@burdenoff/microfe-auth 2026.624.3 → 2026.626.1

package/dist/auth/pages/SsoConfigPage.js

@@ -5,14 +5,16 @@ import { ConfirmActionDialog as i } from "../components/ConfirmActionDialog.js";
 import { nativeCopyText as a, nativeImpact as o, nativeNotify as s } from "../../utils/nativeBridge.js";
 import { useCallback as c, useEffect as l, useRef as ee, useState as u } from "react";
 import { useNavigate as te, useSearchParams as ne } from "react-router-dom";
-import { useI18n as d } from "@burdenoff/fe-libs/shared/providers/shell";
-import { Fragment as f, jsx as p, jsxs as m } from "react/jsx-runtime";
-import { useFeatureFlagDetails as re } from "@burdenoff/fe-libs/shared/feature-flags";
+import { useI18n as re } from "@burdenoff/fe-libs/shared/providers/shell";
+import { Fragment as d, jsx as f, jsxs as p } from "react/jsx-runtime";
+import { useFeatureFlagDetails as ie } from "@burdenoff/fe-libs/shared/feature-flags";
+import { Button as m } from "@burdenoff/fe-libs/button";
+import { EmphasisPanel as ae, IllustratedEmptyState as h, NextSteps as oe, PagePurpose as se } from "@burdenoff/fe-libs/ui";
 //#region src/auth/pages/SsoConfigPage.tsx
-var h = async (e) => {
+var g = async (e) => {
 	o("light"), s(await a(e) ? "success" : "error");
 };
-function g(e) {
+function _(e) {
 	try {
 		let t = new DOMParser().parseFromString(e, "text/xml"), n = t.querySelector("parsererror");
 		if (n) return console.error("XML parse error:", n.textContent), null;
@@ -45,170 +47,279 @@ function g(e) {
 		return console.error("Failed to parse SAML metadata:", e), null;
 	}
 }
-function _({ bypassEnterprisePlanGate: a = !1 }) {
-	let _ = te(), [v] = ne(), { canManageSsoConfig: ie, isLoading: ae } = r(), oe = re("workspace.auth.enterprise-sso"), se = a || oe?.value === !0, y = ee(null), b = v.get("tenant"), x = v.get("org"), S = v.get("workspace"), { ssoConfig: C, oidcConfig: w, isLoading: T, isSaving: E, isDeleting: D, saveSsoConfig: O, deleteSsoConfig: k } = n(b ?? "burdenoff.com"), { t: A } = d(), j = c((e, t) => {
+function v({ bypassEnterprisePlanGate: a = !1 }) {
+	let v = te(), [y] = ne(), { canManageSsoConfig: ce, isLoading: le } = r(), ue = ie("workspace.auth.enterprise-sso"), de = a || ue?.value === !0, b = ee(null), x = y.get("tenant"), S = y.get("org"), C = y.get("workspace"), { ssoConfig: w, oidcConfig: T, isLoading: E, isSaving: D, isDeleting: O, saveSsoConfig: k, deleteSsoConfig: fe } = n(x ?? "burdenoff.com"), { t: A } = re(), j = c((e, t) => {
 		let n = A(e);
 		return n === e ? t : n;
-	}, [A]), [M, ce] = u("saml"), [N, P] = u(!1), [le, F] = u(!1), [I, L] = u(null), [R, z] = u(null), [B, V] = u(""), [H, U] = u(!1), [W, G] = u(!1), [K, q] = u({
+	}, [A]), [M, pe] = u("saml"), [N, P] = u(!1), [me, F] = u(!1), [I, L] = u(null), [R, z] = u(null), [B, V] = u(""), [H, U] = u(!1), [W, G] = u(!1), [K, q] = u({
 		client_name: "",
 		redirect_uris: "",
 		grant_types: ["authorization_code", "refresh_token"],
 		token_endpoint_auth_method: "none"
-	}), [J, Y] = u(!1), [X, Z] = u(null), [Q, $] = u({
+	}), [J, Y] = u(!1), [X, he] = u(null), [Z, Q] = u({
 		entityId: "",
 		ssoUrl: "",
 		sloUrl: "",
 		certificate: "",
 		enabled: !1
-	});
-	return l(() => {
-		C && $({
-			entityId: C.entityId || "",
-			ssoUrl: C.ssoUrl || "",
-			sloUrl: C.sloUrl || "",
-			certificate: C.certificate || "",
-			enabled: C.enabled || !1
+	}), ge = async (e) => {
+		let t = e.target.files?.[0];
+		if (t) {
+			L(null), U(!0);
+			try {
+				let e = _(await t.text());
+				e ? (Q({
+					...Z,
+					entityId: e.entityId,
+					ssoUrl: e.ssoUrl,
+					sloUrl: e.sloUrl || "",
+					certificate: e.certificate
+				}), z(j("auth.sso.importSuccess", "SAML metadata imported successfully! Review and save the configuration.")), P(!0)) : L(j("auth.sso.parseError", "Failed to parse SAML metadata. Make sure the file contains valid IdP metadata XML."));
+			} catch {
+				L(j("auth.sso.readError", "Failed to read metadata file"));
+			} finally {
+				U(!1), b.current && (b.current.value = "");
+			}
+		}
+	}, _e = async () => {
+		if (!B) {
+			L(j("auth.sso.enterUrl", "Please enter a metadata URL"));
+			return;
+		}
+		L(null), U(!0);
+		try {
+			let e = await fetch(B);
+			if (!e.ok) throw Error(`Failed to fetch: ${e.statusText}`);
+			let t = _(await e.text());
+			t ? (Q({
+				...Z,
+				entityId: t.entityId,
+				ssoUrl: t.ssoUrl,
+				sloUrl: t.sloUrl || "",
+				certificate: t.certificate
+			}), z(j("auth.sso.importSuccessFromUrl", "SAML metadata imported successfully! Review and save the configuration.")), P(!0), V("")) : L(j("auth.sso.parseUrlError", "Failed to parse SAML metadata from URL."));
+		} catch (e) {
+			L(e instanceof Error ? e.message : j("auth.sso.fetchError", "Failed to fetch metadata from URL"));
+		} finally {
+			U(!1);
+		}
+	}, ve = async () => {
+		if (!K.client_name || !K.redirect_uris) {
+			L(j("auth.sso.clientRequired", "Client name and redirect URI are required"));
+			return;
+		}
+		Y(!0), L(null);
+		try {
+			let e = T?.registrationEndpoint;
+			if (!e) throw Error(j("auth.sso.oidcNotConfigured", "OIDC dynamic client registration is not configured for this environment."));
+			let t = await fetch(e, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					client_name: K.client_name,
+					redirect_uris: K.redirect_uris.split(",").map((e) => e.trim()),
+					grant_types: K.grant_types,
+					response_types: ["code"],
+					token_endpoint_auth_method: K.token_endpoint_auth_method
+				})
+			});
+			if (!t.ok) {
+				let e = await t.json();
+				throw Error(e.error_description || e.error || "Registration failed");
+			}
+			he(await t.json()), z(j("auth.sso.clientRegistered", "OIDC client registered successfully! Save the client credentials.")), G(!1), q({
+				client_name: "",
+				redirect_uris: "",
+				grant_types: ["authorization_code", "refresh_token"],
+				token_endpoint_auth_method: "none"
+			});
+		} catch (e) {
+			L(e instanceof Error ? e.message : j("auth.sso.registerFailed", "Failed to register client"));
+		} finally {
+			Y(!1);
+		}
+	};
+	l(() => {
+		w && Q({
+			entityId: w.entityId || "",
+			ssoUrl: w.ssoUrl || "",
+			sloUrl: w.sloUrl || "",
+			certificate: w.certificate || "",
+			enabled: w.enabled || !1
 		});
-	}, [C]), ae ? /* @__PURE__ */ p("div", {
+	}, [w]);
+	let ye = async (e) => {
+		e.preventDefault(), L(null), z(null);
+		try {
+			await k(Z), z(j("auth.sso.saveSuccess", "SSO configuration saved successfully!")), P(!1);
+		} catch (e) {
+			L(e instanceof Error ? e.message : j("auth.sso.saveFailed", "Failed to save configuration"));
+		}
+	}, be = async () => {
+		L(null), z(null), o("medium");
+		try {
+			await fe(), s("success"), z(j("auth.sso.deleteSuccess", "SSO configuration deleted successfully.")), F(!1), Q({
+				entityId: "",
+				ssoUrl: "",
+				sloUrl: "",
+				certificate: "",
+				enabled: !1
+			});
+		} catch (e) {
+			s("error"), L(e instanceof Error ? e.message : j("auth.sso.deleteFailed", "Failed to delete configuration"));
+		}
+	}, $ = async () => {
+		L(null);
+		try {
+			await k({
+				...Z,
+				enabled: !Z.enabled
+			}), z(Z.enabled ? j("auth.sso.ssoDisabled", "SSO disabled") : j("auth.sso.ssoEnabled", "SSO enabled"));
+		} catch (e) {
+			L(e instanceof Error ? e.message : j("auth.sso.statusUpdateFailed", "Failed to update status"));
+		}
+	};
+	return le ? /* @__PURE__ */ f("div", {
 		className: "max-w-5xl mx-auto p-6",
-		children: /* @__PURE__ */ m("div", {
+		children: /* @__PURE__ */ p("div", {
 			className: "text-center py-16",
-			children: [/* @__PURE__ */ p(t, { className: "size-8 mx-auto text-text-secondary animate-spin" }), /* @__PURE__ */ p("p", {
+			children: [/* @__PURE__ */ f(t, { className: "size-8 mx-auto text-text-secondary animate-spin" }), /* @__PURE__ */ f("p", {
 				className: "mt-4 text-text-secondary",
 				children: j("auth.sso.loadingPermissions", "Loading permissions...")
