@burdenoff/microfe-auth 2026.825.1 → 2026.828.1

package/dist/auth/pages/LoginPage.js

@@ -3,23 +3,24 @@ import { useAuthStore as t } from "../store/authStore.js";
 import { useAuthOperations as n } from "../hooks/useAuthOperations.js";
 import { useMyWorkspaces as r } from "../hooks/useMyWorkspaces.js";
 import { useOAuthOperations as i } from "../hooks/useOAuthOperations.js";
-import { AuthLayout as a } from "../components/AuthLayout.js";
-import { AlertIcon as o, EmailIcon as s, EyeIcon as c, EyeOffIcon as l, GoogleIcon as ee, LockIcon as te, MicrosoftIcon as ne, SpinnerIcon as re } from "../components/AuthIcons.js";
-import { useCaptchaV3 as ie } from "../hooks/useCaptchaV3.js";
-import { MFA_REDIRECT as ae } from "../constants/sessionKeys.js";
-import { useCallback as u, useEffect as d, useRef as oe, useState as f } from "react";
-import { SSORedirectSpinner as se, getSSORedirectUrl as ce } from "@burdenoff/fe-libs/shared/components";
-import { useLocation as le, useNavigate as ue, useSearchParams as de } from "react-router";
-import { useActiveContext as fe, useI18n as pe } from "@burdenoff/fe-libs/shared/providers/shell";
-import { Fragment as p, jsx as m, jsxs as h } from "react/jsx-runtime";
-import { beginSsoNavigation as me, buildSsoDepositUrl as he, isSsoNavigationPending as ge, markSsoDepositPending as _e, mintSsoSessionTokens as ve } from "@burdenoff/fe-libs/shared/utils";
-import { resolveAuthBridgeConfig as ye } from "@burdenoff/fe-libs/shared/config";
-import { resolveGatewayUrls as be } from "@burdenoff/fe-libs/shared/config/gatewayUrls";
-import { Button as xe } from "@burdenoff/fe-libs/button";
-import { PagePurpose as Se } from "@burdenoff/fe-libs/ui";
-import { getProfileTokens as g, getProfileUser as _, getProfileWorkspaceToken as Ce, getProfiles as v, resolveActiveProfileId as we } from "@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager";
+import { sanitizePostLoginPath as a } from "../utils/redirect.js";
+import { AuthLayout as o } from "../components/AuthLayout.js";
+import { AlertIcon as s, EmailIcon as c, EyeIcon as l, EyeOffIcon as ee, GoogleIcon as te, LockIcon as ne, MicrosoftIcon as u, SpinnerIcon as d } from "../components/AuthIcons.js";
+import { useCaptchaV3 as re } from "../hooks/useCaptchaV3.js";
+import { MFA_REDIRECT as ie } from "../constants/sessionKeys.js";
+import { useCallback as f, useEffect as p, useRef as ae, useState as m } from "react";
+import { SSORedirectSpinner as oe, getSSORedirectUrl as se } from "@burdenoff/fe-libs/shared/components";
+import { useLocation as ce, useNavigate as le, useSearchParams as ue } from "react-router";
+import { useActiveContext as de, useI18n as fe } from "@burdenoff/fe-libs/shared/providers/shell";
+import { Fragment as h, jsx as g, jsxs as _ } from "react/jsx-runtime";
+import { beginSsoNavigation as pe, buildSsoDepositUrl as me, isSsoNavigationPending as he, markSsoDepositPending as ge, mintSsoSessionTokens as _e } from "@burdenoff/fe-libs/shared/utils";
+import { resolveAuthBridgeConfig as ve } from "@burdenoff/fe-libs/shared/config";
+import { resolveGatewayUrls as ye } from "@burdenoff/fe-libs/shared/config/gatewayUrls";
+import { Button as be } from "@burdenoff/fe-libs/button";
+import { PagePurpose as xe } from "@burdenoff/fe-libs/ui";
+import { getProfileTokens as Se, getProfileUser as Ce, getProfileWorkspaceToken as we, getProfiles as Te, resolveActiveProfileId as Ee } from "@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager";
 //#region src/auth/pages/LoginPage.tsx
-function Te() {
+function De() {
 	if (typeof window > "u") return !1;
 	let e = window;
 	if (typeof e.Capacitor?.isNativePlatform == "function") try {
@@ -27,7 +28,7 @@ function Te() {
 	} catch {}
 	return !!(typeof navigator < "u" && /Electron/i.test(navigator.userAgent || ""));
 }
-function Ee(e) {
+function Oe(e) {
 	if (typeof window > "u") return e;
 	try {
 		let t = new URL(e, window.location.origin);
@@ -36,7 +37,7 @@ function Ee(e) {
 		return e;
 	}
 }
-function De(e) {
+function ke(e) {
 	try {
 		let t = e.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), n = t.padEnd(Math.ceil(t.length / 4) * 4, "="), r = JSON.parse(atob(n));
 		return typeof r.exp == "number" && r.exp > Date.now() / 1e3;
@@ -44,16 +45,16 @@ function De(e) {
 		return !1;
 	}
 }
-function Oe(e) {
+function Ae(e) {
 	if (!e) return null;
 	try {
 		let t = new URL(decodeURIComponent(e), window.location.origin);
-		return t.origin === window.location.origin ? y(t, { includeOrigin: !1 }) : null;
+		return t.origin === window.location.origin ? v(t, { includeOrigin: !1 }) : null;
 	} catch {
 		return null;
 	}
 }
-function y(e, t) {
+function v(e, t) {
 	for (let t of [
 		"sso_failed",
 		"sso-failed",
@@ -63,92 +64,97 @@ function y(e, t) {
 	let n = e.searchParams.toString();
 	return `${e.pathname}${n ? `?${n}` : ""}${e.hash}`;
 }
-function b(e) {
+function y(e) {
 	try {
 		let t = new URL(decodeURIComponent(e), window.location.origin);
-		return y(t, { includeOrigin: t.origin !== window.location.origin });
+		return v(t, { includeOrigin: t.origin !== window.location.origin });
 	} catch {
 		return e;
 	}
 }
-function x() {
-	let y = ue(), x = le(), [S] = de(), { t: ke } = pe(), C = u((e, t) => {
-		let n = ke(e);
+function b() {
+	let v = le(), b = ce(), [x] = ue(), { t: S } = fe(), C = f((e, t) => {
+		let n = S(e);
 		return n === e ? t : n;
-	}, [ke]), { signIn: Ae, isLoading: je, error: w, errorCode: Me, resendVerification: Ne } = n(), { completeAuthFlow: Pe } = r(), { setWorkspace: Fe, setOrganization: Ie } = fe(), { defaultPostLoginPath: Le } = e(), { initiateGoogleOAuth: Re, initiateMicrosoftOAuth: ze, isProviderConfigured: T } = i(), E = t((e) => e.mfaRequired), { executeRecaptcha: Be } = ie(), [D, O] = f(!1), [Ve, He] = f(!1), k = u(async (e) => {
-		if (typeof window > "u" || Te()) return e;
+	}, [S]), { signIn: je, isLoading: w, error: T, errorCode: E, resendVerification: Me } = n(), { completeAuthFlow: Ne } = r(), { setWorkspace: D, setOrganization: Pe } = de(), { defaultPostLoginPath: Fe } = e(), { initiateGoogleOAuth: Ie, initiateMicrosoftOAuth: Le, isProviderConfigured: O } = i(), Re = t((e) => e.mfaRequired), { executeRecaptcha: ze } = re(), [k, Be] = m(!1), [Ve, He] = m(!1), Ue = f(async (e) => {
+		if (typeof window > "u" || De()) return e;
 		try {
-			let t = ye(), n = new URL(t.url), r = window.location.origin;
+			let t = ve(), n = new URL(t.url), r = window.location.origin;
 			if (n.origin === r) return e;
-			let i = new URL(e, r).href, a = we();
+			let i = new URL(e, r).href, a = Ee();
 			if (!a) return e;
-			let o = g(a), s = _(a);
+			let o = Se(a), s = Ce(a);
 			if (!o || !s) return e;
-			let c = Ce(a), l = {
+			let c = we(a), l = {
 				...o,
 				workspaceToken: c
 			};
 			if (o.refreshToken) {
-				let { globalBaseUrl: e } = be(), { tokens: t } = await ve(`${e}/global/graphql`, o.refreshToken);
+				let { globalBaseUrl: e } = ye(), { tokens: t } = await _e(`${e}/global/graphql`, o.refreshToken);
 				t && (l = {
 					...t,
 					workspaceToken: c
 				});
 			}
-			return _e(a), he(n.origin, i, {
+			return ge(a), me(n.origin, i, {
 				profileId: a,
 				tokens: JSON.stringify(l),
 				user: JSON.stringify(s),
-				profiles: JSON.stringify(v())
+				profiles: JSON.stringify(Te())
 			});
 		} catch {
 			return e;
 		}
-	}, []), A = oe(!1), j = u((e) => {
+	}, []), A = ae(!1), j = f((e) => {
+		let t = a(e);
 		if (typeof window > "u") {
-			y(e);
+			v(t);
 			return;
 		}
 		try {
-			sessionStorage.setItem("bf-post-login-return-to", e);
+			sessionStorage.setItem("bf-post-login-return-to", t);
 		} catch {}
-		if (Te()) {
-			y(Ee(e));
+		if (De()) {
+			v(Oe(t));
 			return;
 		}
 		A.current = !0, (async () => {
-			let t = await k(e);
-			t.includes("/auth/sso-deposit") ? (me(), window.location.assign(t), window.setTimeout(() => {
-				me(), window.location.replace(t);
-			}, 2500)) : window.location.assign(t);
+			let e = await Promise.race([Ue(t), new Promise((e) => {
+				window.setTimeout(() => e(t), 3e3);
+			})]);
+			e.includes("/auth/sso-deposit") ? (pe(), window.location.assign(e), window.setTimeout(() => {
+				pe(), window.location.replace(e);
+			}, 2500)) : window.location.assign(e), window.setTimeout(() => {
+				typeof window < "u" && window.location.pathname === "/auth/login" && v("/dashboard");
+			}, 3500);
 		})();
-	}, [y, k]), [M, Ue] = f(!1), [N, P] = f(!1), [We, F] = f(!1), [Ge, I] = f(!1), [L, R] = f(!1), [z, B] = f(!1), [Ke, qe] = f(!1), [Je, V] = f(!1), [Ye, H] = f(null), [Xe, U] = f(null), [W, G] = f({
+	}, [v, Ue]), [M, We] = m(!1), [N, P] = m(!1), [Ge, F] = m(!1), [Ke, I] = m(!1), [L, R] = m(!1), [z, B] = m(!1), [qe, Je] = m(!1), [Ye, V] = m(!1), [Xe, H] = m(null), [Ze, U] = m(null), [W, G] = m({
 		email: "",
 		password: "",
 		rememberMe: !1
-	}), [K, q] = f(null), [Ze, J] = f(!1), Y = S.get("mode") === "add-account", X = S.get("returnTo"), Z = oe(X), Q = S.get("reason");
-	d(() => {
+	}), [K, q] = m(null), [Qe, J] = m(!1), Y = x.get("mode") === "add-account", X = x.get("returnTo"), Z = ae(X), Q = x.get("reason");
+	p(() => {
 		Q === "session-expired" ? U(C("auth.login.sessionExpired", "Your session has expired. Please sign in again.")) : Q === "logout" && U(C("auth.login.signedOut", "You have been signed out."));
-	}, [Q, C]), d(() => {
+	}, [Q, C]), p(() => {
 		!Z.current && X && (Z.current = X);
-	}, [X]), d(() => {
-		if (Y || D || A.current || ge()) return;
-		let e = we();
+	}, [X]), p(() => {
+		if (Y || k || A.current || he()) return;
+		let e = Ee();
 		if (e) {
-			let n = g(e), r = _(e);
-			if (n?.accessToken && r && De(n.accessToken)) {
-				t.getState().loadFromProfile(e), j(Oe(X) ?? "/");
+			let n = Se(e), r = Ce(e);
+			if (n?.accessToken && r && ke(n.accessToken)) {
+				t.getState().loadFromProfile(e), j(Ae(X) ?? "/");
 				return;
 			}
 		}
-		let n = ce();
+		let n = se();
 		n && (He(!0), window.location.replace(n));
 	}, [
 		Y,
-		D,
+		k,
 		j,
 		X
-	]), d(() => {
+	]), p(() => {
 		try {
 			localStorage.removeItem("remembered_password");
 			let e = localStorage.getItem("remembered_email");
@@ -160,14 +166,14 @@ function x() {
 		} catch (e) {
 			console.warn("[LoginPage] Failed to load remembered email:", e);
 		}
-	}, []), d(() => {
-		let e = x.state;
+	}, []), p(() => {
+		let e = b.state;
 		e?.message && U(e.message), e?.email && G((t) => ({
 			...t,
 			email: e.email
 		})), e && window.history.replaceState({}, document.title);
-	}, [x.state]);
-	let Qe = (e, t) => {
+	}, [b.state]);
+	let $e = (e, t) => {
 		if (t) switch (t) {
 			case "ACCOUNT_DELETED": return "DELETED";
 			case "ACCOUNT_SUSPENDED": return "SUSPENDED";
@@ -180,20 +186,20 @@ function x() {
 		let n = e.toLowerCase();
 		return n.includes("deleted") || n.includes("permanently deleted") ? "DELETED" : n.includes("suspended") ? "SUSPENDED" : n.includes("oauth provider") || n.includes("oauth-only") || n.includes("oauth only") ? "OAUTH_ONLY" : n.includes("inactive") || n.includes("deactivated") || n.includes("not active") ? "INACTIVE" : n.includes("verify your email") || n.includes("email not verified") || n.includes("email_not_verified") ? "EMAIL_NOT_VERIFIED" : null;
 	};
-	d(() => {
-		let e = S.get("email");
+	p(() => {
+		let e = x.get("email");
 		if (e && G((t) => ({
 			...t,
 			email: e
-		})), S.get("expired") === "true") {
+		})), x.get("expired") === "true") {
 			U(C("auth.login.sessionExpired", "Your session has expired. Please sign in again."));
 			let e = window.location.pathname;
 			window.history.replaceState({}, document.title, e);
 		}
-	}, [S, C]), d(() => {
-		E && y("/auth/mfa-verify");
-	}, [E, y]);
-	let $e = async (e) => {
+	}, [x, C]), p(() => {
+		Re && v("/auth/mfa-verify");
+	}, [Re, v]);
+	let et = async (e) => {
 		e.preventDefault(), P(!1), F(!1), I(!1), R(!1), B(!1), J(!1), V(!1), q(null);
 		let n = (W.email ?? "").trim();
 		if (!n) {
@@ -208,22 +214,22 @@ function x() {
 			q(C("auth.login.enterPassword", "Please enter your password"));
 			return;
 		}
-		if (Y && v().some((e) => e.email.toLowerCase() === n.toLowerCase())) {
+		if (Y && Te().some((e) => e.email.toLowerCase() === n.toLowerCase())) {
 			J(!0), q(null);
 			return;
 		}
 		J(!1);
 		try {
-			let e = await Be("login"), t = await Ae({
+			let e = await ze("login"), t = await je({
 				email: n,
 				password: W.password,
 				rememberMe: W.rememberMe,
 				...e ? { recaptchaToken: e } : {}
 			});
 			if (t.requiresMFA) {
-				let e = b(Z.current || X || (Le ?? "/dashboard"));
+				let e = y(Z.current || X || (Fe ?? "/dashboard"));
 				try {
-					sessionStorage.setItem(ae, e);
+					sessionStorage.setItem(ie, e);
 				} catch {}
 				return;
 			}
@@ -243,10 +249,10 @@ function x() {
 				} catch (e) {
 					console.warn("[LoginPage] Failed to save/clear remembered email:", e);
 				}
-				O(!0);
-				let e = b(Z.current || X || (Le ?? "/dashboard"));
+				Be(!0);
+				let e = y(Z.current || X || (Fe ?? "/dashboard"));
 				try {
-					let n = await Promise.race([Pe(t.token), new Promise((e) => {
+					let n = await Promise.race([Ne(t.token), new Promise((e) => {
 						window.setTimeout(() => {
 							e({
 								success: !1,
@@ -254,122 +260,122 @@ function x() {
 							});
 						}, 5e3);
 					})]);
-					n.success ? (n.workspace && (Fe(n.workspace.id), n.workspace.organizationId && Ie(n.workspace.organizationId)), j(e)) : n.error?.includes("No workspaces found") ? y("/onboarding/create-workspace") : (n.workspace && (Fe(n.workspace.id), n.workspace.organizationId && Ie(n.workspace.organizationId)), console.warn("Auth flow warning:", n.error), j(e));
+					n.success ? (n.workspace && (D(n.workspace.id), n.workspace.organizationId && Pe(n.workspace.organizationId)), j(e)) : n.error?.includes("No workspaces found") ? v("/onboarding/create-workspace") : (n.workspace && (D(n.workspace.id), n.workspace.organizationId && Pe(n.workspace.organizationId)), console.warn("Auth flow warning:", n.error), j(e));
 				} catch (t) {
 					console.error("Auth flow error (login succeeded):", t), j(e);
 				} finally {
-					A.current || O(!1);
+					A.current || Be(!1);
 				}
 			}
 		} catch (e) {
 			let n = e instanceof Error ? e.message : String(e);
 			n.includes("reCAPTCHA") && q(n);
-			let r = t.getState().errorCode, i = Qe(n, r);
+			let r = t.getState().errorCode, i = $e(n, r);
 			i === "DELETED" ? F(!0) : i === "SUSPENDED" ? I(!0) : i === "OAUTH_ONLY" ? R(!0) : i === "INACTIVE" ? P(!0) : i === "EMAIL_NOT_VERIFIED" && B(!0);
 		}
 	};
-	d(() => {
-		if (w) {
-			let e = Qe(w, Me);
+	p(() => {
+		if (T) {
+			let e = $e(T, E);
 			e === "DELETED" ? F(!0) : e === "SUSPENDED" ? I(!0) : e === "OAUTH_ONLY" ? R(!0) : e === "INACTIVE" ? P(!0) : e === "EMAIL_NOT_VERIFIED" && B(!0);
 		}
-	}, [w, Me]);
-	let et = () => {
+	}, [T, E]);
+	let tt = () => {
 		H(null);
 		try {
-			Re();
+			Ie();
 		} catch (e) {
 			H(e instanceof Error ? e.message : C("auth.login.googleSignInFailed", "Failed to initiate Google sign in"));
 		}
-	}, tt = () => {
+	}, nt = () => {
 		H(null);
 		try {
-			ze();
+			Le();
 		} catch (e) {
 			H(e instanceof Error ? e.message : C("auth.login.microsoftSignInFailed", "Failed to initiate Microsoft sign in"));
 		}
-	}, nt = async () => {
-		qe(!0), V(!1);
+	}, rt = async () => {
+		Je(!0), V(!1);
 		try {
-			(await Ne((W.email ?? "").trim())).success ? V(!0) : q(C("auth.login.resendFailed", "Failed to resend verification email. Please try again."));
+			(await Me((W.email ?? "").trim())).success ? V(!0) : q(C("auth.login.resendFailed", "Failed to resend verification email. Please try again."));
 		} catch (e) {
 			console.error("Failed to resend verification email:", e), q(e instanceof Error ? e.message : C("auth.login.resendFailed", "Failed to resend verification email. Please try again."));
 		} finally {
-			qe(!1);
+			Je(!1);
 		}
-	}, rt = T("google"), $ = T("microsoft"), it = [{
+	}, it = O("google"), $ = O("microsoft"), at = [{
 		name: "Google",
-		icon: ee,
-		onClick: et,
-		disabled: !rt,
-		tooltip: rt ? void 0 : C("auth.login.googleNotConfigured", "Google sign in is not configured")
+		icon: te,
+		onClick: tt,
+		disabled: !it,
+		tooltip: it ? void 0 : C("auth.login.googleNotConfigured", "Google sign in is not configured")
 	}, {
 		name: "Microsoft",
-		icon: ne,
-		onClick: tt,
+		icon: u,
+		onClick: nt,
 		disabled: !$,
 		tooltip: $ ? void 0 : C("auth.login.microsoftNotConfigured", "Microsoft sign in is not configured")
 	}];
-	return Ve ? /* @__PURE__ */ m(se, {}) : /* @__PURE__ */ h(a, {
+	return Ve ? /* @__PURE__ */ g(oe, {}) : /* @__PURE__ */ _(o, {
 		title: C("auth.login.welcomeBack", "Welcome back"),
 		subtitle: C("auth.login.enterCredentials", "Enter your credentials to continue"),
 		children: [
-			/* @__PURE__ */ m(Se, {
+			/* @__PURE__ */ g(xe, {
 				className: "mb-5",
 				children: C("auth.login.purpose", "Sign in to reach your workspaces, agents, and settings. Use your email and password, a social provider, or a passwordless magic link.")
 			}),
-			/* @__PURE__ */ h("form", {
-				onSubmit: $e,
+			/* @__PURE__ */ _("form", {
+				onSubmit: et,
 				className: "space-y-5",
 				children: [
-					Xe && /* @__PURE__ */ h("div", {
+					Ze && /* @__PURE__ */ _("div", {
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border",
-						children: [/* @__PURE__ */ m("svg", {
+						children: [/* @__PURE__ */ g("svg", {
 							className: "size-5 flex-shrink-0 mt-0.5 text-text-link",
 							fill: "none",
 							viewBox: "0 0 24 24",
 							stroke: "currentColor",
-							children: /* @__PURE__ */ m("path", {
+							children: /* @__PURE__ */ g("path", {
 								strokeLinecap: "round",
 								strokeLinejoin: "round",
 								strokeWidth: 2,
 								d: "M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
 							})
-						}), /* @__PURE__ */ m("p", {
+						}), /* @__PURE__ */ g("p", {
 							className: "text-sm text-status-info-text",
-							children: Xe
+							children: Ze
 						})]
 					}),
-					K && /* @__PURE__ */ h("div", {
+					K && /* @__PURE__ */ _("div", {
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border",
-						children: [/* @__PURE__ */ m(o, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ m("p", {
+						children: [/* @__PURE__ */ g(s, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ g("p", {
 							className: "text-sm text-status-warning-text",
 							children: K
 						})]
 					}),
-					Ze && /* @__PURE__ */ h("div", {
+					Qe && /* @__PURE__ */ _("div", {
 						className: "flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border",
-						children: [/* @__PURE__ */ m(o, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ h("div", {
+						children: [/* @__PURE__ */ g(s, { className: "size-5 flex-shrink-0 mt-0.5 text-status-warning-text" }), /* @__PURE__ */ _("div", {
 							className: "flex-1",
 							children: [
-								/* @__PURE__ */ m("p", {
+								/* @__PURE__ */ g("p", {
 									className: "text-sm font-medium text-status-warning-text",
 									children: C("auth.login.duplicateAccount", "This account is already signed in.")
