button>\n      </div> */}\n\n      {/* Magic Link Option */}\n      <div className=\"mt-4 text-center\">\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/magic-link\")}\n          className=\"text-sm text-[var(--color-text-secondary)] hover:text-[var(--color-text-primary)] transition-colors\"\n        >\n          {tr(\"auth.login.preferPasswordless\", \"Prefer passwordless login?\")}{\" \"}\n          <span className=\"font-semibold text-text-link hover:text-text-linkHover\">\n            {tr(\"auth.login.signInMagicLink\", \"Sign in with Magic Link\")}\n          </span>\n        </button>\n      </div>\n\n      {/* Sign Up Link */}\n      <p className=\"mt-6 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.login.dontHaveAccount\", \"Don't have an account?\")}{\" \"}\n        <button\n          type=\"button\"\n          onClick={() =>\n            navigate(\n              authPathWithReturnTo(\n                \"/auth/register\",\n                sanitizeReturnPath(returnTo),\n              ),\n            )\n          }\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.login.signUp\", \"Sign up\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmEA,SAASC,IAAyB;CAChC,IAAI,OAAO,SAAW,KAAa,OAAO;CAC1C,IAAMC,IAAI;CAGV,IAAI,OAAOA,EAAE,WAAW,oBAAqB,YAC3C,IAAI;EACF,IAAIA,EAAE,UAAU,iBAAiB,GAAG,OAAO;CAC7C,QAAQ,CAER;CAQF,OANA,GACE,OAAO,YAAc,OACrB,YAAY,KAAK,UAAU,aAAa,EAAE;AAK9C;AAEA,SAASC,GAAiB,GAAwB;CAChD,IAAI,OAAO,SAAW,KAAa,OAAOC;CAC1C,IAAI;EACF,IAAMC,IAAM,IAAI,IAAID,GAAQ,OAAO,SAAS,MAAM;EAClD,OAAO,GAAGC,EAAI,WAAWA,EAAI,SAASA,EAAI;CAC5C,QAAQ;EACN,OAAOD;CACT;AACF;AAEA,SAASE,GAAoB,GAAwB;CACnD,IAAI;EACF,IAAMC,IAAMC,EAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,GAC9DC,IAASF,EAAI,OAAO,KAAK,KAAKA,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtDG,IAAU,KAAK,MAAM,KAAKD,CAAM,CAAC;EACvC,OAAO,OAAOC,EAAQ,OAAQ,YAAYA,EAAQ,MAAM,KAAK,IAAI,IAAI;CACvE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAASC,GAAyB,GAAwC;CACxE,IAAI,CAACC,GAAU,OAAO;CACtB,IAAI;EAEF,IAAMP,IAAM,IAAI,IADA,mBAAmBO,CACf,GAAS,OAAO,SAAS,MAAM;EAEnD,OADIP,EAAI,WAAW,OAAO,SAAS,SAC5BQ,EAAoBR,GAAK,EAAE,eAAe,GAAM,CAAC,IADN;CAEpD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAASQ,EACP,GACA,GACQ;CACR,KAAK,IAAMC,KAAS;EAAC;EAAc;EAAc;CAAe,GAC9D,EAAI,aAAa,OAAOA,CAAK;CAG/B,IAAIC,EAAQ,eACV,OAAOV,EAAI,SAAS;CAGtB,IAAMW,IAASX,EAAI,aAAa,SAAS;CACzC,OAAO,GAAGA,EAAI,WAAWW,IAAS,IAAIA,MAAW,KAAKX,EAAI;AAC5D;AAEA,SAASY,EAAmB,GAA0B;CACpD,IAAI;EAEF,IAAMZ,IAAM,IAAI,IADA,mBAAmBO,CACf,GAAS,OAAO,SAAS,MAAM;EAInD,OAAOC,EAAoBR,GAAK,EAAE,eADZA,EAAI,WAAW,OAAO,SAAS,OACU,CAAC;CAClE,QAAQ;EACN,OAAOO;CACT;AACF;AAMA,SAAgBM,IAAY;CAC1B,IAAMC,IAAKC,EAAM,GACXC,IAAWC,GAAY,GACvBC,IAAWC,GAAY,GACvB,CAACC,KAAgBC,GAAgB,GAEjC,EAAE,YAAQ,cAAW,UAAO,eAAW,2BAC3CC,EAAkB,GACd,EAAE,yBAAqBC,EAAgB,GACvC,EAAE,kBAAc,wBAAoBC,GAAiB,GACrD,EAAE,yBAAsB,UAAUC,OAAiBC,EAAQ,GAC3D,EAAE,yBAAqB,4BAAwB,4BACnDC,EAAmB,GACfC,KAAcC,GAAc,MAAUC,EAAM,WAAW,GACvD,EAAE,kBAAkBC,OAAqBC,GAAa,GACtD,CAACC,GAAkBC,MAAuBC,EAAS,EAAK,GACxD,CAACC,IAAkBC,MAAuBF,EAAS,EAAK,GAmBxDG,IAAoBC,GACxB,OAAO,MAA0C;EAK/C,IAJI,OAAO,SAAW,OAIlB3C,EAAc,GAAG,OAAO4C;EAC5B,IAAI;GACF,IAAMC,IAASC,GAAwB,GACjCC,IAAY,IAAI,IAAIF,EAAO,GAAG,GAC9BG,IAAgB,OAAO,SAAS;GACtC,IAAID,EAAU,WAAWC,GAAe,OAAOJ;GAK/C,IAAMK,IAAmB,IAAI,IAAIL,GAAcI,CAAa,CAAC,CAAC,MAExDE,IAAYC,EAAuB;GACzC,IAAI,CAACD,GAAW,OAAON;GACvB,IAAMQ,IAASC,GAAiBH,CAAS,GACnCI,IAAOC,GAAeL,CAAS;GACrC,IAAI,CAACE,KAAU,CAACE,GAAM,OAAOV;GAC7B,IAAMY,IAAiBC,GAAyBP,CAAS,GASrDQ,IAAyC;IAC3C,GAAGN;IACH;GACF;GACA,IAAIA,EAAO,cAAc;IACvB,IAAM,EAAE,qBAAkBO,GAAmB,GACvC,EAAE,QAAQC,MAAW,MAAMC,GAC/B,GAAGC,EAAc,kBACjBV,EAAO,YACT;IACA,AAAIQ,MACF,IAAgB;KAAE,GAAGA;KAAQ;IAAe;GAEhD;GAGA,OADAG,GAAsBb,CAAS,GACxBc,GAAmBjB,EAAU,QAAQE,GAAkB;IAC5D;IACA,QAAQ,KAAK,UAAUS,CAAa;IACpC,MAAM,KAAK,UAAUJ,CAAI;IACzB,UAAU,KAAK,UAAUW,EAAY,CAAC;GACxC,CAAC;EACH,QAAQ;GACN,OAAOrB;EACT;CACF,GACA,CAAC,CACH,GAMMsB,IAAuBC,GAAO,EAAK,GAEnCC,IAAqBzB,IACxB,MAAiB;EAChB,IAAM0B,IAAWC,EAAsBC,CAAI;EAC3C,IAAI,OAAO,SAAW,KAAa;GACjC,EAASF,CAAQ;GACjB;EACF;EACA,IAAMG,IAAeC,EACnBJ,GACA,OAAO,SAAS,MAClB;EACA,IAAIG,GAGF,GAAaA,CAAY;OAG3B;OAAI;IACF,eAAe,QAAQ,2BAA2BH,CAAQ;GAC5D,QAAQ,CAER;GAIA,AAAIrE,EAAc,IAChBoB,EAASlB,GAAiBmE,CAAQ,CAAC,KAGrC,EAAqB,UAAU,KACzB,YAAY;IAIhB,IAAMlE,IAAS,MAAM,QAAQ,KAAK,CAChCuC,EAAkB2B,CAAQ,GAC1B,IAAI,SAAiB,MAAY;KAC/B,OAAO,iBAAiBK,EAAQL,CAAQ,GAAG,GAAI;IACjD,CAAC,CACH,CAAC;IAoBD,AAnBIlE,EAAO,SAAS,mBAAmB,KAKrCwE,GAAmB,GACnB,OAAO,SAAS,OAAOxE,CAAM,GAC7B,OAAO,iBAAiB;KAEtB,AADAwE,GAAmB,GACnB,OAAO,SAAS,QAAQxE,CAAM;IAChC,GAAG,IAAI,KAEP,OAAO,SAAS,OAAOA,CAAM,GAO/B,OAAO,iBAAiB;KACtB,AACE,OAAO,SAAW,OAClB,OAAO,SAAS,aAAa,iBAE7BiB,EAAS,YAAY;IAEzB,GAAG,IAAI;GACT,EAAA,CAAG;EA9CH;CA+CF,GACA;EAACA;EAAUS;EAAca;CAAiB,CAC5C,GACM,CAACkC,GAAcC,MAAmBtC,EAAS,EAAK,GAChD,CAACuC,GAAmBC,KAAwBxC,EAAS,EAAK,GAC1D,CAACyC,IAAkBC,KAAuB1C,EAAS,EAAK,GACxD,CAAC2C,IAAoBC,KAAyB5C,EAAS,EAAK,GAC5D,CAAC6C,GAAoBC,KAAyB9C,EAAS,EAAK,GAC5D,CAAC+C,GAAoBC,KAAyBhD,EAAS,EAAK,GAC5D,CAACiD,IAAyBC,MAA8BlD,EAAS,EAAK,GACtE,CAACmD,IAAeC,KAAoBpD,EAAS,EAAK,GAClD,CAACqD,IAAYC,KAAiBtD,EAAwB,IAAI,GAC1D,CAACuD,IAAaC,KAAkBxD,EAAwB,IAAI,GAC5D,CAACyD,GAAUC,KAAe1D,EAE9B;EACA,OAAO;EACP,UAAU;EACV,YAAY;CACd,CAAC,GACK,CAAC2D,GAAiBC,KAAsB5D,EAAwB,IAAI,GACpE,CAAC6D,IAAoBC,KAAyB9D,EAAS,EAAK,GAG5D+D,IAAmB9E,EAAa,IAAI,MAAM,MAAM,eAChDb,IAAWa,EAAa,IAAI,UAAU,GACtC+E,IAAqBpC,GAAsBxD,CAAQ,GAOnD6F,IAAchF,EAAa,IAAI,QAAQ;CAsF7C,AArFAiF,QAAgB;EACd,AAAID,MAAgB,oBAClBT,EACE7E,EACE,6BACA,iDACF,CACF,IACSsF,MAAgB,YACzBT,EAAe7E,EAAG,wBAAwB,2BAA2B,CAAC;CAE1E,GAAG,CAACsF,GAAatF,CAAE,CAAC,GAEpBuF,QAAgB;EACd,AAAI,CAACF,EAAmB,WAAW5F,MACjC,EAAmB,UAAUA;CAEjC,GAAG,CAACA,CAAQ,CAAC,GAEb8F,QAAgB;EAId,IAHIH,KAAoBjE,KAGpB6B,EAAqB,WAAWwC,GAAuB,GAAG;EAE9D,IAAMxD,IAAYC,EAAuB;EACzC,IAAID,GAAW;GACb,IAAME,IAASC,GAAiBH,CAAS,GACnCI,IAAOC,GAAeL,CAAS;GACrC,IACEE,GAAQ,eACRE,KACAjD,GAAoB+C,EAAO,WAAW,GACtC;IAEA,AADAnB,EAAa,SAAS,CAAC,CAAC,gBAAgBiB,CAAS,GACjDkB,EACE1D,GAAyBC,CAAQ,KAAKgG,KAAwB,GAChE;IACA;GACF;EACF;EAMA,IACElC,EAAuBkC,KAAwB,IAAI,OAAO,SAAS,MAAM,GAEzE;EAEF,IAAMC,IAASC,GAAkB;EACjC,AAAID,MACFnE,GAAoB,EAAI,GACxB,OAAO,SAAS,QAAQmE,CAAM;CAElC,GAAG;EACDN;EACAjE;EACA+B;EACAzD;EACAgG;CACF,CAAC,GAGDF,QAAgB;EACd,IAAI;GAEF,aAAa,WAAW,qBAAqB;GAE7C,IAAMK,IAAkB,aAAa,QAAQ,kBAAkB;GAE/D,AAAIA,KACFb,GAAa,OAAU;IACrB,GAAGc;IACH,OAAOD;IACP,YAAY;GACd,EAAE;EAEN,SAASE,GAAO;GACd,QAAQ,KAAK,gDAAgDA,CAAK;EACpE;CACF,GAAG,CAAC,CAAC,GAGLP,QAAgB;EACd,IAAMvE,IAAQZ,EAAS;EAQvB,AAPIY,GAAO,WACT6D,EAAe7D,EAAM,OAAO,GAE1BA,GAAO,SACT+D,GAAa,OAAU;GAAE,GAAGc;GAAM,OAAO7E,EAAM;EAAM,EAAE,GAGrDA,KACF,OAAO,QAAQ,aAAa,CAAC,GAAG,SAAS,KAAK;CAElD,GAAG,CAACZ,EAAS,KAAK,CAAC;CAKnB,IAAM2F,MACJ,GACA,MAOU;EAEV,IAAIC,GACF,QAAQA,GAAR;GACE,KAAK,mBACH,OAAO;GACT,KAAK,qBACH,OAAO;GACT,KAAK,sBACH,OAAO;GACT,KAAK,oBACH,OAAO;GACT,KAAK,sBACH,OAAO;EAGX;EAIF,IAAI,CAACC,GAAK,OAAO;EACjB,IAAMC,IAAWD,EAAI,YAAY;EAgCjC,OA7BEC,EAAS,SAAS,SAAS,KAC3BA,EAAS,SAAS,qBAAqB,IAEhC,YAELA,EAAS,SAAS,WAAW,IACxB,cAGPA,EAAS,SAAS,gBAAgB,KAClCA,EAAS,SAAS,YAAY,KAC9BA,EAAS,SAAS,YAAY,IAEvB,eAGPA,EAAS,SAAS,UAAU,KAC5BA,EAAS,SAAS,aAAa,KAC/BA,EAAS,SAAS,YAAY,IAEvB,aAGPA,EAAS,SAAS,mBAAmB,KACrCA,EAAS,SAAS,oBAAoB,KACtCA,EAAS,SAAS,oBAAoB,IAE/B,uBAEF;CACT;CAyBA,AAtBAX,QAAgB;EACd,IAAMY,IAAe7F,EAAa,IAAI,OAAO;EAO7C,IANI6F,KACFpB,GAAa,OAAU;GAAE,GAAGc;GAAM,OAAOM;EAAa,EAAE,GAIxC7F,EAAa,IAAI,SAC/B,MAAc,QAAQ;GACxB,EACEN,EACE,6BACA,iDACF,CACF;GAEA,IAAMoG,IAAS,OAAO,SAAS;GAC/B,OAAO,QAAQ,aAAa,CAAC,GAAG,SAAS,OAAOA,CAAM;EACxD;CACF,GAAG,CAAC9F,GAAcN,CAAE,CAAC,GAGrBuF,QAAgB;EACd,AAAIzE,MACFZ,EAAS,kBAAkB;CAE/B,GAAG,CAACY,IAAaZ,CAAQ,CAAC;CAE1B,IAAMmG,KAAe,OAAO,MAAuB;EASjD,AARA,EAAE,eAAe,GACjBxC,EAAqB,EAAK,GAC1BE,EAAoB,EAAK,GACzBE,EAAsB,EAAK,GAC3BE,EAAsB,EAAK,GAC3BE,EAAsB,EAAK,GAC3Bc,EAAsB,EAAK,GAC3BV,EAAiB,EAAK,GACtBQ,EAAmB,IAAI;EAGvB,IAAMqB,KAAgBxB,EAAS,SAAS,GAAA,CAAI,KAAK;EACjD,IAAI,CAACwB,GACH,EACEtG,EACE,mCACA,qCACF,CACF;OAKF,IAAIsG,EAAa,SAAS,GAAG,KAEvB,CAAC,6BAAW,KAAKA,CAAY,GAC/B,EACEtG,EAAG,2BAA2B,oCAAoC,CACpE;OAKJ,IAAI,CAAC8E,EAAS,YAAYA,EAAS,SAAS,SAAS,GACnD,EACE9E,EAAG,4BAA4B,4BAA4B,CAC7D;OAKF,IAAIoF,KACuBrC,EACD,CAAA,CAAiB,MACtC,MAAMwD,EAAE,MAAM,YAAY,MAAMD,EAAa,YAAY,CAExD,GAEF,AADAnB,EAAsB,EAAI,GAC1BF,EAAmB,IAAI;OAI3B;KAAsB,EAAK;GAE3B,IAAI;IAEF,IAAMuB,IAAiB,MAAMvF,GAAiB,OAAO,GAE/CwF,IAAS,MAAMC,GAAO;KAC1B,OAAOJ;KACP,UAAUxB,EAAS;KACnB,YAAYA,EAAS;KACrB,GAAI0B,IAAiB,EAAE,kBAAe,IAAI,CAAC;IAC7C,CAAC;IAGD,IAAIC,EAAO,aAAa;KAKtB,IACME,IACF7G,EAFsBuF,EAAmB,WAAW5F,MAGjCgG,KAAwB,aAAY;KAC3D,IAAI;MACF,eAAe,QAAQmB,IAAcD,CAAW;KAClD,QAAQ,CAGR;KACA;IACF;IAGA,IAAIF,EAAO,SAAS;KAClB,IAAI;MACF,IAAMzE,IAAYyE,EAAO,MAAM;MAC/B,IAAIzE,GAAW;OAEb,IAAM6E,IADW,OAAO,SAAS,SACT,SAAS,sBAAsB,IACnD,yBACA,KAAA,GACEC,IAAaD,IAAS,YAAYA,MAAW,IAC7CE,IACJ,OAAO,SAAS,aAAa,WAAW,aAAa,IACjDC,IAAW,KAAK,UAAU;QAC9B,IAAIhF;QACJ,QAAQ,OAAO,SAAS;OAC1B,CAAC;OAED,AADA,SAAS,SAAS,UAAU,mBAAmBgF,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmBC,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW;MACnH;KACF,QAAQ,CAER;KAGA,IAAI;MACF,AAAIjC,EAAS,aACX,aAAa,QAAQ,oBAAoBwB,CAAY,IAErD,aAAa,WAAW,kBAAkB;KAE9C,SAASR,GAAO;MACd,QAAQ,KACN,sDACAA,CACF;KACF;KAEA,GAAoB,EAAI;KAExB,IACMmB,IACFnH,EAFsBuF,EAAmB,WAAW5F,MAGjCgG,KAAwB,aAAY;KAC3D,IAAI;MAGF,IAAMyB,IAAiB,MAAM,QAAQ,KAAqB,CACxDC,GAAiBV,EAAO,KAAK,GAC7B,IAAI,SAAyB,MAAY;OACvC,OAAO,iBAAiB;QACtB,EAAQ;SACN,SAAS;SACT,OAAO;QACT,CAAC;OACH,GAAG,GAAI;MACT,CAAC,CACH,CAAC;MAED,AAAIS,EAAe,WAGbA,EAAe,cACjBE,GAAaF,EAAe,UAAU,EAAE,GACpCA,EAAe,UAAU,kBAC3BG,GAAgBH,EAAe,UAAU,cAAc,IAK3DhE,EAAmB+D,CAAa,KACvBC,EAAe,OAAO,SAAS,qBAAqB,IAK3DI,EACEL,GACAxB,GACA,OAAO,SAAS,MAClB,IAEAvC,EAAmB+D,CAAa,IAEhC/G,EAAS,8BAA8B,KAIrCgH,EAAe,cACjBE,GAAaF,EAAe,UAAU,EAAE,GACpCA,EAAe,UAAU,kBAC3BG,GAAgBH,EAAe,UAAU,cAAc,IAG3D,QAAQ,KAAK,sBAAsBA,EAAe,KAAK,GACvDhE,EAAmB+D,CAAa;KAEpC,SAASM,GAAe;MAGtB,AADA,QAAQ,MAAM,sCAAsCA,CAAa,GACjErE,EAAmB+D,CAAa;KAClC,UAAU;MAKR,AAAKjE,EAAqB,WACxB5B,GAAoB,EAAK;KAE7B;IACF;GACF,SAAS6E,GAAK;IAKZ,IAAMuB,IAAWvB,aAAe,QAAQA,EAAI,UAAU,OAAOA,CAAG;IAChE,AAAIuB,EAAS,SAAS,WAAW,KAC/BvC,EAAmBuC,CAAQ;IAE7B,IAAMC,IAAiB1G,EAAa,SAAS,CAAC,CAAC,WACzC2G,IAAY3B,GAAeyB,GAAUC,CAAc;IACzD,AAAIC,MAAc,YAChB3D,EAAoB,EAAI,IACf2D,MAAc,cACvBzD,EAAsB,EAAI,IACjByD,MAAc,eACvBvD,EAAsB,EAAI,IACjBuD,MAAc,aACvB7D,EAAqB,EAAI,IAChB6D,MAAc,wBACvBrD,EAAsB,EAAI;GAE9B;EApK2B;CAqK7B;CAGA,QAAgB;EACd,IAAIyB,GAAO;GACT,IAAM4B,IAAY3B,GAAeD,GAAO6B,EAAS;GACjD,AAAID,MAAc,YAChB3D,EAAoB,EAAI,IACf2D,MAAc,cACvBzD,EAAsB,EAAI,IACjByD,MAAc,eACvBvD,EAAsB,EAAI,IACjBuD,MAAc,aACvB7D,EAAqB,EAAI,IAChB6D,MAAc,wBACvBrD,EAAsB,EAAI;EAE9B;CACF,GAAG,CAACyB,GAAO6B,EAAS,CAAC;CAKrB,IAAMC,WAA0B;EAC9B,EAAc,IAAI;EAClB,IAAI;GACF,GAAoB;EACtB,SAAS3B,GAAK;GACZ,EACEA,aAAe,QACXA,EAAI,UACJjG,EACE,iCACA,mCACF,CACN;EACF;CACF,GAKM6H,WAA6B;EACjC,EAAc,IAAI;EAClB,IAAI;GACF,GAAuB;EACzB,SAAS5B,GAAK;GACZ,EACEA,aAAe,QACXA,EAAI,UACJjG,EACE,oCACA,sCACF,CACN;EACF;CACF,GAKM8H,KAA2B,YAAY;EAE3C,AADAvD,GAA2B,EAAI,GAC/BE,EAAiB,EAAK;EACtB,IAAI;GACF,IAAM6B,KAAgBxB,EAAS,SAAS,GAAA,CAAI,KAAK;GAEjD,CAAI,MADiBiD,GAAmBzB,CAAY,EAAA,CACzC,UACT7B,EAAiB,EAAI,IAErBQ,EACEjF,EACE,2BACA,wDACF,CACF;EAEJ,SAASiG,GAAK;GAEZ,AADA,QAAQ,MAAM,wCAAwCA,CAAG,GACzDhB,EACEgB,aAAe,QACXA,EAAI,UACJjG,EACE,2BACA,wDACF,CACN;EACF,UAAU;GACR,GAA2B,EAAK;EAClC;CACF,GAGMgI,KAAqBC,EAAqB,QAAQ,GAClDC,KAAwBD,EAAqB,WAAW,GAExDE,KAAiB,CACrB;EACE,MAAM;EACN,MAAMC;EACN,SAASR;EACT,UAAU,CAACI;EACX,SAASA,KACL,KAAA,IACAhI,EACE,kCACA,kCACF;CACN,GAWA;EACE,MAAM;EACN,MAAMqI;EACN,SAASR;EACT,UAAU,CAACK;EACX,SAASA,KACL,KAAA,IACAlI,EACE,qCACA,qCACF;CACN,CACF;CAMA,OAJIsB,KACK,kBAACgH,IAAD,CAAqB,CAAA,IAI5B,kBAACC,GAAD;EACE,OAAOvI,EAAG,0BAA0B,cAAc;EAClD,UAAUA,EACR,+BACA,oCACF;EALF,UAAA;GAOE,kBAACwI,IAAD;IAAa,WAAU;IACpB,UAAAxI,EACC,sBACA,uIACF;GACW,CAAA;GACb,kBAAC,QAAD;IAAM,UAAUqG;IAAc,WAAU;IAAxC,UAAA;KAEGzB,MACC,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OAEP,UAAA,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;OACH,CAAA;MACE,CAAA,GACL,kBAAC,KAAD;OAAG,WAAU;OAAiC,UAAAA;MAAe,CAAA,CAC1D;;KAINI,KACC,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAACyD,GAAD,EAAW,WAAU,uDAAwD,CAAA,GAC7E,kBAAC,KAAD;OAAG,WAAU;OACV,UAAAzD;MACA,CAAA,CACA;;KAINE,MACC,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAACuD,GAAD,EAAW,WAAU,uDAAwD,CAAA,GAC7E,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,KAAD;SAAG,WAAU;SACV,UAAAzI,EACC,+BACA,oCACF;QACC,CAAA;QACH,kBAAC,KAAD;SAAG,WAAU;SACV,UAAAA,EACC,mCACA,8FACF;QACC,CAAA;SACDqF,EAAmB,WAAW5F,MAC9B,kBAAC,UAAD;SACE,MAAK;SACL,eACES,EACE,mBACEmF,EAAmB,WAAW5F,KAAY,YAC5C,CACF;SAEF,WAAU;SATZ,UAAA,CAWE,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;UAEP,UAAA,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,aAAa;WACb,GAAE;UACH,CAAA;SACE,CAAA,GACJO,EACC,kCACA,4BACF,CACM;;OAEP;MACF,CAAA,CAAA;;KAIN8F,KAAS,CAACd,KAAmB,CAACE,MAC7B,kBAAC,OAAD;MACE,WAAW,gDACTtB,KAAqBM,KAAsBE,IACvC,6DACA;MAJR,UAAA,CAOE,kBAACqE,GAAD,EACE,WAAW,+BACT7E,KAAqBM,KAAsBE,IACvC,6BACA,2BAEP,CAAA,GACD,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,KAAD;SACE,WAAW,WACTR,KAAqBM,KAAsBE,IACvC,6BACA;SAGL,UAAAN,KACG9D,EACE,6BACA,oEACF,IACAgE,KACEhE,EACE,+BACA,yEACF,IACA4D,IACE5D,EACE,iCACA,oCACF,IACAkE,IACElE,EACE,wBACA,6EACF,IACAoE,IACEpE,EACE,+BACA,yFACF,IACA8F;QACX,CAAA;QACFlC,KACC,kBAAC,UAAD;SACE,MAAK;SACL,eACE1D,EAAS,oBAAoB,EAC3B,OAAO,EAAE,OAAO4E,EAAS,MAAM,EACjC,CAAC;SAEH,WAAU;SAET,UAAA9E,EACC,8BACA,uCACF;QACM,CAAA;QAEToE,KACC,kBAAC,OAAD;SAAK,WAAU;SACZ,UAAAI,KACC,kBAAC,OAAD;UAAK,WAAU;UAAf,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;WAEP,UAAA,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;WACH,CAAA;UACE,CAAA,GACJxE,EACC,+BACA,mDACF,CACG;SAEL,CAAA,IAAA,kBAAC,UAAD;UACE,MAAK;UACL,SAAS8H;UACT,UAAUxD;UACV,WAAU;UAET,UAAAA,KACC,kBAAAzF,GAAA,EAAA,UAAA,CACE,kBAAC8J,IAAD,EAAa,WAAU,sBAAuB,CAAA,GAC7C3I,EAAG,sBAAsB,YAAY,CACtC,EAAA,CAAA,IAEF,kBAAAnB,GAAA,EAAA,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;WAEP,UAAA,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;WACH,CAAA;UACE,CAAA,GACJmB,EACC,iCACA,2BACF,CACA,EAAA,CAAA;SAEE,CAAA;QAEP,CAAA;QAENkE,KACC,kBAAC,OAAD;SAAK,WAAU;SAAf,UAAA,CACG+D,EAAqB,QAAQ,KAC5B,kBAAC,UAAD;UACE,MAAK;UACL,SAASL;UACT,WAAU;UAHZ,UAAA,CAKE,kBAACQ,GAAD,EAAY,WAAU,SAAU,CAAA,GAC/BpI,EAAG,+BAA+B,qBAAqB,CAClD;SAET,CAAA,GAAAiI,EAAqB,WAAW,KAC/B,kBAAC,UAAD;UACE,MAAK;UACL,SAASJ;UACT,WAAU;UAHZ,UAAA,CAKE,kBAACQ,IAAD,EAAe,WAAU,SAAU,CAAA,GAClCrI,EACC,kCACA,wBACF,CACM;SAEP,CAAA,CAAA;;OAEJ;MACF,CAAA,CAAA;;KAIP,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAET,UAAAA,EAAG,yBAAyB,OAAO;MAC/B,CAAA,GACP,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA,CACE,kBAAC,OAAD;QAAK,WAAU;QACb,UAAA,kBAAC4I,IAAD,EAAW,WAAU,2CAA4C,CAAA;OAC9D,CAAA,GACL,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,cAAa;QACb,UAAA;QACA,iBAAc;QACd,cAAY5I,EAAG,yBAAyB,OAAO;QAC/C,OAAO8E,EAAS;QAChB,WAAW,MACTC,EAAY;SAAE,GAAGD;SAAU,OAAO,EAAE,OAAO;QAAM,CAAC;QAEpD,WAAU;QACV,aAAa9E,EAAG,+BAA+B,iBAAiB;OACjE,CAAA,CACE;MACF,CAAA,CAAA;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAET,UAAAA,EAAG,4BAA4B,UAAU;MACrC,CAAA,GACP,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,OAAD;SAAK,WAAU;SACb,UAAA,kBAAC6I,IAAD,EAAU,WAAU,2CAA4C,CAAA;QAC7D,CAAA;QACL,kBAAC,SAAD;SACE,IAAG;SACH,MAAMnF,IAAe,SAAS;SAC9B,cAAa;SACb,UAAA;SACA,iBAAc;SACd,cAAY1D,EAAG,4BAA4B,UAAU;SACrD,OAAO8E,EAAS;SAChB,WAAW,MACTC,EAAY;UAAE,GAAGD;UAAU,UAAU,EAAE,OAAO;SAAM,CAAC;SAEvD,WAAU;SACV,aAAa9E,EACX,kCACA,qBACF;QACD,CAAA;QACD,kBAAC,UAAD;SACE,MAAK;SACL,eAAe2D,GAAgB,CAACD,CAAY;SAC5C,cACEA,IACI1D,EAAG,2BAA2B,eAAe,IAC7CA,EAAG,2BAA2B,eAAe;SAEnD,WAAU;SAET,UACC8I,EADDpF,IACEqF,KAEAC,IAFD,EAAY,WAAU,SAAU,CAEH;QAEzB,CAAA;OACL;MACF,CAAA,CAAA;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAFZ,UAAA,CAIE,kBAACC,IAAD;QACE,IAAG;QACH,SAASnE,EAAS;QAClB,kBAAkB,MAAuC;SACvD,IAAMoE,IAAYC,MAAY;SAI9B,IAHApE,EAAY;UAAE,GAAGD;UAAU,YAAYoE;SAAU,CAAC,GAG9C,CAACA,GACH,IAAI;UACF,aAAa,WAAW,kBAAkB;SAC5C,SAASpD,GAAO;UACd,QAAQ,KACN,iDACAA,CACF;SACF;QAEJ;QACA,cAAY9F,EAAG,yBAAyB,aAAa;OACtD,CAAA,GACD,kBAAC,QAAD;QAAM,WAAU;QACb,UAAAA,EAAG,yBAAyB,aAAa;OACtC,CAAA,CACD;MACP,CAAA,GAAA,kBAAC,UAAD;OACE,MAAK;OACL,eAAeE,EAAS,sBAAsB;OAC9C,WAAU;OAET,UAAAF,EAAG,6BAA6B,kBAAkB;MAC7C,CAAA,CACL;;KAGL,kBAACoJ,IAAD;MACE,MAAK;MACL,UAAUC,KAAalI;MACvB,SAAQ;MACR,MAAK;MACL,WAAU;MAET,UAAAkI,KAAalI,IACZ,kBAAAtC,GAAA,EAAA,UAAA,CACE,kBAAC8J,IAAD,EAAa,WAAU,sBAAuB,CAAA,GAC9C,kBAAC,QAAD,EAAA,UACGxH,IACGnB,EACE,iCACA,yBACF,IACAA,EAAG,wBAAwB,eAAe,EAC1C,CAAA,CACN,EAAA,CAAA,IAEFA,EAAG,qBAAqB,SAAS;KAE7B,CAAA;IACJ;;GAGN,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA,CACE,kBAAC,OAAD;KAAK,WAAU;KACb,UAAA,kBAAC,OAAD,EAAK,WAAU,uDAAwD,CAAA;IACpE,CAAA,GACL,kBAAC,OAAD;KAAK,WAAU;KACb,UAAA,kBAAC,QAAD;MAAM,WAAU;MACb,UAAAA,EAAG,6BAA6B,kBAAkB;KAC/C,CAAA;IACH,CAAA,CACF;;GAGJ0E,MACC,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA,CACE,kBAAC+D,GAAD,EAAW,WAAU,qDAAsD,CAAA,GAC3E,kBAAC,KAAD;KAAG,WAAU;KAAkC,UAAA/D;IAAc,CAAA,CAC1D;;GAIP,kBAAC,OAAD;IAAK,WAAU;IACZ,UAAAyD,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAASmB,EAAS;KAClB,UAAUA,EAAS;KACnB,OAAOA,EAAS;KAChB,cAAYA,EAAS;KACrB,WAAW,wGACTA,EAAS,WACL,oGACA;KAVR,UAAA,CAaE,kBAACA,EAAS,MAAV,EACE,WAAW,UAAUA,EAAS,WAAW,eAAe,KACzD,CAAA,GACD,kBAAC,QAAD;MACE,WAAW,gEACTA,EAAS,WACL,sCACA;MAGL,UAAAA,EAAS;KACN,CAAA,CACA;IAxBD,GAAAA,EAAS,IAwBR,CACT;GACE,CAAA;GA4BL,kBAAC,OAAD;IAAK,WAAU;IACb,UAAA,kBAAC,UAAD;KACE,MAAK;KACL,eAAepJ,EAAS,kBAAkB;KAC1C,WAAU;KAHZ,UAAA;MAKGF,EAAG,iCAAiC,4BAA4B;MAAG;MACpE,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAA,EAAG,8BAA8B,yBAAyB;MACvD,CAAA;KACA;;GACL,CAAA;GAGL,kBAAC,KAAD;IAAG,WAAU;IAAb,UAAA;KACGA,EAAG,8BAA8B,wBAAwB;KAAG;KAC7D,kBAAC,UAAD;MACE,MAAK;MACL,eACEE,EACEqJ,GACE,kBACAC,GAAmB/J,CAAQ,CAC7B,CACF;MAEF,WAAU;MAET,UAAAO,EAAG,qBAAqB,SAAS;KAC5B,CAAA;IACP;;EACO;;AAEhB"}
+{"version":3,"file":"LoginPage.js","names":["_Fragment","isNativeShell","w","toSameOriginPath","target","url","hasValidAccessToken","raw","token","padded","payload","decodeSameOriginReturnTo","returnTo","stripStaleSsoParams","param","options","search","cleanReturnToValue","LoginPage","tr","useTr","navigate","useNavigate","location","useLocation","searchParams","useSearchParams","useAuthOperations","useMyWorkspaces","useActiveContext","navigateHost","useAuth","useOAuthOperations","mfaRequired","useAuthStore","state","executeCaptchaV3","useCaptchaV3","isCompletingAuth","setIsCompletingAuth","useState","isSsoRedirecting","setIsSsoRedirecting","buildPostLoginUrl","useCallback","intendedPath","bridge","resolveAuthBridgeConfig","bridgeUrl","currentOrigin","absoluteIntended","profileId","resolveActiveProfileId","tokens","getProfileTokens","user","getProfileUser","workspaceToken","getProfileWorkspaceToken","depositTokens","resolveGatewayUrls","minted","mintSsoSessionTokens","globalBaseUrl","markSsoDepositPending","buildSsoDepositUrl","getProfiles","redirectInitiatedRef","useRef","redirectAfterLogin","safePath","sanitizePostLoginPath","path","fragmentPath","sameOriginFragmentPath","resolve","beginSsoNavigation","showPassword","setShowPassword","isAccountInactive","setIsAccountInactive","isAccountDeleted","setIsAccountDeleted","isAccountSuspended","setIsAccountSuspended","isOAuthOnlyAccount","setIsOAuthOnlyAccount","isEmailNotVerified","setIsEmailNotVerified","isResendingVerification","setIsResendingVerification","resendSuccess","setResendSuccess","oauthError","setOauthError","infoMessage","setInfoMessage","formData","setFormData","validationError","setValidationError","isDuplicateAccount","setIsDuplicateAccount","isAddAccountMode","initialReturnToRef","reasonParam","useEffect","isSsoNavigationPending","defaultPostLoginPath","ssoUrl","getSSORedirectUrl","rememberedEmail","prev","error","checkErrorType","code","err","lowerErr","emailFromUrl","newUrl","handleSubmit","emailTrimmed","p","recaptchaToken","result","signIn","postMfaPath","MFA_REDIRECT","domain","domainPart","securePart","ssoValue","postLoginPath","authFlowResult","completeAuthFlow","setWorkspace","setOrganization","hostFragmentContinuation","authFlowError","errorMsg","storeErrorCode","errorType","errorCode","handleGoogleLogin","handleMicrosoftLogin","handleResendVerification","resendVerification","isGoogleConfigured","isProviderConfigured","isMicrosoftConfigured","oauthProviders","GoogleIcon","MicrosoftIcon","SSORedirectSpinner","AuthLayout","PagePurpose","AlertIcon","Fragment","SpinnerIcon","EmailIcon","LockIcon","jsx","EyeOffIcon","EyeIcon","Checkbox","isChecked","checked","Button","isLoading","provider","authPathWithReturnTo","sanitizeReturnPath"],"sources":["../../../src/auth/pages/LoginPage.tsx"],"sourcesContent":["import { useState, useEffect, useCallback, useRef } from \"react\";\nimport { useNavigate, useSearchParams, useLocation } from \"react-router\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport {\n  getSSORedirectUrl,\n  SSORedirectSpinner,\n} from \"@burdenoff/fe-libs/shared/components\";\nimport { resolveAuthBridgeConfig } from \"@burdenoff/fe-libs/shared/config\";\nimport { resolveGatewayUrls } from \"@burdenoff/fe-libs/shared/config/gatewayUrls\";\nimport {\n  beginSsoNavigation,\n  buildSsoDepositUrl,\n  isSsoNavigationPending,\n  markSsoDepositPending,\n  mintSsoSessionTokens,\n} from \"@burdenoff/fe-libs/shared/utils\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { Checkbox, PagePurpose } from \"@burdenoff/fe-libs/ui\";\n\nimport {\n  getProfileTokens,\n  getProfileUser,\n  getProfiles,\n  getProfileWorkspaceToken,\n  resolveActiveProfileId,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useMyWorkspaces } from \"../hooks/useMyWorkspaces\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport {\n  hostFragmentContinuation,\n  sameOriginFragmentPath,\n  sanitizePostLoginPath,\n} from \"../utils/redirect\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  // GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useCaptchaV3 } from \"../hooks/useCaptchaV3\";\nimport { MFA_REDIRECT } from \"../constants/sessionKeys\";\nimport type { SignInInput } from \"../types\";\nimport {\n  authPathWithReturnTo,\n  sanitizeReturnPath,\n} from \"../utils/pendingReturnTo\";\n\n/**\n * Detect whether the bundle is running inside a native shell (Capacitor on\n * iOS/Android, or Electron). Cross-origin SSO deposit/relay detours only make\n * sense in a multi-origin web context — in a native shell there is one product\n * origin, tokens already live in localStorage, and `window.location.assign` to\n * an external https URL escapes the embedded webview.\n *\n * Detection is runtime-only and avoids importing any platform-specific module\n * so this stays valid when microfe-auth is consumed by a pure web shell too.\n */\nfunction isNativeShell(): boolean {\n  if (typeof window === \"undefined\") return false;\n  const w = window as typeof window & {\n    Capacitor?: { isNativePlatform?: () => boolean };\n  };\n  if (typeof w.Capacitor?.isNativePlatform === \"function\") {\n    try {\n      if (w.Capacitor.isNativePlatform()) return true;\n    } catch {\n      /* fall through */\n    }\n  }\n  if (\n    typeof navigator !== \"undefined\" &&\n    /Electron/i.test(navigator.userAgent || \"\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\nfunction toSameOriginPath(target: string): string {\n  if (typeof window === \"undefined\") return target;\n  try {\n    const url = new URL(target, window.location.origin);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction hasValidAccessToken(token: string): boolean {\n  try {\n    const raw = token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n    const payload = JSON.parse(atob(padded)) as { exp?: unknown };\n    return typeof payload.exp === \"number\" && payload.exp > Date.now() / 1000;\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeSameOriginReturnTo(returnTo: string | null): string | null {\n  if (!returnTo) return null;\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    if (url.origin !== window.location.origin) return null;\n    return stripStaleSsoParams(url, { includeOrigin: false });\n  } catch {\n    return null;\n  }\n}\n\nfunction stripStaleSsoParams(\n  url: URL,\n  options: { includeOrigin: boolean },\n): string {\n  for (const param of [\"sso_failed\", \"sso-failed\", \"sso-attempted\"] as const) {\n    url.searchParams.delete(param);\n  }\n\n  if (options.includeOrigin) {\n    return url.toString();\n  }\n\n  const search = url.searchParams.toString();\n  return `${url.pathname}${search ? `?${search}` : \"\"}${url.hash}`;\n}\n\nfunction cleanReturnToValue(returnTo: string): string {\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    // Preserve cross-origin absolute returnTo values (e.g., redirects back to\n    // another product's app shell) — only strip stale SSO params.\n    const isCrossOrigin = url.origin !== window.location.origin;\n    return stripStaleSsoParams(url, { includeOrigin: isCrossOrigin });\n  } catch {\n    return returnTo;\n  }\n}\n\n/**\n * Login page with professional design\n * Provides email/password login and social OAuth options\n */\nexport function LoginPage() {\n  const tr = useTr();\n  const navigate = useNavigate();\n  const location = useLocation();\n  const [searchParams] = useSearchParams();\n\n  const { signIn, isLoading, error, errorCode, resendVerification } =\n    useAuthOperations();\n  const { completeAuthFlow } = useMyWorkspaces();\n  const { setWorkspace, setOrganization } = useActiveContext();\n  const { defaultPostLoginPath, navigate: navigateHost } = useAuth();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const mfaRequired = useAuthStore((state) => state.mfaRequired);\n  const { executeRecaptcha: executeCaptchaV3 } = useCaptchaV3();\n  const [isCompletingAuth, setIsCompletingAuth] = useState(false);\n  const [isSsoRedirecting, setIsSsoRedirecting] = useState(false);\n\n  /**\n   * Build the URL that should receive the post-login redirect.\n   *\n   * For cross-eTLD+1 SSO on alpha/prod we detour through the central bridge\n   * host (alphaapp/app.burdenoff.com) so the freshly-issued tokens land in\n   * the bridge origin's first-party (unpartitioned) localStorage. Without\n   * this step, a later direct visit to the bridge host has no local tokens\n   * and no shared cookie (cross-eTLD+1 cookies don't propagate), so the user\n   * sees the login page again.\n   *\n   * Skipped when:\n   *   - Already on the bridge host origin (would be a no-op self-redirect).\n   *   - The user's intended destination is itself on the bridge host\n   *     (likely an in-product navigation, no deposit needed).\n   *   - The freshly-stored profile snapshot can't be read (best-effort only —\n   *     login still succeeds via the direct redirect).\n   */\n  const buildPostLoginUrl = useCallback(\n    async (intendedPath: string): Promise<string> => {\n      if (typeof window === \"undefined\") return intendedPath;\n      // Native shells (Electron, Capacitor iOS/Android) run as a single origin —\n      // skip the cross-eTLD+1 deposit detour, which would otherwise navigate to\n      // an external https URL and escape the embedded webview.\n      if (isNativeShell()) return intendedPath;\n      try {\n        const bridge = resolveAuthBridgeConfig();\n        const bridgeUrl = new URL(bridge.url);\n        const currentOrigin = window.location.origin;\n        if (bridgeUrl.origin === currentOrigin) return intendedPath;\n\n        // intendedPath can be a path or an absolute URL; resolve to absolute\n        // against current origin so the bridge host knows where to send the\n        // user back.\n        const absoluteIntended = new URL(intendedPath, currentOrigin).href;\n\n        const profileId = resolveActiveProfileId();\n        if (!profileId) return intendedPath;\n        const tokens = getProfileTokens(profileId);\n        const user = getProfileUser(profileId);\n        if (!tokens || !user) return intendedPath;\n        const workspaceToken = getProfileWorkspaceToken(profileId);\n\n        // BOFF-4463: mint a DEDICATED refresh-token lineage for the bridge\n        // host. Copying this origin's pair verbatim meant the bridge (and\n        // every product it later relayed to) shared ONE rotating refresh\n        // token — the first origin to refresh revoked it for all others,\n        // surfacing as \"products log me out after minutes/hours\". Falls back\n        // to the legacy copy if the mutation is unreachable (rollout gap /\n        // transient failure) so SSO keeps working.\n        let depositTokens: Record<string, unknown> = {\n          ...tokens,\n          workspaceToken,\n        };\n        if (tokens.refreshToken) {\n          const { globalBaseUrl } = resolveGatewayUrls();\n          const { tokens: minted } = await mintSsoSessionTokens(\n            `${globalBaseUrl}/global/graphql`,\n            tokens.refreshToken,\n          );\n          if (minted) {\n            depositTokens = { ...minted, workspaceToken };\n          }\n        }\n\n        markSsoDepositPending(profileId);\n        return buildSsoDepositUrl(bridgeUrl.origin, absoluteIntended, {\n          profileId,\n          tokens: JSON.stringify(depositTokens),\n          user: JSON.stringify(user),\n          profiles: JSON.stringify(getProfiles()),\n        });\n      } catch {\n        return intendedPath;\n      }\n    },\n    [],\n  );\n\n  // Once a cross-document post-login redirect is initiated, the login page\n  // must FREEZE: resetting isCompletingAuth re-runs the auto-redirect effect\n  // and any state churn schedules same-document navigations that cancel the\n  // provisional deposit hop (BOFF-4463).\n  const redirectInitiatedRef = useRef(false);\n\n  const redirectAfterLogin = useCallback(\n    (path: string) => {\n      const safePath = sanitizePostLoginPath(path);\n      if (typeof window === \"undefined\") {\n        navigate(safePath);\n        return;\n      }\n      const fragmentPath = sameOriginFragmentPath(\n        safePath,\n        window.location.origin,\n      );\n      if (fragmentPath) {\n        // The authenticated profile is already stored on this origin. Do not\n        // copy a fragment capability into bridge payloads or return storage.\n        navigateHost(fragmentPath);\n        return;\n      }\n      try {\n        sessionStorage.setItem(\"bf-post-login-return-to\", safePath);\n      } catch {\n        // Ignore storage failures; redirect still proceeds.\n      }\n      // In native shells use SPA navigation so the embedded webview stays in\n      // the app — no full reload, no chance of the OS opening the URL\n      // externally. Tokens are already in this origin's localStorage.\n      if (isNativeShell()) {\n        navigate(toSameOriginPath(safePath));\n        return;\n      }\n      redirectInitiatedRef.current = true;\n      void (async () => {\n        // Cap the bridge URL build so a hanging SSO token mint cannot keep the\n        // login page stuck on the spinner (BOFF-6807). The sanitized path is\n        // always safe to redirect to directly.