 			})]
 		})
-	}) : ie ? se ? /* @__PURE__ */ m("div", {
+	}) : ce ? de ? /* @__PURE__ */ p("div", {
 		className: "max-w-5xl mx-auto p-6",
 		children: [
-			/* @__PURE__ */ p(i, {
-				open: le,
+			/* @__PURE__ */ f(i, {
+				open: me,
 				onOpenChange: F,
 				title: j("auth.sso.deleteConfirmTitle", "Delete SSO configuration?"),
 				description: j("auth.sso.deleteConfirmDesc", "Users will immediately lose the ability to sign in with this SSO setup until a new configuration is saved."),
 				confirmText: j("auth.sso.deleteConfirmButton", "Delete configuration"),
 				variant: "danger",
-				isPending: D,
-				onConfirm: async () => {
-					L(null), z(null), o("medium");
-					try {
-						await k(), s("success"), z(j("auth.sso.deleteSuccess", "SSO configuration deleted successfully.")), F(!1), $({
-							entityId: "",
-							ssoUrl: "",
-							sloUrl: "",
-							certificate: "",
-							enabled: !1
-						});
-					} catch (e) {
-						s("error"), L(e instanceof Error ? e.message : j("auth.sso.deleteFailed", "Failed to delete configuration"));
-					}
-				}
+				isPending: O,
+				onConfirm: be
 			}),
-			/* @__PURE__ */ m("div", {
+			/* @__PURE__ */ p("div", {
 				className: "flex items-center justify-between mb-8",
-				children: [/* @__PURE__ */ m("div", {
+				children: [/* @__PURE__ */ p("div", {
 					className: "flex items-center gap-4",
-					children: [/* @__PURE__ */ p("button", {
+					children: [/* @__PURE__ */ f("button", {
 						type: "button",
-						onClick: () => _("/auth/security"),
+						onClick: () => v("/auth/security"),
 						"aria-label": j("auth.sso.backToSecurity", "Back to Security"),
 						className: "p-2 rounded-lg hover:bg-bg-sunken transition-colors",
-						children: /* @__PURE__ */ p("svg", {
+						children: /* @__PURE__ */ f("svg", {
 							className: "size-5 text-text-secondary",
 							fill: "none",
 							viewBox: "0 0 24 24",
 							stroke: "currentColor",
 							"aria-hidden": "true",
-							children: /* @__PURE__ */ p("path", {
+							children: /* @__PURE__ */ f("path", {
 								strokeLinecap: "round",
 								strokeLinejoin: "round",
 								strokeWidth: 2,
 								d: "M10 19l-7-7m0 0l7-7m-7 7h18"
 							})
 						})
-					}), /* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("h1", {
+					}), /* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("h1", {
 						className: "text-2xl font-semibold text-text-primary",
 						children: j("auth.sso.title", "Single Sign-On (SSO)")
-					}), /* @__PURE__ */ p("p", {
+					}), /* @__PURE__ */ f("p", {
 						className: "text-text-secondary mt-1",
 						children: j("auth.sso.description", "Configure enterprise SSO with SAML 2.0 or OIDC")
 					})] })]
-				}), C && /* @__PURE__ */ m("div", {
+				}), w && /* @__PURE__ */ p("div", {
 					className: "flex items-center gap-3",
-					children: [/* @__PURE__ */ p("span", {
-						className: `px-3 py-1 rounded-full text-sm font-medium ${Q.enabled ? "bg-status-success-bg-subtle text-status-success-text" : "bg-bg-sunken text-text-secondary"}`,
-						children: Q.enabled ? j("auth.sso.enabled", "Enabled") : j("auth.sso.disabled", "Disabled")
-					}), /* @__PURE__ */ p("button", {
+					children: [/* @__PURE__ */ f("span", {
+						className: `px-3 py-1 rounded-full text-sm font-medium ${Z.enabled ? "bg-status-success-bg-subtle text-status-success-text" : "bg-bg-sunken text-text-secondary"}`,
+						children: Z.enabled ? j("auth.sso.enabled", "Enabled") : j("auth.sso.disabled", "Disabled")
+					}), /* @__PURE__ */ f("button", {
 						type: "button",
-						onClick: async () => {
-							L(null);
-							try {
-								await O({
-									...Q,
-									enabled: !Q.enabled
-								}), z(Q.enabled ? j("auth.sso.ssoDisabled", "SSO disabled") : j("auth.sso.ssoEnabled", "SSO enabled"));
-							} catch (e) {
-								L(e instanceof Error ? e.message : j("auth.sso.statusUpdateFailed", "Failed to update status"));
-							}
-						},
-						disabled: E,
+						onClick: $,
+						disabled: D,
 						className: "px-4 py-2 rounded-lg border border-border-default text-text-primary hover:bg-bg-sunken transition-colors text-sm font-medium",
-						children: Q.enabled ? j("auth.sso.disable", "Disable") : j("auth.sso.enable", "Enable")
+						children: Z.enabled ? j("auth.sso.disable", "Disable") : j("auth.sso.enable", "Enable")
 					})]
 				})]
 			}),
-			a && (b ?? x ?? S) && /* @__PURE__ */ m("div", {
+			/* @__PURE__ */ f(se, {
+				className: "mb-6",
+				children: j("auth.sso.purpose", "Connect your organization's identity provider so your team signs in with their existing corporate credentials. Configure SAML 2.0 or OIDC here, then register the client apps that should accept these logins.")
+			}),
+			/* @__PURE__ */ f(ae, {
+				className: "mb-8",
+				children: /* @__PURE__ */ f("div", {
+					className: "flex items-center justify-between gap-4",
+					children: /* @__PURE__ */ p("div", { children: [
+						/* @__PURE__ */ f("p", {
+							className: "text-sm font-medium text-text-secondary",
+							children: j("auth.sso.statusLabel", "SSO connection")
+						}),
+						/* @__PURE__ */ f("p", {
+							className: "mt-1 text-lg font-semibold text-text-primary",
+							children: w ? Z.enabled ? j("auth.sso.statusActive", "Active — users can sign in via SSO") : j("auth.sso.statusConfiguredDisabled", "Configured but disabled") : j("auth.sso.statusNotConfigured", "Not configured yet")
+						}),
+						/* @__PURE__ */ f("p", {
+							className: "mt-1 text-sm text-text-secondary",
+							children: j("auth.sso.statusHint", "Save a SAML or OIDC configuration below, then enable it to go live.")