 								}),
-								/* @__PURE__ */ m("p", {
+								/* @__PURE__ */ g("p", {
 									className: "mt-1 text-sm text-status-warning-text/80",
 									children: C("auth.login.duplicateAccountHint", "Please use a different account, or go back and switch to this account from the profile menu.")
 								}),
-								(Z.current || X) && /* @__PURE__ */ h("button", {
+								(Z.current || X) && /* @__PURE__ */ _("button", {
 									type: "button",
-									onClick: () => y(decodeURIComponent(Z.current || X || "/dashboard")),
+									onClick: () => v(decodeURIComponent(Z.current || X || "/dashboard")),
 									className: "mt-3 inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm",
-									children: [/* @__PURE__ */ m("svg", {
+									children: [/* @__PURE__ */ g("svg", {
 										className: "size-4",
 										fill: "none",
 										viewBox: "0 0 24 24",
 										stroke: "currentColor",
-										children: /* @__PURE__ */ m("path", {
+										children: /* @__PURE__ */ g("path", {
 											strokeLinecap: "round",
 											strokeLinejoin: "round",
 											strokeWidth: 2,
@@ -380,48 +386,48 @@ function x() {
 							]
 						})]
 					}),
-					w && !K && !Ze && /* @__PURE__ */ h("div", {
+					T && !K && !Qe && /* @__PURE__ */ _("div", {
 						className: `flex items-start gap-3 p-4 rounded-xl border ${N || L || z ? "bg-status-warning-bg-subtle border-status-warning-border" : "bg-status-error-bg-subtle border-status-error-border"}`,
-						children: [/* @__PURE__ */ m(o, { className: `size-5 flex-shrink-0 mt-0.5 ${N || L || z ? "text-status-warning-text" : "text-status-error-text"}` }), /* @__PURE__ */ h("div", {
+						children: [/* @__PURE__ */ g(s, { className: `size-5 flex-shrink-0 mt-0.5 ${N || L || z ? "text-status-warning-text" : "text-status-error-text"}` }), /* @__PURE__ */ _("div", {
 							className: "flex-1",
 							children: [
-								/* @__PURE__ */ m("p", {
+								/* @__PURE__ */ g("p", {
 									className: `text-sm ${N || L || z ? "text-status-warning-text" : "text-status-error-text"}`,
-									children: We ? C("auth.login.accountDeleted", "This account has been permanently deleted and cannot be recovered.") : Ge ? C("auth.login.accountSuspended", "Your account has been suspended. Please contact support for assistance.") : N ? C("auth.login.accountDeactivated", "Your account has been deactivated.") : L ? C("auth.login.oauthOnly", "This account uses OAuth sign-in. Please use Google or Microsoft to sign in.") : z ? C("auth.login.emailNotVerified", "Please verify your email before signing in. Check your inbox for the verification link.") : w
+									children: Ge ? C("auth.login.accountDeleted", "This account has been permanently deleted and cannot be recovered.") : Ke ? C("auth.login.accountSuspended", "Your account has been suspended. Please contact support for assistance.") : N ? C("auth.login.accountDeactivated", "Your account has been deactivated.") : L ? C("auth.login.oauthOnly", "This account uses OAuth sign-in. Please use Google or Microsoft to sign in.") : z ? C("auth.login.emailNotVerified", "Please verify your email before signing in. Check your inbox for the verification link.") : T
 								}),
-								N && /* @__PURE__ */ m("button", {
+								N && /* @__PURE__ */ g("button", {
 									type: "button",
-									onClick: () => y("/auth/reactivate", { state: { email: W.email } }),
+									onClick: () => v("/auth/reactivate", { state: { email: W.email } }),
 									className: "mt-2 text-sm font-semibold text-status-warning-text hover:text-status-warning-text underline underline-offset-2",
 									children: C("auth.login.clickReactivate", "Click here to reactivate your account")
 								}),
-								z && /* @__PURE__ */ m("div", {
+								z && /* @__PURE__ */ g("div", {
 									className: "mt-3",
-									children: Je ? /* @__PURE__ */ h("div", {
+									children: Ye ? /* @__PURE__ */ _("div", {
 										className: "flex items-center gap-2 text-sm text-status-success-text",
-										children: [/* @__PURE__ */ m("svg", {
+										children: [/* @__PURE__ */ g("svg", {
 											className: "size-4",
 											fill: "none",
 											viewBox: "0 0 24 24",
 											stroke: "currentColor",
-											children: /* @__PURE__ */ m("path", {
+											children: /* @__PURE__ */ g("path", {
 												strokeLinecap: "round",
 												strokeLinejoin: "round",
 												strokeWidth: 2,
 												d: "M5 13l4 4L19 7"
 											})
 										}), C("auth.login.verificationSent", "Verification email sent! Please check your inbox.")]
-									}) : /* @__PURE__ */ m("button", {
+									}) : /* @__PURE__ */ g("button", {
 										type: "button",
-										onClick: nt,
-										disabled: Ke,
+										onClick: rt,
+										disabled: qe,
 										className: "inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm disabled:opacity-50 disabled:cursor-not-allowed",
-										children: Ke ? /* @__PURE__ */ h(p, { children: [/* @__PURE__ */ m(re, { className: "size-4 animate-spin" }), C("auth.login.sending", "Sending...")] }) : /* @__PURE__ */ h(p, { children: [/* @__PURE__ */ m("svg", {
+										children: qe ? /* @__PURE__ */ _(h, { children: [/* @__PURE__ */ g(d, { className: "size-4 animate-spin" }), C("auth.login.sending", "Sending...")] }) : /* @__PURE__ */ _(h, { children: [/* @__PURE__ */ g("svg", {
 											className: "size-4",
 											fill: "none",
 											viewBox: "0 0 24 24",
 											stroke: "currentColor",
-											children: /* @__PURE__ */ m("path", {
+											children: /* @__PURE__ */ g("path", {
 												strokeLinecap: "round",
 												strokeLinejoin: "round",
 												strokeWidth: 2,
@@ -430,35 +436,35 @@ function x() {
 										}), C("auth.login.resendVerification", "Resend verification email")] })
 									})
 								}),
-								L && /* @__PURE__ */ h("div", {
+								L && /* @__PURE__ */ _("div", {
 									className: "mt-3 flex flex-col gap-2",
-									children: [T("google") && /* @__PURE__ */ h("button", {
+									children: [O("google") && /* @__PURE__ */ _("button", {
 										type: "button",
-										onClick: et,
+										onClick: tt,
 										className: "inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm",
-										children: [/* @__PURE__ */ m(ee, { className: "size-5" }), C("auth.login.signInWithGoogle", "Sign in with Google")]
-									}), T("microsoft") && /* @__PURE__ */ h("button", {
+										children: [/* @__PURE__ */ g(te, { className: "size-5" }), C("auth.login.signInWithGoogle", "Sign in with Google")]
+									}), O("microsoft") && /* @__PURE__ */ _("button", {
 										type: "button",
-										onClick: tt,
+										onClick: nt,
 										className: "inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm",
-										children: [/* @__PURE__ */ m(ne, { className: "size-5" }), C("auth.login.signInWithMicrosoft", "Sign in with Microsoft")]
+										children: [/* @__PURE__ */ g(u, { className: "size-5" }), C("auth.login.signInWithMicrosoft", "Sign in with Microsoft")]
 									})]
 								})
 							]
 						})]
 					}),
-					/* @__PURE__ */ h("div", {
+					/* @__PURE__ */ _("div", {
 						className: "space-y-2",
-						children: [/* @__PURE__ */ m("label", {
+						children: [/* @__PURE__ */ g("label", {
 							htmlFor: "email",
 							className: "block text-sm font-medium text-[var(--color-text-primary)]",
 							children: C("auth.login.emailLabel", "Email")
-						}), /* @__PURE__ */ h("div", {
+						}), /* @__PURE__ */ _("div", {
 							className: "relative",
-							children: [/* @__PURE__ */ m("div", {
+							children: [/* @__PURE__ */ g("div", {
 								className: "absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none",
-								children: /* @__PURE__ */ m(s, { className: "size-5 text-[var(--color-text-tertiary)]" })
-							}), /* @__PURE__ */ m("input", {
+								children: /* @__PURE__ */ g(c, { className: "size-5 text-[var(--color-text-tertiary)]" })
+							}), /* @__PURE__ */ g("input", {
 								id: "email",
 								type: "email",
 								autoComplete: "email",
@@ -475,20 +481,20 @@ function x() {
 							})]
 						})]
 					}),
-					/* @__PURE__ */ h("div", {
+					/* @__PURE__ */ _("div", {
 						className: "space-y-2",
-						children: [/* @__PURE__ */ m("label", {
+						children: [/* @__PURE__ */ g("label", {
 							htmlFor: "password",
 							className: "block text-sm font-medium text-[var(--color-text-primary)]",
 							children: C("auth.login.passwordLabel", "Password")
-						}), /* @__PURE__ */ h("div", {
+						}), /* @__PURE__ */ _("div", {
 							className: "relative",
 							children: [
-								/* @__PURE__ */ m("div", {
+								/* @__PURE__ */ g("div", {
 									className: "absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none",
-									children: /* @__PURE__ */ m(te, { className: "size-5 text-[var(--color-text-tertiary)]" })
+									children: /* @__PURE__ */ g(ne, { className: "size-5 text-[var(--color-text-tertiary)]" })
 								}),
-								/* @__PURE__ */ m("input", {
+								/* @__PURE__ */ g("input", {
 									id: "password",
 									type: M ? "text" : "password",
 									autoComplete: "current-password",
@@ -503,23 +509,23 @@ function x() {
 									className: "block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all",
 									placeholder: C("auth.login.passwordPlaceholder", "Enter your password")
 								}),
-								/* @__PURE__ */ m("button", {
+								/* @__PURE__ */ g("button", {
 									type: "button",
-									onClick: () => Ue(!M),
+									onClick: () => We(!M),
 									"aria-label": M ? "Hide password" : "Show password",
 									className: "absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors",
-									children: m(M ? l : c, { className: "size-5" })
+									children: g(M ? ee : l, { className: "size-5" })
 								})
 							]
 						})]
 					}),
-					/* @__PURE__ */ h("div", {
+					/* @__PURE__ */ _("div", {
 						className: "flex items-center justify-between",
-						children: [/* @__PURE__ */ h("label", {
+						children: [/* @__PURE__ */ _("label", {
 							className: "flex items-center gap-2 cursor-pointer group",
-							children: [/* @__PURE__ */ h("div", {
+							children: [/* @__PURE__ */ _("div", {
 								className: "relative",
-								children: [/* @__PURE__ */ m("input", {
+								children: [/* @__PURE__ */ g("input", {
 									type: "checkbox",
 									"aria-label": C("auth.login.rememberMe", "Remember me"),
 									checked: W.rememberMe,
@@ -535,101 +541,101 @@ function x() {
 										}
 									},
 									className: "sr-only peer"
-								}), /* @__PURE__ */ m("div", {
+								}), /* @__PURE__ */ g("div", {
 									className: "size-5 rounded-md border-2 border-[var(--color-border-default)] bg-[var(--color-bg-surface)] peer-checked:bg-status-info-bg-subtle0 peer-checked:border-action-primary-bg transition-all peer-focus:ring-2 peer-focus:ring-action-primary-bg/20",
-									children: /* @__PURE__ */ m("svg", {
+									children: /* @__PURE__ */ g("svg", {
 										className: "size-full text-white opacity-0 peer-checked:opacity-100 transition-opacity p-0.5",
 										fill: "none",
 										viewBox: "0 0 24 24",
 										stroke: "currentColor",
 										strokeWidth: 3,
-										children: /* @__PURE__ */ m("path", {
+										children: /* @__PURE__ */ g("path", {
 											strokeLinecap: "round",
 											strokeLinejoin: "round",
 											d: "M5 13l4 4L19 7"
 										})
 									})
 								})]
-							}), /* @__PURE__ */ m("span", {
+							}), /* @__PURE__ */ g("span", {
 								className: "text-sm text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)] transition-colors",
 								children: C("auth.login.rememberMe", "Remember me")
 							})]
-						}), /* @__PURE__ */ m("button", {
+						}), /* @__PURE__ */ g("button", {
 							type: "button",
-							onClick: () => y("/auth/reset-password"),
+							onClick: () => v("/auth/reset-password"),
 							className: "text-sm font-medium text-text-link hover:text-text-linkHover transition-colors",
 							children: C("auth.login.forgotPassword", "Forgot password?")
 						})]
 					}),
-					/* @__PURE__ */ m(xe, {
+					/* @__PURE__ */ g(be, {
 						type: "submit",
-						disabled: je || D,
+						disabled: w || k,
 						variant: "default",
 						size: "lg",
 						className: "w-full font-semibold",
-						children: je || D ? /* @__PURE__ */ h(p, { children: [/* @__PURE__ */ m(re, { className: "size-5 animate-spin" }), /* @__PURE__ */ m("span", { children: D ? C("auth.login.settingUpWorkspace", "Setting up workspace...") : C("auth.login.signingIn", "Signing in...") })] }) : C("auth.login.signIn", "Sign in")
+						children: w || k ? /* @__PURE__ */ _(h, { children: [/* @__PURE__ */ g(d, { className: "size-5 animate-spin" }), /* @__PURE__ */ g("span", { children: k ? C("auth.login.settingUpWorkspace", "Setting up workspace...") : C("auth.login.signingIn", "Signing in...") })] }) : C("auth.login.signIn", "Sign in")
 					})
 				]
 			}),
-			/* @__PURE__ */ h("div", {
+			/* @__PURE__ */ _("div", {
 				className: "relative my-8",
-				children: [/* @__PURE__ */ m("div", {
+				children: [/* @__PURE__ */ g("div", {
 					className: "absolute inset-0 flex items-center",
-					children: /* @__PURE__ */ m("div", { className: "w-full border-t border-[var(--color-border-default)]" })
-				}), /* @__PURE__ */ m("div", {
+					children: /* @__PURE__ */ g("div", { className: "w-full border-t border-[var(--color-border-default)]" })
+				}), /* @__PURE__ */ g("div", {
 					className: "relative flex justify-center",
-					children: /* @__PURE__ */ m("span", {
+					children: /* @__PURE__ */ g("span", {
 						className: "px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]",
 						children: C("auth.login.orContinueWith", "or continue with")
 					})
 				})]
 			}),
-			Ye && /* @__PURE__ */ h("div", {
+			Xe && /* @__PURE__ */ _("div", {
 				className: "flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border",
-				children: [/* @__PURE__ */ m(o, { className: "size-5 flex-shrink-0 mt-0.5 text-status-error-text" }), /* @__PURE__ */ m("p", {
+				children: [/* @__PURE__ */ g(s, { className: "size-5 flex-shrink-0 mt-0.5 text-status-error-text" }), /* @__PURE__ */ g("p", {
 					className: "text-sm text-status-error-text",
-					children: Ye
+					children: Xe
 				})]
 			}),
-			/* @__PURE__ */ m("div", {
+			/* @__PURE__ */ g("div", {
 				className: "grid grid-cols-3 gap-3",
-				children: it.map((e) => /* @__PURE__ */ h("button", {
+				children: at.map((e) => /* @__PURE__ */ _("button", {
 					type: "button",
 					onClick: e.onClick,
 					disabled: e.disabled,
 					title: e.tooltip,
 					"aria-label": e.name,
 					className: `flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${e.disabled ? "border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50" : "border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]"}`,
-					children: [/* @__PURE__ */ m(e.icon, { className: `size-5 ${e.disabled ? "opacity-50" : ""}` }), /* @__PURE__ */ m("span", {
+					children: [/* @__PURE__ */ g(e.icon, { className: `size-5 ${e.disabled ? "opacity-50" : ""}` }), /* @__PURE__ */ g("span", {
 						className: `sr-only sm:not-sr-only text-sm font-medium transition-colors ${e.disabled ? "text-[var(--color-text-disabled)]" : "text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]"}`,
 						children: e.name
 					})]
 				}, e.name))
 			}),
-			/* @__PURE__ */ m("div", {
+			/* @__PURE__ */ g("div", {
 				className: "mt-4 text-center",
-				children: /* @__PURE__ */ h("button", {
+				children: /* @__PURE__ */ _("button", {
 					type: "button",
-					onClick: () => y("/auth/magic-link"),
+					onClick: () => v("/auth/magic-link"),
 					className: "text-sm text-[var(--color-text-secondary)] hover:text-[var(--color-text-primary)] transition-colors",
 					children: [
 						C("auth.login.preferPasswordless", "Prefer passwordless login?"),
 						" ",
-						/* @__PURE__ */ m("span", {
+						/* @__PURE__ */ g("span", {
 							className: "font-semibold text-text-link hover:text-text-linkHover",
 							children: C("auth.login.signInMagicLink", "Sign in with Magic Link")
 						})
 					]
 				})
 			}),
-			/* @__PURE__ */ h("p", {
+			/* @__PURE__ */ _("p", {
 				className: "mt-6 text-center text-sm text-[var(--color-text-secondary)]",
 				children: [
 					C("auth.login.dontHaveAccount", "Don't have an account?"),
 					" ",
-					/* @__PURE__ */ m("button", {
+					/* @__PURE__ */ g("button", {
 						type: "button",
-						onClick: () => y("/auth/register"),
+						onClick: () => v("/auth/register"),
 						className: "font-semibold text-text-link hover:text-text-linkHover transition-colors",
 						children: C("auth.login.signUp", "Sign up")
 					})
@@ -639,6 +645,6 @@ function x() {
 	});
 }
 //#endregion
-export { x as LoginPage };
+export { b as LoginPage };
 
 //# sourceMappingURL=LoginPage.js.map