\n        const target = await Promise.race([\n          buildPostLoginUrl(safePath),\n          new Promise<string>((resolve) => {\n            window.setTimeout(() => resolve(safePath), 3000);\n          }),\n        ]);\n        if (target.includes(\"/auth/sso-deposit\")) {\n          // Cross-document deposit hop: suppress same-document navigators\n          // while it is provisional, and retry once if it still gets\n          // cancelled — on a committed navigation this document unloads and\n          // the timer never fires.\n          beginSsoNavigation();\n          window.location.assign(target);\n          window.setTimeout(() => {\n            beginSsoNavigation();\n            window.location.replace(target);\n          }, 2500);\n        } else {\n          window.location.assign(target);\n        }\n        // Fallback: if the document is still stuck on the login page after a\n        // full redirect attempt, force an in-app navigation so the spinner\n        // cannot stall forever (BOFF-6807). This only fires when the browser\n        // failed to leave /auth/login, e.g. because the computed target was\n        // still an auth URL or the location.assign was a no-op.\n        window.setTimeout(() => {\n          if (\n            typeof window !== \"undefined\" &&\n            window.location.pathname === \"/auth/login\"\n          ) {\n            navigate(\"/dashboard\");\n          }\n        }, 3500);\n      })();\n    },\n    [navigate, navigateHost, buildPostLoginUrl],\n  );\n  const [showPassword, setShowPassword] = useState(false);\n  const [isAccountInactive, setIsAccountInactive] = useState(false);\n  const [isAccountDeleted, setIsAccountDeleted] = useState(false);\n  const [isAccountSuspended, setIsAccountSuspended] = useState(false);\n  const [isOAuthOnlyAccount, setIsOAuthOnlyAccount] = useState(false);\n  const [isEmailNotVerified, setIsEmailNotVerified] = useState(false);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendSuccess, setResendSuccess] = useState(false);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [infoMessage, setInfoMessage] = useState<string | null>(null);\n  const [formData, setFormData] = useState<\n    SignInInput & { rememberMe?: boolean }\n  >({\n    email: \"\",\n    password: \"\",\n    rememberMe: false,\n  });\n  const [validationError, setValidationError] = useState<string | null>(null);\n  const [isDuplicateAccount, setIsDuplicateAccount] = useState(false);\n\n  // Detect add-account mode and returnTo from URL params\n  const isAddAccountMode = searchParams.get(\"mode\") === \"add-account\";\n  const returnTo = searchParams.get(\"returnTo\");\n  const initialReturnToRef = useRef<string | null>(returnTo);\n\n  // Tell the user WHY they are back on the login page. `session-expired` is\n  // set by the shell's forced logout (expired session whose refresh failed);\n  // `logout` covers explicit sign-outs and the SSO-clear fallback (which can\n  // rewrite a session-expired redirect's reason on the cross-product bounce).\n  // Without this the auto-logout looked like a silent, unexplained kick-out.\n  const reasonParam = searchParams.get(\"reason\");\n  useEffect(() => {\n    if (reasonParam === \"session-expired\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n    } else if (reasonParam === \"logout\") {\n      setInfoMessage(tr(\"auth.login.signedOut\", \"You have been signed out.\"));\n    }\n  }, [reasonParam, tr]);\n\n  useEffect(() => {\n    if (!initialReturnToRef.current && returnTo) {\n      initialReturnToRef.current = returnTo;\n    }\n  }, [returnTo]);\n\n  useEffect(() => {\n    if (isAddAccountMode || isCompletingAuth) return;\n    // A cross-document SSO navigation (deposit/relay hop) is already in\n    // flight — issuing another redirect here would cancel it (BOFF-4463).\n    if (redirectInitiatedRef.current || isSsoNavigationPending()) return;\n\n    const profileId = resolveActiveProfileId();\n    if (profileId) {\n      const tokens = getProfileTokens(profileId);\n      const user = getProfileUser(profileId);\n      if (\n        tokens?.accessToken &&\n        user &&\n        hasValidAccessToken(tokens.accessToken)\n      ) {\n        useAuthStore.getState().loadFromProfile(profileId);\n        redirectAfterLogin(\n          decodeSameOriginReturnTo(returnTo) ?? defaultPostLoginPath ?? \"/\",\n        );\n        return;\n      }\n    }\n\n    // A same-origin fragment continuation must remain here during\n    // sign-in too, not only after it. Only the host-declared destination can\n    // select this flow; an arbitrary returnTo query must not suppress SSO.\n    // Credential/MFA checks above and below still apply unchanged.\n    if (\n      sameOriginFragmentPath(defaultPostLoginPath ?? \"\", window.location.origin)\n    ) {\n      return;\n    }\n    const ssoUrl = getSSORedirectUrl();\n    if (ssoUrl) {\n      setIsSsoRedirecting(true);\n      window.location.replace(ssoUrl);\n    }\n  }, [\n    isAddAccountMode,\n    isCompletingAuth,\n    redirectAfterLogin,\n    returnTo,\n    defaultPostLoginPath,\n  ]);\n\n  // Load remembered email on mount and clean up any legacy plaintext password storage\n  useEffect(() => {\n    try {\n      // Security cleanup: remove any previously stored plaintext passwords\n      localStorage.removeItem(\"remembered_password\");\n\n      const rememberedEmail = localStorage.getItem(\"remembered_email\");\n\n      if (rememberedEmail) {\n        setFormData((prev) => ({\n          ...prev,\n          email: rememberedEmail,\n          rememberMe: true,\n        }));\n      }\n    } catch (error) {\n      console.warn(\"[LoginPage] Failed to load remembered email:\", error);\n    }\n  }, []);\n\n  // Check for redirect message and email from location state (e.g., from expired MFA or SSO redirect)\n  useEffect(() => {\n    const state = location.state as { message?: string; email?: string } | null;\n    if (state?.message) {\n      setInfoMessage(state.message);\n    }\n    if (state?.email) {\n      setFormData((prev) => ({ ...prev, email: state.email }));\n    }\n    // Clear state to prevent showing message on refresh\n    if (state) {\n      window.history.replaceState({}, document.title);\n    }\n  }, [location.state]);\n\n  // Determine error type from GraphQL error code (primary) or message (fallback).\n  // The backend sends structured codes in extensions.code which are propagated\n  // through useAuthOperations → authStore.errorCode.\n  const checkErrorType = (\n    err: string | null,\n    code?: string | null,\n  ):\n    | \"DELETED\"\n    | \"SUSPENDED\"\n    | \"OAUTH_ONLY\"\n    | \"INACTIVE\"\n    | \"EMAIL_NOT_VERIFIED\"\n    | null => {\n    // Primary: match on GraphQL error code from extensions\n    if (code) {\n      switch (code) {\n        case \"ACCOUNT_DELETED\":\n          return \"DELETED\";\n        case \"ACCOUNT_SUSPENDED\":\n          return \"SUSPENDED\";\n        case \"OAUTH_ONLY_ACCOUNT\":\n          return \"OAUTH_ONLY\";\n        case \"ACCOUNT_INACTIVE\":\n          return \"INACTIVE\";\n        case \"EMAIL_NOT_VERIFIED\":\n          return \"EMAIL_NOT_VERIFIED\";\n        default:\n          break;\n      }\n    }\n\n    // Fallback: match on error message for non-GraphQL errors or legacy responses\n    if (!err) return null;\n    const lowerErr = err.toLowerCase();\n\n    if (\n      lowerErr.includes(\"deleted\") ||\n      lowerErr.includes(\"permanently deleted\")\n    ) {\n      return \"DELETED\";\n    }\n    if (lowerErr.includes(\"suspended\")) {\n      return \"SUSPENDED\";\n    }\n    if (\n      lowerErr.includes(\"oauth provider\") ||\n      lowerErr.includes(\"oauth-only\") ||\n      lowerErr.includes(\"oauth only\")\n    ) {\n      return \"OAUTH_ONLY\";\n    }\n    if (\n      lowerErr.includes(\"inactive\") ||\n      lowerErr.includes(\"deactivated\") ||\n      lowerErr.includes(\"not active\")\n    ) {\n      return \"INACTIVE\";\n    }\n    if (\n      lowerErr.includes(\"verify your email\") ||\n      lowerErr.includes(\"email not verified\") ||\n      lowerErr.includes(\"email_not_verified\")\n    ) {\n      return \"EMAIL_NOT_VERIFIED\";\n    }\n    return null;\n  };\n\n  // Pre-fill email from URL query parameter (e.g., after email verification)\n  useEffect(() => {\n    const emailFromUrl = searchParams.get(\"email\");\n    if (emailFromUrl) {\n      setFormData((prev) => ({ ...prev, email: emailFromUrl }));\n    }\n\n    // Check for expired session redirect\n    const isExpired = searchParams.get(\"expired\");\n    if (isExpired === \"true\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n      // Clear the query param to prevent showing on refresh\n      const newUrl = window.location.pathname;\n      window.history.replaceState({}, document.title, newUrl);\n    }\n  }, [searchParams, tr]);\n\n  // Redirect to MFA verification when required\n  useEffect(() => {\n    if (mfaRequired) {\n      navigate(\"/auth/mfa-verify\");\n    }\n  }, [mfaRequired, navigate]);\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n    setIsAccountInactive(false);\n    setIsAccountDeleted(false);\n    setIsAccountSuspended(false);\n    setIsOAuthOnlyAccount(false);\n    setIsEmailNotVerified(false);\n    setIsDuplicateAccount(false);\n    setResendSuccess(false);\n    setValidationError(null);\n\n    // Client-side validation\n    const emailTrimmed = (formData.email ?? \"\").trim();\n    if (!emailTrimmed) {\n      setValidationError(\n        tr(\n          \"auth.login.enterEmailOrUsername\",\n          \"Please enter your email or username\",\n        ),\n      );\n      return;\n    }\n\n    // Basic email format validation (if it contains @)\n    if (emailTrimmed.includes(\"@\")) {\n      const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n      if (!emailRegex.test(emailTrimmed)) {\n        setValidationError(\n          tr(\"auth.login.invalidEmail\", \"Please enter a valid email address\"),\n        );\n        return;\n      }\n    }\n\n    if (!formData.password || formData.password.length < 1) {\n      setValidationError(\n        tr(\"auth.login.enterPassword\", \"Please enter your password\"),\n      );\n      return;\n    }\n\n    // In add-account mode, check if this email is already signed in\n    if (isAddAccountMode) {\n      const existingProfiles = getProfiles();\n      const alreadySignedIn = existingProfiles.some(\n        (p) => p.email.toLowerCase() === emailTrimmed.toLowerCase(),\n      );\n      if (alreadySignedIn) {\n        setIsDuplicateAccount(true);\n        setValidationError(null);\n        return;\n      }\n    }\n    setIsDuplicateAccount(false);\n\n    try {\n      // Get reCAPTCHA v3 token (no-op when captcha is disabled)\n      const recaptchaToken = await executeCaptchaV3(\"login\");\n\n      const result = await signIn({\n        email: emailTrimmed,\n        password: formData.password,\n        rememberMe: formData.rememberMe,\n        ...