@camstack/addon-auth 1.2.147 → 1.2.149

package/dist/webauthn/_stub.js

@@ -1,12 +1,12 @@
 import { n as e, r as t, t as n } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react__loadShare__.js-BIIa6vDX.mjs";
 import { n as r, t as i } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-CQ-aEQ9b.mjs";
-import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-C_j9tv24.mjs";
-import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
+import { n as a, t as o } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-BpOR-FRf.mjs";
+import { n as s, r as c, t as l } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
-var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), u = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), d = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), f = (e) => {
-	let t = d(e);
+var u = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), d = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), f = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), p = (e) => {
+	let t = f(e);
 	return t.charAt(0).toUpperCase() + t.slice(1);
-}, p = {
+}, m = {
 	xmlns: "http://www.w3.org/2000/svg",
 	width: 24,
 	height: 24,
@@ -16,28 +16,28 @@ var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) =
 	strokeWidth: 2,
 	strokeLinecap: "round",
 	strokeLinejoin: "round"
-}, m = (e) => {
+}, h = (e) => {
 	for (let t in e) if (t.startsWith("aria-") || t === "role" || t === "title") return !0;
 	return !1;
-}, h = e(({ color: e = "currentColor", size: t = 24, strokeWidth: r = 2, absoluteStrokeWidth: i, className: a = "", children: o, iconNode: s, ...c }, u) => n("svg", {
-	ref: u,
-	...p,
+}, g = e(({ color: e = "currentColor", size: t = 24, strokeWidth: r = 2, absoluteStrokeWidth: i, className: a = "", children: o, iconNode: s, ...c }, l) => n("svg", {
+	ref: l,
+	...m,
 	width: t,
 	height: t,
 	stroke: e,
 	strokeWidth: i ? Number(r) * 24 / Number(t) : r,
-	className: l("lucide", a),
-	...!o && !m(c) && { "aria-hidden": "true" },
+	className: u("lucide", a),
+	...!o && !h(c) && { "aria-hidden": "true" },
 	...c
-}, [...s.map(([e, t]) => n(e, t)), ...Array.isArray(o) ? o : [o]])), g = (t, r) => {
-	let i = e(({ className: e, ...i }, a) => n(h, {
+}, [...s.map(([e, t]) => n(e, t)), ...Array.isArray(o) ? o : [o]])), _ = (t, r) => {
+	let i = e(({ className: e, ...i }, a) => n(g, {
 		ref: a,
 		iconNode: r,
-		className: l(`lucide-${u(f(t))}`, `lucide-${t}`, e),
+		className: u(`lucide-${d(p(t))}`, `lucide-${t}`, e),
 		...i
 	}));
-	return i.displayName = f(t), i;
-}, _ = g("circle-alert", [
+	return i.displayName = p(t), i;
+}, v = _("circle-alert", [
 	["circle", {
 		cx: "12",
 		cy: "12",
@@ -58,7 +58,7 @@ var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) =
 		y2: "16",
 		key: "4dfq90"
 	}]
-]), v = g("fingerprint-pattern", [
+]), y = _("fingerprint-pattern", [
 	["path", {
 		d: "M12 10a2 2 0 0 0-2 2c0 1.02-.1 2.51-.26 4",
 		key: "1nerag"
@@ -95,7 +95,7 @@ var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) =
 		d: "M9 6.8a6 6 0 0 1 9 5.2v2",
 		key: "1fr1j5"
 	}]
-]), y = g("key-round", [["path", {
+]), b = _("key-round", [["path", {
 	d: "M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z",
 	key: "1s6t7t"
 }], ["circle", {
@@ -104,10 +104,10 @@ var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) =
 	r: ".5",
 	fill: "currentColor",
 	key: "w0ekpg"
-}]]), b = g("loader-circle", [["path", {
+}]]), x = _("loader-circle", [["path", {
 	d: "M21 12a9 9 0 1 1-6.219-8.56",
 	key: "13zald"
-}]]), x = g("trash-2", [
+}]]), S = _("trash-2", [
 	["path", {
 		d: "M10 11v6",
 		key: "nco0om"
@@ -131,105 +131,105 @@ var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) =
 ]);
 //#endregion
 //#region ../../node_modules/@simplewebauthn/browser/dist/bundle/index.js
-function S(e) {
+function C(e) {
 	let t = new Uint8Array(e), n = "";
 	for (let e of t) n += String.fromCharCode(e);
 	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function C(e) {
+function w(e) {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = (4 - t.length % 4) % 4, r = t.padEnd(t.length + n, "="), i = atob(r), a = new ArrayBuffer(i.length), o = new Uint8Array(a);
 	for (let e = 0; e < i.length; e++) o[e] = i.charCodeAt(e);
 	return a;
 }
-function w() {
+function T() {
 	return window?.PublicKeyCredential !== void 0 && typeof window.PublicKeyCredential == "function";
 }
-function T(e) {
+function E(e) {
 	let { id: t } = e;
 	return {
 		...e,
-		id: C(t),
+		id: w(t),
 		transports: e.transports
 	};
 }
-function E(e) {
+function D(e) {