package/dist/auth/pages/LoginPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"LoginPage.js","names":[],"sources":["../../../src/auth/pages/LoginPage.tsx"],"sourcesContent":["import { useState, useEffect, useCallback, useRef } from \"react\";\nimport { useNavigate, useSearchParams, useLocation } from \"react-router\";\nimport {\n  useI18n,\n  useActiveContext,\n} from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport {\n  getSSORedirectUrl,\n  SSORedirectSpinner,\n} from \"@burdenoff/fe-libs/shared/components\";\nimport { resolveAuthBridgeConfig } from \"@burdenoff/fe-libs/shared/config\";\nimport { resolveGatewayUrls } from \"@burdenoff/fe-libs/shared/config/gatewayUrls\";\nimport {\n  beginSsoNavigation,\n  buildSsoDepositUrl,\n  isSsoNavigationPending,\n  markSsoDepositPending,\n  mintSsoSessionTokens,\n} from \"@burdenoff/fe-libs/shared/utils\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { PagePurpose } from \"@burdenoff/fe-libs/ui\";\n\nimport {\n  getProfileTokens,\n  getProfileUser,\n  getProfiles,\n  getProfileWorkspaceToken,\n  resolveActiveProfileId,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useMyWorkspaces } from \"../hooks/useMyWorkspaces\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  // GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useCaptchaV3 } from \"../hooks/useCaptchaV3\";\nimport { MFA_REDIRECT } from \"../constants/sessionKeys\";\nimport type { SignInInput } from \"../types\";\n\n/**\n * Detect whether the bundle is running inside a native shell (Capacitor on\n * iOS/Android, or Electron). Cross-origin SSO deposit/relay detours only make\n * sense in a multi-origin web context — in a native shell there is one product\n * origin, tokens already live in localStorage, and `window.location.assign` to\n * an external https URL escapes the embedded webview.\n *\n * Detection is runtime-only and avoids importing any platform-specific module\n * so this stays valid when microfe-auth is consumed by a pure web shell too.\n */\nfunction isNativeShell(): boolean {\n  if (typeof window === \"undefined\") return false;\n  const w = window as typeof window & {\n    Capacitor?: { isNativePlatform?: () => boolean };\n  };\n  if (typeof w.Capacitor?.isNativePlatform === \"function\") {\n    try {\n      if (w.Capacitor.isNativePlatform()) return true;\n    } catch {\n      /* fall through */\n    }\n  }\n  if (\n    typeof navigator !== \"undefined\" &&\n    /Electron/i.test(navigator.userAgent || \"\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\nfunction toSameOriginPath(target: string): string {\n  if (typeof window === \"undefined\") return target;\n  try {\n    const url = new URL(target, window.location.origin);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction hasValidAccessToken(token: string): boolean {\n  try {\n    const raw = token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n    const payload = JSON.parse(atob(padded)) as { exp?: unknown };\n    return typeof payload.exp === \"number\" && payload.exp > Date.now() / 1000;\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeSameOriginReturnTo(returnTo: string | null): string | null {\n  if (!returnTo) return null;\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    if (url.origin !== window.location.origin) return null;\n    return stripStaleSsoParams(url, { includeOrigin: false });\n  } catch {\n    return null;\n  }\n}\n\nfunction stripStaleSsoParams(\n  url: URL,\n  options: { includeOrigin: boolean },\n): string {\n  for (const param of [\"sso_failed\", \"sso-failed\", \"sso-attempted\"] as const) {\n    url.searchParams.delete(param);\n  }\n\n  if (options.includeOrigin) {\n    return url.toString();\n  }\n\n  const search = url.searchParams.toString();\n  return `${url.pathname}${search ? `?${search}` : \"\"}${url.hash}`;\n}\n\nfunction cleanReturnToValue(returnTo: string): string {\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    // Preserve cross-origin absolute returnTo values (e.g., redirects back to\n    // another product's app shell) — only strip stale SSO params.\n    const isCrossOrigin = url.origin !== window.location.origin;\n    return stripStaleSsoParams(url, { includeOrigin: isCrossOrigin });\n  } catch {\n    return returnTo;\n  }\n}\n\n/**\n * Login page with professional design\n * Provides email/password login and social OAuth options\n */\nexport function LoginPage() {\n  const navigate = useNavigate();\n  const location = useLocation();\n  const [searchParams] = useSearchParams();\n  const { t } = useI18n();\n  const tr = useCallback(\n    (key: string, fallback: string): string => {\n      const translated = t(key);\n      return translated === key ? fallback : translated;\n    },\n    [t],\n  );\n  const { signIn, isLoading, error, errorCode, resendVerification } =\n    useAuthOperations();\n  const { completeAuthFlow } = useMyWorkspaces();\n  const { setWorkspace, setOrganization } = useActiveContext();\n  const { defaultPostLoginPath } = useAuth();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const mfaRequired = useAuthStore((state) => state.mfaRequired);\n  const { executeRecaptcha: executeCaptchaV3 } = useCaptchaV3();\n  const [isCompletingAuth, setIsCompletingAuth] = useState(false);\n  const [isSsoRedirecting, setIsSsoRedirecting] = useState(false);\n\n  /**\n   * Build the URL that should receive the post-login redirect.\n   *\n   * For cross-eTLD+1 SSO on alpha/prod we detour through the central bridge\n   * host (alphaapp/app.burdenoff.com) so the freshly-issued tokens land in\n   * the bridge origin's first-party (unpartitioned) localStorage. Without\n   * this step, a later direct visit to the bridge host has no local tokens\n   * and no shared cookie (cross-eTLD+1 cookies don't propagate), so the user\n   * sees the login page again.\n   *\n   * Skipped when:\n   *   - Already on the bridge host origin (would be a no-op self-redirect).\n   *   - The user's intended destination is itself on the bridge host\n   *     (likely an in-product navigation, no deposit needed).\n   *   - The freshly-stored profile snapshot can't be read (best-effort only —\n   *     login still succeeds via the direct redirect).\n   */\n  const buildPostLoginUrl = useCallback(\n    async (intendedPath: string): Promise<string> => {\n      if (typeof window === \"undefined\") return intendedPath;\n      // Native shells (Electron, Capacitor iOS/Android) run as a single origin —\n      // skip the cross-eTLD+1 deposit detour, which would otherwise navigate to\n      // an external https URL and escape the embedded webview.\n      if (isNativeShell()) return intendedPath;\n      try {\n        const bridge = resolveAuthBridgeConfig();\n        const bridgeUrl = new URL(bridge.url);\n        const currentOrigin = window.location.origin;\n        if (bridgeUrl.origin === currentOrigin) return intendedPath;\n\n        // intendedPath can be a path or an absolute URL; resolve to absolute\n        // against current origin so the bridge host knows where to send the\n        // user back.\n        const absoluteIntended = new URL(intendedPath, currentOrigin).href;\n\n        const profileId = resolveActiveProfileId();\n        if (!profileId) return intendedPath;\n        const tokens = getProfileTokens(profileId);\n        const user = getProfileUser(profileId);\n        if (!tokens || !user) return intendedPath;\n        const workspaceToken = getProfileWorkspaceToken(profileId);\n\n        // BOFF-4463: mint a DEDICATED refresh-token lineage for the bridge\n        // host. Copying this origin's pair verbatim meant the bridge (and\n        // every product it later relayed to) shared ONE rotating refresh\n        // token — the first origin to refresh revoked it for all others,\n        // surfacing as \"products log me out after minutes/hours\". Falls back\n        // to the legacy copy if the mutation is unreachable (rollout gap /\n        // transient failure) so SSO keeps working.\n        let depositTokens: Record<string, unknown> = {\n          ...tokens,\n          workspaceToken,\n        };\n        if (tokens.refreshToken) {\n          const { globalBaseUrl } = resolveGatewayUrls();\n          const { tokens: minted } = await mintSsoSessionTokens(\n            `${globalBaseUrl}/global/graphql`,\n            tokens.refreshToken,\n          );\n          if (minted) {\n            depositTokens = { ...minted, workspaceToken };\n          }\n        }\n\n        markSsoDepositPending(profileId);\n        return buildSsoDepositUrl(bridgeUrl.origin, absoluteIntended, {\n          profileId,\n          tokens: JSON.stringify(depositTokens),\n          user: JSON.stringify(user),\n          profiles: JSON.stringify(getProfiles()),\n        });\n      } catch {\n        return intendedPath;\n      }\n    },\n    [],\n  );\n\n  // Once a cross-document post-login redirect is initiated, the login page\n  // must FREEZE: resetting isCompletingAuth re-runs the auto-redirect effect\n  // and any state churn schedules same-document navigations that cancel the\n  // provisional deposit hop (BOFF-4463).\n  const redirectInitiatedRef = useRef(false);\n\n  const redirectAfterLogin = useCallback(\n    (path: string) => {\n      if (typeof window === \"undefined\") {\n        navigate(path);\n        return;\n      }\n      try {\n        sessionStorage.setItem(\"bf-post-login-return-to\", path);\n      } catch {\n        // Ignore storage failures; redirect still proceeds.\n      }\n      // In native shells use SPA navigation so the embedded webview stays in\n      // the app — no full reload, no chance of the OS opening the URL\n      // externally. Tokens are already in this origin's localStorage.\n      if (isNativeShell()) {\n        navigate(toSameOriginPath(path));\n        return;\n      }\n      redirectInitiatedRef.current = true;\n      void (async () => {\n        const target = await buildPostLoginUrl(path);\n        if (target.includes(\"/auth/sso-deposit\")) {\n          // Cross-document deposit hop: suppress same-document navigators\n          // while it is provisional, and retry once if it still gets\n          // cancelled — on a committed navigation this document unloads and\n          // the timer never fires.\n          beginSsoNavigation();\n          window.location.assign(target);\n          window.setTimeout(() => {\n            beginSsoNavigation();\n            window.location.replace(target);\n          }, 2500);\n        } else {\n          window.location.assign(target);\n        }\n      })();\n    },\n    [navigate, buildPostLoginUrl],\n  );\n  const [showPassword, setShowPassword] = useState(false);\n  const [isAccountInactive, setIsAccountInactive] = useState(false);\n  const [isAccountDeleted, setIsAccountDeleted] = useState(false);\n  const [isAccountSuspended, setIsAccountSuspended] = useState(false);\n  const [isOAuthOnlyAccount, setIsOAuthOnlyAccount] = useState(false);\n  const [isEmailNotVerified, setIsEmailNotVerified] = useState(false);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendSuccess, setResendSuccess] = useState(false);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [infoMessage, setInfoMessage] = useState<string | null>(null);\n  const [formData, setFormData] = useState<\n    SignInInput & { rememberMe?: boolean }\n  >({\n    email: \"\",\n    password: \"\",\n    rememberMe: false,\n  });\n  const [validationError, setValidationError] = useState<string | null>(null);\n  const [isDuplicateAccount, setIsDuplicateAccount] = useState(false);\n\n  // Detect add-account mode and returnTo from URL params\n  const isAddAccountMode = searchParams.get(\"mode\") === \"add-account\";\n  const returnTo = searchParams.get(\"returnTo\");\n  const initialReturnToRef = useRef<string | null>(returnTo);\n\n  // Tell the user WHY they are back on the login page. `session-expired` is\n  // set by the shell's forced logout (expired session whose refresh failed);\n  // `logout` covers explicit sign-outs and the SSO-clear fallback (which can\n  // rewrite a session-expired redirect's reason on the cross-product bounce).\n  // Without this the auto-logout looked like a silent, unexplained kick-out.\n  const reasonParam = searchParams.get(\"reason\");\n  useEffect(() => {\n    if (reasonParam === \"session-expired\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n    } else if (reasonParam === \"logout\") {\n      setInfoMessage(tr(\"auth.login.signedOut\", \"You have been signed out.\"));\n    }\n  }, [reasonParam, tr]);\n\n  useEffect(() => {\n    if (!initialReturnToRef.current && returnTo) {\n      initialReturnToRef.current = returnTo;\n    }\n  }, [returnTo]);\n\n  useEffect(() => {\n    if (isAddAccountMode || isCompletingAuth) return;\n    // A cross-document SSO navigation (deposit/relay hop) is already in\n    // flight — issuing another redirect here would cancel it (BOFF-4463).\n    if (redirectInitiatedRef.current || isSsoNavigationPending()) return;\n\n    const profileId = resolveActiveProfileId();\n    if (profileId) {\n      const tokens = getProfileTokens(profileId);\n      const user = getProfileUser(profileId);\n      if (\n        tokens?.accessToken &&\n        user &&\n        hasValidAccessToken(tokens.accessToken)\n      ) {\n        useAuthStore.getState().loadFromProfile(profileId);\n        redirectAfterLogin(decodeSameOriginReturnTo(returnTo) ?? \"/\");\n        return;\n      }\n    }\n\n    const ssoUrl = getSSORedirectUrl();\n    if (ssoUrl) {\n      setIsSsoRedirecting(true);\n      window.location.replace(ssoUrl);\n    }\n  }, [isAddAccountMode, isCompletingAuth, redirectAfterLogin, returnTo]);\n\n  // Load remembered email on mount and clean up any legacy plaintext password storage\n  useEffect(() => {\n    try {\n      // Security cleanup: remove any previously stored plaintext passwords\n      localStorage.removeItem(\"remembered_password\");\n\n      const rememberedEmail = localStorage.getItem(\"remembered_email\");\n\n      if (rememberedEmail) {\n        setFormData((prev) => ({\n          ...prev,\n          email: rememberedEmail,\n          rememberMe: true,\n        }));\n      }\n    } catch (error) {\n      console.warn(\"[LoginPage] Failed to load remembered email:\", error);\n    }\n  }, []);\n\n  // Check for redirect message and email from location state (e.g., from expired MFA or SSO redirect)\n  useEffect(() => {\n    const state = location.state as { message?: string; email?: string } | null;\n    if (state?.message) {\n      setInfoMessage(state.message);\n    }\n    if (state?.email) {\n      setFormData((prev) => ({ ...prev, email: state.email }));\n    }\n    // Clear state to prevent showing message on refresh\n    if (state) {\n      window.history.replaceState({}, document.title);\n    }\n  }, [location.state]);\n\n  // Determine error type from GraphQL error code (primary) or message (fallback).\n  // The backend sends structured codes in extensions.code which are propagated\n  // through useAuthOperations → authStore.errorCode.\n  const checkErrorType = (\n    err: string | null,\n    code?: string | null,\n  ):\n    | \"DELETED\"\n    | \"SUSPENDED\"\n    | \"OAUTH_ONLY\"\n    | \"INACTIVE\"\n    | \"EMAIL_NOT_VERIFIED\"\n    | null => {\n    // Primary: match on GraphQL error code from extensions\n    if (code) {\n      switch (code) {\n        case \"ACCOUNT_DELETED\":\n          return \"DELETED\";\n        case \"ACCOUNT_SUSPENDED\":\n          return \"SUSPENDED\";\n        case \"OAUTH_ONLY_ACCOUNT\":\n          return \"OAUTH_ONLY\";\n        case \"ACCOUNT_INACTIVE\":\n          return \"INACTIVE\";\n        case \"EMAIL_NOT_VERIFIED\":\n          return \"EMAIL_NOT_VERIFIED\";\n        default:\n          break;\n      }\n    }\n\n    // Fallback: match on error message for non-GraphQL errors or legacy responses\n    if (!err) return null;\n    const lowerErr = err.toLowerCase();\n\n    if (\n      lowerErr.includes(\"deleted\") ||\n      lowerErr.includes(\"permanently deleted\")\n    ) {\n      return \"DELETED\";\n    }\n    if (lowerErr.includes(\"suspended\")) {\n      return \"SUSPENDED\";\n    }\n    if (\n      lowerErr.includes(\"oauth provider\") ||\n      lowerErr.includes(\"oauth-only\") ||\n      lowerErr.includes(\"oauth only\")\n    ) {\n      return \"OAUTH_ONLY\";\n    }\n    if (\n      lowerErr.includes(\"inactive\") ||\n      lowerErr.includes(\"deactivated\") ||\n      lowerErr.includes(\"not active\")\n    ) {\n      return \"INACTIVE\";\n    }\n    if (\n      lowerErr.includes(\"verify your email\") ||\n      lowerErr.includes(\"email not verified\") ||\n      lowerErr.includes(\"email_not_verified\")\n    ) {\n      return \"EMAIL_NOT_VERIFIED\";\n    }\n    return null;\n  };\n\n  // Pre-fill email from URL query parameter (e.g., after email verification)\n  useEffect(() => {\n    const emailFromUrl = searchParams.get(\"email\");\n    if (emailFromUrl) {\n      setFormData((prev) => ({ ...prev, email: emailFromUrl }));\n    }\n\n    // Check for expired session redirect\n    const isExpired = searchParams.get(\"expired\");\n    if (isExpired === \"true\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n      // Clear the query param to prevent showing on refresh\n      const newUrl = window.location.pathname;\n      window.history.replaceState({}, document.title, newUrl);\n    }\n  }, [searchParams, tr]);\n\n  // Redirect to MFA verification when required\n  useEffect(() => {\n    if (mfaRequired) {\n      navigate(\"/auth/mfa-verify\");\n    }\n  }, [mfaRequired, navigate]);\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n    setIsAccountInactive(false);\n    setIsAccountDeleted(false);\n    setIsAccountSuspended(false);\n    setIsOAuthOnlyAccount(false);\n    setIsEmailNotVerified(false);\n    setIsDuplicateAccount(false);\n    setResendSuccess(false);\n    setValidationError(null);\n\n    // Client-side validation\n    const emailTrimmed = (formData.email ?? \"\").trim();\n    if (!emailTrimmed) {\n      setValidationError(\n        tr(\n          \"auth.login.enterEmailOrUsername\",\n          \"Please enter your email or username\",\n        ),\n      );\n      return;\n    }\n\n    // Basic email format validation (if it contains @)\n    if (emailTrimmed.includes(\"@\")) {\n      const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n      if (!emailRegex.test(emailTrimmed)) {\n        setValidationError(\n          tr(\"auth.login.invalidEmail\", \"Please enter a valid email address\"),\n        );\n        return;\n      }\n    }\n\n    if (!formData.password || formData.password.length < 1) {\n      setValidationError(\n        tr(\"auth.login.enterPassword\", \"Please enter your password\"),\n      );\n      return;\n    }\n\n    // In add-account mode, check if this email is already signed in\n    if (isAddAccountMode) {\n      const existingProfiles = getProfiles();\n      const alreadySignedIn = existingProfiles.some(\n        (p) => p.email.toLowerCase() === emailTrimmed.toLowerCase(),\n      );\n      if (alreadySignedIn) {\n        setIsDuplicateAccount(true);\n        setValidationError(null);\n        return;\n      }\n    }\n    setIsDuplicateAccount(false);\n\n    try {\n      // Get reCAPTCHA v3 token (no-op when captcha is disabled)\n      const recaptchaToken = await executeCaptchaV3(\"login\");\n\n      const result = await signIn({\n        email: emailTrimmed,\n        password: formData.password,\n        rememberMe: formData.rememberMe,\n        ...(recaptchaToken ? { recaptchaToken } : {}),\n      });\n\n      // If MFA is required, the useEffect above will handle redirect\n      if (result.requiresMFA) {\n        // Persist the post-login destination so MfaVerifyPage honors\n        // `returnTo` and `defaultPostLoginPath` after the user completes\n        // verification — otherwise the MFA path falls back to \"/\" and the\n        // host-configured home (e.g. \"/vibecontrols\") is lost.\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postMfaPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          sessionStorage.setItem(MFA_REDIRECT, postMfaPath);\n        } catch {\n          // sessionStorage may be unavailable (private mode, quota) — the\n          // MFA page still works, it just defaults to \"/\" on completion.\n        }\n        return;\n      }\n\n      // Successful login - complete auth flow (fetch workspaces + issue token)\n      if (result.success) {\n        try {\n          const profileId = result.user?.id;\n          if (profileId) {\n            const hostname = window.location.hostname;\n            const domain = hostname.endsWith(\".local.burdenoff.com\")\n              ? \".local.burdenoff.com\"\n              : undefined;\n            const domainPart = domain ? `; domain=${domain}` : \"\";\n            const securePart =\n              window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n            const ssoValue = JSON.stringify({\n              id: profileId,\n              origin: window.location.origin,\n            });\n            document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n            document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n          }\n        } catch {\n          // Best effort only. Login can continue without the fast-path cookie.