+						})
+					] })
+				})
+			}),
+			a && (x ?? S ?? C) && /* @__PURE__ */ p("div", {
 				className: "mb-6 p-4 rounded-xl bg-status-info-bg-subtle border border-status-info-border",
-				children: [/* @__PURE__ */ p("p", {
+				children: [/* @__PURE__ */ f("p", {
 					className: "text-sm font-medium text-status-info-text mb-1",
 					children: j("auth.sso.adminContext", "Configuring SSO for")
-				}), /* @__PURE__ */ m("div", {
+				}), /* @__PURE__ */ p("div", {
 					className: "flex flex-wrap gap-4 text-xs text-status-info-text",
 					children: [
-						b && /* @__PURE__ */ m("span", { children: [
-							/* @__PURE__ */ p("span", {
+						x && /* @__PURE__ */ p("span", { children: [
+							/* @__PURE__ */ f("span", {
 								className: "font-medium",
 								children: j("auth.sso.tenant", "Tenant:")
 							}),
 							" ",
-							/* @__PURE__ */ p("code", {
+							/* @__PURE__ */ f("code", {
 								className: "font-mono",
-								children: b
+								children: x
 							})
 						] }),
-						x && /* @__PURE__ */ m("span", { children: [
-							/* @__PURE__ */ p("span", {
+						S && /* @__PURE__ */ p("span", { children: [
+							/* @__PURE__ */ f("span", {
 								className: "font-medium",
 								children: j("auth.sso.organization", "Organization:")
 							}),
 							" ",
-							/* @__PURE__ */ p("code", {
+							/* @__PURE__ */ f("code", {
 								className: "font-mono",
-								children: x
+								children: S
 							})
 						] }),
-						S && /* @__PURE__ */ m("span", { children: [
-							/* @__PURE__ */ p("span", {
+						C && /* @__PURE__ */ p("span", { children: [
+							/* @__PURE__ */ f("span", {
 								className: "font-medium",
 								children: j("auth.sso.workspace", "Workspace:")
 							}),
 							" ",
-							/* @__PURE__ */ p("code", {
+							/* @__PURE__ */ f("code", {
 								className: "font-mono",
-								children: S
+								children: C
 							})
 						] })
 					]
 				})]
 			}),
-			I && /* @__PURE__ */ m("div", {
+			I && /* @__PURE__ */ p("div", {
 				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border",
-				children: [/* @__PURE__ */ p(e, { className: "size-5 text-status-error-text flex-shrink-0 mt-0.5" }), /* @__PURE__ */ m("div", {
+				children: [/* @__PURE__ */ f(e, { className: "size-5 text-status-error-text flex-shrink-0 mt-0.5" }), /* @__PURE__ */ p("div", {
 					className: "flex-1",
-					children: [/* @__PURE__ */ p("p", {
+					children: [/* @__PURE__ */ f("p", {
 						className: "text-sm text-status-error-text",
 						children: I
-					}), /* @__PURE__ */ p("button", {
+					}), /* @__PURE__ */ f("button", {
 						type: "button",
 						onClick: () => L(null),
 						className: "mt-2 text-sm text-status-error-text hover:underline",
@@ -216,23 +327,23 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 					})]
 				})]
 			}),
-			R && /* @__PURE__ */ m("div", {
+			R && /* @__PURE__ */ p("div", {
 				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-success-bg-subtle border border-status-success-border",
-				children: [/* @__PURE__ */ p("svg", {
+				children: [/* @__PURE__ */ f("svg", {
 					className: "size-5 text-status-success-text flex-shrink-0 mt-0.5",
 					fill: "currentColor",
 					viewBox: "0 0 20 20",
-					children: /* @__PURE__ */ p("path", {
+					children: /* @__PURE__ */ f("path", {
 						fillRule: "evenodd",
 						d: "M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z",
 						clipRule: "evenodd"
 					})
-				}), /* @__PURE__ */ m("div", {
+				}), /* @__PURE__ */ p("div", {
 					className: "flex-1",
-					children: [/* @__PURE__ */ p("p", {
+					children: [/* @__PURE__ */ f("p", {
 						className: "text-sm text-status-success-text",
 						children: R
-					}), /* @__PURE__ */ p("button", {
+					}), /* @__PURE__ */ f("button", {
 						type: "button",
 						onClick: () => z(null),
 						className: "mt-2 text-sm text-status-success-text hover:underline",
@@ -240,9 +351,9 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 					})]
 				})]
 			}),
-			/* @__PURE__ */ p("div", {
+			/* @__PURE__ */ f("div", {
 				className: "mb-6 border-b border-border-subtle",
-				children: /* @__PURE__ */ p("nav", {
+				children: /* @__PURE__ */ f("nav", {
 					className: "flex gap-6",
 					children: [
 						{
@@ -265,124 +376,105 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							label: j("auth.sso.testTab", "Test SSO"),
 							icon: "🧪"
 						}
-					].map((e) => /* @__PURE__ */ m("button", {
+					].map((e) => /* @__PURE__ */ p("button", {
 						type: "button",
-						onClick: () => ce(e.id),
+						onClick: () => pe(e.id),
 						className: `pb-3 text-sm font-medium transition-colors relative ${M === e.id ? "text-text-link" : "text-text-secondary hover:text-text-primary"}`,
-						children: [/* @__PURE__ */ m("span", {
+						children: [/* @__PURE__ */ p("span", {
 							className: "flex items-center gap-2",
-							children: [/* @__PURE__ */ p("span", { children: e.icon }), e.label]
-						}), M === e.id && /* @__PURE__ */ p("span", { className: "absolute bottom-0 left-0 right-0 h-0.5 bg-action-primary-bg" })]
+							children: [/* @__PURE__ */ f("span", { children: e.icon }), e.label]
+						}), M === e.id && /* @__PURE__ */ f("span", { className: "absolute bottom-0 left-0 right-0 h-0.5 bg-action-primary-bg" })]
 					}, e.id))
 				})
 			}),
-			T && /* @__PURE__ */ m("div", {
+			E && /* @__PURE__ */ p("div", {
 				className: "flex items-center justify-center py-12",
-				children: [/* @__PURE__ */ p(t, { className: "size-8 text-text-link animate-spin" }), /* @__PURE__ */ p("span", {
+				children: [/* @__PURE__ */ f(t, { className: "size-8 text-text-link animate-spin" }), /* @__PURE__ */ f("span", {
 					className: "ml-3 text-text-secondary",
 					children: j("auth.sso.loadingConfig", "Loading configuration...")
 				})]
 			}),
-			!T && M === "saml" && /* @__PURE__ */ m("div", {
+			!E && M === "saml" && /* @__PURE__ */ p("div", {
 				className: "space-y-6",
 				children: [
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-4 rounded-xl bg-status-info-bg-subtle border border-status-info-border",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "font-medium text-status-info-text mb-2",
 								children: j("auth.sso.samlConfigTitle", "SAML 2.0 Configuration")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-status-info-text",
 								children: j("auth.sso.samlConfigDesc", "Configure your Identity Provider (IdP) to enable enterprise SSO. You'll need to get the following information from your IdP (Okta, Azure AD, OneLogin, etc.):")
 							}),
-							/* @__PURE__ */ m("ul", {
+							/* @__PURE__ */ p("ul", {
 								className: "mt-2 text-sm text-status-info-text list-disc list-inside",
 								children: [
-									/* @__PURE__ */ p("li", { children: j("auth.sso.entityIdItem", "Entity ID (Issuer URL)") }),
-									/* @__PURE__ */ p("li", { children: j("auth.sso.ssoUrlItem", "SSO URL (Login URL)") }),
-									/* @__PURE__ */ p("li", { children: j("auth.sso.certificateItem", "X.509 Certificate") })
+									/* @__PURE__ */ f("li", { children: j("auth.sso.entityIdItem", "Entity ID (Issuer URL)") }),
+									/* @__PURE__ */ f("li", { children: j("auth.sso.ssoUrlItem", "SSO URL (Login URL)") }),
+									/* @__PURE__ */ f("li", { children: j("auth.sso.certificateItem", "X.509 Certificate") })
 								]
 							})
 						]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-text-primary mb-4",
 								children: j("auth.sso.importMetadata", "Import IdP Metadata")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-text-secondary mb-4",
 								children: j("auth.sso.importMetadataDesc", "Automatically configure SSO by importing your IdP's metadata XML file or URL.")