 	return e === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e);
 }
-var D = class extends Error {
+var O = class extends Error {
 	constructor({ message: e, code: t, cause: n, name: r }) {
 		super(e, { cause: n }), this.name = r ?? n.name, this.code = t;
 	}
 };
-function O({ error: e, options: t }) {
+function k({ error: e, options: t }) {
 	let { publicKey: n } = t;
 	if (!n) throw Error("options was missing required publicKey property");
 	if (e.name === "AbortError") {
-		if (t.signal instanceof AbortSignal) return new D({
+		if (t.signal instanceof AbortSignal) return new O({
 			message: "Registration ceremony was sent an abort signal",
 			code: "ERROR_CEREMONY_ABORTED",
 			cause: e
 		});
 	} else if (e.name === "ConstraintError") {
-		if (n.authenticatorSelection?.requireResidentKey === !0) return new D({
+		if (n.authenticatorSelection?.requireResidentKey === !0) return new O({
 			message: "Discoverable credentials were required but no available authenticator supported it",
 			code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
 			cause: e
 		});
-		if (t.mediation === "conditional" && n.authenticatorSelection?.userVerification === "required") return new D({
+		if (t.mediation === "conditional" && n.authenticatorSelection?.userVerification === "required") return new O({
 			message: "User verification was required during automatic registration but it could not be performed",
 			code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
 			cause: e
 		});
-		if (n.authenticatorSelection?.userVerification === "required") return new D({
+		if (n.authenticatorSelection?.userVerification === "required") return new O({
 			message: "User verification was required but no available authenticator supported it",
 			code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
 			cause: e
 		});
-	} else if (e.name === "InvalidStateError") return new D({
+	} else if (e.name === "InvalidStateError") return new O({
 		message: "The authenticator was previously registered",
 		code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
 		cause: e
 	});
-	else if (e.name === "NotAllowedError") return new D({
+	else if (e.name === "NotAllowedError") return new O({
 		message: e.message,
 		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
 		cause: e
 	});
-	else if (e.name === "NotSupportedError") return n.pubKeyCredParams.filter((e) => e.type === "public-key").length === 0 ? new D({
+	else if (e.name === "NotSupportedError") return n.pubKeyCredParams.filter((e) => e.type === "public-key").length === 0 ? new O({
 		message: "No entry in pubKeyCredParams was of type \"public-key\"",
 		code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
 		cause: e
-	}) : new D({
+	}) : new O({
 		message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
 		code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
 		cause: e
 	});
 	else if (e.name === "SecurityError") {
 		let t = window.location.hostname;
-		if (!E(t)) return new D({
+		if (!D(t)) return new O({
 			message: `${window.location.hostname} is an invalid domain`,
 			code: "ERROR_INVALID_DOMAIN",
 			cause: e
 		});
-		if (n.rp.id !== t) return new D({
+		if (n.rp.id !== t) return new O({
 			message: `The RP ID "${n.rp.id}" is invalid for this domain`,
 			code: "ERROR_INVALID_RP_ID",
 			cause: e
 		});
 	} else if (e.name === "TypeError") {
-		if (n.user.id.byteLength < 1 || n.user.id.byteLength > 64) return new D({
+		if (n.user.id.byteLength < 1 || n.user.id.byteLength > 64) return new O({
 			message: "User ID was not between 1 and 64 characters",
 			code: "ERROR_INVALID_USER_ID_LENGTH",
 			cause: e
 		});
-	} else if (e.name === "UnknownError") return new D({
+	} else if (e.name === "UnknownError") return new O({
 		message: "The authenticator was unable to process the specified options, or could not create a new credential",
 		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
 		cause: e
 	});
 	return e;
 }
-var k = new class {
+var A = new class {
 	createNewAbortSignal() {
 		if (this.controller) {
 			let e = /* @__PURE__ */ Error("Cancelling existing WebAuthn API call for new one");
@@ -244,28 +244,28 @@ var k = new class {
 			e.name = "AbortError", this.controller.abort(e), this.controller = void 0;
 		}
 	}
-}(), A = ["cross-platform", "platform"];
-function j(e) {
-	if (e && !(A.indexOf(e) < 0)) return e;
+}(), j = ["cross-platform", "platform"];
+function M(e) {
+	if (e && !(j.indexOf(e) < 0)) return e;
 }
-async function M(e) {
+async function N(e) {
