@cauthyhq/react 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,2694 @@
+'use client';
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  AcceptInvite: () => AcceptInvite,
+  Account: () => Account,
+  AccountAgents: () => AccountAgents,
+  AccountEmail: () => AccountEmail,
+  AccountLinked: () => AccountLinked,
+  AccountPasskeys: () => AccountPasskeys,
+  AccountPassword: () => AccountPassword,
+  AccountPhone: () => AccountPhone,
+  AccountProfile: () => AccountProfile,
+  AccountSecondStep: () => AccountSecondStep,
+  AccountSessions: () => AccountSessions,
+  CauthyError: () => import_js5.CauthyError,
+  CauthyProvider: () => CauthyProvider,
+  ForgotPassword: () => ForgotPassword,
+  GoogleOneTap: () => GoogleOneTap,
+  OrganizationMembers: () => OrganizationMembers,
+  Organizations: () => Organizations,
+  PendingTerms: () => PendingTerms,
+  ResetPassword: () => ResetPassword,
+  SignIn: () => SignIn,
+  SignUp: () => SignUp,
+  UserButton: () => UserButton,
+  VerifyEmail: () => VerifyEmail,
+  can: () => import_js5.can,
+  canAutofillPasskeys: () => import_js5.canAutofillPasskeys,
+  canUsePasskeys: () => import_js5.canUsePasskeys,
+  createAuthClient: () => import_js5.createAuthClient,
+  createSessionStore: () => import_js5.createSessionStore,
+  createSignInFlow: () => import_js5.createSignInFlow,
+  definePolicy: () => import_js5.definePolicy,
+  initialsOf: () => initialsOf,
+  themeFromCss: () => import_theme3.themeFromCss,
+  themeFromStackmyth: () => import_theme3.themeFromStackmyth,
+  themeVariables: () => import_theme3.themeVariables,
+  tokensFromStackmyth: () => import_theme3.tokensFromStackmyth,
+  unwrap: () => import_js5.unwrap,
+  useAuth: () => useAuth,
+  useOrganizations: () => useOrganizations,
+  useSession: () => useSession,
+  useSignInFlow: () => useSignInFlow
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/react.tsx
+var import_react = require("react");
+var import_js = require("@cauthyhq/js");
+var import_theme = require("@cauthyhq/js/theme");
+var import_jsx_runtime = require("react/jsx-runtime");
+var useIsomorphicLayoutEffect = typeof window === "undefined" ? import_react.useEffect : import_react.useLayoutEffect;
+var StoreCtx = (0, import_react.createContext)(null);
+var OutcomesCtx = (0, import_react.createContext)(null);
+var ThemeCtx = (0, import_react.createContext)(void 0);
+function CauthyProvider({ children, basePath = "/api/auth", initialSession, locale, theme, fetch, onProtocolMismatch }) {
+  const latest = (0, import_react.useRef)({ locale, fetch, onProtocolMismatch });
+  useIsomorphicLayoutEffect(() => {
+    latest.current = { locale, fetch, onProtocolMismatch };
+  });
+  const readLocale = (0, import_react.useCallback)(() => {
+    const l = latest.current.locale;
+    return typeof l === "function" ? l() : l;
+  }, []);
+  const first = (0, import_react.useRef)(initialSession);
+  const handsMismatch = (0, import_react.useRef)(onProtocolMismatch !== void 0);
+  const [outcomes] = (0, import_react.useState)(() => /* @__PURE__ */ new Set());
+  const store = (0, import_react.useMemo)(
+    () => (0, import_js.createSessionStore)({
+      basePath,
+      initialSession: first.current,
+      locale: readLocale,
+      fetch: async (...args) => {
+        const [input] = args;
+        const path = (typeof input === "string" ? input : input instanceof URL ? input.href : input.url).split("?")[0];
+        try {
+          const res = await (latest.current.fetch ?? globalThis.fetch)(...args);
+          if (outcomes.size > 0) {
+            const error = res.ok ? null : (0, import_js.errorFrom)(res.status, await res.clone().json().catch(() => null));
+            for (const o of [...outcomes]) o(path, error);
+          }
+          return res;
+        } catch (e) {
+          for (const o of [...outcomes]) o(path, import_js.UNAVAILABLE);
+          throw e;
+        }
+      },
+      ...handsMismatch.current ? { onProtocolMismatch: (seen) => latest.current.onProtocolMismatch?.(seen) } : {}
+    }),
+    [basePath, readLocale, outcomes]
+  );
+  (0, import_react.useEffect)(() => store.subscribe(() => {
+  }), [store]);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(StoreCtx.Provider, { value: store, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OutcomesCtx.Provider, { value: outcomes, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ThemeCtx.Provider, { value: theme, children }) }) });
+}
+function useSessionStore() {
+  const store = (0, import_react.useContext)(StoreCtx);
+  if (store === null) throw new Error("@cauthyhq/react: useSession needs <CauthyProvider> above it");
+  return store;
+}
+function useRequestOutcome() {
+  const outcomes = (0, import_react.useContext)(OutcomesCtx);
+  const store = useSessionStore();
+  return (0, import_react.useCallback)(async (route, call) => {
+    let error = null;
+    const hear = (path, e) => {
+      if (path === `${store.basePath}${route}`) error = e;
+    };
+    outcomes?.add(hear);
+    try {
+      return { value: await call(), error };
+    } finally {
+      outcomes?.delete(hear);
+    }
+  }, [outcomes, store]);
+}
+function useProviderTheme() {
+  return (0, import_react.useContext)(ThemeCtx);
+}
+function useThemeVariables() {
+  const theme = (0, import_react.useContext)(ThemeCtx);
+  return (0, import_react.useMemo)(() => theme ? (0, import_theme.themeVariables)(theme) : void 0, [theme]);
+}
+function useSession() {
+  const store = useSessionStore();
+  const state = (0, import_react.useSyncExternalStore)(store.subscribe, store.get, store.get);
+  return (0, import_react.useMemo)(
+    () => ({ session: state.session, status: state.status, refresh: store.refresh, signIn: store.signIn, signOut: store.signOut, accountUrl: store.accountUrl, basePath: store.basePath }),
+    [state, store]
+  );
+}
+function useAuth() {
+  const store = useSessionStore();
+  const { session, status, refresh } = useSession();
+  return (0, import_react.useMemo)(() => ({ ...store.auth, session, status, refresh }), [store, session, status, refresh]);
+}
+
+// src/organizations.ts
+var import_react2 = require("react");
+function useOrganizations(options = {}) {
+  const auth = useAuth();
+  const client = auth.organizations;
+  const who = auth.session?.user.id ?? null;
+  const system = options.system;
+  const [list, setList] = (0, import_react2.useState)([]);
+  const [loading, setLoading] = (0, import_react2.useState)(who !== null);
+  const [error, setError] = (0, import_react2.useState)(null);
+  const outcome = useRequestOutcome();
+  const asked = (0, import_react2.useRef)(0);
+  const reload = (0, import_react2.useCallback)(async () => {
+    const n = ++asked.current;
+    if (who === null) {
+      setList([]);
+      setError(null);
+      setLoading(false);
+      return;
+    }
+    setLoading(true);
+    const { value: seats, error: failed } = await outcome("/me/organizations", () => client.list(system));
+    if (n !== asked.current) return;
+    setList(seats);
+    setError(failed);
+    setLoading(false);
+  }, [client, who, system, outcome]);
+  (0, import_react2.useEffect)(() => {
+    void reload();
+  }, [reload]);
+  return (0, import_react2.useMemo)(() => {
+    const after = async (running) => {
+      const r = await running;
+      await reload();
+      return r;
+    };
+    return {
+      ...client,
+      organizations: list,
+      loading,
+      error,
+      reload,
+      add: (id, f) => after(client.add(id, f)),
+      setRole: (id, userId, role) => after(client.setRole(id, userId, role)),
+      remove: (id, userId) => after(client.remove(id, userId)),
+      rename: (id, name) => after(client.rename(id, name)),
+      archive: (id) => after(client.archive(id)),
+      delete: (id) => after(client.delete(id))
+    };
+  }, [client, list, loading, error, reload]);
+}
+
+// src/headless.ts
+var import_react4 = require("react");
+var import_js2 = require("@cauthyhq/js");
+function useSignInFlow() {
+  const store = useSessionStore();
+  const flow = (0, import_react4.useMemo)(() => (0, import_js2.createSignInFlow)(store.auth), [store]);
+  const state = (0, import_react4.useSyncExternalStore)(flow.subscribe, flow.get, flow.get);
+  return (0, import_react4.useMemo)(() => ({ ...flow, ...state }), [flow, state]);
+}
+
+// src/user-button.tsx
+var import_react6 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var TEXTS = {
+  en: { signIn: "Sign in", menu: "Account menu for {name}", manageAccount: "Manage account", signOut: "Sign out" },
+  es: { signIn: "Entrar", menu: "Men\xFA de la cuenta de {name}", manageAccount: "Administrar la cuenta", signOut: "Cerrar sesi\xF3n" }
+};
+function initialsOf(name, email) {
+  const words = name.trim().split(/\s+/).filter(Boolean);
+  const first = (w) => Array.from(w)[0] ?? "";
+  if (words.length >= 2) return (first(words[0]) + first(words[words.length - 1])).toUpperCase();
+  if (words.length === 1) return Array.from(words[0]).slice(0, 2).join("").toUpperCase();