 							}),
-							/* @__PURE__ */ m("div", {
+							/* @__PURE__ */ p("div", {
 								className: "grid grid-cols-1 md:grid-cols-2 gap-6",
-								children: [/* @__PURE__ */ m("div", {
+								children: [/* @__PURE__ */ p("div", {
 									className: "space-y-3",
 									children: [
-										/* @__PURE__ */ p("label", {
+										/* @__PURE__ */ f("label", {
 											className: "block text-sm font-medium text-text-primary",
 											children: j("auth.sso.uploadFile", "Upload Metadata File")
 										}),
-										/* @__PURE__ */ p("input", {
-											ref: y,
+										/* @__PURE__ */ f("input", {
+											ref: b,
 											type: "file",
 											accept: ".xml,application/xml,text/xml",
-											onChange: async (e) => {
-												let t = e.target.files?.[0];
-												if (t) {
-													L(null), U(!0);
-													try {
-														let e = g(await t.text());
-														e ? ($({
-															...Q,
-															entityId: e.entityId,
-															ssoUrl: e.ssoUrl,
-															sloUrl: e.sloUrl || "",
-															certificate: e.certificate
-														}), z(j("auth.sso.importSuccess", "SAML metadata imported successfully! Review and save the configuration.")), P(!0)) : L(j("auth.sso.parseError", "Failed to parse SAML metadata. Make sure the file contains valid IdP metadata XML."));
-													} catch {
-														L(j("auth.sso.readError", "Failed to read metadata file"));
-													} finally {
-														U(!1), y.current && (y.current.value = "");
-													}
-												}
-											},
+											onChange: ge,
 											className: "hidden",
 											id: "metadata-file",
 											"aria-label": j("auth.sso.uploadFile", "Upload Metadata File")
 										}),
-										/* @__PURE__ */ m("label", {
+										/* @__PURE__ */ p("label", {
 											htmlFor: "metadata-file",
 											className: "flex items-center justify-center gap-2 w-full px-4 py-3 border-2 border-dashed border-border-default rounded-xl cursor-pointer hover:border-action-primary-bg transition-colors",
-											children: [H ? /* @__PURE__ */ p(t, { className: "size-5 animate-spin text-text-link" }) : /* @__PURE__ */ p("svg", {
+											children: [H ? /* @__PURE__ */ f(t, { className: "size-5 animate-spin text-text-link" }) : /* @__PURE__ */ f("svg", {
 												className: "size-5 text-text-tertiary",
 												fill: "none",
 												viewBox: "0 0 24 24",
 												stroke: "currentColor",
-												children: /* @__PURE__ */ p("path", {
+												children: /* @__PURE__ */ f("path", {
 													strokeLinecap: "round",
 													strokeLinejoin: "round",
 													strokeWidth: 2,
 													d: "M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"
 												})
-											}), /* @__PURE__ */ p("span", {
+											}), /* @__PURE__ */ f("span", {
 												className: "text-sm text-text-secondary",
 												children: H ? j("auth.sso.importing", "Importing...") : j("auth.sso.chooseFile", "Choose XML file")
 											})]
 										})
 									]
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ p("div", {
 									className: "space-y-3",
-									children: [/* @__PURE__ */ p("label", {
+									children: [/* @__PURE__ */ f("label", {
 										className: "block text-sm font-medium text-text-primary",
 										children: j("auth.sso.fetchFromUrl", "Fetch from URL")
-									}), /* @__PURE__ */ m("div", {
+									}), /* @__PURE__ */ p("div", {
 										className: "flex gap-2",
-										children: [/* @__PURE__ */ p("input", {
+										children: [/* @__PURE__ */ f("input", {
 											id: "sso-metadata-url",
 											type: "url",
 											value: B,
@@ -390,39 +482,17 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 											placeholder: "https://idp.example.com/metadata.xml",
 											"aria-label": j("auth.sso.fetchFromUrl", "Fetch from URL"),
 											className: "flex-1 px-4 py-2.5 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all text-sm"
-										}), /* @__PURE__ */ m("button", {
+										}), /* @__PURE__ */ p("button", {
 											type: "button",
-											onClick: async () => {
-												if (!B) {
-													L(j("auth.sso.enterUrl", "Please enter a metadata URL"));
-													return;
-												}
-												L(null), U(!0);
-												try {
-													let e = await fetch(B);
-													if (!e.ok) throw Error(`Failed to fetch: ${e.statusText}`);
-													let t = g(await e.text());
-													t ? ($({
-														...Q,
-														entityId: t.entityId,
-														ssoUrl: t.ssoUrl,
-														sloUrl: t.sloUrl || "",
-														certificate: t.certificate
-													}), z(j("auth.sso.importSuccessFromUrl", "SAML metadata imported successfully! Review and save the configuration.")), P(!0), V("")) : L(j("auth.sso.parseUrlError", "Failed to parse SAML metadata from URL."));
-												} catch (e) {
-													L(e instanceof Error ? e.message : j("auth.sso.fetchError", "Failed to fetch metadata from URL"));
-												} finally {
-													U(!1);
-												}
-											},
+											onClick: _e,
 											disabled: H || !B,
 											className: "px-4 py-2.5 rounded-xl bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover disabled:opacity-50 disabled:cursor-not-allowed transition-colors flex items-center gap-2",
-											children: [H ? /* @__PURE__ */ p(t, { className: "size-4 animate-spin" }) : /* @__PURE__ */ p("svg", {
+											children: [H ? /* @__PURE__ */ f(t, { className: "size-4 animate-spin" }) : /* @__PURE__ */ f("svg", {
 												className: "size-4",
 												fill: "none",
 												viewBox: "0 0 24 24",
 												stroke: "currentColor",
-												children: /* @__PURE__ */ p("path", {
+												children: /* @__PURE__ */ f("path", {
 													strokeLinecap: "round",
 													strokeLinejoin: "round",
 													strokeWidth: 2,
@@ -435,44 +505,44 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							})
 						]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-text-primary mb-4",
 								children: j("auth.sso.spMetadata", "Service Provider (SP) Metadata")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-text-secondary mb-4",
 								children: j("auth.sso.spMetadataDesc", "Provide these values to your Identity Provider when setting up the SAML integration:")
 							}),
-							/* @__PURE__ */ m("div", {
+							/* @__PURE__ */ p("div", {
 								className: "space-y-4",
-								children: [/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								children: [/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-sm font-medium text-text-primary mb-1",
 									children: j("auth.sso.spEntityId", "SP Entity ID / Audience URI")
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ p("div", {
 									className: "flex items-center gap-2",
-									children: [/* @__PURE__ */ m("code", {
+									children: [/* @__PURE__ */ p("code", {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
 										children: [window.location.origin, "/auth/saml/metadata"]
-									}), /* @__PURE__ */ p("button", {
+									}), /* @__PURE__ */ f("button", {
 										type: "button",
-										onClick: () => void h(`${window.location.origin}/auth/saml/metadata`),
+										onClick: () => void g(`${window.location.origin}/auth/saml/metadata`),
 										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
 										children: j("auth.sso.copy", "Copy")
 									})]
-								})] }), /* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								})] }), /* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-sm font-medium text-text-primary mb-1",
 									children: j("auth.sso.acsUrl", "Assertion Consumer Service (ACS) URL")
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ p("div", {
 									className: "flex items-center gap-2",
-									children: [/* @__PURE__ */ m("code", {
+									children: [/* @__PURE__ */ p("code", {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
 										children: [window.location.origin, "/auth/sso/callback"]
-									}), /* @__PURE__ */ p("button", {
+									}), /* @__PURE__ */ f("button", {
 										type: "button",
-										onClick: () => void h(`${window.location.origin}/auth/sso/callback`),
+										onClick: () => void g(`${window.location.origin}/auth/sso/callback`),
 										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
 										children: j("auth.sso.copy", "Copy")
 									})]
@@ -480,127 +550,120 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							})
 						]
 					}),
-					/* @__PURE__ */ m("form", {
-						onSubmit: async (e) => {
-							e.preventDefault(), L(null), z(null);
-							try {
-								await O(Q), z(j("auth.sso.saveSuccess", "SSO configuration saved successfully!")), P(!1);
-							} catch (e) {
-								L(e instanceof Error ? e.message : j("auth.sso.saveFailed", "Failed to save configuration"));
-							}
-						},
+					/* @__PURE__ */ p("form", {
+						onSubmit: ye,
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
 						children: [
-							/* @__PURE__ */ m("div", {
+							/* @__PURE__ */ p("div", {
 								className: "flex items-center justify-between mb-6",
-								children: [/* @__PURE__ */ p("h3", {
+								children: [/* @__PURE__ */ f("h3", {
 									className: "text-lg font-medium text-text-primary",
 									children: j("auth.sso.idpSettings", "Identity Provider (IdP) Settings")
-								}), !N && C && /* @__PURE__ */ p("button", {