 	let { optionsJSON: t, useAutoRegister: n = !1 } = e;
-	if (!w()) throw Error("WebAuthn is not supported in this browser");
+	if (!T()) throw Error("WebAuthn is not supported in this browser");
 	let r = {
 		...t,
-		challenge: C(t.challenge),
+		challenge: w(t.challenge),
 		user: {
 			...t.user,
-			id: C(t.user.id)
+			id: w(t.user.id)
 		},
-		excludeCredentials: t.excludeCredentials?.map(T)
+		excludeCredentials: t.excludeCredentials?.map(E)
 	}, i = {};
-	n && (i.mediation = "conditional"), i.publicKey = r, i.signal = k.createNewAbortSignal();
+	n && (i.mediation = "conditional"), i.publicKey = r, i.signal = A.createNewAbortSignal();
 	let a;
 	try {
 		a = await navigator.credentials.create(i);
 	} catch (e) {
-		throw O({
+		throw k({
 			error: e,
 			options: i
 		});
@@ -277,27 +277,27 @@ async function M(e) {
 	if (typeof c.getPublicKeyAlgorithm == "function") try {
 		d = c.getPublicKeyAlgorithm();
 	} catch (e) {
-		N("getPublicKeyAlgorithm()", e);
+		P("getPublicKeyAlgorithm()", e);
 	}
 	let f;
 	if (typeof c.getPublicKey == "function") try {
 		let e = c.getPublicKey();
-		e !== null && (f = S(e));
+		e !== null && (f = C(e));
 	} catch (e) {
-		N("getPublicKey()", e);
+		P("getPublicKey()", e);
 	}
 	let p;
 	if (typeof c.getAuthenticatorData == "function") try {
-		p = S(c.getAuthenticatorData());
+		p = C(c.getAuthenticatorData());
 	} catch (e) {
-		N("getAuthenticatorData()", e);
+		P("getAuthenticatorData()", e);
 	}
 	return {
 		id: o,
-		rawId: S(s),
+		rawId: C(s),
 		response: {
-			attestationObject: S(c.attestationObject),
-			clientDataJSON: S(c.clientDataJSON),
+			attestationObject: C(c.attestationObject),
+			clientDataJSON: C(c.clientDataJSON),
 			transports: u,
 			publicKeyAlgorithm: d,
 			publicKey: f,
@@ -305,139 +305,231 @@ async function M(e) {
 		},
 		type: l,
 		clientExtensionResults: a.getClientExtensionResults(),
-		authenticatorAttachment: j(a.authenticatorAttachment)
+		authenticatorAttachment: M(a.authenticatorAttachment)
 	};
 }
-function N(e, t) {
+function P(e, t) {
 	console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.\n`, t);
 }
-function P() {
-	if (!w()) return new Promise((e) => e(!1));
+function F() {
+	if (!T()) return new Promise((e) => e(!1));
 	let e = window.PublicKeyCredential;
 	return e.isConditionalMediationAvailable === void 0 ? new Promise((e) => e(!1)) : e.isConditionalMediationAvailable();
 }
-function F({ error: e, options: t }) {
+function I({ error: e, options: t }) {
 	let { publicKey: n } = t;
 	if (!n) throw Error("options was missing required publicKey property");
 	if (e.name === "AbortError") {
-		if (t.signal instanceof AbortSignal) return new D({
+		if (t.signal instanceof AbortSignal) return new O({
 			message: "Authentication ceremony was sent an abort signal",
 			code: "ERROR_CEREMONY_ABORTED",
 			cause: e
 		});
-	} else if (e.name === "NotAllowedError") return new D({
+	} else if (e.name === "NotAllowedError") return new O({
 		message: e.message,
 		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
 		cause: e
 	});
 	else if (e.name === "SecurityError") {
 		let t = window.location.hostname;
-		if (!E(t)) return new D({
+		if (!D(t)) return new O({
 			message: `${window.location.hostname} is an invalid domain`,
 			code: "ERROR_INVALID_DOMAIN",
 			cause: e
 		});
-		if (n.rpId !== t) return new D({
+		if (n.rpId !== t) return new O({
 			message: `The RP ID "${n.rpId}" is invalid for this domain`,
 			code: "ERROR_INVALID_RP_ID",
 			cause: e
 		});
-	} else if (e.name === "UnknownError") return new D({
+	} else if (e.name === "UnknownError") return new O({
 		message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
 		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
 		cause: e
 	});
 	return e;
 }
-async function I(e) {
+async function L(e) {
 	let { optionsJSON: t, useBrowserAutofill: n = !1, verifyBrowserAutofillInput: r = !0 } = e;
-	if (!w()) throw Error("WebAuthn is not supported in this browser");
+	if (!T()) throw Error("WebAuthn is not supported in this browser");
 	let i;
-	t.allowCredentials?.length !== 0 && (i = t.allowCredentials?.map(T));
+	t.allowCredentials?.length !== 0 && (i = t.allowCredentials?.map(E));
 	let a = {
 		...t,
-		challenge: C(t.challenge),
+		challenge: w(t.challenge),
 		allowCredentials: i
 	}, o = {};
 	if (n) {
-		if (!await P()) throw Error("Browser does not support WebAuthn autofill");
+		if (!await F()) throw Error("Browser does not support WebAuthn autofill");