\n        }\n\n        // Handle Remember Me: Save or clear email only (never store passwords)\n        try {\n          if (formData.rememberMe) {\n            localStorage.setItem(\"remembered_email\", emailTrimmed);\n          } else {\n            localStorage.removeItem(\"remembered_email\");\n          }\n        } catch (error) {\n          console.warn(\n            \"[LoginPage] Failed to save/clear remembered email:\",\n            error,\n          );\n        }\n\n        setIsCompletingAuth(true);\n        // In add-account mode, redirect back to where the user was\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postLoginPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          type AuthFlowResult = Awaited<ReturnType<typeof completeAuthFlow>>;\n          // Pass the token directly to avoid race condition with React state updates\n          const authFlowResult = await Promise.race<AuthFlowResult>([\n            completeAuthFlow(result.token),\n            new Promise<AuthFlowResult>((resolve) => {\n              window.setTimeout(() => {\n                resolve({\n                  success: false,\n                  error: \"Auth flow timed out after login\",\n                });\n              }, 5000);\n            }),\n          ]);\n\n          if (authFlowResult.success) {\n            // Sync workspace and organization to ActiveContext\n            // This is critical for global search and other workspace-scoped features\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n\n            // Full auth flow completed - redirect to dashboard or returnTo\n            redirectAfterLogin(postLoginPath);\n          } else if (authFlowResult.error?.includes(\"No workspaces found\")) {\n            // No workspaces - redirect to onboarding/workspace creation\n            navigate(\"/onboarding/create-workspace\");\n          } else {\n            // Partial success or error - still sync workspace if available and redirect\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n            console.warn(\"Auth flow warning:\", authFlowResult.error);\n            redirectAfterLogin(postLoginPath);\n          }\n        } catch (authFlowError) {\n          // Auth flow failed but login succeeded - still redirect\n          console.error(\"Auth flow error (login succeeded):\", authFlowError);\n          redirectAfterLogin(postLoginPath);\n        } finally {\n          // Keep the completing state (spinner) once a redirect is in\n          // flight: resetting it re-arms the auto-redirect effect whose\n          // competing navigation cancels the deposit hop (BOFF-4463). The\n          // page is about to unload anyway.\n          if (!redirectInitiatedRef.current) {\n            setIsCompletingAuth(false);\n          }\n        }\n      }\n    } catch (err) {\n      if (import.meta.env.DEV) {\n        console.error(\"Sign in failed:\", err);\n      }\n      // Check error type using error code (from store) and message\n      const errorMsg = err instanceof Error ? err.message : String(err);\n      if (errorMsg.includes(\"reCAPTCHA\")) {\n        setValidationError(errorMsg);\n      }\n      const storeErrorCode = useAuthStore.getState().errorCode;\n      const errorType = checkErrorType(errorMsg, storeErrorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  };\n\n  // Also check the error from useAuthOperations\n  useEffect(() => {\n    if (error) {\n      const errorType = checkErrorType(error, errorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  }, [error, errorCode]);\n\n  /**\n   * Handle Google OAuth login\n   */\n  const handleGoogleLogin = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.googleSignInFailed\",\n              \"Failed to initiate Google sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth login\n   */\n  const handleMicrosoftLogin = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.microsoftSignInFailed\",\n              \"Failed to initiate Microsoft sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle resend verification email\n   */\n  const handleResendVerification = async () => {\n    setIsResendingVerification(true);\n    setResendSuccess(false);\n    try {\n      const emailTrimmed = (formData.email ?? \"\").trim();\n      const result = await resendVerification(emailTrimmed);\n      if (result.success) {\n        setResendSuccess(true);\n      } else {\n        setValidationError(\n          tr(\n            \"auth.login.resendFailed\",\n            \"Failed to resend verification email. Please try again.\",\n          ),\n        );\n      }\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      setValidationError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.resendFailed\",\n              \"Failed to resend verification email. Please try again.\",\n            ),\n      );\n    } finally {\n      setIsResendingVerification(false);\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleLogin,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.login.googleNotConfigured\",\n            \"Google sign in is not configured\",\n          ),\n    },\n    // {\n    //   name: \"GitHub\",\n    //   icon: GitHubIcon,\n    //   onClick: () => {},\n    //   disabled: true,\n    //   tooltip: tr(\n    //     \"auth.login.githubNotConfigured\",\n    //     \"GitHub sign in is not configured\",\n    //   ),\n    // },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftLogin,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.login.microsoftNotConfigured\",\n            \"Microsoft sign in is not configured\",\n          ),\n    },\n  ];\n\n  if (isSsoRedirecting) {\n    return <SSORedirectSpinner />;\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.login.welcomeBack\", \"Welcome back\")}\n      subtitle={tr(\n        \"auth.login.enterCredentials\",\n        \"Enter your credentials to continue\",\n      )}\n    >\n      <PagePurpose className=\"mb-5\">\n        {tr(\n          \"auth.login.purpose\",\n          \"Sign in to reach your workspaces, agents, and settings. Use your email and password, a social provider, or a passwordless magic link.\",\n        )}\n      </PagePurpose>\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Info Message (e.g., from expired MFA redirect) */}\n        {infoMessage && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border\">\n            <svg\n              className=\"size-5 flex-shrink-0 mt-0.5 text-text-link\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z\"\n              />\n            </svg>\n            <p className=\"text-sm text-status-info-text\">{infoMessage}</p>\n          </div>\n        )}\n\n        {/* Validation Error */}\n        {validationError && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <p className=\"text-sm text-status-warning-text\">\n              {validationError}\n            </p>\n          </div>\n        )}\n\n        {/* Duplicate Account Warning (Add Account mode) */}\n        {isDuplicateAccount && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <div className=\"flex-1\">\n              <p className=\"text-sm font-medium text-status-warning-text\">\n                {tr(\n                  \"auth.login.duplicateAccount\",\n                  \"This account is already signed in.\",\n                )}\n              </p>\n              <p className=\"mt-1 text-sm text-status-warning-text/80\">\n                {tr(\n                  \"auth.login.duplicateAccountHint\",\n                  \"Please use a different account, or go back and switch to this account from the profile menu.\",\n                )}\n              </p>\n              {(initialReturnToRef.current || returnTo) && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\n                      decodeURIComponent(\n                        initialReturnToRef.current || returnTo || \"/dashboard\",\n                      ),\n                    )\n                  }\n                  className=\"mt-3 inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm\"\n                >\n                  <svg\n                    className=\"size-4\"\n                    fill=\"none\"\n                    viewBox=\"0 0 24 24\"\n                    stroke=\"currentColor\"\n                  >\n                    <path\n                      strokeLinecap=\"round\"\n                      strokeLinejoin=\"round\"\n                      strokeWidth={2}\n                      d=\"M10 19l-7-7m0 0l7-7m-7 7h18\"\n                    />\n                  </svg>\n                  {tr(\n                    \"auth.login.goBackSwitchAccount\",\n                    \"Go back and switch account\",\n                  )}\n                </button>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Error Alert */}\n        {error && !validationError && !isDuplicateAccount && (\n          <div\n            className={`flex items-start gap-3 p-4 rounded-xl border ${\n              isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                ? \"bg-status-warning-bg-subtle border-status-warning-border\"\n                : \"bg-status-error-bg-subtle border-status-error-border\"\n            }`}\n          >\n            <AlertIcon\n              className={`size-5 flex-shrink-0 mt-0.5 ${\n                isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                  ? \"text-status-warning-text\"\n                  : \"text-status-error-text\"\n              }`}\n            />\n            <div className=\"flex-1\">\n              <p\n                className={`text-sm ${\n                  isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                    ? \"text-status-warning-text\"\n                    : \"text-status-error-text\"\n                }`}\n              >\n                {isAccountDeleted\n                  ? tr(\n                      \"auth.login.accountDeleted\",\n                      \"This account has been permanently deleted and cannot be recovered.\",\n                    )\n                  : isAccountSuspended\n                    ? tr(\n                        \"auth.login.accountSuspended\",\n                        \"Your account has been suspended. Please contact support for assistance.\",\n                      )\n                    : isAccountInactive\n                      ? tr(\n                          \"auth.login.accountDeactivated\",\n                          \"Your account has been deactivated.\",\n                        )\n                      : isOAuthOnlyAccount\n                        ? tr(\n                            \"auth.login.oauthOnly\",\n                            \"This account uses OAuth sign-in. Please use Google or Microsoft to sign in.\",\n                          )\n                        : isEmailNotVerified\n                          ? tr(\n                              \"auth.login.emailNotVerified\",\n                              \"Please verify your email before signing in. Check your inbox for the verification link.\",\n                            )\n                          : error}\n              </p>\n              {isAccountInactive && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\"/auth/reactivate\", {\n                      state: { email: formData.email },\n                    })\n                  }\n                  className=\"mt-2 text-sm font-semibold text-status-warning-text hover:text-status-warning-text underline underline-offset-2\"\n                >\n                  {tr(\n                    \"auth.login.clickReactivate\",\n                    \"Click here to reactivate your account\",\n                  )}\n                </button>\n              )}\n              {isEmailNotVerified && (\n                <div className=\"mt-3\">\n                  {resendSuccess ? (\n                    <div className=\"flex items-center gap-2 text-sm text-status-success-text\">\n                      <svg\n                        className=\"size-4\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M5 13l4 4L19 7\"\n                        />\n                      </svg>\n                      {tr(\n                        \"auth.login.verificationSent\",\n                        \"Verification email sent! Please check your inbox.\",\n                      )}\n                    </div>\n                  ) : (\n                    <button\n                      type=\"button\"\n                      onClick={handleResendVerification}\n                      disabled={isResendingVerification}\n                      className=\"inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm disabled:opacity-50 disabled:cursor-not-allowed\"\n                    >\n                      {isResendingVerification ? (\n                        <>\n                          <SpinnerIcon className=\"size-4 animate-spin\" />\n                          {tr(\"auth.login.sending\", \"Sending...\")}\n                        </>\n                      ) : (\n                        <>\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                            />\n                          </svg>\n                          {tr(\n                            \"auth.login.resendVerification\",\n                            \"Resend verification email\",\n                          )}\n                        </>\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n              {isOAuthOnlyAccount && (\n                <div className=\"mt-3 flex flex-col gap-2\">\n                  {isProviderConfigured(\"google\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleGoogleLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <GoogleIcon className=\"size-5\" />\n                      {tr(\"auth.login.signInWithGoogle\", \"Sign in with Google\")}\n                    </button>\n                  )}\n                  {isProviderConfigured(\"microsoft\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleMicrosoftLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <MicrosoftIcon className=\"size-5\" />\n                      {tr(\n                        \"auth.login.signInWithMicrosoft\",\n                        \"Sign in with Microsoft\",\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.emailLabel\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.emailLabel\", \"Email\")}\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\"auth.login.emailPlaceholder\", \"you@example.com\")}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.passwordLabel\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              autoComplete=\"current-password\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.passwordLabel\", \"Password\")}\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.login.passwordPlaceholder\",\n                \"Enter your password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={showPassword ? \"Hide password\" : \"Show password\"}\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"size-5\" />\n              ) : (\n                <EyeIcon className=\"size-5\" />\n              )}\n            </button>\n          </div>\n        </div>\n\n        {/* Remember & Forgot */}\n        <div className=\"flex items-center justify-between\">\n          <label className=\"flex items-center gap-2 cursor-pointer group\">\n            <div className=\"relative\">\n              <input\n                type=\"checkbox\"\n                aria-label={tr(\"auth.login.rememberMe\", \"Remember me\")}\n                checked={formData.rememberMe}\n                onChange={(e) => {\n                  const isChecked = e.target.checked;\n                  setFormData({ ...formData, rememberMe: isChecked });\n\n                  // Clear saved email immediately when unchecked\n                  if (!isChecked) {\n                    try {\n                      localStorage.removeItem(\"remembered_email\");\n                    } catch (error) {\n                      console.warn(\n                        \"[LoginPage] Failed to clear remembered email:\",\n                        error,\n                      );\n                    }\n                  }\n                }}\n                className=\"sr-only peer\"\n              />\n              <div className=\"size-5 rounded-md border-2 border-[var(--color-border-default)] bg-[var(--color-bg-surface)] peer-checked:bg-status-info-bg-subtle0 peer-checked:border-action-primary-bg transition-all peer-focus:ring-2 peer-focus:ring-action-primary-bg/20\">\n                <svg\n                  className=\"size-full text-white opacity-0 peer-checked:opacity-100 transition-opacity p-0.5\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                  strokeWidth={3}\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n            </div>\n            <span className=\"text-sm text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)] transition-colors\">\n              {tr(\"auth.login.rememberMe\", \"Remember me\")}\n            </span>\n          </label>\n          <button\n            type=\"button\"\n            onClick={() => navigate(\"/auth/reset-password\")}\n            className=\"text-sm font-medium text-text-link hover:text-text-linkHover transition-colors\"\n          >\n            {tr(\"auth.login.forgotPassword\", \"Forgot password?\")}\n          </button>\n        </div>\n\n        {/* Submit Button */}\n        <Button\n          type=\"submit\"\n          disabled={isLoading || isCompletingAuth}\n          variant=\"default\"\n          size=\"lg\"\n          className=\"w-full font-semibold\"\n        >\n          {isLoading || isCompletingAuth ? (\n            <>\n              <SpinnerIcon className=\"size-5 animate-spin\" />\n              <span>\n                {isCompletingAuth\n                  ? tr(\n                      \"auth.login.settingUpWorkspace\",\n                      \"Setting up workspace...\",\n                    )\n                  : tr(\"auth.login.signingIn\", \"Signing in...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.login.signIn\", \"Sign in\")\n          )}\n        </Button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.login.orContinueWith\", \"or continue with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            aria-label={provider.name}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`size-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Enterprise SSO Option — temporarily hidden */}\n      {/* <div className=\"mt-6\">\n        <button type=\"button\"\n          onClick={() => navigate(\"/auth/sso/login\")}\n          className=\"w-full flex items-center justify-center gap-3 px-4 py-3 rounded-xl border-2 border-dashed border-[var(--color-border-default)] hover:border-action-primary-bg bg-[var(--color-bg-surface)] hover:bg-status-info-bg-subtle transition-all duration-200 group\"\n        >\n          <svg\n            className=\"size-5 text-[var(--color-text-tertiary)] group-hover:text-text-link\"\n            fill=\"none\"\n            viewBox=\"0 0 24 24\"\n            stroke=\"currentColor\"\n          >\n            <path\n              strokeLinecap=\"round\"\n              strokeLinejoin=\"round\"\n              strokeWidth={1.5}\n              d=\"M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4\"\n            />\n          </svg>\n          <span className=\"text-sm font-medium text-[var(--color-text-secondary)] group-hover:text-text-link\">\n            {tr(\"auth.login.enterpriseSso\", \"Sign in with Enterprise SSO\")}\n          </span>\n        </button>\n      </div> */}\n\n      {/* Magic Link Option */}\n      <div className=\"mt-4 text-center\">\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/magic-link\")}\n          className=\"text-sm text-[var(--color-text-secondary)] hover:text-[var(--color-text-primary)] transition-colors\"\n        >\n          {tr(\"auth.login.preferPasswordless\", \"Prefer passwordless login?\")}{\" \"}\n          <span className=\"font-semibold text-text-link hover:text-text-linkHover\">\n            {tr(\"auth.login.signInMagicLink\", \"Sign in with Magic Link\")}\n          </span>\n        </button>\n      </div>\n\n      {/* Sign Up Link */}\n      <p className=\"mt-6 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.login.dontHaveAccount\", \"Don't have an account?