+								}), !N && w && /* @__PURE__ */ f("button", {
 									type: "button",
 									onClick: () => P(!0),
 									className: "px-4 py-2 rounded-lg border border-status-info-border text-text-link hover:bg-status-info-bg-subtle text-sm font-medium transition-colors",
 									children: j("auth.sso.editConfig", "Edit Configuration")
 								})]
 							}),
-							/* @__PURE__ */ m("div", {
+							/* @__PURE__ */ p("div", {
 								className: "space-y-5",
 								children: [
-									/* @__PURE__ */ m("div", { children: [
-										/* @__PURE__ */ m("label", {
+									/* @__PURE__ */ p("div", { children: [
+										/* @__PURE__ */ p("label", {
 											htmlFor: "sso-entity-id",
 											className: "block text-sm font-medium text-text-primary mb-2",
 											children: [
 												j("auth.sso.idpEntityId", "IdP Entity ID / Issuer URL"),
 												" ",
-												/* @__PURE__ */ p("span", {
+												/* @__PURE__ */ f("span", {
 													className: "text-status-error-text",
 													"aria-hidden": "true",
 													children: "*"
 												})
 											]
 										}),
-										/* @__PURE__ */ p("input", {
+										/* @__PURE__ */ f("input", {
 											id: "sso-entity-id",
 											type: "url",
 											"aria-label": j("auth.sso.idpEntityId", "IdP Entity ID"),
-											value: Q.entityId,
-											onChange: (e) => $({
-												...Q,
+											value: Z.entityId,
+											onChange: (e) => Q({
+												...Z,
 												entityId: e.target.value
 											}),
-											disabled: !N && !!C,
+											disabled: !N && !!w,
 											placeholder: j("auth.sso.idpEntityIdPlaceholder", "https://your-idp.example.com/saml/metadata"),
 											required: !0,
 											"aria-required": "true",
 											"aria-describedby": "sso-entity-id-hint",
 											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all"
 										}),
-										/* @__PURE__ */ p("p", {
+										/* @__PURE__ */ f("p", {
 											id: "sso-entity-id-hint",
 											className: "mt-1 text-xs text-text-secondary",
 											children: j("auth.sso.idpEntityIdHelper", "The unique identifier of your Identity Provider")
 										})
 									] }),
-									/* @__PURE__ */ m("div", { children: [
-										/* @__PURE__ */ m("label", {
+									/* @__PURE__ */ p("div", { children: [
+										/* @__PURE__ */ p("label", {
 											htmlFor: "sso-sso-url",
 											className: "block text-sm font-medium text-text-primary mb-2",
 											children: [
 												j("auth.sso.ssoUrl", "SSO URL (Login URL)"),
 												" ",
-												/* @__PURE__ */ p("span", {
+												/* @__PURE__ */ f("span", {
 													className: "text-status-error-text",
 													"aria-hidden": "true",
 													children: "*"
 												})
 											]
 										}),
-										/* @__PURE__ */ p("input", {
+										/* @__PURE__ */ f("input", {
 											id: "sso-sso-url",
 											type: "url",
 											"aria-label": j("auth.sso.ssoUrl", "SSO URL"),
-											value: Q.ssoUrl,
-											onChange: (e) => $({
-												...Q,
+											value: Z.ssoUrl,
+											onChange: (e) => Q({
+												...Z,
 												ssoUrl: e.target.value
 											}),
-											disabled: !N && !!C,
+											disabled: !N && !!w,
 											placeholder: j("auth.sso.ssoUrlPlaceholder", "https://your-idp.example.com/saml/sso"),
 											required: !0,
 											"aria-required": "true",
 											"aria-describedby": "sso-sso-url-hint",
 											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all"
 										}),
-										/* @__PURE__ */ p("p", {
+										/* @__PURE__ */ f("p", {
 											id: "sso-sso-url-hint",
 											className: "mt-1 text-xs text-text-secondary",
 											children: j("auth.sso.ssoUrlHelper", "The URL where users are redirected to authenticate")
 										})
 									] }),
-									/* @__PURE__ */ m("div", { children: [
-										/* @__PURE__ */ m("label", {
+									/* @__PURE__ */ p("div", { children: [
+										/* @__PURE__ */ p("label", {
 											htmlFor: "sso-certificate",
 											className: "block text-sm font-medium text-text-primary mb-2",
 											children: [
 												j("auth.sso.certificate", "X.509 Certificate"),
 												" ",
-												/* @__PURE__ */ p("span", {
+												/* @__PURE__ */ f("span", {
 													className: "text-status-error-text",
 													"aria-hidden": "true",
 													children: "*"
 												})
 											]
 										}),
-										/* @__PURE__ */ p("textarea", {
+										/* @__PURE__ */ f("textarea", {
 											id: "sso-certificate",
 											"aria-label": j("auth.sso.certificate", "X.509 Certificate"),
-											value: Q.certificate,
-											onChange: (e) => $({
-												...Q,
+											value: Z.certificate,
+											onChange: (e) => Q({
+												...Z,
 												certificate: e.target.value
 											}),
-											disabled: !N && !!C,
+											disabled: !N && !!w,
 											placeholder: j("auth.sso.certificatePlaceholder", "-----BEGIN CERTIFICATE-----\nMIIDpDCCAoygAwIBAgIGAX...\n-----END CERTIFICATE-----"),
 											required: !0,
 											"aria-required": "true",
@@ -608,7 +671,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 											rows: 6,
 											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all font-mono text-sm"
 										}),
-										/* @__PURE__ */ p("p", {
+										/* @__PURE__ */ f("p", {
 											id: "sso-certificate-hint",
 											className: "mt-1 text-xs text-text-secondary",
 											children: j("auth.sso.certificateHelper", "The public X.509 certificate from your IdP for signature verification")
@@ -616,22 +679,24 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									] })
 								]
 							}),
-							(N || !C) && /* @__PURE__ */ m("div", {
+							(N || !w) && /* @__PURE__ */ p("div", {
 								className: "mt-6 flex items-center gap-3",
-								children: [/* @__PURE__ */ p("button", {
+								children: [/* @__PURE__ */ f(m, {
 									type: "submit",
-									disabled: E,
-									className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
-									children: E ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.saving", "Saving...")] }) : j("auth.sso.saveConfig", "Save Configuration")
-								}), N && /* @__PURE__ */ p("button", {
+									disabled: D,
+									variant: "default",
+									size: "lg",
+									className: "font-semibold",
+									children: D ? /* @__PURE__ */ p(d, { children: [/* @__PURE__ */ f(t, { className: "size-4 animate-spin" }), j("auth.sso.saving", "Saving...")] }) : j("auth.sso.saveConfig", "Save Configuration")
+								}), N && /* @__PURE__ */ f("button", {
 									type: "button",
 									onClick: () => {
-										P(!1), C && $({
-											entityId: C.entityId || "",
-											ssoUrl: C.ssoUrl || "",
-											sloUrl: C.sloUrl || "",
-											certificate: C.certificate || "",
-											enabled: C.enabled || !1
+										P(!1), w && Q({
+											entityId: w.entityId || "",
+											ssoUrl: w.ssoUrl || "",
+											sloUrl: w.sloUrl || "",
+											certificate: w.certificate || "",
+											enabled: w.enabled || !1
 										});
 									},
 									className: "px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors",
@@ -640,116 +705,116 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							})
 						]
 					}),
-					C && /* @__PURE__ */ m("div", {
+					w && /* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-status-error-border bg-status-error-bg-subtle",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-status-error-text mb-2",
 								children: j("auth.sso.dangerZone", "Danger Zone")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-status-error-text mb-4",
 								children: j("auth.sso.dangerZoneDesc", "Deleting the SSO configuration will prevent users from signing in with their enterprise credentials. This action cannot be undone.")
 							}),
-							/* @__PURE__ */ p("button", {
+							/* @__PURE__ */ f("button", {
 								type: "button",
 								onClick: () => F(!0),
-								disabled: D,
+								disabled: O,
 								className: "px-4 py-2 rounded-lg bg-status-error-bg text-white font-medium hover:bg-status-error-bg-hover disabled:opacity-50 transition-colors flex items-center gap-2",
-								children: D ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.deleting", "Deleting...")] }) : j("auth.sso.deleteConfig", "Delete SSO Configuration")
+								children: O ? /* @__PURE__ */ p(d, { children: [/* @__PURE__ */ f(t, { className: "size-4 animate-spin" }), j("auth.sso.deleting", "Deleting...")] }) : j("auth.sso.deleteConfig", "Delete SSO Configuration")
 							})
 						]
 					})
 				]
 			}),
-			!T && M === "oidc" && /* @__PURE__ */ m("div", {
+			!E && M === "oidc" && /* @__PURE__ */ p("div", {
 				className: "space-y-6",
 				children: [
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-4 rounded-xl bg-accent-purple-subtle border border-accent-purple-subtle",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "font-medium text-accent-purple mb-2",
 							children: j("auth.sso.oidcProviderInfo", "OIDC Provider Information")
-						}), /* @__PURE__ */ p("p", {
+						}), /* @__PURE__ */ f("p", {
 							className: "text-sm text-accent-purple",
 							children: j("auth.sso.oidcProviderInfoDesc", "Your auth service acts as an OpenID Connect Provider. This allows other applications to authenticate users through your system using standard OAuth 2.0/OIDC flows.")