+  return (first(email.trim()) || "?").toUpperCase();
+}
+function UserButton(props) {
+  const { session, status, signIn, signOut: hostedSignOut, accountUrl } = useSession();
+  const auth = useAuth();
+  const look = useThemeVariables();
+  const t = { ...TEXTS[props.locale ?? "en"], ...props.texts };
+  const cx = (part) => props.classNames?.[part] ?? (props.unstyled ? void 0 : `cauthy-user-${part}`);
+  const root = props.unstyled ? {} : { "data-cauthy": "", style: look };
+  const [open, setOpen] = (0, import_react6.useState)(false);
+  const [leaving, setLeaving] = (0, import_react6.useState)(false);
+  const menuId = (0, import_react6.useId)();
+  const trigger = (0, import_react6.useRef)(null);
+  const menu = (0, import_react6.useRef)(null);
+  (0, import_react6.useEffect)(() => {
+    if (!open) return;
+    menu.current?.querySelector('[role="menuitem"]')?.focus();
+    const outside = (e) => {
+      const target = e.target;
+      if (!menu.current?.contains(target) && !trigger.current?.contains(target)) setOpen(false);
+    };
+    document.addEventListener("mousedown", outside);
+    return () => document.removeEventListener("mousedown", outside);
+  }, [open]);
+  if (status !== "authenticated" || session === null) {
+    const waiting = status === "loading";
+    return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: cx("root"), ...root, children: props.signInHref && !waiting ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("a", { className: cx("trigger"), href: props.signInHref, children: t.signIn }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: cx("trigger"), disabled: waiting, "aria-busy": waiting || void 0, onClick: () => signIn(), children: t.signIn }) });
+  }
+  const name = session.user.name || session.user.email;
+  const close = (focus) => {
+    setOpen(false);
+    if (focus) trigger.current?.focus();
+  };
+  const items = () => [...menu.current?.querySelectorAll('[role="menuitem"]') ?? []];
+  const onMenuKey = (e) => {
+    const list = items();
+    const at = list.indexOf(document.activeElement);
+    const go = (i) => {
+      e.preventDefault();
+      list[(i + list.length) % list.length]?.focus();
+    };
+    if (e.key === "Escape") {
+      e.preventDefault();
+      close(true);
+    } else if (e.key === "ArrowDown") go(at + 1);
+    else if (e.key === "ArrowUp") go(at - 1);
+    else if (e.key === "Home") go(0);
+    else if (e.key === "End") go(list.length - 1);
+    else if (e.key === "Tab") close(false);
+  };
+  const signOut = async () => {
+    setLeaving(true);
+    const r = await auth.signOut();
+    if (!r.ok && r.error.code === "not_configured") return hostedSignOut();
+    setLeaving(false);
+    if (!r.ok) return;
+    setOpen(false);
+    if (props.onSignOut) props.onSignOut();
+    else window.location.assign("/");
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: cx("root"), ...root, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+      "button",
+      {
+        ref: trigger,
+        type: "button",
+        className: cx("trigger"),
+        "aria-haspopup": "menu",
+        "aria-expanded": open,
+        "aria-controls": open ? menuId : void 0,
+        "aria-label": t.menu.replace("{name}", name),
+        onClick: () => setOpen((o) => !o),
+        onKeyDown: (e) => {
+          if (e.key === "ArrowDown" || e.key === "Enter" || e.key === " ") {
+            e.preventDefault();
+            setOpen(true);
+          }
+        },
+        children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: cx("avatar"), "aria-hidden": "true", children: initialsOf(session.user.name, session.user.email) })
+      }
+    ),
+    open && /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { ref: menu, id: menuId, role: "menu", "aria-label": name, className: cx("menu"), onKeyDown: onMenuKey, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: cx("identity"), role: "presentation", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("strong", { children: session.user.name }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: session.user.email })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("a", { role: "menuitem", tabIndex: -1, className: cx("item"), href: props.accountHref ?? accountUrl(), children: t.manageAccount }),
+      props.children,
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { role: "menuitem", tabIndex: -1, type: "button", className: cx("item"), disabled: leaving, "aria-busy": leaving || void 0, onClick: () => void signOut(), children: t.signOut })
+    ] })
+  ] });
+}
+
+// src/organizations-view.tsx
+var import_react10 = require("react");
+
+// src/components.tsx
+var import_react8 = require("react");
+var import_js3 = require("@cauthyhq/js");
+var import_theme2 = require("@cauthyhq/js/theme");
+var import_js4 = require("@cauthyhq/js");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+var TEXTS2 = {
+  en: {
+    email: "Email",
+    password: "Password",
+    name: "Name",
+    company: "Your company's name",
+    code: "Code",
+    signIn: "Sign in",
+    signUp: "Create account",
+    continueWith: "Continue with",
+    orWithEmail: "or with your email",
+    keepSignedIn: "Keep me signed in",
+    forgotPassword: "Forgot your password?",
+    noAccount: "No account yet?",
+    createAccount: "Create one",
+    haveAccount: "Already have an account?",
+    iAccept: "I have read and accept",
+    and: "and",
+    termsOfService: "the Terms of Service",
+    privacyPolicy: "the Privacy Policy",
+    sendLink: "Send the link",
+    linkSent: "If that address has an account, a link to choose a new password is on its way.",
+    codeHelp: "Enter the code from your authenticator app, or a recovery code.",
+    verify: "Verify",
+    codeHelpPhone: "We send a code to your phone. Ask for it, then type it here, or use a recovery code.",
+    codeHelpEmail: "We sent a code to {to}. Type it here.",
+    sendEmailAgain: "Send the code again",
+    sendCodeSms: "Send a code by SMS to {to}",
+    sendCodeWhatsapp: "Send a code by WhatsApp to {to}",
+    codeSent: "We sent a code to {to}. Type it here.",
+    pushSend: "Approve on my phone",
+    pushPick: "On your phone, pick {n}",
+    pushWaiting: "We sent a notification to your phone. Open it and pick this number.",
+    phone: "Phone, with its country code",
+    phoneHelp: "Get your codes by SMS or WhatsApp instead of an app.",
+    phoneOn: "Codes go to {to}.",
+    phoneOff: "No phone yet.",
+    addPhone: "Add phone",
+    removePhone: "Remove phone",
+    bySms: "SMS",
+    byWhatsapp: "WhatsApp",
+    channel: "Send codes by",
+    checkEmail: "Almost there: open the link we sent to confirm your address \u2014 it signs you in.",
+    backToSignIn: "Back to sign in",
+    emailMeALink: "Email me a sign-in link",
+    linkHelp: "We will email you a link that signs you in, no password needed.",
+    sendMeTheLink: "Send me the link",
+    back: "Back",
+    usePasskey: "Sign in with a passkey",
+    codeFromMail: "Reading it on another device? Enter the code from the email.",
+    signInLinkSent: "If that address has an account, a link to sign in is on its way.",
+    newPassword: "New password",
+    savePassword: "Save the password",
+    passwordChanged: "Your password was changed. You can sign in with it now.",
+    confirming: "Confirming your address\u2026",
+    emailConfirmed: "Your address is confirmed. You can sign in now.",
+    invitedTo: "You've been invited to {workspace}",
+    invitedToOrganization: "You've been invited to {organization} on {workspace}",
+    invitedAs: "You will sign in as {email}.",
+    choosePassword: "Choose a password",
+    acceptInvite: "Accept and sign in",
+    openingInvitation: "Opening your invitation\u2026",
+    invitationInvalid: "This invitation is not valid: it was already used, or it has expired. Ask whoever invited you to send it again.",
+    profile: "Profile",
+    save: "Save",
+    saved: "Saved.",
+    currentPassword: "Current password",
+    changePassword: "Change password",
+    passwordChangedHere: "Your password was changed. Every other session of your account was signed out.",
+    secondStep: "Second step",
+    secondStepOn: "On: signing in also asks for a code from your authenticator app.",
+    secondStepOff: "Off: signing in asks only for your password.",
+    turnOn: "Turn on",
+    turnOff: "Turn off",
+    addToApp: "Scan this code with your authenticator app, or add the key below by hand, then enter the code it shows.",
+    openInApp: "Open in an authenticator app",
+    qrAlt: "QR code to add this account to an authenticator app",
+    recoveryCodes: "Recovery codes",
+    newRecoveryCodes: "New recovery codes",
+    keepCodes: "Keep these codes somewhere safe. Each works once, and they are not shown again.",
+    copyCodes: "Copy all",
+    downloadCodes: "Download .txt",
+    codesCopied: "The codes were copied.",