 		if (document.querySelectorAll("input[autocomplete$='webauthn']").length < 1 && r) throw Error("No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected");
 		o.mediation = "conditional", a.allowCredentials = [];
 	}
-	o.publicKey = a, o.signal = k.createNewAbortSignal();
+	o.publicKey = a, o.signal = A.createNewAbortSignal();
 	let s;
 	try {
 		s = await navigator.credentials.get(o);
 	} catch (e) {
-		throw F({
+		throw I({
 			error: e,
 			options: o
 		});
 	}
 	if (!s) throw Error("Authentication was not completed");
 	let { id: c, rawId: l, response: u, type: d } = s, f;
-	return u.userHandle && (f = S(u.userHandle)), {
+	return u.userHandle && (f = C(u.userHandle)), {
 		id: c,
-		rawId: S(l),
+		rawId: C(l),
 		response: {
-			authenticatorData: S(u.authenticatorData),
-			clientDataJSON: S(u.clientDataJSON),
-			signature: S(u.signature),
+			authenticatorData: C(u.authenticatorData),
+			clientDataJSON: C(u.clientDataJSON),
+			signature: C(u.signature),
 			userHandle: f
 		},
 		type: d,
 		clientExtensionResults: s.getClientExtensionResults(),
-		authenticatorAttachment: j(s.authenticatorAttachment)
+		authenticatorAttachment: M(s.authenticatorAttachment)
 	};
 }
 //#endregion
 //#region src/webauthn/widgets/passkey-ceremony.ts
-function L() {
-	return w();
+function R() {
+	return T();
+}
+function z(e) {
+	return {
+		...e,
+		challenge: e.challenge
+	};
 }
-async function R(e) {
-	let t = await I({ optionsJSON: e });
+function B(e) {
+	return {
+		...e,
+		challenge: e.challenge
+	};
+}
+async function V(e) {
+	if (typeof e.challenge != "string") throw Error("passkey authentication options missing challenge");
+	let t = await L({ optionsJSON: z(e) });
 	return Object.fromEntries(Object.entries(t));
 }
-async function z(e) {
-	let t = await M({ optionsJSON: e });
+async function H(e) {
+	if (typeof e.challenge != "string") throw Error("passkey registration options missing challenge");
+	let t = await N({ optionsJSON: B(e) });
 	return Object.fromEntries(Object.entries(t));
 }
 //#endregion
+//#region src/i18n/index.ts
+var { useT: U } = a("auth-webauthn", {
+	en: {
+		directLogin: {
+			requiresCallback: "Passkey direct-login widget requires an onComplete callback.",
+			signInWithPasskey: "Sign in with a passkey",
+			unsupported: "This browser does not support passkeys.",
+			failed: "Passkey sign-in failed",
+			secondFactorRequired: "Additional verification is required — sign in with your password to continue."
+		},
+		login: {
+			requiresChallenge: "Passkey login widget requires a challengeToken + onComplete callback.",
+			unsupported: "This browser does not support passkeys.",
+			verificationFailed: "Passkey verification failed",
+			usePasskey: "Use a passkey"
+		},
+		enrollment: {
+			title: "Passkeys",
+			intro: "Add a passkey (Touch ID, Windows Hello, or a security key) to sign in directly — fast and phishing-resistant, no password needed.",
+			loading: "Loading passkeys…",
+			addedUsed: "Added {{added}} · last used {{used}}",
+			addedNever: "Added {{added}} · never used",
+			currentPassword: "Current password",
+			passwordToConfirm: "Password to confirm",
+			remove: "Remove",
+			usePasskey: "Use a passkey",
+			none: "No passkeys enrolled yet.",
+			secondFactorTitle: "Require passkey as second factor",
+			secondFactorHint: "Also ask for a passkey after every password sign-in. Off by default — enrolling a passkey on its own only enables direct passkey sign-in.",
+			passkeyName: "Passkey name",
+			namePlaceholder: "e.g. MacBook Touch ID",
+			enrolling: "Enrolling…",
+			addPasskey: "Add passkey",
+			unnamedDevice: "Unnamed device",
+			preferenceFailed: "Could not update the preference",
+			enrollFailed: "Passkey enrollment failed",
+			removeFailed: "Remove failed"
+		}
+	},
+	it: {
+		directLogin: {
+			requiresCallback: "Il widget di accesso diretto con passkey richiede una callback onComplete.",
+			signInWithPasskey: "Accedi con una passkey",
+			unsupported: "Questo browser non supporta le passkey.",
+			failed: "Accesso con passkey non riuscito",
+			secondFactorRequired: "È richiesta una verifica aggiuntiva — accedi con la password per continuare."
+		},
+		login: {
+			requiresChallenge: "Il widget di accesso con passkey richiede un challengeToken e una callback onComplete.",
+			unsupported: "Questo browser non supporta le passkey.",
+			verificationFailed: "Verifica della passkey non riuscita",
+			usePasskey: "Usa una passkey"
+		},
+		enrollment: {
+			title: "Passkey",
+			intro: "Aggiungi una passkey (Touch ID, Windows Hello o una chiave di sicurezza) per accedere direttamente: veloce, resistente al phishing e senza password.",