 						})]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-text-primary mb-4",
 								children: j("auth.sso.discoveryEndpoint", "Discovery Endpoint")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-text-secondary mb-4",
 								children: j("auth.sso.discoveryEndpointDesc", "Applications can auto-configure by fetching the OpenID Connect Discovery document:")
 							}),
-							/* @__PURE__ */ m("div", {
+							/* @__PURE__ */ p("div", {
 								className: "flex items-center gap-2",
-								children: [/* @__PURE__ */ p("code", {
+								children: [/* @__PURE__ */ f("code", {
 									className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono break-all",
-									children: w?.issuer ? `${w.issuer}/.well-known/openid-configuration` : "Discovery endpoint unavailable until OIDC is configured"
-								}), /* @__PURE__ */ p("button", {
+									children: T?.issuer ? `${T.issuer}/.well-known/openid-configuration` : "Discovery endpoint unavailable until OIDC is configured"
+								}), /* @__PURE__ */ f("button", {
 									type: "button",
 									onClick: () => {
-										let e = w?.issuer ? `${w.issuer}/.well-known/openid-configuration` : "";
-										e && h(e);
+										let e = T?.issuer ? `${T.issuer}/.well-known/openid-configuration` : "";
+										e && g(e);
 									},
-									disabled: !w?.issuer,
+									disabled: !T?.issuer,
 									className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken flex-shrink-0",
 									children: j("auth.sso.copy", "Copy")
 								})]
 							})
 						]
 					}),
-					w && /* @__PURE__ */ m("div", {
+					T && /* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "text-lg font-medium text-text-primary mb-4",
 							children: j("auth.sso.oidcEndpoints", "OIDC Endpoints")
-						}), /* @__PURE__ */ p("div", {
+						}), /* @__PURE__ */ f("div", {
 							className: "space-y-4",
 							children: [
 								{
 									label: j("auth.sso.issuer", "Issuer"),
-									value: w.issuer
+									value: T.issuer
 								},
 								{
 									label: j("auth.sso.authorizationEndpoint", "Authorization Endpoint"),
-									value: w.authorizationEndpoint
+									value: T.authorizationEndpoint
 								},
 								{
 									label: j("auth.sso.tokenEndpoint", "Token Endpoint"),
-									value: w.tokenEndpoint
+									value: T.tokenEndpoint
 								},
 								{
 									label: j("auth.sso.userinfoEndpoint", "UserInfo Endpoint"),
-									value: w.userinfoEndpoint
+									value: T.userinfoEndpoint
 								},
 								{
 									label: j("auth.sso.jwksUri", "JWKS URI"),
-									value: w.jwksUri
+									value: T.jwksUri
 								}
-							].map((e) => /* @__PURE__ */ m("div", {
+							].map((e) => /* @__PURE__ */ p("div", {
 								className: "flex items-start gap-4",
-								children: [/* @__PURE__ */ p("span", {
+								children: [/* @__PURE__ */ f("span", {
 									className: "w-48 text-sm font-medium text-text-primary flex-shrink-0",
 									children: e.label
-								}), /* @__PURE__ */ p("code", {
+								}), /* @__PURE__ */ f("code", {
 									className: "text-sm text-text-secondary font-mono break-all",
 									children: e.value
 								})]
 							}, e.label))
 						})]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "text-lg font-medium text-text-primary mb-4",
 							children: j("auth.sso.supportedFeatures", "Supported Features")
-						}), /* @__PURE__ */ p("div", {
+						}), /* @__PURE__ */ f("div", {
 							className: "grid grid-cols-2 gap-4",
 							children: [
 								{
@@ -776,9 +841,9 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									name: j("auth.sso.featTokenRevocation", "Token Revocation"),
 									status: !0
 								}
-							].map((e) => /* @__PURE__ */ m("div", {
+							].map((e) => /* @__PURE__ */ p("div", {
 								className: "flex items-center gap-2",
-								children: [/* @__PURE__ */ p("span", { className: `size-2 rounded-full ${e.status ? "bg-status-success-text" : "bg-bg-sunken"}` }), /* @__PURE__ */ p("span", {
+								children: [/* @__PURE__ */ f("span", { className: `size-2 rounded-full ${e.status ? "bg-status-success-text" : "bg-bg-sunken"}` }), /* @__PURE__ */ f("span", {
 									className: "text-sm text-text-primary",
 									children: e.name
 								})]
@@ -787,40 +852,40 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 					})
 				]
 			}),
-			!T && M === "clients" && /* @__PURE__ */ m("div", {
+			!E && M === "clients" && /* @__PURE__ */ p("div", {
 				className: "space-y-6",
 				children: [
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-4 rounded-xl bg-status-warning-bg-subtle border border-status-warning-border",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "font-medium text-status-warning-text mb-2",
 							children: j("auth.sso.clientManagement", "OIDC Client Management")
-						}), /* @__PURE__ */ p("p", {
+						}), /* @__PURE__ */ f("p", {
 							className: "text-sm text-status-warning-text",
 							children: j("auth.sso.clientManagementDesc", "Register applications that can authenticate users through your OIDC provider. Each client gets unique credentials to use in the OAuth 2.0 / OIDC flow.")
 						})]
 					}),
-					X && /* @__PURE__ */ m("div", {
+					X && /* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border-2 border-status-success-border bg-status-success-bg-subtle",
-						children: [/* @__PURE__ */ m("div", {
+						children: [/* @__PURE__ */ p("div", {
 							className: "flex items-start justify-between mb-4",
-							children: [/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("h3", {
+							children: [/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-status-success-text",
 								children: j("auth.sso.clientCreatedTitle", "Client Created Successfully!")
-							}), /* @__PURE__ */ p("p", {
+							}), /* @__PURE__ */ f("p", {
 								className: "text-sm text-status-success-text mt-1",
 								children: j("auth.sso.clientCreatedDesc", "Save these credentials securely. The client secret will not be shown again.")
-							})] }), /* @__PURE__ */ p("button", {
+							})] }), /* @__PURE__ */ f("button", {
 								type: "button",
-								onClick: () => Z(null),
+								onClick: () => he(null),
 								"aria-label": j("auth.sso.dismissClientCredentials", "Dismiss"),
 								className: "text-status-success-text hover:text-status-success-text",
-								children: /* @__PURE__ */ p("svg", {
+								children: /* @__PURE__ */ f("svg", {
 									className: "size-5",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
-									children: /* @__PURE__ */ p("path", {
+									children: /* @__PURE__ */ f("path", {
 										strokeLinecap: "round",
 										strokeLinejoin: "round",
 										strokeWidth: 2,
@@ -828,66 +893,66 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									})
 								})
 							})]
-						}), /* @__PURE__ */ m("div", {
+						}), /* @__PURE__ */ p("div", {
 							className: "space-y-3",
 							children: [
-								/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-xs font-medium text-status-success-text mb-1",
 									children: j("auth.sso.clientId", "Client ID")
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ p("div", {
 									className: "flex gap-2",
-									children: [/* @__PURE__ */ p("code", {
+									children: [/* @__PURE__ */ f("code", {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
 										children: X.client_id
-									}), /* @__PURE__ */ p("button", {
+									}), /* @__PURE__ */ f("button", {
 										type: "button",
-										onClick: () => void h(X.client_id),
+										onClick: () => void g(X.client_id),
 										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
 										children: j("auth.sso.copy", "Copy")
 									})]
 								})] }),
-								X.client_secret && /* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								X.client_secret && /* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-xs font-medium text-status-success-text mb-1",
 									children: j("auth.sso.clientSecret", "Client Secret (save now!)")