+    codesNotCopied: "The codes could not be copied. Select them and copy them by hand.",
+    change: "Change",
+    passwordSet: "Your account has a password.",
+    addAnotherPasskey: "Add a passkey",
+    passkeys: "Passkeys",
+    managePasskeys: "Add or remove a passkey",
+    passkeysHelp: "Sign in with your fingerprint, your face or your device's lock, without a password.",
+    noPasskeys: "No passkey yet.",
+    passkeyName: "A name for this device (optional)",
+    addPasskey: "Add a passkey on this device",
+    removePasskey: "Remove",
+    addPasskeyDevice: "Add this device (fingerprint or face)",
+    addSecurityKey: "Add a security key",
+    passkeyKinds: { security_key: "Security key", synced: "Synced across your devices", device: "On this device only" },
+    passkeyAdded: "The passkey was added. Next time, sign in with it.",
+    passkeyUnnamed: "Passkey",
+    sessions: "Where you are signed in",
+    signOutEverywhere: "Sign out everywhere",
+    agents: "AI agents",
+    agentsHelp: "Agents you allowed to act for you. Disconnect one and it loses its access within minutes.",
+    disconnect: "Disconnect",
+    anAgent: "An AI agent",
+    unknownDevice: "Unknown device",
+    emailAddress: "Email address",
+    newEmail: "New email address",
+    changeEmail: "Change email",
+    emailSent: "We sent a link to {email}. Your address changes once you open it.",
+    linkedAccounts: "Linked accounts",
+    noLinkedAccounts: "No account is linked.",
+    linkWith: "Link",
+    unlink: "Unlink",
+    linked: "The account was linked.",
+    ssoOnly: "Your company signs you in to this account.",
+    members: "Members",
+    membersHidden: "Your role here does not let you see the members.",
+    organizationMissing: "You do not belong to this organization.",
+    memberYou: "you",
+    memberInvited: "invited",
+    memberManager: "manages members",
+    memberRole: "Role",
+    memberAdd: "Add member",
+    memberAdded: "{email} is a member now.",
+    memberRemove: "Remove",
+    memberRemoveConfirm: "Remove {who}?",
+    memberLeave: "Leave",
+    memberLeaveConfirm: "Leave {org}? You will need an invitation to come back.",
+    memberInviteAgain: "Send the invitation again",
+    memberInvitationSent: "The invitation is on its way.",
+    organization: "Organization",
+    organizationRename: "Rename",
+    organizationRenamed: "The organization is now called {name}.",
+    organizationArchive: "Archive",
+    organizationArchiveConfirm: "Archive {org}? Its members will no longer reach it, and only the workspace can restore it.",
+    organizationArchived: "{org} was archived.",
+    organizationDelete: "Delete organization",
+    organizationDeleteConfirm: "Delete {org} for good? Its members lose it and this cannot be undone.",
+    organizationDeleted: "{org} was deleted.",
+    yes: "Yes",
+    cancel: "Cancel",
+    termsChanged: "Our terms changed",
+    termsChangedHelp: "To go on, read and accept",
+    acceptTerms: "Accept",
+    errors: {
+      not_allowed: "Your role in this organization does not allow that.",
+      last_manager: "Somebody else must manage the members first: give that role to another member.",
+      last_owner: "An organization keeps at least one owner: make another member owner first.",
+      organization_not_found: "That organization no longer exists.",
+      member_exists: "That person already belongs to the organization; their role was not changed. Change it in the list instead.",
+      already_member: "That person already belongs to the organization. Change their role instead.",
+      unknown_role: "Choose one of the roles offered.",
+      user_not_active: "That account is disabled.",
+      required: "This is required.",
+      invalid_email: "That does not look like an email address.",
+      too_short: `Use at least ${import_js3.MIN_PASSWORD} characters.`,
+      invalid_credentials: "The address or the password is not right.",
+      unavailable: "Sign-in is unavailable right now. Try again in a moment.",
+      state_mismatch: "That sign-in could not be completed. Try again.",
+      cancelled: "The sign-in was cancelled.",
+      email_taken: "That address already has an account.",
+      email_unchanged: "That is already your address.",
+      last_sign_in_method: "Add a password or link another account first: it is your only way to sign in.",
+      identity_already_linked: "That account is linked to someone else.",
+      manual_linking_disabled: "Linking accounts is turned off for this workspace.",
+      invalid_token: "This link is not valid, or it has expired. Ask for a new one.",
+      invalid_code: "That code is not right, or it has expired.",
+      wrong_password: "The current password is not right.",
+      step_up_required: "Enter your current password.",
+      weak_password: "Choose a stronger password.",
+      unauthenticated: "Sign in first.",
+      phone_refused: "The code could not be sent to that number.",
+      too_many_codes: "Enough codes were sent. Use the last one, or sign in again.",
+      phone_unavailable: "Codes cannot be sent that way here.",
+      phone_already_set: "Remove the phone you have first.",
+      phone_codes_unavailable: "Codes cannot be sent right now. Try again in a moment.",
+      captcha_required: "Complete the check that you are not a bot, then try again.",
+      captcha_failed: "The check that you are not a bot did not pass. Try it again.",
+      passkey_failed: "The passkey could not be used. Try again, or sign in another way.",
+      passkey_exists: "This device already has a passkey for your account.",
+      passkey_unavailable: "Passkeys cannot be used here.",
+      sso_required: "This address signs in through its company.",
+      sso_not_found: "No company sign-in answers for this address.",
+      sso_failed: "The sign-in with your company could not be completed. Try again.",
+      sso_unavailable: "Your company's sign-in cannot be reached right now. Try again in a moment.",
+      invalid_assertion: "Your company's answer could not be checked. Try again.",
+      provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
+      connection_inactive: "Your company's sign-in is turned off for this workspace.",
+      invalid_grant: "That sign-in expired. Try again.",
+      password_disabled: "This workspace does not sign in with a password. Use one of the other ways.",
+      passkeys_disabled: "Passkeys are turned off for this workspace."
+    }
+  },
+  es: {
+    email: "Correo",
+    password: "Contrase\xF1a",
+    name: "Nombre",
+    company: "Nombre de tu empresa",
+    code: "C\xF3digo",
+    signIn: "Entrar",
+    signUp: "Crear cuenta",
+    continueWith: "Continuar con",
+    orWithEmail: "o con tu correo",
+    keepSignedIn: "Mantener la sesi\xF3n abierta",
+    forgotPassword: "\xBFOlvidaste tu contrase\xF1a?",
+    noAccount: "\xBFNo tienes cuenta?",
+    createAccount: "Crear una",
+    haveAccount: "\xBFYa tienes cuenta?",
+    iAccept: "He le\xEDdo y acepto",
+    and: "y",
+    termsOfService: "los T\xE9rminos del servicio",
+    privacyPolicy: "la Pol\xEDtica de privacidad",
+    sendLink: "Enviar el enlace",
+    linkSent: "Si ese correo tiene una cuenta, ya va en camino un enlace para elegir una contrase\xF1a nueva.",
+    codeHelp: "Escribe el c\xF3digo de tu aplicaci\xF3n de autenticaci\xF3n, o un c\xF3digo de recuperaci\xF3n.",
+    verify: "Verificar",
+    codeHelpPhone: "Te enviamos un c\xF3digo a tu tel\xE9fono. P\xEDdelo y escr\xEDbelo aqu\xED, o usa un c\xF3digo de recuperaci\xF3n.",
+    codeHelpEmail: "Te enviamos un c\xF3digo a {to}. Escr\xEDbelo aqu\xED.",
+    sendEmailAgain: "Enviar el c\xF3digo de nuevo",
+    sendCodeSms: "Enviar un c\xF3digo por SMS a {to}",
+    sendCodeWhatsapp: "Enviar un c\xF3digo por WhatsApp a {to}",
+    codeSent: "Te enviamos un c\xF3digo a {to}. Escr\xEDbelo aqu\xED.",
+    pushSend: "Aprobar en mi tel\xE9fono",
+    pushPick: "En tu tel\xE9fono, elige el {n}",
+    pushWaiting: "Enviamos una notificaci\xF3n a tu tel\xE9fono. \xC1brela y elige este n\xFAmero.",
+    phone: "Tel\xE9fono, con su c\xF3digo de pa\xEDs",
+    phoneHelp: "Recibe tus c\xF3digos por SMS o WhatsApp en vez de una app.",
+    phoneOn: "Los c\xF3digos van a {to}.",
+    phoneOff: "Todav\xEDa no tienes un tel\xE9fono.",
+    addPhone: "Agregar tel\xE9fono",
+    removePhone: "Quitar tel\xE9fono",
+    bySms: "SMS",
+    byWhatsapp: "WhatsApp",
+    channel: "Enviar los c\xF3digos por",
+    checkEmail: "Casi listo: abre el enlace que te enviamos para confirmar tu correo; te deja adentro.",
+    backToSignIn: "Volver a entrar",
+    emailMeALink: "Env\xEDame un enlace para entrar",
+    linkHelp: "Te enviamos un enlace al correo que te deja entrar, sin contrase\xF1a.",
+    sendMeTheLink: "Env\xEDame el enlace",
+    back: "Volver",
+    usePasskey: "Entrar con una llave de acceso",
+    codeFromMail: "\xBFLo est\xE1s leyendo en otro dispositivo? Escribe el c\xF3digo que trae el correo.",