(recaptchaToken ? { recaptchaToken } : {}),\n      });\n\n      // If MFA is required, the useEffect above will handle redirect\n      if (result.requiresMFA) {\n        // Persist the post-login destination so MfaVerifyPage honors\n        // `returnTo` and `defaultPostLoginPath` after the user completes\n        // verification — otherwise the MFA path falls back to \"/\" and the\n        // host-configured home (e.g. \"/vibecontrols\") is lost.\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postMfaPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          sessionStorage.setItem(MFA_REDIRECT, postMfaPath);\n        } catch {\n          // sessionStorage may be unavailable (private mode, quota) — the\n          // MFA page still works, it just defaults to \"/\" on completion.\n        }\n        return;\n      }\n\n      // Successful login - complete auth flow (fetch workspaces + issue token)\n      if (result.success) {\n        try {\n          const profileId = result.user?.id;\n          if (profileId) {\n            const hostname = window.location.hostname;\n            const domain = hostname.endsWith(\".local.burdenoff.com\")\n              ? \".local.burdenoff.com\"\n              : undefined;\n            const domainPart = domain ? `; domain=${domain}` : \"\";\n            const securePart =\n              window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n            const ssoValue = JSON.stringify({\n              id: profileId,\n              origin: window.location.origin,\n            });\n            document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n            document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n          }\n        } catch {\n          // Best effort only. Login can continue without the fast-path cookie.\n        }\n\n        // Handle Remember Me: Save or clear email only (never store passwords)\n        try {\n          if (formData.rememberMe) {\n            localStorage.setItem(\"remembered_email\", emailTrimmed);\n          } else {\n            localStorage.removeItem(\"remembered_email\");\n          }\n        } catch (error) {\n          console.warn(\n            \"[LoginPage] Failed to save/clear remembered email:\",\n            error,\n          );\n        }\n\n        setIsCompletingAuth(true);\n        // In add-account mode, redirect back to where the user was\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postLoginPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          type AuthFlowResult = Awaited<ReturnType<typeof completeAuthFlow>>;\n          // Pass the token directly to avoid race condition with React state updates\n          const authFlowResult = await Promise.race<AuthFlowResult>([\n            completeAuthFlow(result.token),\n            new Promise<AuthFlowResult>((resolve) => {\n              window.setTimeout(() => {\n                resolve({\n                  success: false,\n                  error: \"Auth flow timed out after login\",\n                });\n              }, 5000);\n            }),\n          ]);\n\n          if (authFlowResult.success) {\n            // Sync workspace and organization to ActiveContext\n            // This is critical for global search and other workspace-scoped features\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n\n            // Full auth flow completed - redirect to dashboard or returnTo\n            redirectAfterLogin(postLoginPath);\n          } else if (authFlowResult.error?.includes(\"No workspaces found\")) {\n            // A context-free invitation can establish canonical membership after\n            // sign-in. Do not force a new organization/workspace first merely\n            // because this authenticated actor has no discovery inventory yet.\n            if (\n              hostFragmentContinuation(\n                postLoginPath,\n                defaultPostLoginPath,\n                window.location.origin,\n              )\n            ) {\n              redirectAfterLogin(postLoginPath);\n            } else {\n              navigate(\"/onboarding/create-workspace\");\n            }\n          } else {\n            // Partial success or error - still sync workspace if available and redirect\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n            console.warn(\"Auth flow warning:\", authFlowResult.error);\n            redirectAfterLogin(postLoginPath);\n          }\n        } catch (authFlowError) {\n          // Auth flow failed but login succeeded - still redirect\n          console.error(\"Auth flow error (login succeeded):\", authFlowError);\n          redirectAfterLogin(postLoginPath);\n        } finally {\n          // Keep the completing state (spinner) once a redirect is in\n          // flight: resetting it re-arms the auto-redirect effect whose\n          // competing navigation cancels the deposit hop (BOFF-4463). The\n          // page is about to unload anyway.\n          if (!redirectInitiatedRef.current) {\n            setIsCompletingAuth(false);\n          }\n        }\n      }\n    } catch (err) {\n      if (import.meta.env.DEV) {\n        console.error(\"Sign in failed:\", err);\n      }\n      // Check error type using error code (from store) and message\n      const errorMsg = err instanceof Error ? err.message : String(err);\n      if (errorMsg.includes(\"reCAPTCHA\")) {\n        setValidationError(errorMsg);\n      }\n      const storeErrorCode = useAuthStore.getState().errorCode;\n      const errorType = checkErrorType(errorMsg, storeErrorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  };\n\n  // Also check the error from useAuthOperations\n  useEffect(() => {\n    if (error) {\n      const errorType = checkErrorType(error, errorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  }, [error, errorCode]);\n\n  /**\n   * Handle Google OAuth login\n   */\n  const handleGoogleLogin = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.googleSignInFailed\",\n              \"Failed to initiate Google sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth login\n   */\n  const handleMicrosoftLogin = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.microsoftSignInFailed\",\n              \"Failed to initiate Microsoft sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle resend verification email\n   */\n  const handleResendVerification = async () => {\n    setIsResendingVerification(true);\n    setResendSuccess(false);\n    try {\n      const emailTrimmed = (formData.email ?? \"\").trim();\n      const result = await resendVerification(emailTrimmed);\n      if (result.success) {\n        setResendSuccess(true);\n      } else {\n        setValidationError(\n          tr(\n            \"auth.login.resendFailed\",\n            \"Failed to resend verification email. Please try again.\",\n          ),\n        );\n      }\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      setValidationError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.resendFailed\",\n              \"Failed to resend verification email. Please try again.\",\n            ),\n      );\n    } finally {\n      setIsResendingVerification(false);\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleLogin,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.login.googleNotConfigured\",\n            \"Google sign in is not configured\",\n          ),\n    },\n    // {\n    //   name: \"GitHub\",\n    //   icon: GitHubIcon,\n    //   onClick: () => {},\n    //   disabled: true,\n    //   tooltip: tr(\n    //     \"auth.login.githubNotConfigured\",\n    //     \"GitHub sign in is not configured\",\n    //   ),\n    // },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftLogin,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.login.microsoftNotConfigured\",\n            \"Microsoft sign in is not configured\",\n          ),\n    },\n  ];\n\n  if (isSsoRedirecting) {\n    return <SSORedirectSpinner />;\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.login.welcomeBack\", \"Welcome back\")}\n      subtitle={tr(\n        \"auth.login.enterCredentials\",\n        \"Enter your credentials to continue\",\n      )}\n    >\n      <PagePurpose className=\"mb-5\">\n        {tr(\n          \"auth.login.purpose\",\n          \"Sign in to reach your workspaces, agents, and settings. Use your email and password, a social provider, or a passwordless magic link.\",\n        )}\n      </PagePurpose>\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Info Message (e.g., from expired MFA redirect) */}\n        {infoMessage && (\n          <div\n            role=\"status\"\n            className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border\"\n          >\n            <svg\n              className=\"size-5 flex-shrink-0 mt-0.5 text-text-link\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z\"\n              />\n            </svg>\n            <p className=\"text-sm text-status-info-text\">{infoMessage}</p>\n          </div>\n        )}\n\n        {/* Validation Error */}\n        {validationError && (\n          <div\n            role=\"alert\"\n            className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\"\n          >\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <p className=\"text-sm text-status-warning-text\">\n              {validationError}\n            </p>\n          </div>\n        )}\n\n        {/* Duplicate Account Warning (Add Account mode) */}\n        {isDuplicateAccount && (\n          <div\n            role=\"alert\"\n            className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\"\n          >\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <div className=\"flex-1\">\n              <p className=\"text-sm font-medium text-status-warning-text\">\n                {tr(\n                  \"auth.login.duplicateAccount\",\n                  \"This account is already signed in.