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ p("div", {
 									className: "flex gap-2",
-									children: [/* @__PURE__ */ p("code", {
+									children: [/* @__PURE__ */ f("code", {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
 										children: X.client_secret
-									}), /* @__PURE__ */ p("button", {
+									}), /* @__PURE__ */ f("button", {
 										type: "button",
-										onClick: () => void h(X.client_secret || ""),
+										onClick: () => void g(X.client_secret || ""),
 										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
 										children: j("auth.sso.copy", "Copy")
 									})]
 								})] }),
-								/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-xs font-medium text-status-success-text mb-1",
 									children: j("auth.sso.redirectUris", "Redirect URIs")
-								}), /* @__PURE__ */ p("code", {
+								}), /* @__PURE__ */ f("code", {
 									className: "block px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
 									children: X.redirect_uris.join(", ")
 								})] })
 							]
 						})]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
-						children: [/* @__PURE__ */ m("div", {
+						children: [/* @__PURE__ */ p("div", {
 							className: "flex items-center justify-between mb-6",
-							children: [/* @__PURE__ */ p("h3", {
+							children: [/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-text-primary",
 								children: j("auth.sso.registerClient", "Register New Client")
-							}), !W && /* @__PURE__ */ m("button", {
+							}), !W && /* @__PURE__ */ p("button", {
 								type: "button",
 								onClick: () => G(!0),
 								className: "px-4 py-2 rounded-lg bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover transition-colors flex items-center gap-2",
-								children: [/* @__PURE__ */ p("svg", {
+								children: [/* @__PURE__ */ f("svg", {
 									className: "size-4",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
-									children: /* @__PURE__ */ p("path", {
+									children: /* @__PURE__ */ f("path", {
 										strokeLinecap: "round",
 										strokeLinejoin: "round",
 										strokeWidth: 2,
@@ -895,22 +960,22 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									})
 								}), j("auth.sso.newClient", "New Client")]
 							})]
-						}), W ? /* @__PURE__ */ m("div", {
+						}), W ? /* @__PURE__ */ p("div", {
 							className: "space-y-5",
 							children: [
-								/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ m("label", {
+								/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ p("label", {
 									htmlFor: "oidc-client-name",
 									className: "block text-sm font-medium text-text-primary mb-2",
 									children: [
 										j("auth.sso.clientName", "Client Name"),
 										" ",
-										/* @__PURE__ */ p("span", {
+										/* @__PURE__ */ f("span", {
 											className: "text-status-error-text",
 											"aria-hidden": "true",
 											children: "*"
 										})
 									]
-								}), /* @__PURE__ */ p("input", {
+								}), /* @__PURE__ */ f("input", {
 									id: "oidc-client-name",
 									type: "text",
 									"aria-label": j("auth.sso.oidcClientName", "Client Name"),
@@ -923,21 +988,21 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									"aria-required": "true",
 									className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all"
 								})] }),
-								/* @__PURE__ */ m("div", { children: [
-									/* @__PURE__ */ m("label", {
+								/* @__PURE__ */ p("div", { children: [
+									/* @__PURE__ */ p("label", {
 										htmlFor: "oidc-redirect-uris",
 										className: "block text-sm font-medium text-text-primary mb-2",
 										children: [
 											j("auth.sso.redirectUris", "Redirect URIs"),
 											" ",
-											/* @__PURE__ */ p("span", {
+											/* @__PURE__ */ f("span", {
 												className: "text-status-error-text",
 												"aria-hidden": "true",
 												children: "*"
 											})
 										]
 									}),
-									/* @__PURE__ */ p("input", {
+									/* @__PURE__ */ f("input", {
 										id: "oidc-redirect-uris",
 										type: "text",
 										"aria-label": j("auth.sso.oidcRedirectUris", "Redirect URIs"),
@@ -951,24 +1016,24 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										"aria-describedby": "oidc-redirect-uris-hint",
 										className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all"
 									}),
-									/* @__PURE__ */ p("p", {
+									/* @__PURE__ */ f("p", {
 										id: "oidc-redirect-uris-hint",
 										className: "mt-1 text-xs text-text-secondary",
 										children: j("auth.sso.redirectUrisHelper", "Separate multiple URIs with commas")
 									})
 								] }),
-								/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									className: "block text-sm font-medium text-text-primary mb-2",
 									children: j("auth.sso.grantTypes", "Grant Types")
-								}), /* @__PURE__ */ p("div", {
+								}), /* @__PURE__ */ f("div", {
 									className: "flex flex-wrap gap-3",
 									children: [
 										"authorization_code",
 										"refresh_token",
 										"client_credentials"
-									].map((e) => /* @__PURE__ */ m("label", {
+									].map((e) => /* @__PURE__ */ p("label", {
 										className: "flex items-center gap-2 cursor-pointer",
-										children: [/* @__PURE__ */ p("input", {
+										children: [/* @__PURE__ */ f("input", {
 											type: "checkbox",
 											"aria-label": e,
 											checked: K.grant_types.includes(e),
@@ -982,17 +1047,17 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 												});
 											},
 											className: "size-4 rounded border-border-default text-text-link focus:ring-action-primary-bg"
-										}), /* @__PURE__ */ p("span", {
+										}), /* @__PURE__ */ f("span", {
 											className: "text-sm text-text-primary",
 											children: e.replace(/_/g, " ")
 										})]
 									}, e))
 								})] }),
-								/* @__PURE__ */ m("div", { children: [/* @__PURE__ */ p("label", {
+								/* @__PURE__ */ p("div", { children: [/* @__PURE__ */ f("label", {
 									htmlFor: "oidc-token-auth-method",
 									className: "block text-sm font-medium text-text-primary mb-2",
 									children: j("auth.sso.tokenEndpointAuth", "Token Endpoint Auth Method")
-								}), /* @__PURE__ */ m("select", {
+								}), /* @__PURE__ */ p("select", {
 									id: "oidc-token-auth-method",
 									value: K.token_endpoint_auth_method,
 									onChange: (e) => q({
@@ -1001,64 +1066,31 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									}),
 									className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all",
 									children: [
-										/* @__PURE__ */ p("option", {
+										/* @__PURE__ */ f("option", {
 											value: "none",
 											children: j("auth.sso.tokenAuthNone", "None (Public Client - SPAs, Mobile Apps)")
 										}),
-										/* @__PURE__ */ p("option", {
+										/* @__PURE__ */ f("option", {
 											value: "client_secret_basic",
 											children: j("auth.sso.tokenAuthBasic", "Client Secret Basic")
 										}),
-										/* @__PURE__ */ p("option", {
+										/* @__PURE__ */ f("option", {
 											value: "client_secret_post",
 											children: j("auth.sso.tokenAuthPost", "Client Secret Post")
 										})
 									]
 								})] }),
-								/* @__PURE__ */ m("div", {
+								/* @__PURE__ */ p("div", {
 									className: "flex items-center gap-3 pt-2",
-									children: [/* @__PURE__ */ p("button", {
+									children: [/* @__PURE__ */ f(m, {
 										type: "button",
-										onClick: async () => {
-											if (!K.client_name || !K.redirect_uris) {
-												L(j("auth.sso.clientRequired", "Client name and redirect URI are required"));
-												return;
-											}
-											Y(!0), L(null);
-											try {
-												let e = w?.registrationEndpoint;
-												if (!e) throw Error(j("auth.sso.oidcNotConfigured", "OIDC dynamic client registration is not configured for this environment."));
-												let t = await fetch(e, {
-													method: "POST",
-													headers: { "Content-Type": "application/json" },
-													body: JSON.stringify({
-														client_name: K.client_name,
-														redirect_uris: K.redirect_uris.split(",").map((e) => e.trim()),
-														grant_types: K.grant_types,
-														response_types: ["code"],
-														token_endpoint_auth_method: K.token_endpoint_auth_method
-													})
-												});
-												if (!t.ok) {
-													let e = await t.json();
-													throw Error(e.error_description || e.error || "Registration failed");
-												}
-												Z(await t.json()), z(j("auth.sso.clientRegistered", "OIDC client registered successfully! Save the client credentials.")), G(!1), q({
-													client_name: "",
-													redirect_uris: "",
-													grant_types: ["authorization_code", "refresh_token"],
-													token_endpoint_auth_method: "none"
-												});
-											} catch (e) {
-												L(e instanceof Error ? e.message : j("auth.sso.registerFailed", "Failed to register client"));
-											} finally {
-												Y(!1);
-											}
-										},
+										onClick: ve,
 										disabled: J,
-										className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
-										children: J ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.registering", "Registering...")] }) : j("auth.sso.registerClientButton", "Register Client")
-									}), /* @__PURE__ */ p("button", {
+										variant: "default",
+										size: "lg",
+										className: "font-semibold",
+										children: J ? /* @__PURE__ */ p(d, { children: [/* @__PURE__ */ f(t, { className: "size-4 animate-spin" }), j("auth.sso.registering", "Registering...")] }) : j("auth.sso.registerClientButton", "Register Client")
+									}), /* @__PURE__ */ f("button", {
 										type: "button",
 										onClick: () => {
 											G(!1), q({
@@ -1073,61 +1105,48 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									})]
 								})
 							]
-						}) : /* @__PURE__ */ m("div", {
-							className: "text-center py-8 text-text-secondary",
-							children: [/* @__PURE__ */ p("svg", {
-								className: "size-12 mx-auto mb-3 text-text-muted",
-								fill: "none",
-								viewBox: "0 0 24 24",
-								stroke: "currentColor",
-								children: /* @__PURE__ */ p("path", {
-									strokeLinecap: "round",
-									strokeLinejoin: "round",
-									strokeWidth: 1.5,
-									d: "M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"
-								})
-							}), /* @__PURE__ */ p("p", {
-								className: "text-sm",
-								children: j("auth.sso.emptyClients", "Click \"New Client\" to register an OAuth 2.0 / OIDC client application.")
-							})]
+						}) : /* @__PURE__ */ f(h, {
+							illustration: "empty-generic",
+							title: j("auth.sso.emptyClientsTitle", "No client apps yet"),
+							description: j("auth.sso.emptyClients", "Click \"New Client\" to register an OAuth 2.0 / OIDC client application.")