+    signInLinkSent: "Si ese correo tiene una cuenta, ya va en camino un enlace para entrar.",
+    newPassword: "Contrase\xF1a nueva",
+    savePassword: "Guardar la contrase\xF1a",
+    passwordChanged: "Tu contrase\xF1a se cambi\xF3. Ya puedes entrar con ella.",
+    confirming: "Confirmando tu correo\u2026",
+    emailConfirmed: "Tu correo qued\xF3 confirmado. Ya puedes entrar.",
+    invitedTo: "Te invitaron a {workspace}",
+    invitedToOrganization: "Te invitaron a {organization} en {workspace}",
+    invitedAs: "Vas a entrar como {email}.",
+    choosePassword: "Elige una contrase\xF1a",
+    acceptInvite: "Aceptar y entrar",
+    openingInvitation: "Abriendo tu invitaci\xF3n\u2026",
+    invitationInvalid: "Esta invitaci\xF3n no es v\xE1lida: ya se us\xF3 o venci\xF3. P\xEDdele a quien te invit\xF3 que te la env\xEDe de nuevo.",
+    profile: "Perfil",
+    save: "Guardar",
+    saved: "Guardado.",
+    currentPassword: "Contrase\xF1a actual",
+    changePassword: "Cambiar contrase\xF1a",
+    passwordChangedHere: "Tu contrase\xF1a se cambi\xF3. Se cerraron todas las dem\xE1s sesiones de tu cuenta.",
+    secondStep: "Segundo paso",
+    secondStepOn: "Activo: al entrar tambi\xE9n se pide un c\xF3digo de tu aplicaci\xF3n de autenticaci\xF3n.",
+    secondStepOff: "Inactivo: al entrar solo se pide tu contrase\xF1a.",
+    turnOn: "Activar",
+    turnOff: "Desactivar",
+    addToApp: "Escanea este c\xF3digo con tu aplicaci\xF3n de autenticaci\xF3n, o agrega a mano la clave de abajo, y escribe el c\xF3digo que muestra.",
+    openInApp: "Abrir en una aplicaci\xF3n de autenticaci\xF3n",
+    qrAlt: "C\xF3digo QR para agregar esta cuenta a una aplicaci\xF3n de autenticaci\xF3n",
+    recoveryCodes: "C\xF3digos de recuperaci\xF3n",
+    newRecoveryCodes: "Nuevos c\xF3digos de recuperaci\xF3n",
+    keepCodes: "Guarda estos c\xF3digos en un lugar seguro. Cada uno sirve una vez y no se vuelven a mostrar.",
+    copyCodes: "Copiar todos",
+    downloadCodes: "Descargar .txt",
+    codesCopied: "Los c\xF3digos quedaron copiados.",
+    codesNotCopied: "No se pudieron copiar los c\xF3digos. Selecci\xF3nalos y c\xF3pialos a mano.",
+    change: "Cambiar",
+    passwordSet: "Tu cuenta tiene contrase\xF1a.",
+    addAnotherPasskey: "Agregar una llave de acceso",
+    passkeys: "Llaves de acceso",
+    managePasskeys: "Agregar o quitar una llave de acceso",
+    passkeysHelp: "Entra con tu huella, tu rostro o el bloqueo de tu dispositivo, sin contrase\xF1a.",
+    noPasskeys: "Todav\xEDa no tienes llaves de acceso.",
+    passkeyName: "Un nombre para este dispositivo (opcional)",
+    addPasskey: "Agregar una llave en este dispositivo",
+    removePasskey: "Quitar",
+    addPasskeyDevice: "Agregar este dispositivo (huella o rostro)",
+    addSecurityKey: "Agregar una llave f\xEDsica",
+    passkeyKinds: { security_key: "Llave f\xEDsica", synced: "Sincronizada entre tus dispositivos", device: "Solo en un dispositivo" },
+    passkeyAdded: "La llave de acceso qued\xF3 agregada. La pr\xF3xima vez, entra con ella.",
+    passkeyUnnamed: "Llave de acceso",
+    sessions: "D\xF3nde tienes la sesi\xF3n abierta",
+    signOutEverywhere: "Cerrar sesi\xF3n en todas partes",
+    agents: "Agentes de IA",
+    agentsHelp: "Los agentes a los que permitiste actuar por ti. Si desconectas uno, pierde el acceso en pocos minutos.",
+    disconnect: "Desconectar",
+    anAgent: "Un agente de IA",
+    unknownDevice: "Dispositivo desconocido",
+    emailAddress: "Correo",
+    newEmail: "Correo nuevo",
+    changeEmail: "Cambiar el correo",
+    emailSent: "Enviamos un enlace a {email}. Tu correo cambia cuando lo abras.",
+    linkedAccounts: "Cuentas vinculadas",
+    noLinkedAccounts: "No hay cuentas vinculadas.",
+    linkWith: "Vincular",
+    unlink: "Desvincular",
+    linked: "La cuenta qued\xF3 vinculada.",
+    ssoOnly: "A esta cuenta entras con el inicio de sesi\xF3n de tu empresa.",
+    members: "Miembros",
+    membersHidden: "Tu rol aqu\xED no te deja ver los miembros.",
+    organizationMissing: "No perteneces a esta organizaci\xF3n.",
+    memberYou: "t\xFA",
+    memberInvited: "invitado",
+    memberManager: "administra los miembros",
+    memberRole: "Rol",
+    memberAdd: "Agregar miembro",
+    memberAdded: "{email} ya es miembro.",
+    memberRemove: "Quitar",
+    memberRemoveConfirm: "\xBFQuitar a {who}?",
+    memberLeave: "Salir",
+    memberLeaveConfirm: "\xBFSalir de {org}? Necesitar\xE1s una invitaci\xF3n para volver.",
+    memberInviteAgain: "Enviar la invitaci\xF3n de nuevo",
+    memberInvitationSent: "La invitaci\xF3n va en camino.",
+    organization: "Organizaci\xF3n",
+    organizationRename: "Cambiar nombre",
+    organizationRenamed: "La organizaci\xF3n ahora se llama {name}.",
+    organizationArchive: "Archivar",
+    organizationArchiveConfirm: "\xBFArchivar {org}? Sus miembros ya no podr\xE1n entrar y solo el espacio de trabajo puede restaurarla.",
+    organizationArchived: "{org} qued\xF3 archivada.",
+    organizationDelete: "Eliminar organizaci\xF3n",
+    organizationDeleteConfirm: "\xBFEliminar {org} para siempre? Sus miembros la pierden y no se puede deshacer.",
+    organizationDeleted: "{org} qued\xF3 eliminada.",
+    yes: "S\xED",
+    cancel: "Cancelar",
+    termsChanged: "Nuestros t\xE9rminos cambiaron",
+    termsChangedHelp: "Para seguir, lee y acepta",
+    acceptTerms: "Aceptar",
+    errors: {
+      not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
+      last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
+      last_owner: "Una organizaci\xF3n conserva al menos un propietario: primero haz propietario a otro miembro.",
+      organization_not_found: "Esa organizaci\xF3n ya no existe.",
+      member_exists: "Esa persona ya pertenece a la organizaci\xF3n; su rol no cambi\xF3. C\xE1mbialo en la lista.",
+      already_member: "Esa persona ya pertenece a la organizaci\xF3n. Cambia su rol.",
+      unknown_role: "Escoge uno de los roles ofrecidos.",
+      user_not_active: "Esa cuenta est\xE1 desactivada.",
+      required: "Este dato es obligatorio.",
+      invalid_email: "Eso no parece un correo.",
+      too_short: `Usa al menos ${import_js3.MIN_PASSWORD} caracteres.`,
+      invalid_credentials: "El correo o la contrase\xF1a no son correctos.",
+      unavailable: "No se puede entrar en este momento. Intenta de nuevo en un momento.",
+      state_mismatch: "No se pudo completar el ingreso. Intenta de nuevo.",
+      cancelled: "El ingreso se cancel\xF3.",
+      email_taken: "Ese correo ya tiene una cuenta.",
+      email_unchanged: "Ese ya es tu correo.",
+      last_sign_in_method: "Primero agrega una contrase\xF1a o vincula otra cuenta: es tu \xFAnica forma de entrar.",
+      identity_already_linked: "Esa cuenta est\xE1 vinculada a otra persona.",
+      manual_linking_disabled: "Vincular cuentas est\xE1 desactivado en este workspace.",
+      invalid_token: "Este enlace no es v\xE1lido o ya venci\xF3. Pide uno nuevo.",
+      invalid_code: "Ese c\xF3digo no es correcto o ya venci\xF3.",
+      wrong_password: "La contrase\xF1a actual no es correcta.",
+      step_up_required: "Escribe tu contrase\xF1a actual.",
+      weak_password: "Elige una contrase\xF1a m\xE1s fuerte.",
+      unauthenticated: "Inicia sesi\xF3n primero.",
+      phone_refused: "No se pudo enviar el c\xF3digo a ese n\xFAmero.",
+      too_many_codes: "Ya se enviaron suficientes c\xF3digos. Usa el \xFAltimo o vuelve a entrar.",
+      phone_unavailable: "Aqu\xED no se pueden enviar c\xF3digos de esa forma.",
+      phone_already_set: "Primero quita el tel\xE9fono que tienes.",
+      phone_codes_unavailable: "Ahora no se pueden enviar c\xF3digos. Int\xE9ntalo en un momento.",
+      captcha_required: "Completa la verificaci\xF3n de que no eres un robot y vuelve a intentarlo.",
+      captcha_failed: "La verificaci\xF3n de que no eres un robot no pas\xF3. Int\xE9ntalo de nuevo.",
+      passkey_failed: "No se pudo usar la llave de acceso. Intenta de nuevo o entra de otra forma.",
+      passkey_exists: "Este dispositivo ya tiene una llave de acceso de tu cuenta.",
+      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso.",
+      sso_required: "Este correo entra con el inicio de sesi\xF3n de su empresa.",
+      sso_not_found: "Ninguna empresa usa inicio de sesi\xF3n propio con este correo.",
+      sso_failed: "No se pudo completar el ingreso con tu empresa. Intenta de nuevo.",
+      sso_unavailable: "Ahora no se puede llegar al inicio de sesi\xF3n de tu empresa. Intenta en un momento.",
+      invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
+      provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
+      connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo.",
+      password_disabled: "En este workspace no se entra con contrase\xF1a. Usa una de las otras formas.",
+      passkeys_disabled: "Las llaves de acceso est\xE1n desactivadas en este workspace."