\",\n                )}\n              </p>\n              <p className=\"mt-1 text-sm text-status-warning-text/80\">\n                {tr(\n                  \"auth.login.duplicateAccountHint\",\n                  \"Please use a different account, or go back and switch to this account from the profile menu.\",\n                )}\n              </p>\n              {(initialReturnToRef.current || returnTo) && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\n                      decodeURIComponent(\n                        initialReturnToRef.current || returnTo || \"/dashboard\",\n                      ),\n                    )\n                  }\n                  className=\"mt-3 inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm\"\n                >\n                  <svg\n                    className=\"size-4\"\n                    fill=\"none\"\n                    viewBox=\"0 0 24 24\"\n                    stroke=\"currentColor\"\n                  >\n                    <path\n                      strokeLinecap=\"round\"\n                      strokeLinejoin=\"round\"\n                      strokeWidth={2}\n                      d=\"M10 19l-7-7m0 0l7-7m-7 7h18\"\n                    />\n                  </svg>\n                  {tr(\n                    \"auth.login.goBackSwitchAccount\",\n                    \"Go back and switch account\",\n                  )}\n                </button>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Error Alert */}\n        {error && !validationError && !isDuplicateAccount && (\n          <div\n            role=\"alert\"\n            className={`flex items-start gap-3 p-4 rounded-xl border ${\n              isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                ? \"bg-status-warning-bg-subtle border-status-warning-border\"\n                : \"bg-status-error-bg-subtle border-status-error-border\"\n            }`}\n          >\n            <AlertIcon\n              className={`size-5 flex-shrink-0 mt-0.5 ${\n                isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                  ? \"text-status-warning-text\"\n                  : \"text-status-error-text\"\n              }`}\n            />\n            <div className=\"flex-1\">\n              <p\n                className={`text-sm ${\n                  isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                    ? \"text-status-warning-text\"\n                    : \"text-status-error-text\"\n                }`}\n              >\n                {isAccountDeleted\n                  ? tr(\n                      \"auth.login.accountDeleted\",\n                      \"This account has been permanently deleted and cannot be recovered.\",\n                    )\n                  : isAccountSuspended\n                    ? tr(\n                        \"auth.login.accountSuspended\",\n                        \"Your account has been suspended. Please contact support for assistance.\",\n                      )\n                    : isAccountInactive\n                      ? tr(\n                          \"auth.login.accountDeactivated\",\n                          \"Your account has been deactivated.\",\n                        )\n                      : isOAuthOnlyAccount\n                        ? tr(\n                            \"auth.login.oauthOnly\",\n                            \"This account uses OAuth sign-in. Please use Google or Microsoft to sign in.\",\n                          )\n                        : isEmailNotVerified\n                          ? tr(\n                              \"auth.login.emailNotVerified\",\n                              \"Please verify your email before signing in. Check your inbox for the verification link.\",\n                            )\n                          : error}\n              </p>\n              {isAccountInactive && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\"/auth/reactivate\", {\n                      state: { email: formData.email },\n                    })\n                  }\n                  className=\"mt-2 text-sm font-semibold text-status-warning-text hover:text-status-warning-text underline underline-offset-2\"\n                >\n                  {tr(\n                    \"auth.login.clickReactivate\",\n                    \"Click here to reactivate your account\",\n                  )}\n                </button>\n              )}\n              {isEmailNotVerified && (\n                <div className=\"mt-3\">\n                  {resendSuccess ? (\n                    <div className=\"flex items-center gap-2 text-sm text-status-success-text\">\n                      <svg\n                        className=\"size-4\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M5 13l4 4L19 7\"\n                        />\n                      </svg>\n                      {tr(\n                        \"auth.login.verificationSent\",\n                        \"Verification email sent! Please check your inbox.\",\n                      )}\n                    </div>\n                  ) : (\n                    <button\n                      type=\"button\"\n                      onClick={handleResendVerification}\n                      disabled={isResendingVerification}\n                      className=\"inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm disabled:opacity-50 disabled:cursor-not-allowed\"\n                    >\n                      {isResendingVerification ? (\n                        <>\n                          <SpinnerIcon className=\"size-4 animate-spin\" />\n                          {tr(\"auth.login.sending\", \"Sending...\")}\n                        </>\n                      ) : (\n                        <>\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                            />\n                          </svg>\n                          {tr(\n                            \"auth.login.resendVerification\",\n                            \"Resend verification email\",\n                          )}\n                        </>\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n              {isOAuthOnlyAccount && (\n                <div className=\"mt-3 flex flex-col gap-2\">\n                  {isProviderConfigured(\"google\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleGoogleLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <GoogleIcon className=\"size-5\" />\n                      {tr(\"auth.login.signInWithGoogle\", \"Sign in with Google\")}\n                    </button>\n                  )}\n                  {isProviderConfigured(\"microsoft\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleMicrosoftLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <MicrosoftIcon className=\"size-5\" />\n                      {tr(\n                        \"auth.login.signInWithMicrosoft\",\n                        \"Sign in with Microsoft\",\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.emailLabel\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.emailLabel\", \"Email\")}\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\"auth.login.emailPlaceholder\", \"you@example.com\")}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.passwordLabel\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              autoComplete=\"current-password\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.passwordLabel\", \"Password\")}\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.login.passwordPlaceholder\",\n                \"Enter your password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={\n                showPassword\n                  ? tr(\"auth.login.hidePassword\", \"Hide password\")\n                  : tr(\"auth.login.showPassword\", \"Show password\")\n              }\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"size-5\" />\n              ) : (\n                <EyeIcon className=\"size-5\" />\n              )}\n            </button>\n          </div>\n        </div>\n\n        {/* Remember & Forgot */}\n        <div className=\"flex items-center justify-between\">\n          <label\n            htmlFor=\"remember-me\"\n            className=\"flex items-center gap-2 cursor-pointer group\"\n          >\n            <Checkbox\n              id=\"remember-me\"\n              checked={formData.rememberMe}\n              onCheckedChange={(checked: boolean | \"indeterminate\") => {\n                const isChecked = checked === true;\n                setFormData({ ...formData, rememberMe: isChecked });\n\n                // Clear saved email immediately when unchecked\n                if (!isChecked) {\n                  try {\n                    localStorage.removeItem(\"remembered_email\");\n                  } catch (error) {\n                    console.warn(\n                      \"[LoginPage] Failed to clear remembered email:\",\n                      error,\n                    );\n                  }\n                }\n              }}\n              aria-label={tr(\"auth.login.rememberMe\", \"Remember me\")}\n            />\n            <span className=\"text-sm text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)] transition-colors\">\n              {tr(\"auth.login.rememberMe\", \"Remember me\")}\n            </span>\n          </label>\n          <button\n            type=\"button\"\n            onClick={() => navigate(\"/auth/reset-password\")}\n            className=\"text-sm font-medium text-text-link hover:text-text-linkHover transition-colors\"\n          >\n            {tr(\"auth.login.forgotPassword\", \"Forgot password?