\")}{\" \"}\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/register\")}\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.login.signUp\", \"Sign up\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA4DA,SAAS,KAAyB;AAChC,KAAI,OAAO,SAAW,IAAa,QAAO;CAC1C,IAAM,IAAI;AAGV,KAAI,OAAO,EAAE,WAAW,oBAAqB,WAC3C,KAAI;AACF,MAAI,EAAE,UAAU,kBAAkB,CAAE,QAAO;SACrC;AAUV,QANA,GACE,OAAO,YAAc,OACrB,YAAY,KAAK,UAAU,aAAa,GAAG;;AAO/C,SAAS,GAAiB,GAAwB;AAChD,KAAI,OAAO,SAAW,IAAa,QAAO;AAC1C,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAQ,OAAO,SAAS,OAAO;AACnD,SAAO,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI;SACpC;AACN,SAAO;;;AAIX,SAAS,GAAoB,GAAwB;AACnD,KAAI;EACF,IAAM,IAAM,EAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,EAC/D,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,EAAE,GAAG,GAAG,IAAI,EACvD,IAAU,KAAK,MAAM,KAAK,EAAO,CAAC;AACxC,SAAO,OAAO,EAAQ,OAAQ,YAAY,EAAQ,MAAM,KAAK,KAAK,GAAG;SAC/D;AACN,SAAO;;;AAIX,SAAS,GAAyB,GAAwC;AACxE,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EAEF,IAAM,IAAM,IAAI,IADA,mBAAmB,EAAS,EACf,OAAO,SAAS,OAAO;AAEpD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,EAAoB,GAAK,EAAE,eAAe,IAAO,CAAC,GADP;SAE5C;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GACQ;AACR,MAAK,IAAM,KAAS;EAAC;EAAc;EAAc;EAAgB,CAC/D,GAAI,aAAa,OAAO,EAAM;AAGhC,KAAI,EAAQ,cACV,QAAO,EAAI,UAAU;CAGvB,IAAM,IAAS,EAAI,aAAa,UAAU;AAC1C,QAAO,GAAG,EAAI,WAAW,IAAS,IAAI,MAAW,KAAK,EAAI;;AAG5D,SAAS,EAAmB,GAA0B;AACpD,KAAI;EAEF,IAAM,IAAM,IAAI,IADA,mBAAmB,EAAS,EACf,OAAO,SAAS,OAAO;AAIpD,SAAO,EAAoB,GAAK,EAAE,eADZ,EAAI,WAAW,OAAO,SAAS,QACW,CAAC;SAC3D;AACN,SAAO;;;AAQX,SAAgB,IAAY;CAC1B,IAAM,IAAW,IAAa,EACxB,IAAW,IAAa,EACxB,CAAC,KAAgB,IAAiB,EAClC,EAAE,UAAM,IAAS,EACjB,IAAK,GACR,GAAa,MAA6B;EACzC,IAAM,IAAa,GAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAEzC,CAAC,GAAE,CACJ,EACK,EAAE,YAAQ,eAAW,UAAO,eAAW,2BAC3C,GAAmB,EACf,EAAE,yBAAqB,GAAiB,EACxC,EAAE,kBAAc,wBAAoB,IAAkB,EACtD,EAAE,6BAAyB,GAAS,EACpC,EAAE,yBAAqB,4BAAwB,4BACnD,GAAoB,EAChB,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,EAAE,kBAAkB,OAAqB,IAAc,EACvD,CAAC,GAAkB,KAAuB,EAAS,GAAM,EACzD,CAAC,IAAkB,MAAuB,EAAS,GAAM,EAmBzD,IAAoB,EACxB,OAAO,MAA0C;AAK/C,MAJI,OAAO,SAAW,OAIlB,IAAe,CAAE,QAAO;AAC5B,MAAI;GACF,IAAM,IAAS,IAAyB,EAClC,IAAY,IAAI,IAAI,EAAO,IAAI,EAC/B,IAAgB,OAAO,SAAS;AACtC,OAAI,EAAU,WAAW,EAAe,QAAO;GAK/C,IAAM,IAAmB,IAAI,IAAI,GAAc,EAAc,CAAC,MAExD,IAAY,IAAwB;AAC1C,OAAI,CAAC,EAAW,QAAO;GACvB,IAAM,IAAS,EAAiB,EAAU,EACpC,IAAO,EAAe,EAAU;AACtC,OAAI,CAAC,KAAU,CAAC,EAAM,QAAO;GAC7B,IAAM,IAAiB,GAAyB,EAAU,EAStD,IAAyC;IAC3C,GAAG;IACH;IACD;AACD,OAAI,EAAO,cAAc;IACvB,IAAM,EAAE,qBAAkB,IAAoB,EACxC,EAAE,QAAQ,MAAW,MAAM,GAC/B,GAAG,EAAc,kBACjB,EAAO,aACR;AACD,IAAI,MACF,IAAgB;KAAE,GAAG;KAAQ;KAAgB;;AAKjD,UADA,GAAsB,EAAU,EACzB,GAAmB,EAAU,QAAQ,GAAkB;IAC5D;IACA,QAAQ,KAAK,UAAU,EAAc;IACrC,MAAM,KAAK,UAAU,EAAK;IAC1B,UAAU,KAAK,UAAU,GAAa,CAAC;IACxC,CAAC;UACI;AACN,UAAO;;IAGX,EAAE,CACH,EAMK,IAAuB,GAAO,GAAM,EAEpC,IAAqB,GACxB,MAAiB;AAChB,MAAI,OAAO,SAAW,KAAa;AACjC,KAAS,EAAK;AACd;;AAEF,MAAI;AACF,kBAAe,QAAQ,2BAA2B,EAAK;UACjD;AAMR,MAAI,IAAe,EAAE;AACnB,KAAS,GAAiB,EAAK,CAAC;AAChC;;AAGF,EADA,EAAqB,UAAU,KACzB,YAAY;GAChB,IAAM,IAAS,MAAM,EAAkB,EAAK;AAC5C,GAAI,EAAO,SAAS,oBAAoB,IAKtC,IAAoB,EACpB,OAAO,SAAS,OAAO,EAAO,EAC9B,OAAO,iBAAiB;AAEtB,IADA,IAAoB,EACpB,OAAO,SAAS,QAAQ,EAAO;MAC9B,KAAK,IAER,OAAO,SAAS,OAAO,EAAO;MAE9B;IAEN,CAAC,GAAU,EAAkB,CAC9B,EACK,CAAC,GAAc,MAAmB,EAAS,GAAM,EACjD,CAAC,GAAmB,KAAwB,EAAS,GAAM,EAC3D,CAAC,IAAkB,KAAuB,EAAS,GAAM,EACzD,CAAC,IAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,GAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,GAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,IAAyB,MAA8B,EAAS,GAAM,EACvE,CAAC,IAAe,KAAoB,EAAS,GAAM,EACnD,CAAC,IAAY,KAAiB,EAAwB,KAAK,EAC3D,CAAC,IAAa,KAAkB,EAAwB,KAAK,EAC7D,CAAC,GAAU,KAAe,EAE9B;EACA,OAAO;EACP,UAAU;EACV,YAAY;EACb,CAAC,EACI,CAAC,GAAiB,KAAsB,EAAwB,KAAK,EACrE,CAAC,IAAoB,KAAyB,EAAS,GAAM,EAG7D,IAAmB,EAAa,IAAI,OAAO,KAAK,eAChD,IAAW,EAAa,IAAI,WAAW,EACvC,IAAqB,GAAsB,EAAS,EAOpD,IAAc,EAAa,IAAI,SAAS;AAqE9C,CApEA,QAAgB;AACd,EAAI,MAAgB,oBAClB,EACE,EACE,6BACA,kDACD,CACF,GACQ,MAAgB,YACzB,EAAe,EAAG,wBAAwB,4BAA4B,CAAC;IAExE,CAAC,GAAa,EAAG,CAAC,EAErB,QAAgB;AACd,EAAI,CAAC,EAAmB,WAAW,MACjC,EAAmB,UAAU;IAE9B,CAAC,EAAS,CAAC,EAEd,QAAgB;AAId,MAHI,KAAoB,KAGpB,EAAqB,WAAW,IAAwB,CAAE;EAE9D,IAAM,IAAY,IAAwB;AAC1C,MAAI,GAAW;GACb,IAAM,IAAS,EAAiB,EAAU,EACpC,IAAO,EAAe,EAAU;AACtC,OACE,GAAQ,eACR,KACA,GAAoB,EAAO,YAAY,EACvC;AAEA,IADA,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,EAAmB,GAAyB,EAAS,IAAI,IAAI;AAC7D;;;EAIJ,IAAM,IAAS,IAAmB;AAClC,EAAI,MACF,GAAoB,GAAK,EACzB,OAAO,SAAS,QAAQ,EAAO;IAEhC;EAAC;EAAkB;EAAkB;EAAoB;EAAS,CAAC,EAGtE,QAAgB;AACd,MAAI;AAEF,gBAAa,WAAW,sBAAsB;GAE9C,IAAM,IAAkB,aAAa,QAAQ,mBAAmB;AAEhE,GAAI,KACF,GAAa,OAAU;IACrB,GAAG;IACH,OAAO;IACP,YAAY;IACb,EAAE;WAEE,GAAO;AACd,WAAQ,KAAK,gDAAgD,EAAM;;IAEpE,EAAE,CAAC,EAGN,QAAgB;EACd,IAAM,IAAQ,EAAS;AAQvB,EAPI,GAAO,WACT,EAAe,EAAM,QAAQ,EAE3B,GAAO,SACT,GAAa,OAAU;GAAE,GAAG;GAAM,OAAO,EAAM;GAAO,EAAE,EAGtD,KACF,OAAO,QAAQ,aAAa,EAAE,EAAE,SAAS,MAAM;IAEhD,CAAC,EAAS,MAAM,CAAC;CAKpB,IAAM,MACJ,GACA,MAOU;AAEV,MAAI,EACF,SAAQ,GAAR;GACE,KAAK,kBACH,QAAO;GACT,KAAK,oBACH,QAAO;GACT,KAAK,qBACH,QAAO;GACT,KAAK,mBACH,QAAO;GACT,KAAK,qBACH,QAAO;GACT,QACE;;AAKN,MAAI,CAAC,EAAK,QAAO;EACjB,IAAM,IAAW,EAAI,aAAa;AAgClC,SA7BE,EAAS,SAAS,UAAU,IAC5B,EAAS,SAAS,sBAAsB,GAEjC,YAEL,EAAS,SAAS,YAAY,GACzB,cAGP,EAAS,SAAS,iBAAiB,IACnC,EAAS,SAAS,aAAa,IAC/B,EAAS,SAAS,aAAa,GAExB,eAGP,EAAS,SAAS,WAAW,IAC7B,EAAS,SAAS,cAAc,IAChC,EAAS,SAAS,aAAa,GAExB,aAGP,EAAS,SAAS,oBAAoB,IACtC,EAAS,SAAS,qBAAqB,IACvC,EAAS,SAAS,qBAAqB,GAEhC,uBAEF;;AA0BT,CAtBA,QAAgB;EACd,IAAM,IAAe,EAAa,IAAI,QAAQ;AAO9C,MANI,KACF,GAAa,OAAU;GAAE,GAAG;GAAM,OAAO;GAAc,EAAE,EAIzC,EAAa,IAAI,UAAU,KAC3B,QAAQ;AACxB,KACE,EACE,6BACA,kDACD,CACF;GAED,IAAM,IAAS,OAAO,SAAS;AAC/B,UAAO,QAAQ,aAAa,EAAE,EAAE,SAAS,OAAO,EAAO;;IAExD,CAAC,GAAc,EAAG,CAAC,EAGtB,QAAgB;AACd,EAAI,KACF,EAAS,mBAAmB;IAE7B,CAAC,GAAa,EAAS,CAAC;CAE3B,IAAM,KAAe,OAAO,MAAuB;AASjD,EARA,EAAE,gBAAgB,EAClB,EAAqB,GAAM,EAC3B,EAAoB,GAAM,EAC1B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAiB,GAAM,EACvB,EAAmB,KAAK;EAGxB,IAAM,KAAgB,EAAS,SAAS,IAAI,MAAM;AAClD,MAAI,CAAC,GAAc;AACjB,KACE,EACE,mCACA,sCACD,CACF;AACD;;AAIF,MAAI,EAAa,SAAS,IAAI,IAExB,CADe,6BACH,KAAK,EAAa,EAAE;AAClC,KACE,EAAG,2BAA2B,qCAAqC,CACpE;AACD;;AAIJ,MAAI,CAAC,EAAS,YAAY,EAAS,SAAS,SAAS,GAAG;AACtD,KACE,EAAG,4BAA4B,6BAA6B,CAC7D;AACD;;AAIF,MAAI,KACuB,GAAa,CACG,MACtC,MAAM,EAAE,MAAM,aAAa,KAAK,EAAa,aAAa,CAC5D,EACoB;AAEnB,GADA,EAAsB,GAAK,EAC3B,EAAmB,KAAK;AACxB;;AAGJ,IAAsB,GAAM;AAE5B,MAAI;GAEF,IAAM,IAAiB,MAAM,GAAiB,QAAQ,EAEhD,IAAS,MAAM,GAAO;IAC1B,OAAO;IACP,UAAU,EAAS;IACnB,YAAY,EAAS;IACrB,GAAI,IAAiB,EAAE,mBAAgB,GAAG,EAAE;IAC7C,CAAC;AAGF,OAAI,EAAO,aAAa;IAKtB,IACM,IACF,EAFsB,EAAmB,WAAW,MAGjC,MAAwB,cAAa;AAC5D,QAAI;AACF,oBAAe,QAAQ,IAAc,EAAY;YAC3C;AAIR;;AAIF,OAAI,EAAO,SAAS;AAClB,QAAI;KACF,IAAM,IAAY,EAAO,MAAM;AAC/B,SAAI,GAAW;MAEb,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IACJ,OAAO,SAAS,aAAa,WAAW,aAAa,IACjD,IAAW,KAAK,UAAU;OAC9B,IAAI;OACJ,QAAQ,OAAO,SAAS;OACzB,CAAC;AAEF,MADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;;YAE7G;AAKR,QAAI;AACF,KAAI,EAAS,aACX,aAAa,QAAQ,oBAAoB,EAAa,GAEtD,aAAa,WAAW,mBAAmB;aAEtC,GAAO;AACd,aAAQ,KACN,sDACA,EACD;;AAGH,MAAoB,GAAK;IAEzB,IACM,IACF,EAFsB,EAAmB,WAAW,MAGjC,MAAwB,cAAa;AAC5D,QAAI;KAGF,IAAM,IAAiB,MAAM,QAAQ,KAAqB,CACxD,GAAiB,EAAO,MAAM,EAC9B,IAAI,SAAyB,MAAY;AACvC,aAAO,iBAAiB;AACtB,SAAQ;QACN,SAAS;QACT,OAAO;QACR,CAAC;SACD,IAAK;OACR,CACH,CAAC;AAEF,KAAI,EAAe,WAGb,EAAe,cACjB,GAAa,EAAe,UAAU,GAAG,EACrC,EAAe,UAAU,kBAC3B,GAAgB,EAAe,UAAU,eAAe,GAK5D,EAAmB,EAAc,IACxB,EAAe,OAAO,SAAS,sBAAsB,GAE9D,EAAS,+BAA+B,IAGpC,EAAe,cACjB,GAAa,EAAe,UAAU,GAAG,EACrC,EAAe,UAAU,kBAC3B,GAAgB,EAAe,UAAU,eAAe,GAG5D,QAAQ,KAAK,sBAAsB,EAAe,MAAM,EACxD,EAAmB,EAAc;aAE5B,GAAe;AAGtB,KADA,QAAQ,MAAM,sCAAsC,EAAc,EAClE,EAAmB,EAAc;cACzB;AAKR,KAAK,EAAqB,WACxB,EAAoB,GAAM;;;WAIzB,GAAK;GAKZ,IAAM,IAAW,aAAe,QAAQ,EAAI,UAAU,OAAO,EAAI;AACjE,GAAI,EAAS,SAAS,YAAY,IAChC,EAAmB,EAAS;GAE9B,IAAM,IAAiB,EAAa,UAAU,CAAC,WACzC,IAAY,GAAe,GAAU,EAAe;AAC1D,GAAI,MAAc,YAChB,EAAoB,GAAK,GAChB,MAAc,cACvB,EAAsB,GAAK,GAClB,MAAc,eACvB,EAAsB,GAAK,GAClB,MAAc,aACvB,EAAqB,GAAK,GACjB,MAAc,wBACvB,EAAsB,GAAK;;;AAMjC,SAAgB;AACd,MAAI,GAAO;GACT,IAAM,IAAY,GAAe,GAAO,GAAU;AAClD,GAAI,MAAc,YAChB,EAAoB,GAAK,GAChB,MAAc,cACvB,EAAsB,GAAK,GAClB,MAAc,eACvB,EAAsB,GAAK,GAClB,MAAc,aACvB,EAAqB,GAAK,GACjB,MAAc,wBACvB,EAAsB,GAAK;;IAG9B,CAAC,GAAO,GAAU,CAAC;CAKtB,IAAM,WAA0B;AAC9B,IAAc,KAAK;AACnB,MAAI;AACF,OAAqB;WACd,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,iCACA,oCACD,CACN;;IAOC,WAA6B;AACjC,IAAc,KAAK;AACnB,MAAI;AACF,OAAwB;WACjB,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,oCACA,uCACD,CACN;;IAOC,KAA2B,YAAY;AAE3C,EADA,GAA2B,GAAK,EAChC,EAAiB,GAAM;AACvB,MAAI;AAGF,IADe,MAAM,IADC,EAAS,SAAS,IAAI,MAAM,CACG,EAC1C,UACT,EAAiB,GAAK,GAEtB,EACE,EACE,2BACA,yDACD,CACF;WAEI,GAAK;AAEZ,GADA,QAAQ,MAAM,wCAAwC,EAAI,EAC1D,EACE,aAAe,QACX,EAAI,UACJ,EACE,2BACA,yDACD,CACN;YACO;AACR,MAA2B,GAAM;;IAK/B,KAAqB,EAAqB,SAAS,EACnD,IAAwB,EAAqB,YAAY,EAEzD,KAAiB,CACrB;EACE,MAAM;EACN,MAAM;EACN,SAAS;EACT,UAAU,CAAC;EACX,SAAS,KACL,KAAA,IACA,EACE,kCACA,mCACD;EACN,EAWD;EACE,MAAM;EACN,MAAM;EACN,SAAS;EACT,UAAU,CAAC;EACX,SAAS,IACL,KAAA,IACA,EACE,qCACA,sCACD;EACN,CACF;AAMD,QAJI,KACK,kBAAC,IAAD,EAAsB,CAAA,GAI7B,kBAAC,GAAD;EACE,OAAO,EAAG,0BAA0B,eAAe;EACnD,UAAU,EACR,+BACA,qCACD;YALH;GAOE,kBAAC,IAAD;IAAa,WAAU;cACpB,EACC,sBACA,wIACD;IACW,CAAA;GACd,kBAAC,QAAD;IAAM,UAAU;IAAc,WAAU;cAAxC;KAEG,MACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;iBAEP,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,EACN,kBAAC,KAAD;OAAG,WAAU;iBAAiC;OAAgB,CAAA,CAC1D;;KAIP,KACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,wDAAyD,CAAA,EAC9E,kBAAC,KAAD;OAAG,WAAU;iBACV;OACC,CAAA,CACA;;KAIP,MACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,wDAAyD,CAAA,EAC9E,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,KAAD;SAAG,WAAU;mBACV,EACC,+BACA,qCACD;SACC,CAAA;QACJ,kBAAC,KAAD;SAAG,WAAU;mBACV,EACC,mCACA,+FACD;SACC,CAAA;SACF,EAAmB,WAAW,MAC9B,kBAAC,UAAD;SACE,MAAK;SACL,eACE,EACE,mBACE,EAAmB,WAAW,KAAY,aAC3C,CACF;SAEH,WAAU;mBATZ,CAWE,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;oBAEP,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,aAAa;WACb,GAAE;WACF,CAAA;UACE,CAAA,EACL,EACC,kCACA,6BACD,CACM;;QAEP;SACF;;KAIP,KAAS,CAAC,KAAmB,CAAC,MAC7B,kBAAC,OAAD;MACE,WAAW,gDACT,KAAqB,KAAsB,IACvC,6DACA;gBAJR,CAOE,kBAAC,GAAD,EACE,WAAW,+BACT,KAAqB,KAAsB,IACvC,6BACA,4BAEN,CAAA,EACF,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,KAAD;SACE,WAAW,WACT,KAAqB,KAAsB,IACvC,6BACA;mBAGL,KACG,EACE,6BACA,qEACD,GACD,KACE,EACE,+BACA,0EACD,GACD,IACE,EACE,iCACA,qCACD,GACD,IACE,EACE,wBACA,8EACD,GACD,IACE,EACE,+BACA,0FACD,GACD;SACV,CAAA;QACH,KACC,kBAAC,UAAD;SACE,MAAK;SACL,eACE,EAAS,oBAAoB,EAC3B,OAAO,EAAE,OAAO,EAAS,OAAO,EACjC,CAAC;SAEJ,WAAU;mBAET,EACC,8BACA,wCACD;SACM,CAAA;QAEV,KACC,kBAAC,OAAD;SAAK,WAAU;mBACZ,KACC,kBAAC,OAAD;UAAK,WAAU;oBAAf,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;qBAEP,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;YACF,CAAA;WACE,CAAA,EACL,EACC,+BACA,oDACD,CACG;cAEN,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,UAAU;UACV,WAAU;oBAET,KACC,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,IAAD,EAAa,WAAU,uBAAwB,CAAA,EAC9C,EAAG,sBAAsB,aAAa,CACtC,EAAA,CAAA,GAEH,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;qBAEP,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;YACF,CAAA;WACE,CAAA,EACL,EACC,iCACA,4BACD,CACA,EAAA,CAAA;UAEE,CAAA;SAEP,CAAA;QAEP,KACC,kBAAC,OAAD;SAAK,WAAU;mBAAf,CACG,EAAqB,SAAS,IAC7B,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,WAAU;oBAHZ,CAKE,kBAAC,IAAD,EAAY,WAAU,UAAW,CAAA,EAChC,EAAG,+BAA+B,sBAAsB,CAClD;aAEV,EAAqB,YAAY,IAChC,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,WAAU;oBAHZ,CAKE,kBAAC,IAAD,EAAe,WAAU,UAAW,CAAA,EACnC,EACC,kCACA,yBACD,CACM;YAEP;;QAEJ;SACF;;KAIR,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,yBAAyB,QAAQ;OAC/B,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAW,WAAU,4CAA6C,CAAA;QAC9D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,cAAa;QACb,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,yBAAyB,QAAQ;QAChD,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,OAAO,EAAE,OAAO;SAAO,CAAC;QAErD,WAAU;QACV,aAAa,EAAG,+BAA+B,kBAAkB;QACjE,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,4BAA4B,WAAW;OACrC,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,OAAD;SAAK,WAAU;mBACb,kBAAC,IAAD,EAAU,WAAU,4CAA6C,CAAA;SAC7D,CAAA;QACN,kBAAC,SAAD;SACE,IAAG;SACH,MAAM,IAAe,SAAS;SAC9B,cAAa;SACb,UAAA;SACA,iBAAc;SACd,cAAY,EAAG,4BAA4B,WAAW;SACtD,OAAO,EAAS;SAChB,WAAW,MACT,EAAY;UAAE,GAAG;UAAU,UAAU,EAAE,OAAO;UAAO,CAAC;SAExD,WAAU;SACV,aAAa,EACX,kCACA,sBACD;SACD,CAAA;QACF,kBAAC,UAAD;SACE,MAAK;SACL,eAAe,GAAgB,CAAC,EAAa;SAC7C,cAAY,IAAe,kBAAkB;SAC7C,WAAU;mBAGR,EADD,IACE,IAEA,GAFD,EAAY,WAAU,UAAW,CAEH;SAEzB,CAAA;QACL;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OAAO,WAAU;iBAAjB,CACE,kBAAC,OAAD;QAAK,WAAU;kBAAf,CACE,kBAAC,SAAD;SACE,MAAK;SACL,cAAY,EAAG,yBAAyB,cAAc;SACtD,SAAS,EAAS;SAClB,WAAW,MAAM;UACf,IAAM,IAAY,EAAE,OAAO;AAI3B,cAHA,EAAY;WAAE,GAAG;WAAU,YAAY;WAAW,CAAC,EAG/C,CAAC,EACH,KAAI;AACF,wBAAa,WAAW,mBAAmB;mBACpC,GAAO;AACd,mBAAQ,KACN,iDACA,EACD;;;SAIP,WAAU;SACV,CAAA,EACF,kBAAC,OAAD;SAAK,WAAU;mBACb,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;UACP,aAAa;oBAEb,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,GAAE;WACF,CAAA;UACE,CAAA;SACF,CAAA,CACF;WACN,kBAAC,QAAD;QAAM,WAAU;kBACb,EAAG,yBAAyB,cAAc;QACtC,CAAA,CACD;UACR,kBAAC,UAAD;OACE,MAAK;OACL,eAAe,EAAS,uBAAuB;OAC/C,WAAU;iBAET,EAAG,6BAA6B,mBAAmB;OAC7C,CAAA,CACL;;KAGN,kBAAC,IAAD;MACE,MAAK;MACL,UAAU,MAAa;MACvB,SAAQ;MACR,MAAK;MACL,WAAU;gBAET,MAAa,IACZ,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,IAAD,EAAa,WAAU,uBAAwB,CAAA,EAC/C,kBAAC,QAAD,EAAA,UACG,IACG,EACE,iCACA,0BACD,GACD,EAAG,wBAAwB,gBAAgB,EAC1C,CAAA,CACN,EAAA,CAAA,GAEH,EAAG,qBAAqB,UAAU;MAE7B,CAAA;KACJ;;GAGP,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD,EAAK,WAAU,wDAAyD,CAAA;KACpE,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,QAAD;MAAM,WAAU;gBACb,EAAG,6BAA6B,mBAAmB;MAC/C,CAAA;KACH,CAAA,CACF;;GAGL,MACC,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,GAAD,EAAW,WAAU,sDAAuD,CAAA,EAC5E,kBAAC,KAAD;KAAG,WAAU;eAAkC;KAAe,CAAA,CAC1D;;GAIR,kBAAC,OAAD;IAAK,WAAU;cACZ,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAAS,EAAS;KAClB,UAAU,EAAS;KACnB,OAAO,EAAS;KAChB,cAAY,EAAS;KACrB,WAAW,wGACT,EAAS,WACL,oGACA;eAVR,CAaE,kBAAC,EAAS,MAAV,EACE,WAAW,UAAU,EAAS,WAAW,eAAe,MACxD,CAAA,EACF,kBAAC,QAAD;MACE,WAAW,gEACT,EAAS,WACL,sCACA;gBAGL,EAAS;MACL,CAAA,CACA;OAxBF,EAAS,KAwBP,CACT;IACE,CAAA;GA4BN,kBAAC,OAAD;IAAK,WAAU;cACb,kBAAC,UAAD;KACE,MAAK;KACL,eAAe,EAAS,mBAAmB;KAC3C,WAAU;eAHZ;MAKG,EAAG,iCAAiC,6BAA6B;MAAE;MACpE,kBAAC,QAAD;OAAM,WAAU;iBACb,EAAG,8BAA8B,0BAA0B;OACvD,CAAA;MACA;;IACL,CAAA;GAGN,kBAAC,KAAD;IAAG,WAAU;cAAb;KACG,EAAG,8BAA8B,yBAAyB;KAAE;KAC7D,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAS,iBAAiB;MACzC,WAAU;gBAET,EAAG,qBAAqB,UAAU;MAC5B,CAAA;KACP;;GACO"}
+{"version":3,"file":"LoginPage.js","names":[],"sources":["../../../src/auth/pages/LoginPage.tsx"],"sourcesContent":["import { useState, useEffect, useCallback, useRef } from \"react\";\nimport { useNavigate, useSearchParams, useLocation } from \"react-router\";\nimport {\n  useI18n,\n  useActiveContext,\n} from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport {\n  getSSORedirectUrl,\n  SSORedirectSpinner,\n} from \"@burdenoff/fe-libs/shared/components\";\nimport { resolveAuthBridgeConfig } from \"@burdenoff/fe-libs/shared/config\";\nimport { resolveGatewayUrls } from \"@burdenoff/fe-libs/shared/config/gatewayUrls\";\nimport {\n  beginSsoNavigation,\n  buildSsoDepositUrl,\n  isSsoNavigationPending,\n  markSsoDepositPending,\n  mintSsoSessionTokens,\n} from \"@burdenoff/fe-libs/shared/utils\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { PagePurpose } from \"@burdenoff/fe-libs/ui\";\n\nimport {\n  getProfileTokens,\n  getProfileUser,\n  getProfiles,\n  getProfileWorkspaceToken,\n  resolveActiveProfileId,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useMyWorkspaces } from \"../hooks/useMyWorkspaces\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport { sanitizePostLoginPath } from \"../utils/redirect\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  // GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useCaptchaV3 } from \"../hooks/useCaptchaV3\";\nimport { MFA_REDIRECT } from \"../constants/sessionKeys\";\nimport type { SignInInput } from \"../types\";\n\n/**\n * Detect whether the bundle is running inside a native shell (Capacitor on\n * iOS/Android, or Electron). Cross-origin SSO deposit/relay detours only make\n * sense in a multi-origin web context — in a native shell there is one product\n * origin, tokens already live in localStorage, and `window.location.assign` to\n * an external https URL escapes the embedded webview.\n *\n * Detection is runtime-only and avoids importing any platform-specific module\n * so this stays valid when microfe-auth is consumed by a pure web shell too.\n */\nfunction isNativeShell(): boolean {\n  if (typeof window === \"undefined\") return false;\n  const w = window as typeof window & {\n    Capacitor?: { isNativePlatform?: () => boolean };\n  };\n  if (typeof w.Capacitor?.isNativePlatform === \"function\") {\n    try {\n      if (w.Capacitor.isNativePlatform()) return true;\n    } catch {\n      /* fall through */\n    }\n  }\n  if (\n    typeof navigator !== \"undefined\" &&\n    /Electron/i.test(navigator.userAgent || \"\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\nfunction toSameOriginPath(target: string): string {\n  if (typeof window === \"undefined\") return target;\n  try {\n    const url = new URL(target, window.location.origin);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction hasValidAccessToken(token: string): boolean {\n  try {\n    const raw = token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n    const payload = JSON.parse(atob(padded)) as { exp?: unknown };\n    return typeof payload.exp === \"number\" && payload.exp > Date.now() / 1000;\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeSameOriginReturnTo(returnTo: string | null): string | null {\n  if (!returnTo) return null;\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    if (url.origin !== window.location.origin) return null;\n    return stripStaleSsoParams(url, { includeOrigin: false });\n  } catch {\n    return null;\n  }\n}\n\nfunction stripStaleSsoParams(\n  url: URL,\n  options: { includeOrigin: boolean },\n): string {\n  for (const param of [\"sso_failed\", \"sso-failed\", \"sso-attempted\"] as const) {\n    url.searchParams.delete(param);\n  }\n\n  if (options.includeOrigin) {\n    return url.toString();\n  }\n\n  const search = url.searchParams.toString();\n  return `${url.pathname}${search ? `?${search}` : \"\"}${url.hash}`;\n}\n\nfunction cleanReturnToValue(returnTo: string): string {\n  try {\n    const decoded = decodeURIComponent(returnTo);\n    const url = new URL(decoded, window.location.origin);\n    // Preserve cross-origin absolute returnTo values (e.g., redirects back to\n    // another product's app shell) — only strip stale SSO params.\n    const isCrossOrigin = url.origin !== window.location.origin;\n    return stripStaleSsoParams(url, { includeOrigin: isCrossOrigin });\n  } catch {\n    return returnTo;\n  }\n}\n\n/**\n * Login page with professional design\n * Provides email/password login and social OAuth options\n */\nexport function LoginPage() {\n  const navigate = useNavigate();\n  const location = useLocation();\n  const [searchParams] = useSearchParams();\n  const { t } = useI18n();\n  const tr = useCallback(\n    (key: string, fallback: string): string => {\n      const translated = t(key);\n      return translated === key ? fallback : translated;\n    },\n    [t],\n  );\n  const { signIn, isLoading, error, errorCode, resendVerification } =\n    useAuthOperations();\n  const { completeAuthFlow } = useMyWorkspaces();\n  const { setWorkspace, setOrganization } = useActiveContext();\n  const { defaultPostLoginPath } = useAuth();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const mfaRequired = useAuthStore((state) => state.mfaRequired);\n  const { executeRecaptcha: executeCaptchaV3 } = useCaptchaV3();\n  const [isCompletingAuth, setIsCompletingAuth] = useState(false);\n  const [isSsoRedirecting, setIsSsoRedirecting] = useState(false);\n\n  /**\n   * Build the URL that should receive the post-login redirect.