+			loading: "Caricamento passkey…",
+			addedUsed: "Aggiunta il {{added}} · ultimo utilizzo {{used}}",
+			addedNever: "Aggiunta il {{added}} · mai utilizzata",
+			currentPassword: "Password attuale",
+			passwordToConfirm: "Password per confermare",
+			remove: "Rimuovi",
+			usePasskey: "Usa una passkey",
+			none: "Nessuna passkey registrata.",
+			secondFactorTitle: "Richiedi la passkey come secondo fattore",
+			secondFactorHint: "Chiedi una passkey anche dopo ogni accesso con password. Disattivato per impostazione predefinita: registrare una passkey abilita soltanto l'accesso diretto con passkey.",
+			passkeyName: "Nome della passkey",
+			namePlaceholder: "es. MacBook Touch ID",
+			enrolling: "Registrazione…",
+			addPasskey: "Aggiungi passkey",
+			unnamedDevice: "Dispositivo senza nome",
+			preferenceFailed: "Impossibile aggiornare la preferenza",
+			enrollFailed: "Registrazione della passkey non riuscita",
+			removeFailed: "Rimozione non riuscita"
+		}
+	}
+});
+//#endregion
 //#region src/webauthn/widgets/PasskeyEnrollment.tsx
-function B(e) {
-	let n = a(), l = r({
+function W(e) {
+	let n = o(), { t: a, lang: u } = U(), d = r({
 		queryKey: ["auth", "listOwnPasskeys"],
 		queryFn: () => n.listOwnPasskeys()
-	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = r({
+	}), f = d.data ?? [], [p, m] = t(""), [h, g] = t(!1), [_, C] = t(null), w = r({
 		queryKey: ["auth", "getOwnPasskeySecondFactorPreference"],
 		queryFn: () => n.getOwnPasskeySecondFactorPreference(),
-		enabled: u.length > 0
-	}), C = S.data?.enabled ?? !1, w = i({
+		enabled: f.length > 0
+	}), T = w.data?.enabled ?? !1, E = i({
 		mutationFn: (e) => n.setOwnPasskeySecondFactorPreference({ enabled: e }),
 		onSuccess: () => {
-			g(null), S.refetch();
+			C(null), w.refetch();
 		},
-		onError: (e) => g(e instanceof Error ? e.message : "Could not update the preference")
-	}), T = async () => {
-		g(null), m(!0);
+		onError: (e) => C(e instanceof Error ? e.message : a("enrollment.preferenceFailed"))
+	}), D = async () => {
+		C(null), g(!0);
 		try {
-			let e = await z((await n.beginOwnPasskeyRegistration()).optionsJSON);
+			let e = await H((await n.beginOwnPasskeyRegistration()).optionsJSON);
 			await n.finishOwnPasskeyRegistration({
 				response: e,
-				label: d.trim() || "Unnamed device"
-			}), f(""), l.refetch();
+				label: p.trim() || a("enrollment.unnamedDevice")
+			}), m(""), d.refetch();
 		} catch (e) {
-			g(e instanceof Error ? e.message : "Passkey enrollment failed");
+			C(e instanceof Error ? e.message : a("enrollment.enrollFailed"));
 		} finally {
-			m(!1);
+			g(!1);
 		}
-	}, [E, D] = t(null), [O, k] = t(""), A = i({
+	}, [O, k] = t(null), [A, j] = t(""), M = i({
 		mutationFn: async (e) => {
 			let t;
 			if ("password" in e.proof) t = (await n.reauthenticate({ password: e.proof.password })).reauthToken;
 			else {
-				let { optionsJSON: e } = await n.reauthBeginPasskey(), r = await R(e);
+				let { optionsJSON: e } = await n.reauthBeginPasskey(), r = await V(e);
 				t = (await n.reauthenticate({ passkeyResponse: r })).reauthToken;
 			}
 			return n.removeOwnPasskey({
@@ -446,142 +538,141 @@ function B(e) {
 			});
 		},
 		onSuccess: () => {
-			g(null), D(null), k(""), l.refetch();
+			C(null), k(null), j(""), d.refetch();
 		},
-		onError: (e) => g(e instanceof Error ? e.message : "Remove failed")
+		onError: (e) => C(e instanceof Error ? e.message : a("enrollment.removeFailed"))
 	});
-	return /* @__PURE__ */ s("div", {
+	return /* @__PURE__ */ c("div", {
 		className: "rounded-lg border border-border bg-surface overflow-hidden",
-		children: [/* @__PURE__ */ s("div", {
+		children: [/* @__PURE__ */ c("div", {
 			className: "px-4 py-2.5 border-b border-border flex items-center gap-2",
-			children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5 text-foreground-subtle" }), /* @__PURE__ */ o("div", {
+			children: [/* @__PURE__ */ s(y, { className: "h-3.5 w-3.5 text-foreground-subtle" }), /* @__PURE__ */ s("div", {
 				className: "text-xs font-semibold text-foreground",
-				children: "Passkeys"
+				children: a("enrollment.title")
 			})]
-		}), /* @__PURE__ */ s("div", {
+		}), /* @__PURE__ */ c("div", {
 			className: "p-4 space-y-3",
 			children: [
-				/* @__PURE__ */ o("div", {
+				/* @__PURE__ */ s("div", {
 					className: "text-xs text-foreground-subtle",
-					children: "Add a passkey (Touch ID, Windows Hello, or a security key) to sign in directly — fast and phishing-resistant, no password needed."