+    }
+  }
+};
+var PlainButton = ({ variant: _variant, loading, children, ...p }) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("button", { ...p, "aria-busy": loading || void 0, children: [
+  loading && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Spinner, {}),
+  children
+] });
+var UnstyledButton = ({ variant: _variant, loading, children, ...p }) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("button", { ...p, "aria-busy": loading || void 0, children: [
+  loading && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Spinner, { plain: true }),
+    " "
+  ] }),
+  children
+] });
+function Spinner({ plain }) {
+  if (!plain) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "cauthy-spinner", "aria-hidden": "true" });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SpinnerIcon, {});
+}
+var LESS_MOTION = "(prefers-reduced-motion: reduce)";
+function watchMotion(changed) {
+  if (typeof window === "undefined" || typeof window.matchMedia !== "function") return () => {
+  };
+  const query = window.matchMedia(LESS_MOTION);
+  query.addEventListener?.("change", changed);
+  return () => query.removeEventListener?.("change", changed);
+}
+var stillHere = () => typeof window.matchMedia === "function" && window.matchMedia(LESS_MOTION).matches;
+var stillOnServer = () => true;
+function SpinnerIcon() {
+  const still = (0, import_react8.useSyncExternalStore)(watchMotion, stillHere, stillOnServer);
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("svg", { className: "cauthy-spinner-icon", width: "1em", height: "1em", viewBox: "0 0 16 16", fill: "none", "aria-hidden": "true", focusable: "false", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("circle", { cx: "8", cy: "8", r: "6.5", stroke: "currentColor", strokeOpacity: "0.25", strokeWidth: "2" }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("path", { d: "M14.5 8A6.5 6.5 0 0 0 8 1.5", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", children: !still && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("animateTransform", { attributeName: "transform", type: "rotate", from: "0 8 8", to: "360 8 8", dur: "0.7s", repeatCount: "indefinite" }) })
+  ] });
+}
+var PlainInput = (p) => /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("input", { ...p });
+var looks = /* @__PURE__ */ new Map();
+var loaded = /* @__PURE__ */ new Set();
+function loadFonts(fonts) {
+  if (typeof document === "undefined" || typeof FontFace === "undefined") return;
+  for (const f of fonts ?? []) {
+    const key = `${f.family}|${f.url}|${f.weight ?? ""}|${f.style ?? ""}`;
+    if (loaded.has(key) || !/^[A-Za-z0-9][A-Za-z0-9 _-]*$/.test(f.family) || !/^https:\/\/[^\s"'()]+\.woff2$/i.test(f.url)) continue;
+    loaded.add(key);
+    const face = new FontFace(f.family, `url("${f.url}") format("woff2")`, { weight: String(f.weight ?? "400"), style: f.style === "italic" ? "italic" : "normal", display: "swap" });
+    void face.load().then((ready) => document.fonts.add(ready), () => loaded.delete(key));
+  }
+}
+function useRoot(props) {
+  const { basePath } = useSession();
+  const store = useSessionStore();
+  const given = useProviderTheme();
+  const [workspace, setWorkspace] = (0, import_react8.useState)(null);
+  const wanted = !props.unstyled && props.workspaceLook !== false;
+  (0, import_react8.useEffect)(() => {
+    if (!props.unstyled && given) loadFonts(given.fonts);
+  }, [given, props.unstyled]);
+  (0, import_react8.useEffect)(() => {
+    if (!wanted) return;
+    let live = true;
+    let look = looks.get(basePath);
+    if (!look) {
+      look = store.auth.look();
+      looks.set(basePath, look);
+    }
+    void look.then((theme) => {
+      if (!live || !theme) return;
+      setWorkspace(theme);
+      loadFonts(theme.fonts);
+    });
+    return () => {
+      live = false;
+    };
+  }, [basePath, store, wanted]);
+  if (props.unstyled) return {};
+  const shown = wanted ? workspace : null;
+  return { "data-cauthy": "", style: (0, import_theme2.themeVariables)({ ...shown, ...given }) };
+}
+var turnstileScript = null;
+function loadTurnstile() {
+  const ready = () => window.turnstile;
+  if (ready()) return Promise.resolve(ready());
+  turnstileScript ?? (turnstileScript = new Promise((resolve, reject) => {
+    const script = document.createElement("script");
+    script.src = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";
+    script.async = true;
+    script.onload = () => ready() ? resolve(ready()) : reject(new Error("turnstile did not load"));
+    script.onerror = () => {
+      turnstileScript = null;
+      reject(new Error("turnstile did not load"));
+    };
+    document.head.appendChild(script);
+  }));
+  return turnstileScript;
+}
+function useChallenge(siteKey, locale) {
+  const box = (0, import_react8.useRef)(null);
+  const widget = (0, import_react8.useRef)(null);
+  const [token, setToken] = (0, import_react8.useState)("");
+  (0, import_react8.useEffect)(() => {
+    if (!siteKey || !box.current) return;
+    let gone = false;
+    void loadTurnstile().then((api) => {
+      if (gone || !box.current) return;
+      const id = api.render(box.current, {
+        sitekey: siteKey,
+        language: locale ?? "auto",
+        size: "flexible",
+        callback: (t) => setToken(t),
+        "expired-callback": () => setToken(""),
+        "error-callback": () => setToken("")
+      });
+      widget.current = { api, id };
+    }).catch(() => {
+    });
+    return () => {
+      gone = true;
+      if (widget.current) widget.current.api.remove(widget.current.id);
+      widget.current = null;
+    };
+  }, [siteKey, locale]);
+  const renew = () => {
+    setToken("");
+    if (widget.current) widget.current.api.reset(widget.current.id);
+  };
+  const node = siteKey ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { ref: box, className: "cauthy-challenge" }) : null;
+  return { node, token: token || void 0, renew };
+}
+function useMethods(auth) {
+  const [methods, setMethods] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => {
+    void auth.methods().then(setMethods);
+  }, []);
+  return methods;
+}
+function sitePath(to) {
+  return to && to.startsWith("/") && !to.startsWith("//") && !to.includes("\\") ? to : void 0;
+}
+function sameOrigin(to) {
+  const path = sitePath(to);
+  if (path || !to) return path;
+  try {
+    const url = new URL(to);
+    return url.origin === window.location.origin ? url.pathname + url.search + url.hash : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isPending(v) {
+  return typeof v?.then === "function";
+}
+function useForm(props, opts = {}) {
+  const t = { ...TEXTS2[props.locale ?? "en"], ...props.texts, errors: { ...TEXTS2[props.locale ?? "en"].errors, ...props.texts?.errors } };
+  const cx = (slot) => props.classNames?.[slot] ?? `cauthy-${slot}`;
+  const own = (slot) => props.classNames?.[slot];
+  const C = props.components ?? {};
+  const Button = C.Button ?? (props.unstyled ? UnstyledButton : PlainButton);
+  const Input = C.Input ?? PlainInput;
+  const [error, setOnlyError] = (0, import_react8.useState)(null);
+  const [problems, setProblems] = (0, import_react8.useState)({ list: [], round: 0 });
+  const setError = (0, import_react8.useCallback)((e) => {
+    setOnlyError(e);
+    setProblems((p) => p.list.length === 0 ? p : { list: [], round: p.round });
+  }, []);
+  const check = (...found) => {
+    const list = found.filter((e) => Boolean(e));
+    setOnlyError(null);
+    setProblems((p) => ({ list, round: list.length > 0 ? p.round + 1 : p.round }));
+    return list.length === 0;
+  };
+  const fieldError = (name) => problems.list.find((e) => e.field === name) ?? (error?.field === name ? error : null);
+  const firstWrong = (name) => problems.list[0]?.field === name ? problems.round : 0;
+  const [acting, setActing] = (0, import_react8.useState)(null);
+  const busy = acting !== null || opts.waiting === true;
+  const setBusy = (0, import_react8.useCallback)((on) => setActing(on === false ? null : on === true ? SUBMIT : on), []);
+  const loading = (key = SUBMIT) => acting === key;
+  const shown = (0, import_react8.useRef)(true);
+  (0, import_react8.useEffect)(() => {
+    shown.current = true;
+    const back = (e) => {
+      if (e.persisted) setActing(null);
+    };
+    window.addEventListener("pageshow", back);
+    return () => {
+      shown.current = false;
+      window.removeEventListener("pageshow", back);
+    };
+  }, []);
+  const hold = (after) => {
+    if (!isPending(after)) return;
+    const free = () => {
+      if (shown.current) setActing(null);
+    };
+    after.then(free, free);
+  };
+  const fail = (e) => {
+    setActing(null);
+    setError(e);
+  };
+  const [policy, setPolicy] = (0, import_react8.useState)(void 0);
+  const locale = props.locale ?? "en";
+  const say = (e) => {
+    if (props.texts?.errors?.[e.code] === void 0 && isPasswordRule(e)) return (0, import_js3.explainPasswordProblems)(e.reasons ?? [e.code], policy, locale);
+    return t.errors[e.code] ?? e.message;
+  };
+  const passwordRule = (0, import_js3.describePasswordPolicy)(policy, locale);
+  const done = (to) => {
+    setActing((a) => a ?? SUBMIT);
+    if (props.onSuccess) hold(props.onSuccess());
+    else window.location.assign(sitePath(to) ?? sameOrigin(props.returnTo) ?? "/");
+  };
+  const root = useRoot(opts.part ? { ...props, unstyled: true } : props);
+  const plain = props.unstyled === true;
+  return { t, cx, own, C, Button, Input, error, setError, fail, check, fieldError, firstWrong, busy, setBusy, loading, hold, say, done, root, plain, policy, setPolicy, passwordRule };
+}
+var SUBMIT = "submit";
+function Wrap(p) {
+  const { Form: OwnForm } = p.f.C;
+  const busy = p.busy ?? (p.f.busy || void 0);
+  if (OwnForm) {
+    const own = /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+      OwnForm,
+      {
+        as: p.as === "form" ? "form" : "div",
+        onSubmit: p.onSubmit,
+        noValidate: p.noValidate,
+        "aria-busy": busy,
+        className: p.slot ? p.f.own(p.slot) : void 0,
+        section: p.section,
+        children: p.children
+      }
+    );
+    return p.root?.["data-cauthy"] !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { ...p.root, children: own }) : own;
+  }
+  const Tag2 = p.as;
+  const children = p.busy && p.children === void 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Pending, { f: p.f }) : p.children;
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag2, { className: p.slot ? p.f.cx(p.slot) : void 0, ...p.root, onSubmit: p.onSubmit, noValidate: p.noValidate, "aria-busy": busy, children });
+}
+function Pending({ f }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: f.cx("pending"), children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Spinner, { plain: f.plain }) });
+}
+function Note({ f, children, footer }) {
+  const { Text } = f.C;
+  if (Text) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { as: "p", tone: "muted", size: footer ? "sm" : "md", children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { className: f.cx(footer ? "footer" : "notice"), children });
+}
+function Heading({ f, children }) {
+  const { Text } = f.C;
+  if (Text) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { as: "h2", size: "lg", children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("h2", { className: f.cx("heading"), children });
+}
+function Say({ f, tone, children }) {
+  const { Alert } = f.C;
+  if (Alert) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Alert, { tone, children });
+  if (tone === "danger") return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { role: "alert", "aria-live": "assertive", "aria-atomic": "true", className: f.cx("error"), children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { role: "status", "aria-live": "polite", "aria-atomic": "true", className: f.cx("notice"), children });
+}
+function Or({ f, children }) {
+  const { Divider } = f.C;
+  if (Divider) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Divider, { label: children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { className: f.cx("separator"), children });
+}
+function A({ f, href, newTab, children }) {
+  const { Link } = f.C;
+  if (Link) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Link, { href, newTab, children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("a", { className: f.cx("link"), href, target: newTab ? "_blank" : void 0, rel: newTab ? "noopener" : void 0, children });
+}
+function Tag({ f, tone, children, plain }) {
+  const { Badge } = f.C;