\n   *\n   * For cross-eTLD+1 SSO on alpha/prod we detour through the central bridge\n   * host (alphaapp/app.burdenoff.com) so the freshly-issued tokens land in\n   * the bridge origin's first-party (unpartitioned) localStorage. Without\n   * this step, a later direct visit to the bridge host has no local tokens\n   * and no shared cookie (cross-eTLD+1 cookies don't propagate), so the user\n   * sees the login page again.\n   *\n   * Skipped when:\n   *   - Already on the bridge host origin (would be a no-op self-redirect).\n   *   - The user's intended destination is itself on the bridge host\n   *     (likely an in-product navigation, no deposit needed).\n   *   - The freshly-stored profile snapshot can't be read (best-effort only —\n   *     login still succeeds via the direct redirect).\n   */\n  const buildPostLoginUrl = useCallback(\n    async (intendedPath: string): Promise<string> => {\n      if (typeof window === \"undefined\") return intendedPath;\n      // Native shells (Electron, Capacitor iOS/Android) run as a single origin —\n      // skip the cross-eTLD+1 deposit detour, which would otherwise navigate to\n      // an external https URL and escape the embedded webview.\n      if (isNativeShell()) return intendedPath;\n      try {\n        const bridge = resolveAuthBridgeConfig();\n        const bridgeUrl = new URL(bridge.url);\n        const currentOrigin = window.location.origin;\n        if (bridgeUrl.origin === currentOrigin) return intendedPath;\n\n        // intendedPath can be a path or an absolute URL; resolve to absolute\n        // against current origin so the bridge host knows where to send the\n        // user back.\n        const absoluteIntended = new URL(intendedPath, currentOrigin).href;\n\n        const profileId = resolveActiveProfileId();\n        if (!profileId) return intendedPath;\n        const tokens = getProfileTokens(profileId);\n        const user = getProfileUser(profileId);\n        if (!tokens || !user) return intendedPath;\n        const workspaceToken = getProfileWorkspaceToken(profileId);\n\n        // BOFF-4463: mint a DEDICATED refresh-token lineage for the bridge\n        // host. Copying this origin's pair verbatim meant the bridge (and\n        // every product it later relayed to) shared ONE rotating refresh\n        // token — the first origin to refresh revoked it for all others,\n        // surfacing as \"products log me out after minutes/hours\". Falls back\n        // to the legacy copy if the mutation is unreachable (rollout gap /\n        // transient failure) so SSO keeps working.\n        let depositTokens: Record<string, unknown> = {\n          ...tokens,\n          workspaceToken,\n        };\n        if (tokens.refreshToken) {\n          const { globalBaseUrl } = resolveGatewayUrls();\n          const { tokens: minted } = await mintSsoSessionTokens(\n            `${globalBaseUrl}/global/graphql`,\n            tokens.refreshToken,\n          );\n          if (minted) {\n            depositTokens = { ...minted, workspaceToken };\n          }\n        }\n\n        markSsoDepositPending(profileId);\n        return buildSsoDepositUrl(bridgeUrl.origin, absoluteIntended, {\n          profileId,\n          tokens: JSON.stringify(depositTokens),\n          user: JSON.stringify(user),\n          profiles: JSON.stringify(getProfiles()),\n        });\n      } catch {\n        return intendedPath;\n      }\n    },\n    [],\n  );\n\n  // Once a cross-document post-login redirect is initiated, the login page\n  // must FREEZE: resetting isCompletingAuth re-runs the auto-redirect effect\n  // and any state churn schedules same-document navigations that cancel the\n  // provisional deposit hop (BOFF-4463).\n  const redirectInitiatedRef = useRef(false);\n\n  const redirectAfterLogin = useCallback(\n    (path: string) => {\n      const safePath = sanitizePostLoginPath(path);\n      if (typeof window === \"undefined\") {\n        navigate(safePath);\n        return;\n      }\n      try {\n        sessionStorage.setItem(\"bf-post-login-return-to\", safePath);\n      } catch {\n        // Ignore storage failures; redirect still proceeds.\n      }\n      // In native shells use SPA navigation so the embedded webview stays in\n      // the app — no full reload, no chance of the OS opening the URL\n      // externally. Tokens are already in this origin's localStorage.\n      if (isNativeShell()) {\n        navigate(toSameOriginPath(safePath));\n        return;\n      }\n      redirectInitiatedRef.current = true;\n      void (async () => {\n        // Cap the bridge URL build so a hanging SSO token mint cannot keep the\n        // login page stuck on the spinner (BOFF-6807). The sanitized path is\n        // always safe to redirect to directly.\n        const target = await Promise.race([\n          buildPostLoginUrl(safePath),\n          new Promise<string>((resolve) => {\n            window.setTimeout(() => resolve(safePath), 3000);\n          }),\n        ]);\n        if (target.includes(\"/auth/sso-deposit\")) {\n          // Cross-document deposit hop: suppress same-document navigators\n          // while it is provisional, and retry once if it still gets\n          // cancelled — on a committed navigation this document unloads and\n          // the timer never fires.\n          beginSsoNavigation();\n          window.location.assign(target);\n          window.setTimeout(() => {\n            beginSsoNavigation();\n            window.location.replace(target);\n          }, 2500);\n        } else {\n          window.location.assign(target);\n        }\n        // Fallback: if the document is still stuck on the login page after a\n        // full redirect attempt, force an in-app navigation so the spinner\n        // cannot stall forever (BOFF-6807). This only fires when the browser\n        // failed to leave /auth/login, e.g. because the computed target was\n        // still an auth URL or the location.assign was a no-op.\n        window.setTimeout(() => {\n          if (\n            typeof window !== \"undefined\" &&\n            window.location.pathname === \"/auth/login\"\n          ) {\n            navigate(\"/dashboard\");\n          }\n        }, 3500);\n      })();\n    },\n    [navigate, buildPostLoginUrl],\n  );\n  const [showPassword, setShowPassword] = useState(false);\n  const [isAccountInactive, setIsAccountInactive] = useState(false);\n  const [isAccountDeleted, setIsAccountDeleted] = useState(false);\n  const [isAccountSuspended, setIsAccountSuspended] = useState(false);\n  const [isOAuthOnlyAccount, setIsOAuthOnlyAccount] = useState(false);\n  const [isEmailNotVerified, setIsEmailNotVerified] = useState(false);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendSuccess, setResendSuccess] = useState(false);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [infoMessage, setInfoMessage] = useState<string | null>(null);\n  const [formData, setFormData] = useState<\n    SignInInput & { rememberMe?: boolean }\n  >({\n    email: \"\",\n    password: \"\",\n    rememberMe: false,\n  });\n  const [validationError, setValidationError] = useState<string | null>(null);\n  const [isDuplicateAccount, setIsDuplicateAccount] = useState(false);\n\n  // Detect add-account mode and returnTo from URL params\n  const isAddAccountMode = searchParams.get(\"mode\") === \"add-account\";\n  const returnTo = searchParams.get(\"returnTo\");\n  const initialReturnToRef = useRef<string | null>(returnTo);\n\n  // Tell the user WHY they are back on the login page. `session-expired` is\n  // set by the shell's forced logout (expired session whose refresh failed);\n  // `logout` covers explicit sign-outs and the SSO-clear fallback (which can\n  // rewrite a session-expired redirect's reason on the cross-product bounce).\n  // Without this the auto-logout looked like a silent, unexplained kick-out.\n  const reasonParam = searchParams.get(\"reason\");\n  useEffect(() => {\n    if (reasonParam === \"session-expired\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n    } else if (reasonParam === \"logout\") {\n      setInfoMessage(tr(\"auth.login.signedOut\", \"You have been signed out.\"));\n    }\n  }, [reasonParam, tr]);\n\n  useEffect(() => {\n    if (!initialReturnToRef.current && returnTo) {\n      initialReturnToRef.current = returnTo;\n    }\n  }, [returnTo]);\n\n  useEffect(() => {\n    if (isAddAccountMode || isCompletingAuth) return;\n    // A cross-document SSO navigation (deposit/relay hop) is already in\n    // flight — issuing another redirect here would cancel it (BOFF-4463).\n    if (redirectInitiatedRef.current || isSsoNavigationPending()) return;\n\n    const profileId = resolveActiveProfileId();\n    if (profileId) {\n      const tokens = getProfileTokens(profileId);\n      const user = getProfileUser(profileId);\n      if (\n        tokens?.accessToken &&\n        user &&\n        hasValidAccessToken(tokens.accessToken)\n      ) {\n        useAuthStore.getState().loadFromProfile(profileId);\n        redirectAfterLogin(decodeSameOriginReturnTo(returnTo) ?? \"/\");\n        return;\n      }\n    }\n\n    const ssoUrl = getSSORedirectUrl();\n    if (ssoUrl) {\n      setIsSsoRedirecting(true);\n      window.location.replace(ssoUrl);\n    }\n  }, [isAddAccountMode, isCompletingAuth, redirectAfterLogin, returnTo]);\n\n  // Load remembered email on mount and clean up any legacy plaintext password storage\n  useEffect(() => {\n    try {\n      // Security cleanup: remove any previously stored plaintext passwords\n      localStorage.removeItem(\"remembered_password\");\n\n      const rememberedEmail = localStorage.getItem(\"remembered_email\");\n\n      if (rememberedEmail) {\n        setFormData((prev) => ({\n          ...prev,\n          email: rememberedEmail,\n          rememberMe: true,\n        }));\n      }\n    } catch (error) {\n      console.warn(\"[LoginPage] Failed to load remembered email:\", error);\n    }\n  }, []);\n\n  // Check for redirect message and email from location state (e.g., from expired MFA or SSO redirect)\n  useEffect(() => {\n    const state = location.state as { message?: string; email?: string } | null;\n    if (state?.message) {\n      setInfoMessage(state.message);\n    }\n    if (state?.email) {\n      setFormData((prev) => ({ ...prev, email: state.email }));\n    }\n    // Clear state to prevent showing message on refresh\n    if (state) {\n      window.history.replaceState({}, document.title);\n    }\n  }, [location.state]);\n\n  // Determine error type from GraphQL error code (primary) or message (fallback).\n  // The backend sends structured codes in extensions.code which are propagated\n  // through useAuthOperations → authStore.errorCode.\n  const checkErrorType = (\n    err: string | null,\n    code?: string | null,\n  ):\n    | \"DELETED\"\n    | \"SUSPENDED\"\n    | \"OAUTH_ONLY\"\n    | \"INACTIVE\"\n    | \"EMAIL_NOT_VERIFIED\"\n    | null => {\n    // Primary: match on GraphQL error code from extensions\n    if (code) {\n      switch (code) {\n        case \"ACCOUNT_DELETED\":\n          return \"DELETED\";\n        case \"ACCOUNT_SUSPENDED\":\n          return \"SUSPENDED\";\n        case \"OAUTH_ONLY_ACCOUNT\":\n          return \"OAUTH_ONLY\";\n        case \"ACCOUNT_INACTIVE\":\n          return \"INACTIVE\";\n        case \"EMAIL_NOT_VERIFIED\":\n          return \"EMAIL_NOT_VERIFIED\";\n        default:\n          break;\n      }\n    }\n\n    // Fallback: match on error message for non-GraphQL errors or legacy responses\n    if (!err) return null;\n    const lowerErr = err.toLowerCase();\n\n    if (\n      lowerErr.includes(\"deleted\") ||\n      lowerErr.includes(\"permanently deleted\")\n    ) {\n      return \"DELETED\";\n    }\n    if (lowerErr.includes(\"suspended\")) {\n      return \"SUSPENDED\";\n    }\n    if (\n      lowerErr.includes(\"oauth provider\") ||\n      lowerErr.includes(\"oauth-only\") ||\n      lowerErr.includes(\"oauth only\")\n    ) {\n      return \"OAUTH_ONLY\";\n    }\n    if (\n      lowerErr.includes(\"inactive\") ||\n      lowerErr.includes(\"deactivated\") ||\n      lowerErr.includes(\"not active\")\n    ) {\n      return \"INACTIVE\";\n    }\n    if (\n      lowerErr.includes(\"verify your email\") ||\n      lowerErr.includes(\"email not verified\") ||\n      lowerErr.includes(\"email_not_verified\")\n    ) {\n      return \"EMAIL_NOT_VERIFIED\";\n    }\n    return null;\n  };\n\n  // Pre-fill email from URL query parameter (e.g., after email verification)\n  useEffect(() => {\n    const emailFromUrl = searchParams.get(\"email\");\n    if (emailFromUrl) {\n      setFormData((prev) => ({ ...prev, email: emailFromUrl }));\n    }\n\n    // Check for expired session redirect\n    const isExpired = searchParams.get(\"expired\");\n    if (isExpired === \"true\") {\n      setInfoMessage(\n        tr(\n          \"auth.login.sessionExpired\",\n          \"Your session has expired. Please sign in again.\",\n        ),\n      );\n      // Clear the query param to prevent showing on refresh\n      const newUrl = window.location.pathname;\n      window.history.replaceState({}, document.title, newUrl);\n    }\n  }, [searchParams, tr]);\n\n  // Redirect to MFA verification when required\n  useEffect(() => {\n    if (mfaRequired) {\n      navigate(\"/auth/mfa-verify\");\n    }\n  }, [mfaRequired, navigate]);\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n    setIsAccountInactive(false);\n    setIsAccountDeleted(false);\n    setIsAccountSuspended(false);\n    setIsOAuthOnlyAccount(false);\n    setIsEmailNotVerified(false);\n    setIsDuplicateAccount(false);\n    setResendSuccess(false);\n    setValidationError(null);\n\n    // Client-side validation\n    const emailTrimmed = (formData.email ?? \"\").trim();\n    if (!emailTrimmed) {\n      setValidationError(\n        tr(\n          \"auth.login.enterEmailOrUsername\",\n          \"Please enter your email or username\",\n        ),\n      );\n      return;\n    }\n\n    // Basic email format validation (if it contains @)\n    if (emailTrimmed.includes(\"@\")) {\n      const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n      if (!emailRegex.test(emailTrimmed)) {\n        setValidationError(\n          tr(\"auth.login.invalidEmail\", \"Please enter a valid email address\"),\n        );\n        return;\n      }\n    }\n\n    if (!formData.password || formData.password.length < 1) {\n      setValidationError(\n        tr(\"auth.login.enterPassword\", \"Please enter your password\"),\n      );\n      return;\n    }\n\n    // In add-account mode, check if this email is already signed in\n    if (isAddAccountMode) {\n      const existingProfiles = getProfiles();\n      const alreadySignedIn = existingProfiles.some(\n        (p) => p.email.toLowerCase() === emailTrimmed.toLowerCase(),\n      );\n      if (alreadySignedIn) {\n        setIsDuplicateAccount(true);\n        setValidationError(null);\n        return;\n      }\n    }\n    setIsDuplicateAccount(false);\n\n    try {\n      // Get reCAPTCHA v3 token (no-op when captcha is disabled)\n      const recaptchaToken = await executeCaptchaV3(\"login\");\n\n      const result = await signIn({\n        email: emailTrimmed,\n        password: formData.password,\n        rememberMe: formData.rememberMe,\n        ...(recaptchaToken ? { recaptchaToken } : {}),\n      });\n\n      // If MFA is required, the useEffect above will handle redirect\n      if (result.requiresMFA) {\n        // Persist the post-login destination so MfaVerifyPage honors\n        // `returnTo` and `defaultPostLoginPath` after the user completes\n        // verification — otherwise the MFA path falls back to \"/\" and the\n        // host-configured home (e.g. \"/vibecontrols\") is lost.\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postMfaPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          sessionStorage.setItem(MFA_REDIRECT, postMfaPath);\n        } catch {\n          // sessionStorage may be unavailable (private mode, quota) — the\n          // MFA page still works, it just defaults to \"/\" on completion.\n        }\n        return;\n      }\n\n      // Successful login - complete auth flow (fetch workspaces + issue token)\n      if (result.success) {\n        try {\n          const profileId = result.user?.id;\n          if (profileId) {\n            const hostname = window.location.hostname;\n            const domain = hostname.endsWith(\".local.burdenoff.com\")\n              ? \".local.burdenoff.com\"\n              : undefined;\n            const domainPart = domain ? `; domain=${domain}` : \"\";\n            const securePart =\n              window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n            const ssoValue = JSON.stringify({\n              id: profileId,\n              origin: window.location.origin,\n            });\n            document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n            document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n          }\n        } catch {\n          // Best effort only. Login can continue without the fast-path cookie.\n        }\n\n        // Handle Remember Me: Save or clear email only (never store passwords)\n        try {\n          if (formData.rememberMe) {\n            localStorage.setItem(\"remembered_email\", emailTrimmed);\n          } else {\n            localStorage.removeItem(\"remembered_email\");\n          }\n        } catch (error) {\n          console.warn(\n            \"[LoginPage] Failed to save/clear remembered email:\",\n            error,\n          );\n        }\n\n        setIsCompletingAuth(true);\n        // In add-account mode, redirect back to where the user was\n        const effectiveReturnTo = initialReturnToRef.current || returnTo;\n        const postLoginPath = effectiveReturnTo\n          ? cleanReturnToValue(effectiveReturnTo)\n          : cleanReturnToValue(defaultPostLoginPath ?? \"/dashboard\");\n        try {\n          type AuthFlowResult = Awaited<ReturnType<typeof completeAuthFlow>>;\n          // Pass the token directly to avoid race condition with React state updates\n          const authFlowResult = await Promise.race<AuthFlowResult>([\n            completeAuthFlow(result.token),\n            new Promise<AuthFlowResult>((resolve) => {\n              window.setTimeout(() => {\n                resolve({\n                  success: false,\n                  error: \"Auth flow timed out after login\",\n                });\n              }, 5000);\n            }),\n          ]);\n\n          if (authFlowResult.success) {\n            // Sync workspace and organization to ActiveContext\n            // This is critical for global search and other workspace-scoped features\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n\n            // Full auth flow completed - redirect to dashboard or returnTo\n            redirectAfterLogin(postLoginPath);\n          } else if (authFlowResult.error?.includes(\"No workspaces found\")) {\n            // No workspaces - redirect to onboarding/workspace creation\n            navigate(\"/onboarding/create-workspace\");\n          } else {\n            // Partial success or error - still sync workspace if available and redirect\n            if (authFlowResult.workspace) {\n              setWorkspace(authFlowResult.workspace.id);\n              if (authFlowResult.workspace.organizationId) {\n                setOrganization(authFlowResult.workspace.organizationId);\n              }\n            }\n            console.warn(\"Auth flow warning:\", authFlowResult.error);\n            redirectAfterLogin(postLoginPath);\n          }\n        } catch (authFlowError) {\n          // Auth flow failed but login succeeded - still redirect\n          console.error(\"Auth flow error (login succeeded):\", authFlowError);\n          redirectAfterLogin(postLoginPath);\n        } finally {\n          // Keep the completing state (spinner) once a redirect is in\n          // flight: resetting it re-arms the auto-redirect effect whose\n          // competing navigation cancels the deposit hop (BOFF-4463). The\n          // page is about to unload anyway.