+					children: a("enrollment.intro")
 				}),
-				l.isLoading ? /* @__PURE__ */ s("div", {
+				d.isLoading ? /* @__PURE__ */ c("div", {
 					className: "flex items-center gap-2 text-xs text-foreground-subtle",
-					children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Loading passkeys…"]
-				}) : u.length > 0 ? /* @__PURE__ */ o("ul", {
+					children: [/* @__PURE__ */ s(x, { className: "h-3.5 w-3.5 animate-spin" }), a("enrollment.loading")]
+				}) : f.length > 0 ? /* @__PURE__ */ s("ul", {
 					className: "divide-y divide-border rounded-md border border-border",
-					children: u.map((e) => /* @__PURE__ */ s("li", {
+					children: f.map((e) => /* @__PURE__ */ c("li", {
 						className: "flex items-center gap-3 px-3 py-2 text-xs",
 						children: [
-							/* @__PURE__ */ o(y, { className: "h-3.5 w-3.5 text-foreground-subtle shrink-0" }),
-							/* @__PURE__ */ s("div", {
+							/* @__PURE__ */ s(b, { className: "h-3.5 w-3.5 text-foreground-subtle shrink-0" }),
+							/* @__PURE__ */ c("div", {
 								className: "flex-1 min-w-0",
-								children: [/* @__PURE__ */ o("div", {
+								children: [/* @__PURE__ */ s("div", {
 									className: "font-medium text-foreground truncate",
 									children: e.label
 								}), /* @__PURE__ */ s("div", {
 									className: "text-[10px] text-foreground-subtle",
-									children: [
-										"Added ",
-										new Date(e.createdAt).toLocaleDateString(),
-										e.lastUsedAt ? ` · last used ${new Date(e.lastUsedAt).toLocaleDateString()}` : " · never used"
-									]
+									children: e.lastUsedAt ? a("enrollment.addedUsed", {
+										added: new Date(e.createdAt).toLocaleDateString(u),
+										used: new Date(e.lastUsedAt).toLocaleDateString(u)
+									}) : a("enrollment.addedNever", { added: new Date(e.createdAt).toLocaleDateString(u) })
 								})]
 							}),
-							E === e.credentialId ? /* @__PURE__ */ s("form", {
+							O === e.credentialId ? /* @__PURE__ */ c("form", {
 								className: "flex items-center gap-1.5",
 								onSubmit: (t) => {
-									t.preventDefault(), O.length > 0 && A.mutate({
+									t.preventDefault(), A.length > 0 && M.mutate({
 										credentialId: e.credentialId,
-										proof: { password: O }
+										proof: { password: A }
 									});
 								},
 								children: [
-									/* @__PURE__ */ o("input", {
+									/* @__PURE__ */ s("input", {
 										type: "password",
 										autoComplete: "current-password",
-										"aria-label": "Current password",
-										placeholder: "Password to confirm",
-										value: O,
-										onChange: (e) => k(e.target.value),
+										"aria-label": a("enrollment.currentPassword"),
+										placeholder: a("enrollment.passwordToConfirm"),
+										value: A,
+										onChange: (e) => j(e.target.value),
 										className: "w-36 rounded border border-border bg-background px-2 py-1 text-[11px]"
 									}),
-									/* @__PURE__ */ o("button", {
+									/* @__PURE__ */ s("button", {
 										type: "submit",
-										disabled: O.length === 0 || A.isPending,
+										disabled: A.length === 0 || M.isPending,
 										className: "rounded px-2 py-1 text-[11px] text-danger hover:bg-danger/10 disabled:opacity-50",
-										children: "Remove"
+										children: a("enrollment.remove")
 									}),
-									/* @__PURE__ */ o("button", {
+									/* @__PURE__ */ s("button", {
 										type: "button",
-										disabled: A.isPending,
-										onClick: () => A.mutate({
+										disabled: M.isPending,
+										onClick: () => M.mutate({
 											credentialId: e.credentialId,
 											proof: { passkey: !0 }
 										}),
 										className: "rounded px-2 py-1 text-[11px] text-foreground-subtle hover:bg-surface-hover disabled:opacity-50",
-										children: "Use a passkey"
+										children: a("enrollment.usePasskey")
 									})
 								]
-							}) : /* @__PURE__ */ s("button", {
+							}) : /* @__PURE__ */ c("button", {
 								onClick: () => {
-									g(null), k(""), D(e.credentialId);
+									C(null), j(""), k(e.credentialId);
 								},
-								disabled: A.isPending,
+								disabled: M.isPending,
 								className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[11px] text-danger hover:bg-danger/10 disabled:opacity-50",
-								children: [/* @__PURE__ */ o(x, { className: "h-3 w-3" }), "Remove"]
+								children: [/* @__PURE__ */ s(S, { className: "h-3 w-3" }), a("enrollment.remove")]
 							})
 						]
 					}, e.credentialId))
-				}) : /* @__PURE__ */ o("div", {
+				}) : /* @__PURE__ */ s("div", {
 					className: "text-[11px] text-foreground-subtle",
-					children: "No passkeys enrolled yet."
+					children: a("enrollment.none")
 				}),
-				u.length > 0 && /* @__PURE__ */ s("div", {
+				f.length > 0 && /* @__PURE__ */ c("div", {
 					className: "flex items-start justify-between gap-3 rounded-md border border-border px-3 py-2.5",
-					children: [/* @__PURE__ */ s("div", {
+					children: [/* @__PURE__ */ c("div", {
 						className: "min-w-0",
-						children: [/* @__PURE__ */ o("div", {
+						children: [/* @__PURE__ */ s("div", {
 							className: "text-xs font-medium text-foreground",
-							children: "Require passkey as second factor"
-						}), /* @__PURE__ */ o("div", {
+							children: a("enrollment.secondFactorTitle")
+						}), /* @__PURE__ */ s("div", {
 							className: "text-[10px] text-foreground-subtle mt-0.5",
-							children: "Also ask for a passkey after every password sign-in. Off by default — enrolling a passkey on its own only enables direct passkey sign-in."