+  if (Badge) return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Badge, { tone, children })
+  ] });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_jsx_runtime3.Fragment, { children: plain });
+}
+function Check(p) {
+  const id = (0, import_react8.useId)();
+  const { f } = p;
+  const { Checkbox } = f.C;
+  if (Checkbox) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Checkbox, { id, name: p.name, checked: p.checked, required: p.required, disabled: f.busy, className: f.own("check"), onChange: p.onChange, children: p.children });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("label", { className: f.cx("check"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("input", { type: "checkbox", name: p.name, checked: p.checked, required: p.required, disabled: f.busy, onChange: (e) => p.onChange(e.target.checked) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: p.children })
+  ] });
+}
+function Pick(p) {
+  const made = (0, import_react8.useId)();
+  const id = p.id ?? made;
+  const { f } = p;
+  const { Select } = f.C;
+  const disabled = p.disabled || f.busy;
+  if (Select) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Select, { id, name: p.name, value: p.value, options: p.options, disabled, "aria-label": p.label, className: f.own("input"), onChange: p.onChange });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("select", { id, name: p.name, "aria-label": p.label, className: f.cx("input"), value: p.value, disabled, onChange: (e) => p.onChange(e.target.value), children: p.options.map((o) => /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("option", { value: o.value, children: o.label }, o.value)) });
+}
+function Labelled({ f, id, label, children }) {
+  const { Field: OwnField } = f.C;
+  if (OwnField) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(OwnField, { id, label, className: f.own("field"), children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("label", { className: f.cx("field"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: f.cx("label"), children: label }),
+    children
+  ] });
+}
+function Documents({ f, documents }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_jsx_runtime3.Fragment, { children: documents.map((d, i) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("span", { children: [
+    i > 0 && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+      f.t.and,
+      " "
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: d.url, newTab: true, children: d.kind === "terms" ? f.t.termsOfService : f.t.privacyPolicy }),
+    " "
+  ] }, d.kind)) });
+}
+var PASSWORD_RULES = ["needs_lowercase", "needs_uppercase", "needs_digit", "needs_symbol", "needs_classes", "breached"];
+function isPasswordRule(e) {
+  if (e.code === "weak_password" || PASSWORD_RULES.includes(e.code)) return true;
+  return (e.code === "too_short" || e.code === "too_long") && (e.field === "password" || e.field === "newPassword");
+}
+function newPasswordProblem(value, policy, field = "password") {
+  const bad = (0, import_js3.checkNewPassword)(value, policy);
+  if (!bad) return null;
+  return { code: bad.code, message: bad.message, field, ...bad.code === "required" ? {} : { reasons: (0, import_js3.passwordProblems)(value, policy) } };
+}
+function usePasswordPolicy(f, methods) {
+  const { setPolicy } = f;
+  (0, import_react8.useEffect)(() => {
+    if (methods?.password) setPolicy(methods.password);
+  }, [methods, setPolicy]);
+}
+function Field(p) {
+  const id = (0, import_react8.useId)();
+  const { f } = p;
+  const bad = f.fieldError(p.name);
+  const focus = f.firstWrong(p.name);
+  (0, import_react8.useEffect)(() => {
+    if (focus > 0 && typeof document !== "undefined") document.getElementById(id)?.focus();
+  }, [focus, id]);
+  const described = [bad ? `${id}-error` : "", p.hint ? `${id}-hint` : ""].filter(Boolean).join(" ");
+  const input = /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+    f.Input,
+    {
+      id,
+      name: p.name,
+      type: p.type,
+      value: p.value,
+      autoComplete: p.autoComplete,
+      required: p.required,
+      disabled: f.busy,
+      className: f.cx("input"),
+      "aria-invalid": bad ? true : void 0,
+      "aria-describedby": described || void 0,
+      onChange: (e) => p.onChange(e.target.value)
+    }
+  );
+  const { Field: OwnField } = f.C;
+  if (OwnField) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+      OwnField,
+      {
+        id,
+        label: p.label,
+        aside: p.aside,
+        help: p.hint && !bad ? p.hint : void 0,
+        error: bad ? f.say(bad) : void 0,
+        required: p.required,
+        className: f.own("field"),
+        children: input
+      }
+    );
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: f.cx("field"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("label", { className: f.cx("label"), htmlFor: id, children: [
+      p.label,
+      p.aside
+    ] }),
+    input,
+    p.hint && !bad && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { id: `${id}-hint`, className: f.cx("hint"), children: p.hint }),
+    bad && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { id: `${id}-error`, className: f.cx("fieldError"), children: f.say(bad) })
+  ] });
+}
+function returnedError() {
+  if (typeof window === "undefined") return null;
+  const code = new URLSearchParams(window.location.search).get("auth_error");
+  return code ? { code, message: "That sign-in could not be completed. Try again." } : null;
+}
+function takeToken(name) {
+  if (typeof window === "undefined") return null;
+  const url = new URL(window.location.href);
+  const token = url.searchParams.get(name);
+  if (token === null) return null;
+  url.searchParams.delete(name);
+  window.history.replaceState(window.history.state, "", url.pathname + url.search + url.hash);
+  return token;
+}
+function useMailedToken(name, open) {
+  const opened = (0, import_react8.useRef)(false);
+  (0, import_react8.useEffect)(() => {
+    if (opened.current) return;
+    opened.current = true;
+    open(takeToken(name));
+  }, []);
+}
+function SecondStepForm(p) {
+  const { f, auth } = p;
+  const [code, setCode] = (0, import_react8.useState)("");
+  const [phoneWay, setPhoneWay] = (0, import_react8.useState)(null);
+  const [phoneSent, setPhoneSent] = (0, import_react8.useState)("");
+  (0, import_react8.useEffect)(() => {
+    void auth.signIn.mfaMethods().then((r) => {
+      if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push, email: r.email });
+    });
+  }, []);
+  const sendEmail = async () => {
+    f.setBusy("email");
+    f.setError(null);
+    const r = await auth.signIn.mfaSendEmail();
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setPhoneSent(r.sentTo);
+  };
+  const [pushNumber, setPushNumber] = (0, import_react8.useState)(0);
+  const pushWait = (0, import_react8.useRef)(null);
+  (0, import_react8.useEffect)(() => () => pushWait.current?.abort(), []);
+  const sendPush = async () => {
+    f.setBusy("push");
+    f.setError(null);
+    const r = await auth.signIn.mfaPush();
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setPushNumber(r.number);
+    pushWait.current?.abort();
+    const ctl = new AbortController();
+    pushWait.current = ctl;
+    const done = await auth.signIn.mfaPushWait({ signal: ctl.signal });
+    if (ctl.signal.aborted) return;
+    setPushNumber(0);
+    if (!done.ok) return f.setError(done.error);
+    f.setBusy("push");
+    f.done();
+  };
+  const sendCode = async () => {
+    f.setBusy("phone");
+    f.setError(null);
+    const r = await auth.signIn.mfaSendCode();
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setPhoneSent(r.sentTo);
+  };
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.signIn.mfa({ code });
+    if (!r.ok) return f.fail(r.error);
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const to = phoneWay?.phone?.number ?? "";
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("email"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
+    pushNumber > 0 ? f.C.Text ? (
+      // The application's text: the number to pick drawn large, by its own rules.
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { role: "status", "aria-live": "polite", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.C.Text, { as: "p", children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.C.Text, { as: "p", size: "lg", children: pushNumber }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.C.Text, { as: "p", tone: "muted", children: f.t.pushWaiting })
+      ] })
+    ) : /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { children: f.t.pushWaiting })
+    ] }) : phoneWay?.push && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("push"), disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
+    phoneWay?.phone && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("phone"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+  ] });
+}
+function ProviderButtons(p) {
+  const { f } = p;
+  const pick = (id) => {
+    f.setBusy(`provider:${id}`);
+    p.onPick(id);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_jsx_runtime3.Fragment, { children: p.providers.map((provider) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(f.Button, { type: "button", variant: "secondary", loading: f.loading(`provider:${provider.id}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => pick(provider.id), children: [
+    provider.iconUrl && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("img", { src: provider.iconUrl, alt: "", width: 18, height: 18, className: f.cx("providerIcon") }),
+    f.t.continueWith,
+    " ",
+    provider.name
+  ] }, provider.id)) });
+}
+function signInOffers(methods) {
+  const password = methods?.passwordSignIn !== false;
+  return { password, email: password || methods?.magicLink === true || methods?.sso === true, passkey: methods?.passkey === true };
+}
+function SignIn(props) {
+  const auth = useAuth();
+  const [methods, setMethods] = (0, import_react8.useState)(null);
+  const f = useForm(props, { waiting: methods === null });
+  const [email, setEmail] = (0, import_react8.useState)("");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [code, setCode] = (0, import_react8.useState)("");
+  const [remember, setRemember] = (0, import_react8.useState)(false);
+  const rememberNow = (0, import_react8.useRef)(false);
+  rememberNow.current = remember && methods?.persistentSessions === true;
+  const [step, setStep] = (0, import_react8.useState)("password");
+  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const offers = signInOffers(methods);
+  const passwordOn = offers.password;
+  const autofill = (0, import_react8.useRef)(null);
+  const [offer, setOffer] = (0, import_react8.useState)(0);
+  const [company, setCompany] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => {
+    if (!methods?.sso || (0, import_js3.checkEmail)(email) !== null) return setCompany(null);
+    let current = true;
+    const t = setTimeout(() => {
+      void auth.signIn.ssoDiscover({ email }).then((r) => {
+        if (current) setCompany(r.ok && r.status === "found" ? r.connection : null);
+      });
+    }, 350);
+    return () => {
+      current = false;
+      clearTimeout(t);
+    };
+  }, [email, methods]);
+  const toCompany = () => {
+    autofill.current?.abort();
+    f.setBusy("sso");
+    auth.signIn.sso({ email }, { returnTo: props.returnTo, remember: rememberNow.current });
+  };
+  (0, import_react8.useEffect)(() => {
+    void auth.methods().then(setMethods);
+    const back = returnedError();
+    if (back) f.setError(back);
+  }, []);
+  useMailedToken("ml_token", (token) => {
+    if (!token) return;
+    setStep("opening");
+    const query = new URLSearchParams(window.location.search);
+    void auth.signIn.magicLinkVerify({ token, remember: query.get("remember") === "1" }).then((r) => {
+      if (r.ok) return f.done(query.get("return_to") ?? void 0);
+      f.setError(r.error);
+      setStep("password");
+    });
+  });
+  (0, import_react8.useEffect)(() => {
+    if (step !== "password" || !methods?.passkeyHere) return;
+    const ctl = new AbortController();
+    autofill.current = ctl;
+    void auth.signIn.passkeyAutofill({ signal: ctl.signal, remember: () => rememberNow.current }).then((r) => {
+      if (ctl.signal.aborted) return;
+      if (r.ok) return f.done();
+      if (r.error.code === "cancelled") return;
+      f.setError(r.error);
+      if (r.error.code === "passkey_failed" || r.error.code === "step_expired") setOffer((n) => n + 1);
+    });
+    return () => ctl.abort();
+  }, [step, methods, offer]);