\n          if (!redirectInitiatedRef.current) {\n            setIsCompletingAuth(false);\n          }\n        }\n      }\n    } catch (err) {\n      if (import.meta.env.DEV) {\n        console.error(\"Sign in failed:\", err);\n      }\n      // Check error type using error code (from store) and message\n      const errorMsg = err instanceof Error ? err.message : String(err);\n      if (errorMsg.includes(\"reCAPTCHA\")) {\n        setValidationError(errorMsg);\n      }\n      const storeErrorCode = useAuthStore.getState().errorCode;\n      const errorType = checkErrorType(errorMsg, storeErrorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  };\n\n  // Also check the error from useAuthOperations\n  useEffect(() => {\n    if (error) {\n      const errorType = checkErrorType(error, errorCode);\n      if (errorType === \"DELETED\") {\n        setIsAccountDeleted(true);\n      } else if (errorType === \"SUSPENDED\") {\n        setIsAccountSuspended(true);\n      } else if (errorType === \"OAUTH_ONLY\") {\n        setIsOAuthOnlyAccount(true);\n      } else if (errorType === \"INACTIVE\") {\n        setIsAccountInactive(true);\n      } else if (errorType === \"EMAIL_NOT_VERIFIED\") {\n        setIsEmailNotVerified(true);\n      }\n    }\n  }, [error, errorCode]);\n\n  /**\n   * Handle Google OAuth login\n   */\n  const handleGoogleLogin = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.googleSignInFailed\",\n              \"Failed to initiate Google sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth login\n   */\n  const handleMicrosoftLogin = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.microsoftSignInFailed\",\n              \"Failed to initiate Microsoft sign in\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle resend verification email\n   */\n  const handleResendVerification = async () => {\n    setIsResendingVerification(true);\n    setResendSuccess(false);\n    try {\n      const emailTrimmed = (formData.email ?? \"\").trim();\n      const result = await resendVerification(emailTrimmed);\n      if (result.success) {\n        setResendSuccess(true);\n      } else {\n        setValidationError(\n          tr(\n            \"auth.login.resendFailed\",\n            \"Failed to resend verification email. Please try again.\",\n          ),\n        );\n      }\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      setValidationError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.login.resendFailed\",\n              \"Failed to resend verification email. Please try again.\",\n            ),\n      );\n    } finally {\n      setIsResendingVerification(false);\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleLogin,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.login.googleNotConfigured\",\n            \"Google sign in is not configured\",\n          ),\n    },\n    // {\n    //   name: \"GitHub\",\n    //   icon: GitHubIcon,\n    //   onClick: () => {},\n    //   disabled: true,\n    //   tooltip: tr(\n    //     \"auth.login.githubNotConfigured\",\n    //     \"GitHub sign in is not configured\",\n    //   ),\n    // },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftLogin,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.login.microsoftNotConfigured\",\n            \"Microsoft sign in is not configured\",\n          ),\n    },\n  ];\n\n  if (isSsoRedirecting) {\n    return <SSORedirectSpinner />;\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.login.welcomeBack\", \"Welcome back\")}\n      subtitle={tr(\n        \"auth.login.enterCredentials\",\n        \"Enter your credentials to continue\",\n      )}\n    >\n      <PagePurpose className=\"mb-5\">\n        {tr(\n          \"auth.login.purpose\",\n          \"Sign in to reach your workspaces, agents, and settings. Use your email and password, a social provider, or a passwordless magic link.\",\n        )}\n      </PagePurpose>\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Info Message (e.g., from expired MFA redirect) */}\n        {infoMessage && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-info-bg-subtle border-status-info-border\">\n            <svg\n              className=\"size-5 flex-shrink-0 mt-0.5 text-text-link\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z\"\n              />\n            </svg>\n            <p className=\"text-sm text-status-info-text\">{infoMessage}</p>\n          </div>\n        )}\n\n        {/* Validation Error */}\n        {validationError && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <p className=\"text-sm text-status-warning-text\">\n              {validationError}\n            </p>\n          </div>\n        )}\n\n        {/* Duplicate Account Warning (Add Account mode) */}\n        {isDuplicateAccount && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-warning-bg-subtle border-status-warning-border\">\n            <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-warning-text\" />\n            <div className=\"flex-1\">\n              <p className=\"text-sm font-medium text-status-warning-text\">\n                {tr(\n                  \"auth.login.duplicateAccount\",\n                  \"This account is already signed in.\",\n                )}\n              </p>\n              <p className=\"mt-1 text-sm text-status-warning-text/80\">\n                {tr(\n                  \"auth.login.duplicateAccountHint\",\n                  \"Please use a different account, or go back and switch to this account from the profile menu.\",\n                )}\n              </p>\n              {(initialReturnToRef.current || returnTo) && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\n                      decodeURIComponent(\n                        initialReturnToRef.current || returnTo || \"/dashboard\",\n                      ),\n                    )\n                  }\n                  className=\"mt-3 inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm\"\n                >\n                  <svg\n                    className=\"size-4\"\n                    fill=\"none\"\n                    viewBox=\"0 0 24 24\"\n                    stroke=\"currentColor\"\n                  >\n                    <path\n                      strokeLinecap=\"round\"\n                      strokeLinejoin=\"round\"\n                      strokeWidth={2}\n                      d=\"M10 19l-7-7m0 0l7-7m-7 7h18\"\n                    />\n                  </svg>\n                  {tr(\n                    \"auth.login.goBackSwitchAccount\",\n                    \"Go back and switch account\",\n                  )}\n                </button>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Error Alert */}\n        {error && !validationError && !isDuplicateAccount && (\n          <div\n            className={`flex items-start gap-3 p-4 rounded-xl border ${\n              isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                ? \"bg-status-warning-bg-subtle border-status-warning-border\"\n                : \"bg-status-error-bg-subtle border-status-error-border\"\n            }`}\n          >\n            <AlertIcon\n              className={`size-5 flex-shrink-0 mt-0.5 ${\n                isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                  ? \"text-status-warning-text\"\n                  : \"text-status-error-text\"\n              }`}\n            />\n            <div className=\"flex-1\">\n              <p\n                className={`text-sm ${\n                  isAccountInactive || isOAuthOnlyAccount || isEmailNotVerified\n                    ? \"text-status-warning-text\"\n                    : \"text-status-error-text\"\n                }`}\n              >\n                {isAccountDeleted\n                  ? tr(\n                      \"auth.login.accountDeleted\",\n                      \"This account has been permanently deleted and cannot be recovered.\",\n                    )\n                  : isAccountSuspended\n                    ? tr(\n                        \"auth.login.accountSuspended\",\n                        \"Your account has been suspended. Please contact support for assistance.\",\n                      )\n                    : isAccountInactive\n                      ? tr(\n                          \"auth.login.accountDeactivated\",\n                          \"Your account has been deactivated.\",\n                        )\n                      : isOAuthOnlyAccount\n                        ? tr(\n                            \"auth.login.oauthOnly\",\n                            \"This account uses OAuth sign-in. Please use Google or Microsoft to sign in.\",\n                          )\n                        : isEmailNotVerified\n                          ? tr(\n                              \"auth.login.emailNotVerified\",\n                              \"Please verify your email before signing in. Check your inbox for the verification link.\",\n                            )\n                          : error}\n              </p>\n              {isAccountInactive && (\n                <button\n                  type=\"button\"\n                  onClick={() =>\n                    navigate(\"/auth/reactivate\", {\n                      state: { email: formData.email },\n                    })\n                  }\n                  className=\"mt-2 text-sm font-semibold text-status-warning-text hover:text-status-warning-text underline underline-offset-2\"\n                >\n                  {tr(\n                    \"auth.login.clickReactivate\",\n                    \"Click here to reactivate your account\",\n                  )}\n                </button>\n              )}\n              {isEmailNotVerified && (\n                <div className=\"mt-3\">\n                  {resendSuccess ? (\n                    <div className=\"flex items-center gap-2 text-sm text-status-success-text\">\n                      <svg\n                        className=\"size-4\"\n                        fill=\"none\"\n                        viewBox=\"0 0 24 24\"\n                        stroke=\"currentColor\"\n                      >\n                        <path\n                          strokeLinecap=\"round\"\n                          strokeLinejoin=\"round\"\n                          strokeWidth={2}\n                          d=\"M5 13l4 4L19 7\"\n                        />\n                      </svg>\n                      {tr(\n                        \"auth.login.verificationSent\",\n                        \"Verification email sent! Please check your inbox.\",\n                      )}\n                    </div>\n                  ) : (\n                    <button\n                      type=\"button\"\n                      onClick={handleResendVerification}\n                      disabled={isResendingVerification}\n                      className=\"inline-flex items-center gap-2 px-4 py-2.5 rounded-xl border border-status-warning-border bg-bg-surface text-status-warning-text text-sm font-medium hover:bg-status-warning-bg-subtle hover:border-status-warning-border transition-all shadow-sm disabled:opacity-50 disabled:cursor-not-allowed\"\n                    >\n                      {isResendingVerification ? (\n                        <>\n                          <SpinnerIcon className=\"size-4 animate-spin\" />\n                          {tr(\"auth.login.sending\", \"Sending...\")}\n                        </>\n                      ) : (\n                        <>\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                            />\n                          </svg>\n                          {tr(\n                            \"auth.login.resendVerification\",\n                            \"Resend verification email\",\n                          )}\n                        </>\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n              {isOAuthOnlyAccount && (\n                <div className=\"mt-3 flex flex-col gap-2\">\n                  {isProviderConfigured(\"google\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleGoogleLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <GoogleIcon className=\"size-5\" />\n                      {tr(\"auth.login.signInWithGoogle\", \"Sign in with Google\")}\n                    </button>\n                  )}\n                  {isProviderConfigured(\"microsoft\") && (\n                    <button\n                      type=\"button\"\n                      onClick={handleMicrosoftLogin}\n                      className=\"inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-xl border border-border-default bg-bg-surface text-text-primary text-sm font-medium hover:bg-bg-canvas hover:border-border-default transition-all shadow-sm\"\n                    >\n                      <MicrosoftIcon className=\"size-5\" />\n                      {tr(\n                        \"auth.login.signInWithMicrosoft\",\n                        \"Sign in with Microsoft\",\n                      )}\n                    </button>\n                  )}\n                </div>\n              )}\n            </div>\n          </div>\n        )}\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.emailLabel\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.emailLabel\", \"Email\")}\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\"auth.login.emailPlaceholder\", \"you@example.com\")}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.login.passwordLabel\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              autoComplete=\"current-password\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.login.passwordLabel\", \"Password\")}\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.login.passwordPlaceholder\",\n                \"Enter your password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={showPassword ? \"Hide password\" : \"Show password\"}\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"size-5\" />\n              ) : (\n                <EyeIcon className=\"size-5\" />\n              )}\n            </button>\n          </div>\n        </div>\n\n        {/* Remember & Forgot */}\n        <div className=\"flex items-center justify-between\">\n          <label className=\"flex items-center gap-2 cursor-pointer group\">\n            <div className=\"relative\">\n              <input\n                type=\"checkbox\"\n                aria-label={tr(\"auth.login.rememberMe\", \"Remember me\")}\n                checked={formData.rememberMe}\n                onChange={(e) => {\n                  const isChecked = e.target.checked;\n                  setFormData({ ...formData, rememberMe: isChecked });\n\n                  // Clear saved email immediately when unchecked\n                  if (!isChecked) {\n                    try {\n                      localStorage.removeItem(\"remembered_email\");\n                    } catch (error) {\n                      console.warn(\n                        \"[LoginPage] Failed to clear remembered email:\",\n                        error,\n                      );\n                    }\n                  }\n                }}\n                className=\"sr-only peer\"\n              />\n              <div className=\"size-5 rounded-md border-2 border-[var(--color-border-default)] bg-[var(--color-bg-surface)] peer-checked:bg-status-info-bg-subtle0 peer-checked:border-action-primary-bg transition-all peer-focus:ring-2 peer-focus:ring-action-primary-bg/20\">\n                <svg\n                  className=\"size-full text-white opacity-0 peer-checked:opacity-100 transition-opacity p-0.5\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                  strokeWidth={3}\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n            </div>\n            <span className=\"text-sm text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)] transition-colors\">\n              {tr(\"auth.login.rememberMe\", \"Remember me\")}\n            </span>\n          </label>\n          <button\n            type=\"button\"\n            onClick={() => navigate(\"/auth/reset-password\")}\n            className=\"text-sm font-medium text-text-link hover:text-text-linkHover transition-colors\"\n          >\n            {tr(\"auth.login.forgotPassword\", \"Forgot password?\")}\n          </button>\n        </div>\n\n        {/* Submit Button */}\n        <Button\n          type=\"submit\"\n          disabled={isLoading || isCompletingAuth}\n          variant=\"default\"\n          size=\"lg\"\n          className=\"w-full font-semibold\"\n        >\n          {isLoading || isCompletingAuth ? (\n            <>\n              <SpinnerIcon className=\"size-5 animate-spin\" />\n              <span>\n                {isCompletingAuth\n                  ? tr(\n                      \"auth.login.settingUpWorkspace\",\n                      \"Setting up workspace...\",\n                    )\n                  : tr(\"auth.login.signingIn\", \"Signing in...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.login.signIn\", \"Sign in\")\n          )}\n        </Button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.login.orContinueWith\", \"or continue with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            aria-label={provider.name}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`size-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Enterprise SSO Option — temporarily hidden */}\n      {/* <div className=\"mt-6\">\n        <button type=\"button\"\n          onClick={() => navigate(\"/auth/sso/login\")}\n          className=\"w-full flex items-center justify-center gap-3 px-4 py-3 rounded-xl border-2 border-dashed border-[var(--color-border-default)] hover:border-action-primary-bg bg-[var(--color-bg-surface)] hover:bg-status-info-bg-subtle transition-all duration-200 group\"\n        >\n          <svg\n            className=\"size-5 text-[var(--color-text-tertiary)] group-hover:text-text-link\"\n            fill=\"none\"\n            viewBox=\"0 0 24 24\"\n            stroke=\"currentColor\"\n          >\n            <path\n              strokeLinecap=\"round\"\n              strokeLinejoin=\"round\"\n              strokeWidth={1.5}\n              d=\"M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4\"\n            />\n          </svg>\n          <span className=\"text-sm font-medium text-[var(--color-text-secondary)] group-hover:text-text-link\">\n            {tr(\"auth.login.enterpriseSso\", \"Sign in with Enterprise SSO\")}\n          </span>\n        </button>\n      </div> */}\n\n      {/* Magic Link Option */}\n      <div className=\"mt-4 text-center\">\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/magic-link\")}\n          className=\"text-sm text-[var(--color-text-secondary)] hover:text-[var(--color-text-primary)] transition-colors\"\n        >\n          {tr(\"auth.login.preferPasswordless\", \"Prefer passwordless login?