+							children: a("enrollment.secondFactorHint")
 						})]
-					}), /* @__PURE__ */ o("button", {
+					}), /* @__PURE__ */ s("button", {
 						type: "button",
 						role: "switch",
-						"aria-checked": C,
-						"aria-label": "Require passkey as second factor",
-						onClick: () => w.mutate(!C),
-						disabled: S.isLoading || w.isPending,
-						className: `relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors disabled:opacity-50 ${C ? "bg-primary" : "bg-foreground-subtle/30"}`,
-						children: /* @__PURE__ */ o("span", { className: `inline-block h-3.5 w-3.5 rounded-full bg-white shadow transition-transform ${C ? "translate-x-[18px]" : "translate-x-[3px]"}` })
+						"aria-checked": T,
+						"aria-label": a("enrollment.secondFactorTitle"),
+						onClick: () => E.mutate(!T),
+						disabled: w.isLoading || E.isPending,
+						className: `relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors disabled:opacity-50 ${T ? "bg-primary" : "bg-foreground-subtle/30"}`,
+						children: /* @__PURE__ */ s("span", { className: `inline-block h-3.5 w-3.5 rounded-full bg-white shadow transition-transform ${T ? "translate-x-[18px]" : "translate-x-[3px]"}` })
 					})]
 				}),
-				h && /* @__PURE__ */ s("div", {
+				_ && /* @__PURE__ */ c("div", {
 					className: "text-[11px] text-danger flex items-center gap-1",
-					children: [/* @__PURE__ */ o(_, { className: "h-3 w-3" }), h]
+					children: [/* @__PURE__ */ s(v, { className: "h-3 w-3" }), _]
 				}),
-				/* @__PURE__ */ s("div", {
+				/* @__PURE__ */ c("div", {
 					className: "flex items-end gap-2",
-					children: [/* @__PURE__ */ s("div", {
+					children: [/* @__PURE__ */ c("div", {
 						className: "flex-1 space-y-1",
-						children: [/* @__PURE__ */ o("label", {
+						children: [/* @__PURE__ */ s("label", {
 							className: "text-[10px] uppercase tracking-wide text-foreground-subtle",
-							children: "Passkey name"
-						}), /* @__PURE__ */ o("input", {
+							children: a("enrollment.passkeyName")
+						}), /* @__PURE__ */ s("input", {
 							type: "text",
-							value: d,
-							onChange: (e) => f(e.target.value),
-							placeholder: "e.g. MacBook Touch ID",
+							value: p,
+							onChange: (e) => m(e.target.value),
+							placeholder: a("enrollment.namePlaceholder"),
 							className: "w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary"
 						})]
-					}), /* @__PURE__ */ o("button", {
-						onClick: T,
-						disabled: p,
+					}), /* @__PURE__ */ s("button", {
+						onClick: D,
+						disabled: h,
 						className: "inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-2 text-xs font-semibold text-primary-foreground hover:opacity-90 disabled:opacity-50",
-						children: p ? /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Enrolling…"] }) : /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5" }), "Add passkey"] })
+						children: h ? /* @__PURE__ */ c(l, { children: [/* @__PURE__ */ s(x, { className: "h-3.5 w-3.5 animate-spin" }), a("enrollment.enrolling")] }) : /* @__PURE__ */ c(l, { children: [/* @__PURE__ */ s(y, { className: "h-3.5 w-3.5" }), a("enrollment.addPasskey")] })
 					})]
 				})
 			]
@@ -590,7 +681,7 @@ function B(e) {
 }
 //#endregion
 //#region src/webauthn/widgets/PasskeyLogin.tsx
-function V(e) {
+function G(e) {
 	if (!e) return null;
 	let t = e.challengeToken, n = e.onComplete, r = e.onError;
 	return typeof t != "string" || typeof n != "function" ? null : {
@@ -599,65 +690,43 @@ function V(e) {
 		onError: typeof r == "function" ? r : void 0
 	};
 }
-function H(e) {
-	let n = a(), r = V(e.config), [i, c] = t(!1), [l, u] = t(null);
-	return r ? L() ? /* @__PURE__ */ s("div", {
+function K(e) {
+	let n = o(), { t: r } = U(), i = G(e.config), [a, l] = t(!1), [u, d] = t(null);
+	return i ? R() ? /* @__PURE__ */ c("div", {
 		className: "space-y-2",
-		children: [/* @__PURE__ */ s("button", {
+		children: [/* @__PURE__ */ c("button", {
 			type: "button",
 			"data-testid": "login-passkey",
 			onClick: async () => {
-				u(null), c(!0);
+				d(null), l(!0);
 				try {
-					let e = await R((await n.loginBeginPasskey(r.challengeToken)).optionsJSON), t = await n.loginVerifyPasskey(r.challengeToken, e);
-					r.onComplete(t.token);
+					let e = await V((await n.loginBeginPasskey(i.challengeToken)).optionsJSON), t = await n.loginVerifyPasskey(i.challengeToken, e);
+					i.onComplete(t.token);
 				} catch (e) {
-					let t = e instanceof Error ? e.message : "Passkey verification failed";
-					u(t), r.onError?.(t);
+					let t = e instanceof Error ? e.message : r("login.verificationFailed");
+					d(t), i.onError?.(t);
 				} finally {
-					c(!1);
+					l(!1);
 				}
 			},
-			disabled: i,
+			disabled: a,
 			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-background px-4 py-2.5 text-sm font-semibold text-foreground hover:bg-surface-hover disabled:opacity-50 transition-all",
-			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), "Use a passkey"]
-		}), l && /* @__PURE__ */ o("div", {
+			children: [a ? /* @__PURE__ */ s(x, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ s(y, { className: "h-4 w-4 text-primary" }), r("login.usePasskey")]
+		}), u && /* @__PURE__ */ s("div", {
 			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
-			children: l
+			children: u
 		})]
-	}) : /* @__PURE__ */ o("div", {
+	}) : /* @__PURE__ */ s("div", {
 		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
-		children: "This browser does not support passkeys."