+  const submit = async (e) => {
+    e.preventDefault();
+    autofill.current?.abort();
+    if (step === "password" && company?.enforced) {
+      f.setError(null);
+      return toCompany();
+    }
+    if (step === "link") {
+      if (company?.enforced) return toCompany();
+      if (f.check((0, import_js3.checkEmail)(email))) return sendLink();
+      return;
+    }
+    if (step === "password" && !passwordOn) {
+      if (company) return toCompany();
+      if (methods?.magicLink && f.check((0, import_js3.checkEmail)(email))) return sendLink();
+      return;
+    }
+    if (step === "password" && !f.check((0, import_js3.checkEmail)(email), (0, import_js3.checkPassword)(password))) return;
+    f.setBusy(true);
+    f.setError(null);
+    const r = step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token, remember: rememberNow.current });
+    if (step === "password") challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
+    if (!r.ok) {
+      setOffer((n) => n + 1);
+      return f.fail(r.error);
+    }
+    if (r.status === "mfa_required") {
+      setPassword("");
+      f.setBusy(false);
+      return setStep("code");
+    }
+    f.done("returnTo" in r && typeof r.returnTo === "string" ? r.returnTo : void 0);
+  };
+  const usePasskey = async () => {
+    autofill.current?.abort();
+    f.setBusy("passkey");
+    f.setError(null);
+    const r = await auth.signIn.passkey({ returnTo: props.returnTo, locale: props.locale, email, remember: rememberNow.current });
+    if (r.ok && r.status === "redirected") return;
+    if (r.ok) return f.done();
+    f.setBusy(false);
+    setOffer((n) => n + 1);
+    if (r.error.code !== "cancelled") f.setError(r.error);
+  };
+  const sendLink = async () => {
+    autofill.current?.abort();
+    f.setBusy("link");
+    f.setError(null);
+    const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token, create: props.createAccounts, returnTo: props.returnTo, remember: rememberNow.current });
+    f.setBusy(false);
+    challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
+    if (!r.ok) return f.setError(r.error);
+    setStep("sent");
+  };
+  const openLink = () => {
+    autofill.current?.abort();
+    f.setError(null);
+    setStep("link");
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const asksEmail = offers.email;
+  if (step === "opening") return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "form", root: f.root, busy: true });
+  if (step === "sent") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.signInLinkSent }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.codeFromMail }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+    ] });
+  }
+  if (step === "code") return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SecondStepForm, { f, auth });
+  if (step === "link") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.linkHelp }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
+      challenge.node,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading("link"), disabled: f.busy, className: f.cx("button"), children: f.t.sendMeTheLink }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => {
+        f.setError(null);
+        setStep("password");
+      }, children: f.t.back })
+    ] });
+  }
+  const quickLink = methods?.magicLink === true && passwordOn;
+  const keep = methods?.persistentSessions === true && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Check, { f, name: "remember", checked: remember, onChange: setRemember, children: f.t.keepSignedIn });
+  const quick = offers.passkey || (methods?.providers.length ?? 0) > 0 || quickLink;
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    keep,
+    offers.passkey && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("passkey"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ProviderButtons, { f, providers: methods?.providers ?? [], onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo, remember: rememberNow.current }) }),
+    quickLink && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: openLink, children: f.t.emailMeALink }),
+    asksEmail && quick && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Or, { f, children: f.t.orWithEmail }),
+    asksEmail && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
+    company && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(f.Button, { type: "button", variant: company.enforced ? "primary" : "secondary", loading: f.loading("sso"), disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
+      f.t.continueWith,
+      " ",
+      company.name
+    ] }),
+    company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.ssoOnly }),
+    !company?.enforced && passwordOn && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+        Field,
+        {
+          f,
+          name: "password",
+          type: "password",
+          label: f.t.password,
+          value: password,
+          autoComplete: "current-password",
+          required: true,
+          onChange: setPassword,
+          aside: props.links?.forgotPassword ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
+        }
+      ),
+      challenge.node,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
+    ] }),
+    !company?.enforced && !passwordOn && methods?.magicLink && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+      challenge.node,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading("link"), disabled: f.busy, className: f.cx("button"), children: f.t.sendMeTheLink })
+    ] }),
+    methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Note, { f, footer: true, children: [
+      f.t.noAccount,
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signUp, children: f.t.createAccount })
+    ] })
+  ] });
+}
+function GoogleOneTap(props) {
+  const auth = useAuth();
+  const unauthenticated = auth.status === "unauthenticated";
+  (0, import_react8.useEffect)(() => {
+    if (!unauthenticated) return;
+    const ctl = new AbortController();
+    void auth.signIn.googleOneTap({ signal: ctl.signal, context: props.context, remember: props.remember }).then((r) => {
+      if (!r.ok || ctl.signal.aborted) return;
+      if (props.onSuccess) props.onSuccess();
+      else {
+        const to = sameOrigin(props.returnTo);
+        if (to) window.location.assign(to);
+      }
+    });
+    return () => ctl.abort();
+  }, [unauthenticated]);
+  return null;
+}
+function SignUp(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [name, setName] = (0, import_react8.useState)("");
+  const [organization, setOrganization] = (0, import_react8.useState)("");
+  const [email, setEmail] = (0, import_react8.useState)("");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [sent, setSent] = (0, import_react8.useState)(false);
+  const methods = useMethods(auth);
+  usePasswordPolicy(f, methods);
+  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const [acceptLegal, setAcceptLegal] = (0, import_react8.useState)(false);
+  const [consents, setConsents] = (0, import_react8.useState)({});
+  const legal = methods?.legal;
+  const guest = auth.session?.user.isAnonymous === true;
+  const submit = async (e) => {
+    e.preventDefault();
+    const asksCompany = methods?.organization?.ask === true;
+    if (!f.check(
+      asksCompany && (0, import_js4.checkOrganization)(organization, methods?.organization?.required === true),
+      (0, import_js3.checkName)(name),
+      (0, import_js3.checkEmail)(email),
+      newPasswordProblem(password, f.policy)
+    )) return;
+    f.setBusy(true);
+    f.setError(null);
+    const r = guest ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({
+      name,
+      email,
+      password,
+      ...methods?.organization?.ask ? { organization } : {},
+      ...legal ? { acceptLegal, consents } : {},
+      captchaToken: challenge.token
+    });
+    challenge.renew();
+    if (!r.ok) return f.fail(r.error);
+    if (r.status === "verification_required") {
+      f.setBusy(false);
+      return setSent(true);
+    }
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const passwordOn = methods?.passwordSignIn !== false;
+  const providers = guest || methods?.organization?.required ? [] : methods?.providers ?? [];
+  if (sent) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.checkEmail }),
+      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
+    ] });
+  }
+  if (methods === null) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "form", root: f.root, busy: true });
+  const footer = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Note, { f, footer: true, children: [
+    f.t.haveAccount,
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.signIn })
+  ] });
+  if (!passwordOn) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+      footer
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    providers.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Or, { f, children: f.t.orWithEmail }),
+    methods.organization?.ask && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "organization", type: "text", label: f.t.company, value: organization, autoComplete: "organization", required: methods.organization.required, onChange: setOrganization }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.password, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    legal && legal.documents.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Check, { f, name: "acceptLegal", checked: acceptLegal, required: true, onChange: setAcceptLegal, children: [
+      f.t.iAccept,
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Documents, { f, documents: legal.documents })
+    ] }),
+    legal?.consentPurposes.map((p) => /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Check, { f, name: `consent_${p.key}`, checked: consents[p.key] === true, required: p.required, onChange: (on) => setConsents({ ...consents, [p.key]: on }), children: p.label }, p.key)),
+    challenge.node,
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
+    footer
+  ] });
+}
+function ForgotPassword(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [email, setEmail] = (0, import_react8.useState)("");
+  const [sent, setSent] = (0, import_react8.useState)(false);
+  const challenge = useChallenge(useMethods(auth)?.captchaSiteKey, props.locale);
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.forgotPassword({ email, captchaToken: challenge.token });
+    f.setBusy(false);
+    challenge.renew();
+    if (!r.ok) return f.setError(r.error);
+    setSent(true);
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  if (sent) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.linkSent }),
+      props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
+    challenge.node,
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.sendLink }),
+    props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, footer: true, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn }) })
+  ] });
+}
+function ResetPassword(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [token, setToken] = (0, import_react8.useState)(null);
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [changed, setChanged] = (0, import_react8.useState)(false);
+  usePasswordPolicy(f, useMethods(auth));
+  useMailedToken("token", (t) => {
+    setToken(t ?? "");
+    if (!t) f.setError({ code: "invalid_token", message: "This link is not valid, or it has expired." });
+  });
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.resetPassword({ token: token ?? "", password });
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setChanged(true);
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn });
+  if (changed) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.passwordChanged }),
+      back
+    ] });
+  }
+  if (token === "") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      props.links?.forgotPassword && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.forgotPassword, children: f.t.forgotPassword })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.newPassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy || token === null, className: f.cx("button"), children: f.t.savePassword })
+  ] });
+}
+function VerifyEmail(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [state, setState] = (0, import_react8.useState)("confirming");
+  useMailedToken("token", (token) => {
+    if (!token) {
+      f.setError({ code: "invalid_token", message: "This link is not valid, or it has expired." });
+      return setState("failed");
+    }
+    void auth.verifyEmail({ token }).then((r) => {
+      if (r.ok && r.status === "signed_in") return f.done();