\")}\n          </button>\n        </div>\n\n        {/* Submit Button */}\n        <Button\n          type=\"submit\"\n          disabled={isLoading || isCompletingAuth}\n          variant=\"default\"\n          size=\"lg\"\n          className=\"w-full font-semibold\"\n        >\n          {isLoading || isCompletingAuth ? (\n            <>\n              <SpinnerIcon className=\"size-5 animate-spin\" />\n              <span>\n                {isCompletingAuth\n                  ? tr(\n                      \"auth.login.settingUpWorkspace\",\n                      \"Setting up workspace...\",\n                    )\n                  : tr(\"auth.login.signingIn\", \"Signing in...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.login.signIn\", \"Sign in\")\n          )}\n        </Button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.login.orContinueWith\", \"or continue with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            aria-label={provider.name}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`size-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Enterprise SSO Option — temporarily hidden */}\n      {/* <div className=\"mt-6\">\n        <button type=\"button\"\n          onClick={() => navigate(\"/auth/sso/login\")}\n          className=\"w-full flex items-center justify-center gap-3 px-4 py-3 rounded-xl border-2 border-dashed border-[var(--color-border-default)] hover:border-action-primary-bg bg-[var(--color-bg-surface)] hover:bg-status-info-bg-subtle transition-all duration-200 group\"\n        >\n          <svg\n            className=\"size-5 text-[var(--color-text-tertiary)] group-hover:text-text-link\"\n            fill=\"none\"\n            viewBox=\"0 0 24 24\"\n            stroke=\"currentColor\"\n          >\n            <path\n              strokeLinecap=\"round\"\n              strokeLinejoin=\"round\"\n              strokeWidth={1.5}\n              d=\"M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4\"\n            />\n          </svg>\n          <span className=\"text-sm font-medium text-[var(--color-text-secondary)] group-hover:text-text-link\">\n            {tr(\"auth.login.enterpriseSso\", \"Sign in with Enterprise SSO\")}\n          </span>\n        </button>\n      </div> */}\n\n      {/* Magic Link Option */}\n      <div className=\"mt-4 text-center\">\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/magic-link\")}\n          className=\"text-sm text-[var(--color-text-secondary)] hover:text-[var(--color-text-primary)] transition-colors\"\n        >\n          {tr(\"auth.login.preferPasswordless\", \"Prefer passwordless login?\")}{\" \"}\n          <span className=\"font-semibold text-text-link hover:text-text-linkHover\">\n            {tr(\"auth.login.signInMagicLink\", \"Sign in with Magic Link\")}\n          </span>\n        </button>\n      </div>\n\n      {/* Sign Up Link */}\n      <p className=\"mt-6 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.login.dontHaveAccount\", \"Don't have an account?\")}{\" \"}\n        <button\n          type=\"button\"\n          onClick={() =>\n            navigate(\n              authPathWithReturnTo(\n                \"/auth/register\",\n                sanitizeReturnPath(returnTo),\n              ),\n            )\n          }\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.login.signUp\", \"Sign up\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmEA,SAASC,IAAyB;CAChC,IAAI,OAAO,SAAW,KAAa,OAAO;CAC1C,IAAMC,IAAI;CAGV,IAAI,OAAOA,EAAE,WAAW,oBAAqB,YAC3C,IAAI;EACF,IAAIA,EAAE,UAAU,iBAAiB,GAAG,OAAO;CAC7C,QAAQ,CAER;CAQF,OANA,GACE,OAAO,YAAc,OACrB,YAAY,KAAK,UAAU,aAAa,EAAE;AAK9C;AAEA,SAASC,GAAiB,GAAwB;CAChD,IAAI,OAAO,SAAW,KAAa,OAAOC;CAC1C,IAAI;EACF,IAAMC,IAAM,IAAI,IAAID,GAAQ,OAAO,SAAS,MAAM;EAClD,OAAO,GAAGC,EAAI,WAAWA,EAAI,SAASA,EAAI;CAC5C,QAAQ;EACN,OAAOD;CACT;AACF;AAEA,SAASE,GAAoB,GAAwB;CACnD,IAAI;EACF,IAAMC,IAAMC,EAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,GAC9DC,IAASF,EAAI,OAAO,KAAK,KAAKA,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtDG,IAAU,KAAK,MAAM,KAAKD,CAAM,CAAC;EACvC,OAAO,OAAOC,EAAQ,OAAQ,YAAYA,EAAQ,MAAM,KAAK,IAAI,IAAI;CACvE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAASC,GAAyB,GAAwC;CACxE,IAAI,CAACC,GAAU,OAAO;CACtB,IAAI;EAEF,IAAMP,IAAM,IAAI,IADA,mBAAmBO,CACf,GAAS,OAAO,SAAS,MAAM;EAEnD,OADIP,EAAI,WAAW,OAAO,SAAS,SAC5BQ,EAAoBR,GAAK,EAAE,eAAe,GAAM,CAAC,IADN;CAEpD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAASQ,EACP,GACA,GACQ;CACR,KAAK,IAAMC,KAAS;EAAC;EAAc;EAAc;CAAe,GAC9D,EAAI,aAAa,OAAOA,CAAK;CAG/B,IAAIC,EAAQ,eACV,OAAOV,EAAI,SAAS;CAGtB,IAAMW,IAASX,EAAI,aAAa,SAAS;CACzC,OAAO,GAAGA,EAAI,WAAWW,IAAS,IAAIA,MAAW,KAAKX,EAAI;AAC5D;AAEA,SAASY,EAAmB,GAA0B;CACpD,IAAI;EAEF,IAAMZ,IAAM,IAAI,IADA,mBAAmBO,CACf,GAAS,OAAO,SAAS,MAAM;EAInD,OAAOC,EAAoBR,GAAK,EAAE,eADZA,EAAI,WAAW,OAAO,SAAS,OACU,CAAC;CAClE,QAAQ;EACN,OAAOO;CACT;AACF;AAMA,SAAgBM,IAAY;CAC1B,IAAMC,IAAKC,EAAM,GACXC,IAAWC,GAAY,GACvBC,IAAWC,GAAY,GACvB,CAACC,KAAgBC,GAAgB,GAEjC,EAAE,YAAQ,cAAW,UAAO,eAAW,2BAC3CC,EAAkB,GACd,EAAE,yBAAqBC,EAAgB,GACvC,EAAE,kBAAc,wBAAoBC,GAAiB,GACrD,EAAE,yBAAsB,UAAUC,OAAiBC,EAAQ,GAC3D,EAAE,yBAAqB,4BAAwB,4BACnDC,EAAmB,GACfC,KAAcC,GAAc,MAAUC,EAAM,WAAW,GACvD,EAAE,kBAAkBC,OAAqBC,GAAa,GACtD,CAACC,GAAkBC,MAAuBC,EAAS,EAAK,GACxD,CAACC,IAAkBC,MAAuBF,EAAS,EAAK,GAmBxDG,IAAoBC,GACxB,OAAO,MAA0C;EAK/C,IAJI,OAAO,SAAW,OAIlB3C,EAAc,GAAG,OAAO4C;EAC5B,IAAI;GACF,IAAMC,IAASC,GAAwB,GACjCC,IAAY,IAAI,IAAIF,EAAO,GAAG,GAC9BG,IAAgB,OAAO,SAAS;GACtC,IAAID,EAAU,WAAWC,GAAe,OAAOJ;GAK/C,IAAMK,IAAmB,IAAI,IAAIL,GAAcI,CAAa,CAAC,CAAC,MAExDE,IAAYC,EAAuB;GACzC,IAAI,CAACD,GAAW,OAAON;GACvB,IAAMQ,IAASC,GAAiBH,CAAS,GACnCI,IAAOC,GAAeL,CAAS;GACrC,IAAI,CAACE,KAAU,CAACE,GAAM,OAAOV;GAC7B,IAAMY,IAAiBC,GAAyBP,CAAS,GASrDQ,IAAyC;IAC3C,GAAGN;IACH;GACF;GACA,IAAIA,EAAO,cAAc;IACvB,IAAM,EAAE,qBAAkBO,GAAmB,GACvC,EAAE,QAAQC,MAAW,MAAMC,GAC/B,GAAGC,EAAc,kBACjBV,EAAO,YACT;IACA,AAAIQ,MACF,IAAgB;KAAE,GAAGA;KAAQ;IAAe;GAEhD;GAGA,OADAG,GAAsBb,CAAS,GACxBc,GAAmBjB,EAAU,QAAQE,GAAkB;IAC5D;IACA,QAAQ,KAAK,UAAUS,CAAa;IACpC,MAAM,KAAK,UAAUJ,CAAI;IACzB,UAAU,KAAK,UAAUW,EAAY,CAAC;GACxC,CAAC;EACH,QAAQ;GACN,OAAOrB;EACT;CACF,GACA,CAAC,CACH,GAMMsB,IAAuBC,GAAO,EAAK,GAEnCC,IAAqBzB,IACxB,MAAiB;EAChB,IAAM0B,IAAWC,EAAsBC,CAAI;EAC3C,IAAI,OAAO,SAAW,KAAa;GACjC,EAASF,CAAQ;GACjB;EACF;EACA,IAAMG,IAAeC,EACnBJ,GACA,OAAO,SAAS,MAClB;EACA,IAAIG,GAGF,GAAaA,CAAY;OAG3B;OAAI;IACF,eAAe,QAAQ,2BAA2BH,CAAQ;GAC5D,QAAQ,CAER;GAIA,AAAIrE,EAAc,IAChBoB,EAASlB,GAAiBmE,CAAQ,CAAC,KAGrC,EAAqB,UAAU,KACzB,YAAY;IAIhB,IAAMlE,IAAS,MAAM,QAAQ,KAAK,CAChCuC,EAAkB2B,CAAQ,GAC1B,IAAI,SAAiB,MAAY;KAC/B,OAAO,iBAAiBK,EAAQL,CAAQ,GAAG,GAAI;IACjD,CAAC,CACH,CAAC;IAoBD,AAnBIlE,EAAO,SAAS,mBAAmB,KAKrCwE,GAAmB,GACnB,OAAO,SAAS,OAAOxE,CAAM,GAC7B,OAAO,iBAAiB;KAEtB,AADAwE,GAAmB,GACnB,OAAO,SAAS,QAAQxE,CAAM;IAChC,GAAG,IAAI,KAEP,OAAO,SAAS,OAAOA,CAAM,GAO/B,OAAO,iBAAiB;KACtB,AACE,OAAO,SAAW,OAClB,OAAO,SAAS,aAAa,iBAE7BiB,EAAS,YAAY;IAEzB,GAAG,IAAI;GACT,EAAA,CAAG;EA9CH;CA+CF,GACA;EAACA;EAAUS;EAAca;CAAiB,CAC5C,GACM,CAACkC,GAAcC,MAAmBtC,EAAS,EAAK,GAChD,CAACuC,GAAmBC,KAAwBxC,EAAS,EAAK,GAC1D,CAACyC,IAAkBC,KAAuB1C,EAAS,EAAK,GACxD,CAAC2C,IAAoBC,KAAyB5C,EAAS,EAAK,GAC5D,CAAC6C,GAAoBC,KAAyB9C,EAAS,EAAK,GAC5D,CAAC+C,GAAoBC,KAAyBhD,EAAS,EAAK,GAC5D,CAACiD,IAAyBC,MAA8BlD,EAAS,EAAK,GACtE,CAACmD,IAAeC,KAAoBpD,EAAS,EAAK,GAClD,CAACqD,IAAYC,KAAiBtD,EAAwB,IAAI,GAC1D,CAACuD,IAAaC,KAAkBxD,EAAwB,IAAI,GAC5D,CAACyD,GAAUC,KAAe1D,EAE9B;EACA,OAAO;EACP,UAAU;EACV,YAAY;CACd,CAAC,GACK,CAAC2D,GAAiBC,KAAsB5D,EAAwB,IAAI,GACpE,CAAC6D,IAAoBC,KAAyB9D,EAAS,EAAK,GAG5D+D,IAAmB9E,EAAa,IAAI,MAAM,MAAM,eAChDb,IAAWa,EAAa,IAAI,UAAU,GACtC+E,IAAqBpC,GAAsBxD,CAAQ,GAOnD6F,IAAchF,EAAa,IAAI,QAAQ;CAsF7C,AArFAiF,QAAgB;EACd,AAAID,MAAgB,oBAClBT,EACE7E,EACE,6BACA,iDACF,CACF,IACSsF,MAAgB,YACzBT,EAAe7E,EAAG,wBAAwB,2BAA2B,CAAC;CAE1E,GAAG,CAACsF,GAAatF,CAAE,CAAC,GAEpBuF,QAAgB;EACd,AAAI,CAACF,EAAmB,WAAW5F,MACjC,EAAmB,UAAUA;CAEjC,GAAG,CAACA,CAAQ,CAAC,GAEb8F,QAAgB;EAId,IAHIH,KAAoBjE,KAGpB6B,EAAqB,WAAWwC,GAAuB,GAAG;EAE9D,IAAMxD,IAAYC,EAAuB;EACzC,IAAID,GAAW;GACb,IAAME,IAASC,GAAiBH,CAAS,GACnCI,IAAOC,GAAeL,CAAS;GACrC,IACEE,GAAQ,eACRE,KACAjD,GAAoB+C,EAAO,WAAW,GACtC;IAEA,AADAnB,EAAa,SAAS,CAAC,CAAC,gBAAgBiB,CAAS,GACjDkB,EACE1D,GAAyBC,CAAQ,KAAKgG,KAAwB,GAChE;IACA;GACF;EACF;EAMA,IACElC,EAAuBkC,KAAwB,IAAI,OAAO,SAAS,MAAM,GAEzE;EAEF,IAAMC,IAASC,GAAkB;EACjC,AAAID,MACFnE,GAAoB,EAAI,GACxB,OAAO,SAAS,QAAQmE,CAAM;CAElC,GAAG;EACDN;EACAjE;EACA+B;EACAzD;EACAgG;CACF,CAAC,GAGDF,QAAgB;EACd,IAAI;GAEF,aAAa,WAAW,qBAAqB;GAE7C,IAAMK,IAAkB,aAAa,QAAQ,kBAAkB;GAE/D,AAAIA,KACFb,GAAa,OAAU;IACrB,GAAGc;IACH,OAAOD;IACP,YAAY;GACd,EAAE;EAEN,SAASE,GAAO;GACd,QAAQ,KAAK,gDAAgDA,CAAK;EACpE;CACF,GAAG,CAAC,CAAC,GAGLP,QAAgB;EACd,IAAMvE,IAAQZ,EAAS;EAQvB,AAPIY,GAAO,WACT6D,EAAe7D,EAAM,OAAO,GAE1BA,GAAO,SACT+D,GAAa,OAAU;GAAE,GAAGc;GAAM,OAAO7E,EAAM;EAAM,EAAE,GAGrDA,KACF,OAAO,QAAQ,aAAa,CAAC,GAAG,SAAS,KAAK;CAElD,GAAG,CAACZ,EAAS,KAAK,CAAC;CAKnB,IAAM2F,MACJ,GACA,MAOU;EAEV,IAAIC,GACF,QAAQA,GAAR;GACE,KAAK,mBACH,OAAO;GACT,KAAK,qBACH,OAAO;GACT,KAAK,sBACH,OAAO;GACT,KAAK,oBACH,OAAO;GACT,KAAK,sBACH,OAAO;EAGX;EAIF,IAAI,CAACC,GAAK,OAAO;EACjB,IAAMC,IAAWD,EAAI,YAAY;EAgCjC,OA7BEC,EAAS,SAAS,SAAS,KAC3BA,EAAS,SAAS,qBAAqB,IAEhC,YAELA,EAAS,SAAS,WAAW,IACxB,cAGPA,EAAS,SAAS,gBAAgB,KAClCA,EAAS,SAAS,YAAY,KAC9BA,EAAS,SAAS,YAAY,IAEvB,eAGPA,EAAS,SAAS,UAAU,KAC5BA,EAAS,SAAS,aAAa,KAC/BA,EAAS,SAAS,YAAY,IAEvB,aAGPA,EAAS,SAAS,mBAAmB,KACrCA,EAAS,SAAS,oBAAoB,KACtCA,EAAS,SAAS,oBAAoB,IAE/B,uBAEF;CACT;CAyBA,AAtBAX,QAAgB;EACd,IAAMY,IAAe7F,EAAa,IAAI,OAAO;EAO7C,IANI6F,KACFpB,GAAa,OAAU;GAAE,GAAGc;GAAM,OAAOM;EAAa,EAAE,GAIxC7F,EAAa,IAAI,SAC/B,MAAc,QAAQ;GACxB,EACEN,EACE,6BACA,iDACF,CACF;GAEA,IAAMoG,IAAS,OAAO,SAAS;GAC/B,OAAO,QAAQ,aAAa,CAAC,GAAG,SAAS,OAAOA,CAAM;EACxD;CACF,GAAG,CAAC9F,GAAcN,CAAE,CAAC,GAGrBuF,QAAgB;EACd,AAAIzE,MACFZ,EAAS,kBAAkB;CAE/B,GAAG,CAACY,IAAaZ,CAAQ,CAAC;CAE1B,IAAMmG,KAAe,OAAO,MAAuB;EASjD,AARA,EAAE,eAAe,GACjBxC,EAAqB,EAAK,GAC1BE,EAAoB,EAAK,GACzBE,EAAsB,EAAK,GAC3BE,EAAsB,EAAK,GAC3BE,EAAsB,EAAK,GAC3Bc,EAAsB,EAAK,GAC3BV,EAAiB,EAAK,GACtBQ,EAAmB,IAAI;EAGvB,IAAMqB,KAAgBxB,EAAS,SAAS,GAAA,CAAI,KAAK;EACjD,IAAI,CAACwB,GACH,EACEtG,EACE,mCACA,qCACF,CACF;OAKF,IAAIsG,EAAa,SAAS,GAAG,KAEvB,CAAC,6BAAW,KAAKA,CAAY,GAC/B,EACEtG,EAAG,2BAA2B,oCAAoC,CACpE;OAKJ,IAAI,CAAC8E,EAAS,YAAYA,EAAS,SAAS,SAAS,GACnD,EACE9E,EAAG,4BAA4B,4BAA4B,CAC7D;OAKF,IAAIoF,KACuBrC,EACD,CAAA,CAAiB,MACtC,MAAMwD,EAAE,MAAM,YAAY,MAAMD,EAAa,YAAY,CAExD,GAEF,AADAnB,EAAsB,EAAI,GAC1BF,EAAmB,IAAI;OAI3B;KAAsB,EAAK;GAE3B,IAAI;IAEF,IAAMuB,IAAiB,MAAMvF,GAAiB,OAAO,GAE/CwF,IAAS,MAAMC,GAAO;KAC1B,OAAOJ;KACP,UAAUxB,EAAS;KACnB,YAAYA,EAAS;KACrB,GAAI0B,IAAiB,EAAE,kBAAe,IAAI,CAAC;IAC7C,CAAC;IAGD,IAAIC,EAAO,aAAa;KAKtB,IACME,IACF7G,EAFsBuF,EAAmB,WAAW5F,MAGjCgG,KAAwB,aAAY;KAC3D,IAAI;MACF,eAAe,QAAQmB,IAAcD,CAAW;KAClD,QAAQ,CAGR;KACA;IACF;IAGA,IAAIF,EAAO,SAAS;KAClB,IAAI;MACF,IAAMzE,IAAYyE,EAAO,MAAM;MAC/B,IAAIzE,GAAW;OAEb,IAAM6E,IADW,OAAO,SAAS,SACT,SAAS,sBAAsB,IACnD,yBACA,KAAA,GACEC,IAAaD,IAAS,YAAYA,MAAW,IAC7CE,IACJ,OAAO,SAAS,aAAa,WAAW,aAAa,IACjDC,IAAW,KAAK,UAAU;QAC9B,IAAIhF;QACJ,QAAQ,OAAO,SAAS;OAC1B,CAAC;OAED,AADA,SAAS,SAAS,UAAU,mBAAmBgF,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmBC,CAAQ,IAAIF,EAAW,wBAAwBC,EAAW;MACnH;KACF,QAAQ,CAER;KAGA,IAAI;MACF,AAAIjC,EAAS,aACX,aAAa,QAAQ,oBAAoBwB,CAAY,IAErD,aAAa,WAAW,kBAAkB;KAE9C,SAASR,GAAO;MACd,QAAQ,KACN,sDACAA,CACF;KACF;KAEA,GAAoB,EAAI;KAExB,IACMmB,IACFnH,EAFsBuF,EAAmB,WAAW5F,MAGjCgG,KAAwB,aAAY;KAC3D,IAAI;MAGF,IAAMyB,IAAiB,MAAM,QAAQ,KAAqB,CACxDC,GAAiBV,EAAO,KAAK,GAC7B,IAAI,SAAyB,MAAY;OACvC,OAAO,iBAAiB;QACtB,EAAQ;SACN,SAAS;SACT,OAAO;QACT,CAAC;OACH,GAAG,GAAI;MACT,CAAC,CACH,CAAC;MAED,AAAIS,EAAe,WAGbA,EAAe,cACjBE,GAAaF,EAAe,UAAU,EAAE,GACpCA,EAAe,UAAU,kBAC3BG,GAAgBH,EAAe,UAAU,cAAc,IAK3DhE,EAAmB+D,CAAa,KACvBC,EAAe,OAAO,SAAS,qBAAqB,IAK3DI,EACEL,GACAxB,GACA,OAAO,SAAS,MAClB,IAEAvC,EAAmB+D,CAAa,IAEhC/G,EAAS,8BAA8B,KAIrCgH,EAAe,cACjBE,GAAaF,EAAe,UAAU,EAAE,GACpCA,EAAe,UAAU,kBAC3BG,GAAgBH,EAAe,UAAU,cAAc,IAG3D,QAAQ,KAAK,sBAAsBA,EAAe,KAAK,GACvDhE,EAAmB+D,CAAa;KAEpC,SAASM,GAAe;MAGtB,AADA,QAAQ,MAAM,sCAAsCA,CAAa,GACjErE,EAAmB+D,CAAa;KAClC,UAAU;MAKR,AAAKjE,EAAqB,WACxB5B,GAAoB,EAAK;KAE7B;IACF;GACF,SAAS6E,GAAK;IAKZ,IAAMuB,IAAWvB,aAAe,QAAQA,EAAI,UAAU,OAAOA,CAAG;IAChE,AAAIuB,EAAS,SAAS,WAAW,KAC/BvC,EAAmBuC,CAAQ;IAE7B,IAAMC,IAAiB1G,EAAa,SAAS,CAAC,CAAC,WACzC2G,IAAY3B,GAAeyB,GAAUC,CAAc;IACzD,AAAIC,MAAc,YAChB3D,EAAoB,EAAI,IACf2D,MAAc,cACvBzD,EAAsB,EAAI,IACjByD,MAAc,eACvBvD,EAAsB,EAAI,IACjBuD,MAAc,aACvB7D,EAAqB,EAAI,IAChB6D,MAAc,wBACvBrD,EAAsB,EAAI;GAE9B;EApK2B;CAqK7B;CAGA,QAAgB;EACd,IAAIyB,GAAO;GACT,IAAM4B,IAAY3B,GAAeD,GAAO6B,EAAS;GACjD,AAAID,MAAc,YAChB3D,EAAoB,EAAI,IACf2D,MAAc,cACvBzD,EAAsB,EAAI,IACjByD,MAAc,eACvBvD,EAAsB,EAAI,IACjBuD,MAAc,aACvB7D,EAAqB,EAAI,IAChB6D,MAAc,wBACvBrD,EAAsB,EAAI;EAE9B;CACF,GAAG,CAACyB,GAAO6B,EAAS,CAAC;CAKrB,IAAMC,WAA0B;EAC9B,EAAc,IAAI;EAClB,IAAI;GACF,GAAoB;EACtB,SAAS3B,GAAK;GACZ,EACEA,aAAe,QACXA,EAAI,UACJjG,EACE,iCACA,mCACF,CACN;EACF;CACF,GAKM6H,WAA6B;EACjC,EAAc,IAAI;EAClB,IAAI;GACF,GAAuB;EACzB,SAAS5B,GAAK;GACZ,EACEA,aAAe,QACXA,EAAI,UACJjG,EACE,oCACA,sCACF,CACN;EACF;CACF,GAKM8H,KAA2B,YAAY;EAE3C,AADAvD,GAA2B,EAAI,GAC/BE,EAAiB,EAAK;EACtB,IAAI;GACF,IAAM6B,KAAgBxB,EAAS,SAAS,GAAA,CAAI,KAAK;GAEjD,CAAI,MADiBiD,GAAmBzB,CAAY,EAAA,CACzC,UACT7B,EAAiB,EAAI,IAErBQ,EACEjF,EACE,2BACA,wDACF,CACF;EAEJ,SAASiG,GAAK;GAEZ,AADA,QAAQ,MAAM,wCAAwCA,CAAG,GACzDhB,EACEgB,aAAe,QACXA,EAAI,UACJjG,EACE,2BACA,wDACF,CACN;EACF,UAAU;GACR,GAA2B,EAAK;EAClC;CACF,GAGMgI,KAAqBC,EAAqB,QAAQ,GAClDC,KAAwBD,EAAqB,WAAW,GAExDE,KAAiB,CACrB;EACE,MAAM;EACN,MAAMC;EACN,SAASR;EACT,UAAU,CAACI;EACX,SAASA,KACL,KAAA,IACAhI,EACE,kCACA,kCACF;CACN,GAWA;EACE,MAAM;EACN,MAAMqI;EACN,SAASR;EACT,UAAU,CAACK;EACX,SAASA,KACL,KAAA,IACAlI,EACE,qCACA,qCACF;CACN,CACF;CAMA,OAJIsB,KACK,kBAACgH,IAAD,CAAqB,CAAA,IAI5B,kBAACC,GAAD;EACE,OAAOvI,EAAG,0BAA0B,cAAc;EAClD,UAAUA,EACR,+BACA,oCACF;EALF,UAAA;GAOE,kBAACwI,IAAD;IAAa,WAAU;IACpB,UAAAxI,EACC,sBACA,uIACF;GACW,CAAA;GACb,kBAAC,QAAD;IAAM,UAAUqG;IAAc,WAAU;IAAxC,UAAA;KAEGzB,MACC,kBAAC,OAAD;MACE,MAAK;MACL,WAAU;MAFZ,UAAA,CAIE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OAEP,UAAA,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;OACH,CAAA;MACE,CAAA,GACL,kBAAC,KAAD;OAAG,WAAU;OAAiC,UAAAA;MAAe,CAAA,CAC1D;;KAINI,KACC,kBAAC,OAAD;MACE,MAAK;MACL,WAAU;MAFZ,UAAA,CAIE,kBAACyD,GAAD,EAAW,WAAU,uDAAwD,CAAA,GAC7E,kBAAC,KAAD;OAAG,WAAU;OACV,UAAAzD;MACA,CAAA,CACA;;KAINE,MACC,kBAAC,OAAD;MACE,MAAK;MACL,WAAU;MAFZ,UAAA,CAIE,kBAACuD,GAAD,EAAW,WAAU,uDAAwD,CAAA,GAC7E,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,KAAD;SAAG,WAAU;SACV,UAAAzI,EACC,+BACA,oCACF;QACC,CAAA;QACH,kBAAC,KAAD;SAAG,WAAU;SACV,UAAAA,EACC,mCACA,8FACF;QACC,CAAA;SACDqF,EAAmB,WAAW5F,MAC9B,kBAAC,UAAD;SACE,MAAK;SACL,eACES,EACE,mBACEmF,EAAmB,WAAW5F,KAAY,YAC5C,CACF;SAEF,WAAU;SATZ,UAAA,CAWE,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;UAEP,UAAA,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,aAAa;WACb,GAAE;UACH,CAAA;SACE,CAAA,GACJO,EACC,kCACA,4BACF,CACM;;OAEP;MACF,CAAA,CAAA;;KAIN8F,KAAS,CAACd,KAAmB,CAACE,MAC7B,kBAAC,OAAD;MACE,MAAK;MACL,WAAW,gDACTtB,KAAqBM,KAAsBE,IACvC,6DACA;MALR,UAAA,CAQE,kBAACqE,GAAD,EACE,WAAW,+BACT7E,KAAqBM,KAAsBE,IACvC,6BACA,2BAEP,CAAA,GACD,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,KAAD;SACE,WAAW,WACTR,KAAqBM,KAAsBE,IACvC,6BACA;SAGL,UAAAN,KACG9D,EACE,6BACA,oEACF,IACAgE,KACEhE,EACE,+BACA,yEACF,IACA4D,IACE5D,EACE,iCACA,oCACF,IACAkE,IACElE,EACE,wBACA,6EACF,IACAoE,IACEpE,EACE,+BACA,yFACF,IACA8F;QACX,CAAA;QACFlC,KACC,kBAAC,UAAD;SACE,MAAK;SACL,eACE1D,EAAS,oBAAoB,EAC3B,OAAO,EAAE,OAAO4E,EAAS,MAAM,EACjC,CAAC;SAEH,WAAU;SAET,UAAA9E,EACC,8BACA,uCACF;QACM,CAAA;QAEToE,KACC,kBAAC,OAAD;SAAK,WAAU;SACZ,UAAAI,KACC,kBAAC,OAAD;UAAK,WAAU;UAAf,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;WAEP,UAAA,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;WACH,CAAA;UACE,CAAA,GACJxE,EACC,+BACA,mDACF,CACG;SAEL,CAAA,IAAA,kBAAC,UAAD;UACE,MAAK;UACL,SAAS8H;UACT,UAAUxD;UACV,WAAU;UAET,UAAAA,KACC,kBAAAzF,GAAA,EAAA,UAAA,CACE,kBAAC8J,IAAD,EAAa,WAAU,sBAAuB,CAAA,GAC7C3I,EAAG,sBAAsB,YAAY,CACtC,EAAA,CAAA,IAEF,kBAAAnB,GAAA,EAAA,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;WAEP,UAAA,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;WACH,CAAA;UACE,CAAA,GACJmB,EACC,iCACA,2BACF,CACA,EAAA,CAAA;SAEE,CAAA;QAEP,CAAA;QAENkE,KACC,kBAAC,OAAD;SAAK,WAAU;SAAf,UAAA,CACG+D,EAAqB,QAAQ,KAC5B,kBAAC,UAAD;UACE,MAAK;UACL,SAASL;UACT,WAAU;UAHZ,UAAA,CAKE,kBAACQ,GAAD,EAAY,WAAU,SAAU,CAAA,GAC/BpI,EAAG,+BAA+B,qBAAqB,CAClD;SAET,CAAA,GAAAiI,EAAqB,WAAW,KAC/B,kBAAC,UAAD;UACE,MAAK;UACL,SAASJ;UACT,WAAU;UAHZ,UAAA,CAKE,kBAACQ,IAAD,EAAe,WAAU,SAAU,CAAA,GAClCrI,EACC,kCACA,wBACF,CACM;SAEP,CAAA,CAAA;;OAEJ;MACF,CAAA,CAAA;;KAIP,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAET,UAAAA,EAAG,yBAAyB,OAAO;MAC/B,CAAA,GACP,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA,CACE,kBAAC,OAAD;QAAK,WAAU;QACb,UAAA,kBAAC4I,IAAD,EAAW,WAAU,2CAA4C,CAAA;OAC9D,CAAA,GACL,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,cAAa;QACb,UAAA;QACA,iBAAc;QACd,cAAY5I,EAAG,yBAAyB,OAAO;QAC/C,OAAO8E,EAAS;QAChB,WAAW,MACTC,EAAY;SAAE,GAAGD;SAAU,OAAO,EAAE,OAAO;QAAM,CAAC;QAEpD,WAAU;QACV,aAAa9E,EAAG,+BAA+B,iBAAiB;OACjE,CAAA,CACE;MACF,CAAA,CAAA;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAET,UAAAA,EAAG,4BAA4B,UAAU;MACrC,CAAA,GACP,kBAAC,OAAD;OAAK,WAAU;OAAf,UAAA;QACE,kBAAC,OAAD;SAAK,WAAU;SACb,UAAA,kBAAC6I,IAAD,EAAU,WAAU,2CAA4C,CAAA;QAC7D,CAAA;QACL,kBAAC,SAAD;SACE,IAAG;SACH,MAAMnF,IAAe,SAAS;SAC9B,cAAa;SACb,UAAA;SACA,iBAAc;SACd,cAAY1D,EAAG,4BAA4B,UAAU;SACrD,OAAO8E,EAAS;SAChB,WAAW,MACTC,EAAY;UAAE,GAAGD;UAAU,UAAU,EAAE,OAAO;SAAM,CAAC;SAEvD,WAAU;SACV,aAAa9E,EACX,kCACA,qBACF;QACD,CAAA;QACD,kBAAC,UAAD;SACE,MAAK;SACL,eAAe2D,GAAgB,CAACD,CAAY;SAC5C,cACEA,IACI1D,EAAG,2BAA2B,eAAe,IAC7CA,EAAG,2BAA2B,eAAe;SAEnD,WAAU;SAET,UACC8I,EADDpF,IACEqF,KAEAC,IAFD,EAAY,WAAU,SAAU,CAEH;QAEzB,CAAA;OACL;MACF,CAAA,CAAA;;KAGL,kBAAC,OAAD;MAAK,WAAU;MAAf,UAAA,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;OAFZ,UAAA,CAIE,kBAACC,IAAD;QACE,IAAG;QACH,SAASnE,EAAS;QAClB,kBAAkB,MAAuC;SACvD,IAAMoE,IAAYC,MAAY;SAI9B,IAHApE,EAAY;UAAE,GAAGD;UAAU,YAAYoE;SAAU,CAAC,GAG9C,CAACA,GACH,IAAI;UACF,aAAa,WAAW,kBAAkB;SAC5C,SAASpD,GAAO;UACd,QAAQ,KACN,iDACAA,CACF;SACF;QAEJ;QACA,cAAY9F,EAAG,yBAAyB,aAAa;OACtD,CAAA,GACD,kBAAC,QAAD;QAAM,WAAU;QACb,UAAAA,EAAG,yBAAyB,aAAa;OACtC,CAAA,CACD;MACP,CAAA,GAAA,kBAAC,UAAD;OACE,MAAK;OACL,eAAeE,EAAS,sBAAsB;OAC9C,WAAU;OAET,UAAAF,EAAG,6BAA6B,kBAAkB;MAC7C,CAAA,CACL;;KAGL,kBAACoJ,IAAD;MACE,MAAK;MACL,UAAUC,KAAalI;MACvB,SAAQ;MACR,MAAK;MACL,WAAU;MAET,UAAAkI,KAAalI,IACZ,kBAAAtC,GAAA,EAAA,UAAA,CACE,kBAAC8J,IAAD,EAAa,WAAU,sBAAuB,CAAA,GAC9C,kBAAC,QAAD,EAAA,UACGxH,IACGnB,EACE,iCACA,yBACF,IACAA,EAAG,wBAAwB,eAAe,EAC1C,CAAA,CACN,EAAA,CAAA,IAEFA,EAAG,qBAAqB,SAAS;KAE7B,CAAA;IACJ;;GAGN,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA,CACE,kBAAC,OAAD;KAAK,WAAU;KACb,UAAA,kBAAC,OAAD,EAAK,WAAU,uDAAwD,CAAA;IACpE,CAAA,GACL,kBAAC,OAAD;KAAK,WAAU;KACb,UAAA,kBAAC,QAAD;MAAM,WAAU;MACb,UAAAA,EAAG,6BAA6B,kBAAkB;KAC/C,CAAA;IACH,CAAA,CACF;;GAGJ0E,MACC,kBAAC,OAAD;IAAK,WAAU;IAAf,UAAA,CACE,kBAAC+D,GAAD,EAAW,WAAU,qDAAsD,CAAA,GAC3E,kBAAC,KAAD;KAAG,WAAU;KAAkC,UAAA/D;IAAc,CAAA,CAC1D;;GAIP,kBAAC,OAAD;IAAK,WAAU;IACZ,UAAAyD,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAASmB,EAAS;KAClB,UAAUA,EAAS;KACnB,OAAOA,EAAS;KAChB,cAAYA,EAAS;KACrB,WAAW,wGACTA,EAAS,WACL,oGACA;KAVR,UAAA,CAaE,kBAACA,EAAS,MAAV,EACE,WAAW,UAAUA,EAAS,WAAW,eAAe,KACzD,CAAA,GACD,kBAAC,QAAD;MACE,WAAW,gEACTA,EAAS,WACL,sCACA;MAGL,UAAAA,EAAS;KACN,CAAA,CACA;IAxBD,GAAAA,EAAS,IAwBR,CACT;GACE,CAAA;GA4BL,kBAAC,OAAD;IAAK,WAAU;IACb,UAAA,kBAAC,UAAD;KACE,MAAK;KACL,eAAepJ,EAAS,kBAAkB;KAC1C,WAAU;KAHZ,UAAA;MAKGF,EAAG,iCAAiC,4BAA4B;MAAG;MACpE,kBAAC,QAAD;OAAM,WAAU;OACb,UAAAA,EAAG,8BAA8B,yBAAyB;MACvD,CAAA;KACA;;GACL,CAAA;GAGL,kBAAC,KAAD;IAAG,WAAU;IAAb,UAAA;KACGA,EAAG,8BAA8B,wBAAwB;KAAG;KAC7D,kBAAC,UAAD;MACE,MAAK;MACL,eACEE,EACEqJ,GACE,kBACAC,GAAmB/J,CAAQ,CAC7B,CACF;MAEF,WAAU;MAET,UAAAO,EAAG,qBAAqB,SAAS;KAC5B,CAAA;IACP;;EACO;;AAEhB"}

package/dist/auth/pages/MfaVerifyPage.js

@@ -121,6 +121,7 @@ function y() {
 				className: "space-y-6",
 				children: [
 					E && /* @__PURE__ */ g("div", {
+						role: "alert",
 						className: "flex items-start gap-3 p-4 rounded-xl bg-[var(--color-status-error-bg-subtle)] border border-[var(--color-status-error-border)]",
 						children: [/* @__PURE__ */ h(i, { className: "size-5 text-[var(--color-status-error-text)] flex-shrink-0 mt-0.5" }), /* @__PURE__ */ h("p", {
 							className: "text-sm text-[var(--color-status-error-text)]",