\")}{\" \"}\n          <span className=\"font-semibold text-text-link hover:text-text-linkHover\">\n            {tr(\"auth.login.signInMagicLink\", \"Sign in with Magic Link\")}\n          </span>\n        </button>\n      </div>\n\n      {/* Sign Up Link */}\n      <p className=\"mt-6 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.login.dontHaveAccount\", \"Don't have an account?\")}{\" \"}\n        <button\n          type=\"button\"\n          onClick={() => navigate(\"/auth/register\")}\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.login.signUp\", \"Sign up\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6DA,SAAS,KAAyB;AAChC,KAAI,OAAO,SAAW,IAAa,QAAO;CAC1C,IAAM,IAAI;AAGV,KAAI,OAAO,EAAE,WAAW,oBAAqB,WAC3C,KAAI;AACF,MAAI,EAAE,UAAU,kBAAkB,CAAE,QAAO;SACrC;AAUV,QANA,GACE,OAAO,YAAc,OACrB,YAAY,KAAK,UAAU,aAAa,GAAG;;AAO/C,SAAS,GAAiB,GAAwB;AAChD,KAAI,OAAO,SAAW,IAAa,QAAO;AAC1C,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAQ,OAAO,SAAS,OAAO;AACnD,SAAO,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI;SACpC;AACN,SAAO;;;AAIX,SAAS,GAAoB,GAAwB;AACnD,KAAI;EACF,IAAM,IAAM,EAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,EAC/D,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,EAAE,GAAG,GAAG,IAAI,EACvD,IAAU,KAAK,MAAM,KAAK,EAAO,CAAC;AACxC,SAAO,OAAO,EAAQ,OAAQ,YAAY,EAAQ,MAAM,KAAK,KAAK,GAAG;SAC/D;AACN,SAAO;;;AAIX,SAAS,GAAyB,GAAwC;AACxE,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EAEF,IAAM,IAAM,IAAI,IADA,mBAAmB,EAAS,EACf,OAAO,SAAS,OAAO;AAEpD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,EAAoB,GAAK,EAAE,eAAe,IAAO,CAAC,GADP;SAE5C;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GACQ;AACR,MAAK,IAAM,KAAS;EAAC;EAAc;EAAc;EAAgB,CAC/D,GAAI,aAAa,OAAO,EAAM;AAGhC,KAAI,EAAQ,cACV,QAAO,EAAI,UAAU;CAGvB,IAAM,IAAS,EAAI,aAAa,UAAU;AAC1C,QAAO,GAAG,EAAI,WAAW,IAAS,IAAI,MAAW,KAAK,EAAI;;AAG5D,SAAS,EAAmB,GAA0B;AACpD,KAAI;EAEF,IAAM,IAAM,IAAI,IADA,mBAAmB,EAAS,EACf,OAAO,SAAS,OAAO;AAIpD,SAAO,EAAoB,GAAK,EAAE,eADZ,EAAI,WAAW,OAAO,SAAS,QACW,CAAC;SAC3D;AACN,SAAO;;;AAQX,SAAgB,IAAY;CAC1B,IAAM,IAAW,IAAa,EACxB,IAAW,IAAa,EACxB,CAAC,KAAgB,IAAiB,EAClC,EAAE,SAAM,IAAS,EACjB,IAAK,GACR,GAAa,MAA6B;EACzC,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAEzC,CAAC,EAAE,CACJ,EACK,EAAE,YAAQ,cAAW,UAAO,cAAW,2BAC3C,GAAmB,EACf,EAAE,yBAAqB,GAAiB,EACxC,EAAE,iBAAc,wBAAoB,IAAkB,EACtD,EAAE,6BAAyB,GAAS,EACpC,EAAE,yBAAqB,4BAAwB,4BACnD,GAAoB,EAChB,KAAc,GAAc,MAAU,EAAM,YAAY,EACxD,EAAE,kBAAkB,OAAqB,IAAc,EACvD,CAAC,GAAkB,MAAuB,EAAS,GAAM,EACzD,CAAC,IAAkB,MAAuB,EAAS,GAAM,EAmBzD,KAAoB,EACxB,OAAO,MAA0C;AAK/C,MAJI,OAAO,SAAW,OAIlB,IAAe,CAAE,QAAO;AAC5B,MAAI;GACF,IAAM,IAAS,IAAyB,EAClC,IAAY,IAAI,IAAI,EAAO,IAAI,EAC/B,IAAgB,OAAO,SAAS;AACtC,OAAI,EAAU,WAAW,EAAe,QAAO;GAK/C,IAAM,IAAmB,IAAI,IAAI,GAAc,EAAc,CAAC,MAExD,IAAY,IAAwB;AAC1C,OAAI,CAAC,EAAW,QAAO;GACvB,IAAM,IAAS,GAAiB,EAAU,EACpC,IAAO,GAAe,EAAU;AACtC,OAAI,CAAC,KAAU,CAAC,EAAM,QAAO;GAC7B,IAAM,IAAiB,GAAyB,EAAU,EAStD,IAAyC;IAC3C,GAAG;IACH;IACD;AACD,OAAI,EAAO,cAAc;IACvB,IAAM,EAAE,qBAAkB,IAAoB,EACxC,EAAE,QAAQ,MAAW,MAAM,GAC/B,GAAG,EAAc,kBACjB,EAAO,aACR;AACD,IAAI,MACF,IAAgB;KAAE,GAAG;KAAQ;KAAgB;;AAKjD,UADA,GAAsB,EAAU,EACzB,GAAmB,EAAU,QAAQ,GAAkB;IAC5D;IACA,QAAQ,KAAK,UAAU,EAAc;IACrC,MAAM,KAAK,UAAU,EAAK;IAC1B,UAAU,KAAK,UAAU,IAAa,CAAC;IACxC,CAAC;UACI;AACN,UAAO;;IAGX,EAAE,CACH,EAMK,IAAuB,GAAO,GAAM,EAEpC,IAAqB,GACxB,MAAiB;EAChB,IAAM,IAAW,EAAsB,EAAK;AAC5C,MAAI,OAAO,SAAW,KAAa;AACjC,KAAS,EAAS;AAClB;;AAEF,MAAI;AACF,kBAAe,QAAQ,2BAA2B,EAAS;UACrD;AAMR,MAAI,IAAe,EAAE;AACnB,KAAS,GAAiB,EAAS,CAAC;AACpC;;AAGF,EADA,EAAqB,UAAU,KACzB,YAAY;GAIhB,IAAM,IAAS,MAAM,QAAQ,KAAK,CAChC,GAAkB,EAAS,EAC3B,IAAI,SAAiB,MAAY;AAC/B,WAAO,iBAAiB,EAAQ,EAAS,EAAE,IAAK;KAChD,CACH,CAAC;AAoBF,GAnBI,EAAO,SAAS,oBAAoB,IAKtC,IAAoB,EACpB,OAAO,SAAS,OAAO,EAAO,EAC9B,OAAO,iBAAiB;AAEtB,IADA,IAAoB,EACpB,OAAO,SAAS,QAAQ,EAAO;MAC9B,KAAK,IAER,OAAO,SAAS,OAAO,EAAO,EAOhC,OAAO,iBAAiB;AACtB,IACE,OAAO,SAAW,OAClB,OAAO,SAAS,aAAa,iBAE7B,EAAS,aAAa;MAEvB,KAAK;MACN;IAEN,CAAC,GAAU,GAAkB,CAC9B,EACK,CAAC,GAAc,MAAmB,EAAS,GAAM,EACjD,CAAC,GAAmB,KAAwB,EAAS,GAAM,EAC3D,CAAC,IAAkB,KAAuB,EAAS,GAAM,EACzD,CAAC,IAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,GAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,GAAoB,KAAyB,EAAS,GAAM,EAC7D,CAAC,IAAyB,MAA8B,EAAS,GAAM,EACvE,CAAC,IAAe,KAAoB,EAAS,GAAM,EACnD,CAAC,IAAY,KAAiB,EAAwB,KAAK,EAC3D,CAAC,IAAa,KAAkB,EAAwB,KAAK,EAC7D,CAAC,GAAU,KAAe,EAE9B;EACA,OAAO;EACP,UAAU;EACV,YAAY;EACb,CAAC,EACI,CAAC,GAAiB,KAAsB,EAAwB,KAAK,EACrE,CAAC,IAAoB,KAAyB,EAAS,GAAM,EAG7D,IAAmB,EAAa,IAAI,OAAO,KAAK,eAChD,IAAW,EAAa,IAAI,WAAW,EACvC,IAAqB,GAAsB,EAAS,EAOpD,IAAc,EAAa,IAAI,SAAS;AAqE9C,CApEA,QAAgB;AACd,EAAI,MAAgB,oBAClB,EACE,EACE,6BACA,kDACD,CACF,GACQ,MAAgB,YACzB,EAAe,EAAG,wBAAwB,4BAA4B,CAAC;IAExE,CAAC,GAAa,EAAG,CAAC,EAErB,QAAgB;AACd,EAAI,CAAC,EAAmB,WAAW,MACjC,EAAmB,UAAU;IAE9B,CAAC,EAAS,CAAC,EAEd,QAAgB;AAId,MAHI,KAAoB,KAGpB,EAAqB,WAAW,IAAwB,CAAE;EAE9D,IAAM,IAAY,IAAwB;AAC1C,MAAI,GAAW;GACb,IAAM,IAAS,GAAiB,EAAU,EACpC,IAAO,GAAe,EAAU;AACtC,OACE,GAAQ,eACR,KACA,GAAoB,EAAO,YAAY,EACvC;AAEA,IADA,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,EAAmB,GAAyB,EAAS,IAAI,IAAI;AAC7D;;;EAIJ,IAAM,IAAS,IAAmB;AAClC,EAAI,MACF,GAAoB,GAAK,EACzB,OAAO,SAAS,QAAQ,EAAO;IAEhC;EAAC;EAAkB;EAAkB;EAAoB;EAAS,CAAC,EAGtE,QAAgB;AACd,MAAI;AAEF,gBAAa,WAAW,sBAAsB;GAE9C,IAAM,IAAkB,aAAa,QAAQ,mBAAmB;AAEhE,GAAI,KACF,GAAa,OAAU;IACrB,GAAG;IACH,OAAO;IACP,YAAY;IACb,EAAE;WAEE,GAAO;AACd,WAAQ,KAAK,gDAAgD,EAAM;;IAEpE,EAAE,CAAC,EAGN,QAAgB;EACd,IAAM,IAAQ,EAAS;AAQvB,EAPI,GAAO,WACT,EAAe,EAAM,QAAQ,EAE3B,GAAO,SACT,GAAa,OAAU;GAAE,GAAG;GAAM,OAAO,EAAM;GAAO,EAAE,EAGtD,KACF,OAAO,QAAQ,aAAa,EAAE,EAAE,SAAS,MAAM;IAEhD,CAAC,EAAS,MAAM,CAAC;CAKpB,IAAM,MACJ,GACA,MAOU;AAEV,MAAI,EACF,SAAQ,GAAR;GACE,KAAK,kBACH,QAAO;GACT,KAAK,oBACH,QAAO;GACT,KAAK,qBACH,QAAO;GACT,KAAK,mBACH,QAAO;GACT,KAAK,qBACH,QAAO;GACT,QACE;;AAKN,MAAI,CAAC,EAAK,QAAO;EACjB,IAAM,IAAW,EAAI,aAAa;AAgClC,SA7BE,EAAS,SAAS,UAAU,IAC5B,EAAS,SAAS,sBAAsB,GAEjC,YAEL,EAAS,SAAS,YAAY,GACzB,cAGP,EAAS,SAAS,iBAAiB,IACnC,EAAS,SAAS,aAAa,IAC/B,EAAS,SAAS,aAAa,GAExB,eAGP,EAAS,SAAS,WAAW,IAC7B,EAAS,SAAS,cAAc,IAChC,EAAS,SAAS,aAAa,GAExB,aAGP,EAAS,SAAS,oBAAoB,IACtC,EAAS,SAAS,qBAAqB,IACvC,EAAS,SAAS,qBAAqB,GAEhC,uBAEF;;AA0BT,CAtBA,QAAgB;EACd,IAAM,IAAe,EAAa,IAAI,QAAQ;AAO9C,MANI,KACF,GAAa,OAAU;GAAE,GAAG;GAAM,OAAO;GAAc,EAAE,EAIzC,EAAa,IAAI,UAAU,KAC3B,QAAQ;AACxB,KACE,EACE,6BACA,kDACD,CACF;GAED,IAAM,IAAS,OAAO,SAAS;AAC/B,UAAO,QAAQ,aAAa,EAAE,EAAE,SAAS,OAAO,EAAO;;IAExD,CAAC,GAAc,EAAG,CAAC,EAGtB,QAAgB;AACd,EAAI,MACF,EAAS,mBAAmB;IAE7B,CAAC,IAAa,EAAS,CAAC;CAE3B,IAAM,KAAe,OAAO,MAAuB;AASjD,EARA,EAAE,gBAAgB,EAClB,EAAqB,GAAM,EAC3B,EAAoB,GAAM,EAC1B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAsB,GAAM,EAC5B,EAAiB,GAAM,EACvB,EAAmB,KAAK;EAGxB,IAAM,KAAgB,EAAS,SAAS,IAAI,MAAM;AAClD,MAAI,CAAC,GAAc;AACjB,KACE,EACE,mCACA,sCACD,CACF;AACD;;AAIF,MAAI,EAAa,SAAS,IAAI,IAExB,CADe,6BACH,KAAK,EAAa,EAAE;AAClC,KACE,EAAG,2BAA2B,qCAAqC,CACpE;AACD;;AAIJ,MAAI,CAAC,EAAS,YAAY,EAAS,SAAS,SAAS,GAAG;AACtD,KACE,EAAG,4BAA4B,6BAA6B,CAC7D;AACD;;AAIF,MAAI,KACuB,IAAa,CACG,MACtC,MAAM,EAAE,MAAM,aAAa,KAAK,EAAa,aAAa,CAC5D,EACoB;AAEnB,GADA,EAAsB,GAAK,EAC3B,EAAmB,KAAK;AACxB;;AAGJ,IAAsB,GAAM;AAE5B,MAAI;GAEF,IAAM,IAAiB,MAAM,GAAiB,QAAQ,EAEhD,IAAS,MAAM,GAAO;IAC1B,OAAO;IACP,UAAU,EAAS;IACnB,YAAY,EAAS;IACrB,GAAI,IAAiB,EAAE,mBAAgB,GAAG,EAAE;IAC7C,CAAC;AAGF,OAAI,EAAO,aAAa;IAKtB,IACM,IACF,EAFsB,EAAmB,WAAW,MAGjC,MAAwB,cAAa;AAC5D,QAAI;AACF,oBAAe,QAAQ,IAAc,EAAY;YAC3C;AAIR;;AAIF,OAAI,EAAO,SAAS;AAClB,QAAI;KACF,IAAM,IAAY,EAAO,MAAM;AAC/B,SAAI,GAAW;MAEb,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IACJ,OAAO,SAAS,aAAa,WAAW,aAAa,IACjD,IAAW,KAAK,UAAU;OAC9B,IAAI;OACJ,QAAQ,OAAO,SAAS;OACzB,CAAC;AAEF,MADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;;YAE7G;AAKR,QAAI;AACF,KAAI,EAAS,aACX,aAAa,QAAQ,oBAAoB,EAAa,GAEtD,aAAa,WAAW,mBAAmB;aAEtC,GAAO;AACd,aAAQ,KACN,sDACA,EACD;;AAGH,OAAoB,GAAK;IAEzB,IACM,IACF,EAFsB,EAAmB,WAAW,MAGjC,MAAwB,cAAa;AAC5D,QAAI;KAGF,IAAM,IAAiB,MAAM,QAAQ,KAAqB,CACxD,GAAiB,EAAO,MAAM,EAC9B,IAAI,SAAyB,MAAY;AACvC,aAAO,iBAAiB;AACtB,SAAQ;QACN,SAAS;QACT,OAAO;QACR,CAAC;SACD,IAAK;OACR,CACH,CAAC;AAEF,KAAI,EAAe,WAGb,EAAe,cACjB,EAAa,EAAe,UAAU,GAAG,EACrC,EAAe,UAAU,kBAC3B,GAAgB,EAAe,UAAU,eAAe,GAK5D,EAAmB,EAAc,IACxB,EAAe,OAAO,SAAS,sBAAsB,GAE9D,EAAS,+BAA+B,IAGpC,EAAe,cACjB,EAAa,EAAe,UAAU,GAAG,EACrC,EAAe,UAAU,kBAC3B,GAAgB,EAAe,UAAU,eAAe,GAG5D,QAAQ,KAAK,sBAAsB,EAAe,MAAM,EACxD,EAAmB,EAAc;aAE5B,GAAe;AAGtB,KADA,QAAQ,MAAM,sCAAsC,EAAc,EAClE,EAAmB,EAAc;cACzB;AAKR,KAAK,EAAqB,WACxB,GAAoB,GAAM;;;WAIzB,GAAK;GAKZ,IAAM,IAAW,aAAe,QAAQ,EAAI,UAAU,OAAO,EAAI;AACjE,GAAI,EAAS,SAAS,YAAY,IAChC,EAAmB,EAAS;GAE9B,IAAM,IAAiB,EAAa,UAAU,CAAC,WACzC,IAAY,GAAe,GAAU,EAAe;AAC1D,GAAI,MAAc,YAChB,EAAoB,GAAK,GAChB,MAAc,cACvB,EAAsB,GAAK,GAClB,MAAc,eACvB,EAAsB,GAAK,GAClB,MAAc,aACvB,EAAqB,GAAK,GACjB,MAAc,wBACvB,EAAsB,GAAK;;;AAMjC,SAAgB;AACd,MAAI,GAAO;GACT,IAAM,IAAY,GAAe,GAAO,EAAU;AAClD,GAAI,MAAc,YAChB,EAAoB,GAAK,GAChB,MAAc,cACvB,EAAsB,GAAK,GAClB,MAAc,eACvB,EAAsB,GAAK,GAClB,MAAc,aACvB,EAAqB,GAAK,GACjB,MAAc,wBACvB,EAAsB,GAAK;;IAG9B,CAAC,GAAO,EAAU,CAAC;CAKtB,IAAM,WAA0B;AAC9B,IAAc,KAAK;AACnB,MAAI;AACF,OAAqB;WACd,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,iCACA,oCACD,CACN;;IAOC,WAA6B;AACjC,IAAc,KAAK;AACnB,MAAI;AACF,OAAwB;WACjB,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,oCACA,uCACD,CACN;;IAOC,KAA2B,YAAY;AAE3C,EADA,GAA2B,GAAK,EAChC,EAAiB,GAAM;AACvB,MAAI;AAGF,IADe,MAAM,IADC,EAAS,SAAS,IAAI,MAAM,CACG,EAC1C,UACT,EAAiB,GAAK,GAEtB,EACE,EACE,2BACA,yDACD,CACF;WAEI,GAAK;AAEZ,GADA,QAAQ,MAAM,wCAAwC,EAAI,EAC1D,EACE,aAAe,QACX,EAAI,UACJ,EACE,2BACA,yDACD,CACN;YACO;AACR,MAA2B,GAAM;;IAK/B,KAAqB,EAAqB,SAAS,EACnD,IAAwB,EAAqB,YAAY,EAEzD,KAAiB,CACrB;EACE,MAAM;EACN,MAAM;EACN,SAAS;EACT,UAAU,CAAC;EACX,SAAS,KACL,KAAA,IACA,EACE,kCACA,mCACD;EACN,EAWD;EACE,MAAM;EACN,MAAM;EACN,SAAS;EACT,UAAU,CAAC;EACX,SAAS,IACL,KAAA,IACA,EACE,qCACA,sCACD;EACN,CACF;AAMD,QAJI,KACK,kBAAC,IAAD,EAAsB,CAAA,GAI7B,kBAAC,GAAD;EACE,OAAO,EAAG,0BAA0B,eAAe;EACnD,UAAU,EACR,+BACA,qCACD;YALH;GAOE,kBAAC,IAAD;IAAa,WAAU;cACpB,EACC,sBACA,wIACD;IACW,CAAA;GACd,kBAAC,QAAD;IAAM,UAAU;IAAc,WAAU;cAAxC;KAEG,MACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;iBAEP,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,EACN,kBAAC,KAAD;OAAG,WAAU;iBAAiC;OAAgB,CAAA,CAC1D;;KAIP,KACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,wDAAyD,CAAA,EAC9E,kBAAC,KAAD;OAAG,WAAU;iBACV;OACC,CAAA,CACA;;KAIP,MACC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,wDAAyD,CAAA,EAC9E,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,KAAD;SAAG,WAAU;mBACV,EACC,+BACA,qCACD;SACC,CAAA;QACJ,kBAAC,KAAD;SAAG,WAAU;mBACV,EACC,mCACA,+FACD;SACC,CAAA;SACF,EAAmB,WAAW,MAC9B,kBAAC,UAAD;SACE,MAAK;SACL,eACE,EACE,mBACE,EAAmB,WAAW,KAAY,aAC3C,CACF;SAEH,WAAU;mBATZ,CAWE,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;oBAEP,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,aAAa;WACb,GAAE;WACF,CAAA;UACE,CAAA,EACL,EACC,kCACA,6BACD,CACM;;QAEP;SACF;;KAIP,KAAS,CAAC,KAAmB,CAAC,MAC7B,kBAAC,OAAD;MACE,WAAW,gDACT,KAAqB,KAAsB,IACvC,6DACA;gBAJR,CAOE,kBAAC,GAAD,EACE,WAAW,+BACT,KAAqB,KAAsB,IACvC,6BACA,4BAEN,CAAA,EACF,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,KAAD;SACE,WAAW,WACT,KAAqB,KAAsB,IACvC,6BACA;mBAGL,KACG,EACE,6BACA,qEACD,GACD,KACE,EACE,+BACA,0EACD,GACD,IACE,EACE,iCACA,qCACD,GACD,IACE,EACE,wBACA,8EACD,GACD,IACE,EACE,+BACA,0FACD,GACD;SACV,CAAA;QACH,KACC,kBAAC,UAAD;SACE,MAAK;SACL,eACE,EAAS,oBAAoB,EAC3B,OAAO,EAAE,OAAO,EAAS,OAAO,EACjC,CAAC;SAEJ,WAAU;mBAET,EACC,8BACA,wCACD;SACM,CAAA;QAEV,KACC,kBAAC,OAAD;SAAK,WAAU;mBACZ,KACC,kBAAC,OAAD;UAAK,WAAU;oBAAf,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;qBAEP,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;YACF,CAAA;WACE,CAAA,EACL,EACC,+BACA,oDACD,CACG;cAEN,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,UAAU;UACV,WAAU;oBAET,KACC,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,GAAD,EAAa,WAAU,uBAAwB,CAAA,EAC9C,EAAG,sBAAsB,aAAa,CACtC,EAAA,CAAA,GAEH,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,OAAD;WACE,WAAU;WACV,MAAK;WACL,SAAQ;WACR,QAAO;qBAEP,kBAAC,QAAD;YACE,eAAc;YACd,gBAAe;YACf,aAAa;YACb,GAAE;YACF,CAAA;WACE,CAAA,EACL,EACC,iCACA,4BACD,CACA,EAAA,CAAA;UAEE,CAAA;SAEP,CAAA;QAEP,KACC,kBAAC,OAAD;SAAK,WAAU;mBAAf,CACG,EAAqB,SAAS,IAC7B,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,WAAU;oBAHZ,CAKE,kBAAC,IAAD,EAAY,WAAU,UAAW,CAAA,EAChC,EAAG,+BAA+B,sBAAsB,CAClD;aAEV,EAAqB,YAAY,IAChC,kBAAC,UAAD;UACE,MAAK;UACL,SAAS;UACT,WAAU;oBAHZ,CAKE,kBAAC,GAAD,EAAe,WAAU,UAAW,CAAA,EACnC,EACC,kCACA,yBACD,CACM;YAEP;;QAEJ;SACF;;KAIR,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,yBAAyB,QAAQ;OAC/B,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAW,WAAU,4CAA6C,CAAA;QAC9D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,cAAa;QACb,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,yBAAyB,QAAQ;QAChD,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,OAAO,EAAE,OAAO;SAAO,CAAC;QAErD,WAAU;QACV,aAAa,EAAG,+BAA+B,kBAAkB;QACjE,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,4BAA4B,WAAW;OACrC,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,OAAD;SAAK,WAAU;mBACb,kBAAC,IAAD,EAAU,WAAU,4CAA6C,CAAA;SAC7D,CAAA;QACN,kBAAC,SAAD;SACE,IAAG;SACH,MAAM,IAAe,SAAS;SAC9B,cAAa;SACb,UAAA;SACA,iBAAc;SACd,cAAY,EAAG,4BAA4B,WAAW;SACtD,OAAO,EAAS;SAChB,WAAW,MACT,EAAY;UAAE,GAAG;UAAU,UAAU,EAAE,OAAO;UAAO,CAAC;SAExD,WAAU;SACV,aAAa,EACX,kCACA,sBACD;SACD,CAAA;QACF,kBAAC,UAAD;SACE,MAAK;SACL,eAAe,GAAgB,CAAC,EAAa;SAC7C,cAAY,IAAe,kBAAkB;SAC7C,WAAU;mBAGR,EADD,IACE,KAEA,GAFD,EAAY,WAAU,UAAW,CAEH;SAEzB,CAAA;QACL;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OAAO,WAAU;iBAAjB,CACE,kBAAC,OAAD;QAAK,WAAU;kBAAf,CACE,kBAAC,SAAD;SACE,MAAK;SACL,cAAY,EAAG,yBAAyB,cAAc;SACtD,SAAS,EAAS;SAClB,WAAW,MAAM;UACf,IAAM,IAAY,EAAE,OAAO;AAI3B,cAHA,EAAY;WAAE,GAAG;WAAU,YAAY;WAAW,CAAC,EAG/C,CAAC,EACH,KAAI;AACF,wBAAa,WAAW,mBAAmB;mBACpC,GAAO;AACd,mBAAQ,KACN,iDACA,EACD;;;SAIP,WAAU;SACV,CAAA,EACF,kBAAC,OAAD;SAAK,WAAU;mBACb,kBAAC,OAAD;UACE,WAAU;UACV,MAAK;UACL,SAAQ;UACR,QAAO;UACP,aAAa;oBAEb,kBAAC,QAAD;WACE,eAAc;WACd,gBAAe;WACf,GAAE;WACF,CAAA;UACE,CAAA;SACF,CAAA,CACF;WACN,kBAAC,QAAD;QAAM,WAAU;kBACb,EAAG,yBAAyB,cAAc;QACtC,CAAA,CACD;UACR,kBAAC,UAAD;OACE,MAAK;OACL,eAAe,EAAS,uBAAuB;OAC/C,WAAU;iBAET,EAAG,6BAA6B,mBAAmB;OAC7C,CAAA,CACL;;KAGN,kBAAC,IAAD;MACE,MAAK;MACL,UAAU,KAAa;MACvB,SAAQ;MACR,MAAK;MACL,WAAU;gBAET,KAAa,IACZ,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,GAAD,EAAa,WAAU,uBAAwB,CAAA,EAC/C,kBAAC,QAAD,EAAA,UACG,IACG,EACE,iCACA,0BACD,GACD,EAAG,wBAAwB,gBAAgB,EAC1C,CAAA,CACN,EAAA,CAAA,GAEH,EAAG,qBAAqB,UAAU;MAE7B,CAAA;KACJ;;GAGP,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD,EAAK,WAAU,wDAAyD,CAAA;KACpE,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,QAAD;MAAM,WAAU;gBACb,EAAG,6BAA6B,mBAAmB;MAC/C,CAAA;KACH,CAAA,CACF;;GAGL,MACC,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,GAAD,EAAW,WAAU,sDAAuD,CAAA,EAC5E,kBAAC,KAAD;KAAG,WAAU;eAAkC;KAAe,CAAA,CAC1D;;GAIR,kBAAC,OAAD;IAAK,WAAU;cACZ,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAAS,EAAS;KAClB,UAAU,EAAS;KACnB,OAAO,EAAS;KAChB,cAAY,EAAS;KACrB,WAAW,wGACT,EAAS,WACL,oGACA;eAVR,CAaE,kBAAC,EAAS,MAAV,EACE,WAAW,UAAU,EAAS,WAAW,eAAe,MACxD,CAAA,EACF,kBAAC,QAAD;MACE,WAAW,gEACT,EAAS,WACL,sCACA;gBAGL,EAAS;MACL,CAAA,CACA;OAxBF,EAAS,KAwBP,CACT;IACE,CAAA;GA4BN,kBAAC,OAAD;IAAK,WAAU;cACb,kBAAC,UAAD;KACE,MAAK;KACL,eAAe,EAAS,mBAAmB;KAC3C,WAAU;eAHZ;MAKG,EAAG,iCAAiC,6BAA6B;MAAE;MACpE,kBAAC,QAAD;OAAM,WAAU;iBACb,EAAG,8BAA8B,0BAA0B;OACvD,CAAA;MACA;;IACL,CAAA;GAGN,kBAAC,KAAD;IAAG,WAAU;cAAb;KACG,EAAG,8BAA8B,yBAAyB;KAAE;KAC7D,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAS,iBAAiB;MACzC,WAAU;gBAET,EAAG,qBAAqB,UAAU;MAC5B,CAAA;KACP;;GACO"}

package/dist/auth/utils/index.d.ts

@@ -1,2 +1,3 @@
 export * from './validation';
 export * from './formatters';
+export * from './redirect';

package/dist/auth/utils/redirect.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Redirect helpers for the post-login flow.
+ *
+ * Keeps redirect-sanitization logic pure and unit-testable so the login page
+ * cannot accidentally redirect back into an auth route (BOFF-6807).
+ */
+/**
+ * Ensure the post-login destination never lands back on an auth route.
+ * Falls back to `/dashboard` when the supplied path is empty, "/", or an
+ * `/auth/*` path.
+ */
+export declare function sanitizePostLoginPath(path: string): string;

package/dist/auth/utils/redirect.js

@@ -0,0 +1,16 @@
+//#region src/auth/utils/redirect.ts
+function e(e) {
+	if (typeof window > "u") return !1;
+	try {
+		return new URL(e, window.location.origin).pathname.startsWith("/auth");
+	} catch {
+		return !1;
+	}
+}
+function t(t) {
+	return typeof window > "u" ? t : !t || t === "/" || e(t) ? "/dashboard" : t;
+}
+//#endregion
+export { t as sanitizePostLoginPath };
+
+//# sourceMappingURL=redirect.js.map

package/dist/auth/utils/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","names":[],"sources":["../../../src/auth/utils/redirect.ts"],"sourcesContent":["/**\n * Redirect helpers for the post-login flow.\n *\n * Keeps redirect-sanitization logic pure and unit-testable so the login page\n * cannot accidentally redirect back into an auth route (BOFF-6807).\n */\n\nfunction isAuthRoutePath(path: string): boolean {\n  if (typeof window === \"undefined\") return false;\n  try {\n    const url = new URL(path, window.location.origin);\n    return url.pathname.startsWith(\"/auth\");\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Ensure the post-login destination never lands back on an auth route.\n * Falls back to `/dashboard` when the supplied path is empty, \"/\", or an\n * `/auth/*` path.\n */\nexport function sanitizePostLoginPath(path: string): string {\n  if (typeof window === \"undefined\") return path;\n  if (!path || path === \"/\" || isAuthRoutePath(path)) {\n    return \"/dashboard\";\n  }\n  return path;\n}\n"],"mappings":";AAOA,SAAS,EAAgB,GAAuB;AAC9C,KAAI,OAAO,SAAW,IAAa,QAAO;AAC1C,KAAI;AAEF,SADY,IAAI,IAAI,GAAM,OAAO,SAAS,OAAO,CACtC,SAAS,WAAW,QAAQ;SACjC;AACN,SAAO;;;AASX,SAAgB,EAAsB,GAAsB;AAK1D,QAJI,OAAO,SAAW,MAAoB,IACtC,CAAC,KAAQ,MAAS,OAAO,EAAgB,EAAK,GACzC,eAEF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.825.1",
+  "version": "2026.828.1",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {
@@ -36,7 +36,10 @@
     "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
     "format": "prettier --write \"src/**/*.{ts,tsx}\"",
     "type:check": "bash scripts/build-limits.sh tsc --noEmit",
-    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run codegen && bun run lint:sanity && bun run format && bun run type:check && bun run build'",
+    "test": "bash scripts/build-limits.sh vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "bash scripts/build-limits.sh vitest run --coverage",
+    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run codegen && bun run lint:sanity && bun run format && bun run type:check && bun run test && bun run build'",
     "switch:status": "bun scripts/deps-mode.ts status",
     "switch:remote": "bun scripts/deps-mode.ts remote",
     "switch:local": "bun scripts/deps-mode.ts local",
@@ -63,6 +66,9 @@
   "devDependencies": {
     "@eslint/js": "^9.39.1",
     "@graphql-codegen/add": "^6.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "jsdom": "^25.0.1",
+    "vitest": "^3.2.4",
     "@graphql-codegen/cli": "^5.0.0",
     "@graphql-codegen/import-types-preset": "^3.0.1",
     "@graphql-codegen/schema-ast": "^5.0.0",