-	}) : /* @__PURE__ */ o("div", {
+		children: r("login.unsupported")
+	}) : /* @__PURE__ */ s("div", {
 		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
-		children: "Passkey login widget requires a challengeToken + onComplete callback."
+		children: r("login.requiresChallenge")
 	});
 }
 //#endregion
-//#region src/webauthn/widgets/direct-login-i18n.ts
-var U = {
-	en: {
-		signInWithPasskey: "Sign in with a passkey",
-		unsupported: "This browser does not support passkeys.",
-		failed: "Passkey sign-in failed",
-		secondFactorRequired: "Additional verification is required — sign in with your password to continue."
-	},
-	it: {
-		signInWithPasskey: "Accedi con una passkey",
-		unsupported: "Questo browser non supporta le passkey.",
-		failed: "Accesso con passkey non riuscito",
-		secondFactorRequired: "È richiesta una verifica aggiuntiva — accedi con la password per continuare."
-	}
-};
-function W(e) {
-	return (e ?? globalThis.navigator?.language ?? "en").toLowerCase().split("-")[0] === "it" ? "it" : "en";
-}
-function G(e, t) {
-	return U[e][t];
-}
-//#endregion
 //#region src/webauthn/widgets/PasskeyDirectLogin.tsx
-function K(e) {
+function q(e) {
 	if (!e) return null;
 	let t = e.onComplete, n = e.onSecondFactor, r = e.onError, i = e.locale;
 	return typeof t == "function" ? {
@@ -667,57 +736,57 @@ function K(e) {
 		locale: typeof i == "string" ? i : void 0
 	} : null;
 }
-function q(e) {
-	let n = a(), r = K(e.config), [i, c] = t(!1), [l, u] = t(null), d = W(r?.locale);
-	return r ? L() ? /* @__PURE__ */ s("div", {
+function J(e) {
+	let n = o(), r = q(e.config), [i, a] = t(!1), [l, u] = t(null), { t: d } = U(r?.locale);
+	return r ? R() ? /* @__PURE__ */ c("div", {
 		className: "space-y-2",
-		children: [/* @__PURE__ */ s("button", {
+		children: [/* @__PURE__ */ c("button", {
 			type: "button",
 			"data-testid": "login-passkey-direct",
 			onClick: async () => {
-				u(null), c(!0);
+				u(null), a(!0);
 				try {
-					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e), i = t.secondFactors ?? (t.requiresTotp === !0 ? ["totp"] : []);
+					let e = await V((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e), i = t.secondFactors ?? (t.requiresTotp === !0 ? ["totp"] : []);
 					if (i.length > 0) {
 						if (r.onSecondFactor) r.onSecondFactor({
 							challengeToken: t.token,
 							factors: i
 						});
 						else {
-							let e = G(d, "secondFactorRequired");
+							let e = d("directLogin.secondFactorRequired");
 							u(e), r.onError?.(e);
 						}
 						return;
 					}
 					r.onComplete(t.token);
 				} catch (e) {
-					let t = e instanceof Error ? e.message : G(d, "failed");
+					let t = e instanceof Error ? e.message : d("directLogin.failed");
 					u(t), r.onError?.(t);
 				} finally {
-					c(!1);
+					a(!1);
 				}
 			},
 			disabled: i,
 			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-surface px-4 py-2.5 text-sm font-medium text-foreground hover:bg-surface-hover disabled:opacity-50 transition-colors",
-			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), G(d, "signInWithPasskey")]
-		}), l && /* @__PURE__ */ o("div", {
+			children: [i ? /* @__PURE__ */ s(x, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ s(y, { className: "h-4 w-4 text-primary" }), d("directLogin.signInWithPasskey")]
+		}), l && /* @__PURE__ */ s("div", {
 			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
 			children: l
 		})]
-	}) : /* @__PURE__ */ o("div", {
+	}) : /* @__PURE__ */ s("div", {
 		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
-		children: G(d, "unsupported")
-	}) : /* @__PURE__ */ o("div", {
+		children: d("directLogin.unsupported")
+	}) : /* @__PURE__ */ s("div", {
 		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
-		children: "Passkey direct-login widget requires an onComplete callback."
+		children: d("directLogin.requiresCallback")
 	});
 }
 //#endregion
 //#region src/webauthn/widgets/index.tsx
-var J = {
-	"passkey-enrollment": B,
-	"passkey-login": H,
-	"passkey-direct-login": q
+var Y = {
+	"passkey-enrollment": W,
+	"passkey-login": K,
+	"passkey-direct-login": J
 };
 //#endregion
-export { J as default };
+export { Y as default };