 						})]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "text-lg font-medium text-text-primary mb-4",
 							children: j("auth.sso.preconfiguredClients", "Pre-configured Clients")
-						}), /* @__PURE__ */ p("div", {
+						}), /* @__PURE__ */ f("div", {
 							className: "space-y-4",
-							children: /* @__PURE__ */ m("div", {
+							children: /* @__PURE__ */ p("div", {
 								className: "p-4 rounded-lg bg-bg-canvas/50 border border-border-default",
 								children: [
-									/* @__PURE__ */ m("div", {
+									/* @__PURE__ */ p("div", {
 										className: "flex items-center justify-between mb-2",
-										children: [/* @__PURE__ */ p("span", {
+										children: [/* @__PURE__ */ f("span", {
 											className: "font-medium text-text-primary",
 											children: "tenant-frontend"
-										}), /* @__PURE__ */ p("span", {
+										}), /* @__PURE__ */ f("span", {
 											className: "px-2 py-1 rounded-full text-xs bg-status-success-bg-subtle text-status-success-text",
 											children: j("auth.sso.active", "Active")
 										})]
 									}),
-									/* @__PURE__ */ p("p", {
+									/* @__PURE__ */ f("p", {
 										className: "text-sm text-text-secondary",
 										children: j("auth.sso.preconfigClientDesc", "Default frontend client for tenant authentication")
 									}),
-									/* @__PURE__ */ m("div", {
+									/* @__PURE__ */ p("div", {
 										className: "mt-2 flex flex-wrap gap-2",
 										children: [
-											/* @__PURE__ */ p("span", {
+											/* @__PURE__ */ f("span", {
 												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
 												children: "authorization_code"
 											}),
-											/* @__PURE__ */ p("span", {
+											/* @__PURE__ */ f("span", {
 												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
 												children: "refresh_token"
 											}),
-											/* @__PURE__ */ p("span", {
+											/* @__PURE__ */ f("span", {
 												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
 												children: j("auth.sso.pkceRequired", "PKCE required")
 											})
@@ -1139,109 +1158,112 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 					})
 				]
 			}),
-			!T && M === "test" && /* @__PURE__ */ m("div", {
+			!E && M === "test" && /* @__PURE__ */ p("div", {
 				className: "space-y-6",
 				children: [
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-4 rounded-xl bg-status-warning-bg-subtle border border-status-warning-border",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "font-medium text-status-warning-text mb-2",
 							children: j("auth.sso.testLoginTitle", "Test SSO Login")
-						}), /* @__PURE__ */ p("p", {
+						}), /* @__PURE__ */ f("p", {
 							className: "text-sm text-status-warning-text",
 							children: j("auth.sso.testLoginDesc", "Use this section to test your SSO configuration before rolling it out to users. Make sure your IdP is properly configured with the SP metadata above.")
 						})]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
 						children: [
-							/* @__PURE__ */ p("h3", {
+							/* @__PURE__ */ f("h3", {
 								className: "text-lg font-medium text-text-primary mb-4",
 								children: j("auth.sso.spInitiatedTest", "SP-Initiated Login Test")
 							}),
-							/* @__PURE__ */ p("p", {
+							/* @__PURE__ */ f("p", {
 								className: "text-sm text-text-secondary mb-4",
 								children: j("auth.sso.spInitiatedTestDesc", "Click the button below to initiate an SSO login flow. You will be redirected to your IdP to authenticate.")
 							}),
-							C && C.enabled ? /* @__PURE__ */ m("a", {
+							w && w.enabled ? /* @__PURE__ */ p("a", {
 								href: `${window.location.origin}/auth/sso/login`,
 								className: "inline-flex items-center gap-2 px-6 py-3 rounded-xl bg-status-success-bg text-white font-medium shadow-sm hover:opacity-90 transition-all duration-200",
-								children: [/* @__PURE__ */ p("svg", {
+								children: [/* @__PURE__ */ f("svg", {
 									className: "size-5",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
-									children: /* @__PURE__ */ p("path", {
+									children: /* @__PURE__ */ f("path", {
 										strokeLinecap: "round",
 										strokeLinejoin: "round",
 										strokeWidth: 2,
 										d: "M11 16l-4-4m0 0l4-4m-4 4h14m-5 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h7a3 3 0 013 3v1"
 									})
 								}), j("auth.sso.testSsoLoginButton", "Test SSO Login")]
-							}) : /* @__PURE__ */ p("div", {
+							}) : /* @__PURE__ */ f("div", {
 								className: "p-4 rounded-xl bg-bg-sunken/50 text-text-secondary text-sm",
-								children: C ? j("auth.sso.disabledTest", "SSO is disabled. Enable it to test the login flow.") : j("auth.sso.notConfigured", "SSO is not configured. Please configure your IdP settings first.")
+								children: w ? j("auth.sso.disabledTest", "SSO is disabled. Enable it to test the login flow.") : j("auth.sso.notConfigured", "SSO is not configured. Please configure your IdP settings first.")
 							})
 						]
 					}),
-					/* @__PURE__ */ m("div", {
+					/* @__PURE__ */ p("div", {
 						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
-						children: [/* @__PURE__ */ p("h3", {
+						children: [/* @__PURE__ */ f("h3", {
 							className: "text-lg font-medium text-text-primary mb-4",
 							children: j("auth.sso.testResults", "Test Results")
-						}), /* @__PURE__ */ p("p", {
+						}), /* @__PURE__ */ f("p", {
 							className: "text-sm text-text-secondary",
 							children: j("auth.sso.testResultsDesc", "After testing, results will appear here. Check the browser console for detailed logs.")
 						})]
 					})
 				]
+			}),
+			/* @__PURE__ */ f(oe, {
+				className: "mt-8",
+				storageKey: "auth-sso-config",
+				steps: [
+					{
+						id: "save-config",
+						label: j("auth.sso.nextSave", "Save your IdP configuration"),
+						description: j("auth.sso.nextSaveDesc", "Enter your SAML or OIDC details, then save so the connection exists."),
+						done: !!w
+					},
+					{
+						id: "enable-sso",
+						label: j("auth.sso.nextEnable", "Enable SSO for sign-in"),
+						description: j("auth.sso.nextEnableDesc", "Flip the connection on once you've confirmed the settings."),
+						done: !!(w && Z.enabled),
+						onClick: () => {
+							w && !Z.enabled && $();
+						}
+					},
+					{
+						id: "test-login",
+						label: j("auth.sso.nextTest", "Test the login flow"),
+						description: j("auth.sso.nextTestDesc", "Run a test sign-in before rolling SSO out to your whole team."),
+						href: w && w.enabled ? `${window.location.origin}/auth/sso/login` : void 0
+					}
+				]
 			})
 		]
-	}) : /* @__PURE__ */ p("div", {
+	}) : /* @__PURE__ */ f("div", {
 		className: "max-w-5xl mx-auto p-6",
-		children: /* @__PURE__ */ m("div", {
-			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
-			children: [
-				/* @__PURE__ */ p("div", {
-					className: "size-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
-					children: /* @__PURE__ */ p(e, { className: "size-8 text-status-warning-text" })
-				}),
-				/* @__PURE__ */ p("h2", {
-					className: "text-xl font-semibold text-text-primary mb-2",
-					children: j("auth.sso.enterprisePlanRequired", "Enterprise Plan Required")
-				}),
-				/* @__PURE__ */ p("p", {
-					className: "text-text-secondary mb-2",
-					children: j("auth.sso.enterprisePlanRequiredDesc", "Single Sign-On (SAML / OIDC) configuration is available on the Enterprise plan.")
-				}),
-				/* @__PURE__ */ p("p", {
-					className: "text-sm text-text-secondary",
-					children: j("auth.sso.contactSales", "Contact sales to upgrade your workspace to the Enterprise plan.")
-				})
-			]
+		children: /* @__PURE__ */ f(h, {
+			illustration: "onboarding",
+			title: j("auth.sso.enterprisePlanRequired", "Enterprise Plan Required"),
+			description: /* @__PURE__ */ p(d, { children: [
+				j("auth.sso.enterprisePlanRequiredDesc", "Single Sign-On (SAML / OIDC) configuration is available on the Enterprise plan."),
+				" ",
+				j("auth.sso.contactSales", "Contact sales to upgrade your workspace to the Enterprise plan.")
+			] })
 		})
-	}) : /* @__PURE__ */ p("div", {
+	}) : /* @__PURE__ */ f("div", {
 		className: "max-w-5xl mx-auto p-6",
-		children: /* @__PURE__ */ m("div", {
-			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
-			children: [
-				/* @__PURE__ */ p("div", {
-					className: "size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
-					children: /* @__PURE__ */ p(e, { className: "size-8 text-status-error-text" })
-				}),
-				/* @__PURE__ */ p("h2", {
-					className: "text-xl font-semibold text-text-primary mb-2",
-					children: j("auth.sso.adminRequired", "Admin Access Required")
-				}),
-				/* @__PURE__ */ p("p", {
-					className: "text-text-secondary",
-					children: j("auth.sso.adminRequiredDesc", "You need administrator privileges to configure SSO settings.")
-				})
-			]
+		children: /* @__PURE__ */ f(h, {
+			illustration: "empty-generic",
+			title: j("auth.sso.adminRequired", "Admin Access Required"),
+			description: j("auth.sso.adminRequiredDesc", "You need administrator privileges to configure SSO settings.")
 		})
 	});
 }
 //#endregion
-export { _ as SsoConfigPage };
+export { v as SsoConfigPage };
 
 //# sourceMappingURL=SsoConfigPage.js.map