+      if (r.ok) return setState("confirmed");
+      f.setError(r.error);
+      setState("failed");
+    });
+  });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, busy: state === "confirming", children: [
+    state === "confirming" && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.confirming }),
+    state === "confirmed" && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.emailConfirmed }),
+    state === "failed" && f.error && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(f.error) }),
+    state !== "confirming" && props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn })
+  ] });
+}
+function AcceptInvite(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [token, setToken] = (0, import_react8.useState)("");
+  const [invitation, setInvitation] = (0, import_react8.useState)(null);
+  const [state, setState] = (0, import_react8.useState)("opening");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  usePasswordPolicy(f, useMethods(auth));
+  useMailedToken("token", (t) => {
+    if (!t) return setState("invalid");
+    setToken(t);
+    void auth.invitation(t).then((r) => {
+      if (r.ok) {
+        setInvitation(r.invitation);
+        return setState("ready");
+      }
+      if (r.error.code !== "invalid_token") f.setError(r.error);
+      setState("invalid");
+    });
+  });
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.acceptInvitation(token, password);
+    if (!r.ok) {
+      f.setBusy(false);
+      if (r.error.code === "invalid_token") return setState("invalid");
+      return f.setError(r.error);
+    }
+    props.onSaved?.({ kind: "invitation.accepted", email: invitation?.email ?? "", ...invitation?.organization ? { organization: invitation.organization } : {} });
+    if (r.status === "mfa_required") {
+      f.setBusy(false);
+      return setState("code");
+    }
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const back = props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: props.links.signIn, children: f.t.backToSignIn });
+  if (state === "opening") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "form", root: f.root, busy: true, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.openingInvitation }) });
+  }
+  if (state === "invalid") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: general ? f.say(general) : f.t.invitationInvalid }),
+      back
+    ] });
+  }
+  if (state === "code") return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SecondStepForm, { f, auth });
+  const workspace = invitation?.workspace ?? "";
+  const heading = invitation?.organization ? f.t.invitedToOrganization.replace("{organization}", invitation.organization).replace("{workspace}", workspace) : f.t.invitedTo.replace("{workspace}", workspace);
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "form", root: f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: heading }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.invitedAs.replace("{email}", invitation?.email ?? "") }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("input", { type: "email", name: "username", autoComplete: "username", value: invitation?.email ?? "", readOnly: true, hidden: true }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.choosePassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.acceptInvite })
+  ] });
+}
+function PendingTerms(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [owed, setOwed] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => {
+    void auth.account.legal().then((r) => setOwed(r.ok ? r.pending : []));
+  }, []);
+  if (!owed || owed.length === 0) return null;
+  const accept = async () => {
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.account.acceptLegal({ kinds: owed.map((d) => d.kind) });
+    if (!r.ok) return f.fail(r.error);
+    const after = props.onSuccess?.();
+    if (isPending(after)) await Promise.resolve(after).catch(() => void 0);
+    f.setBusy(false);
+    setOwed([]);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "form", root: f.root, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.termsChanged }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Note, { f, children: [
+      f.t.termsChangedHelp,
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Documents, { f, documents: owed })
+    ] }),
+    f.error && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(f.error) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), onClick: () => void accept(), children: f.t.acceptTerms })
+  ] });
+}
+var ACCOUNT_SECTIONS = ["profile", "email", "password", "linked", "secondStep", "phone", "passkeys", "agents", "sessions"];
+function useSection(props) {
+  const f = useForm(props, { part: true });
+  const [done, setDone] = (0, import_react8.useState)(null);
+  const run = async (action, key = SUBMIT, leaves = false) => {
+    f.setBusy(key);
+    f.setError(null);
+    setDone(null);
+    const r = await action();
+    if (!r.ok) f.fail(r.error);
+    else if (!leaves) f.setBusy(false);
+    return r;
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  return { f, done, setDone, run, general };
+}
+function Account(props) {
+  const auth = useAuth();
+  const { accountUrl } = useSession();
+  const f = useForm(props);
+  const [account, setAccount] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => {
+    void auth.account.get().then(setAccount);
+  }, []);
+  if (account === null) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "account", root: f.root, busy: true });
+  const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleString());
+  const mfa = (mfaEnabled) => setAccount({ ...account, mfaEnabled });
+  const part = (section) => {
+    switch (section) {
+      case "profile":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ProfilePart, { props, account, onSaved: setAccount });
+      case "email":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(EmailPart, { props, account });
+      case "password":
+        return account.hasPassword ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(PasswordPart, { props }) : null;
+      case "linked":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LinkedPart, { props });
+      case "secondStep":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SecondStepPart, { props, account, onChanged: mfa });
+      case "phone":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(PhonePart, { props, account, onChanged: mfa });
+      case "passkeys":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(PasskeysPart, { props, account, accountUrl: accountUrl(), when });
+      case "agents":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(AgentsPart, { props, when });
+      case "sessions":
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SessionsPart, { props, when });
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "account", root: f.root, children: (props.sections ?? ACCOUNT_SECTIONS).map((section) => /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react8.Fragment, { children: part(section) }, section)) });
+}
+function AccountProfile(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["profile"] });
+}
+function AccountEmail(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["email"] });
+}
+function AccountPassword(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["password"] });
+}
+function AccountLinked(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["linked"] });
+}
+function AccountSecondStep(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["secondStep"] });
+}
+function AccountPhone(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["phone"] });
+}
+function AccountPasskeys(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["passkeys"] });
+}
+function AccountAgents(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["agents"] });
+}
+function AccountSessions(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Account, { ...props, sections: ["sessions"] });
+}
+var OWNER = "owner";
+function memberActions(seat, m) {
+  const reachable = m.role !== OWNER || seat.role === OWNER;
+  return {
+    changeRole: seat.can.manageMembers && reachable,
+    // Leaving is anybody's; removing somebody else is cauthy:members:remove.
+    remove: m.you || seat.can.removeMembers && reachable,
+    inviteAgain: seat.can.manageMembers && m.invited
+  };
+}
+function rolesToGive(seat, roles, only) {
+  const mine = seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+  return only ? mine.filter((c) => only(c.role, c)) : mine;
+}
+function OrganizationMembers(props) {
+  const auth = useAuth();
+  const { root } = useForm(props);
+  const { f, done, setDone, run } = useSection(props);
+  const problem = f.error && f.error.field !== "email" && f.error.field !== "name" ? f.error : null;
+  const [seat, setSeat] = (0, import_react8.useState)(void 0);
+  const [members, setMembers] = (0, import_react8.useState)(null);
+  const [roles, setRoles] = (0, import_react8.useState)([]);
+  const [email, setEmail] = (0, import_react8.useState)("");
+  const [role, setRole] = (0, import_react8.useState)("");
+  const [name, setName] = (0, import_react8.useState)("");
+  const [asking, setAsking] = (0, import_react8.useState)(null);
+  const [adding, setAdding] = (0, import_react8.useState)(false);
+  const [renamingOpen, setRenamingOpen] = (0, import_react8.useState)(false);
+  const [gone, setGone] = (0, import_react8.useState)(null);
+  const id = props.organizationId;
+  const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
+  const hidden = (action) => props.hide?.includes(action) === true;
+  const saved = (event) => props.onSaved?.(event);
+  const load = async () => {
+    const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
+    const mine = list.find((o) => o.id === id) ?? null;
+    setSeat(mine);
+    if (mine) setName(mine.name);
+    setMembers(people);
+    setRoles(choices ?? []);
+    const offered = mine ? rolesToGive(mine, choices ?? [], props.roles) : [];
+    if (offered.length > 0 && !offered.some((c) => c.role === role)) setRole(offered[0].role);
+  };
+  (0, import_react8.useEffect)(() => {
+    void load();
+  }, [id]);
+  if (gone !== null) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "account", root, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: gone }) });
+  if (seat === void 0) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "account", root, busy: true });
+  if (seat === null) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "account", root, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.organizationMissing }) });
+  const manage = seat.can.manageMembers;
+  const giveable = rolesToGive(seat, roles, props.roles);
+  const roleName = (c) => props.roleLabel?.(c) || c.name || c.role;
+  const label = (r) => {
+    const c = roles.find((x) => x.role === r);
+    return c ? roleName(c) : r;
+  };
+  const add = async (e) => {
+    e.preventDefault();
+    if (!f.check((0, import_js3.checkEmail)(email))) return;
+    const r = await run(() => auth.organizations.add(id, { email, role, locale: props.locale }), "add");
+    if (!r.ok) return;
+    setEmail("");
+    setAdding(false);
+    setDone(f.t.memberAdded.replace("{email}", r.member.email));
+    saved({ kind: "member.added", organizationId: id, userId: r.member.userId, email: r.member.email, role: r.member.role || role });
+    await load();
+  };
+  const change = async (m, next) => {
+    const r = await run(() => auth.organizations.setRole(id, m.userId, next), `role:${m.userId}`);
+    if (!r.ok) return;
+    saved({ kind: "member.role_changed", organizationId: id, userId: m.userId, role: next, previousRole: m.role });
+    await load();
+  };
+  const remove = async (m) => {
+    setAsking(null);
+    const r = await run(() => auth.organizations.remove(id, m.userId), `remove:${m.userId}`);
+    if (!r.ok) return;
+    saved({ kind: m.you ? "member.left" : "member.removed", organizationId: id, userId: m.userId });
+    if (m.you) setSeat(null);
+    else await load();
+  };
+  const inviteAgain = async (m) => {
+    const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }), `invite:${m.userId}`);
+    if (!r.ok) return;
+    setDone(f.t.memberInvitationSent);
+    saved({ kind: "member.invited_again", organizationId: id, userId: m.userId });
+  };
+  const rename = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.organizations.rename(id, name), "rename");
+    if (!r.ok) return;
+    setSeat(r.organization);
+    setName(r.organization.name);
+    setRenamingOpen(false);
+    setDone(f.t.organizationRenamed.replace("{name}", r.organization.name));
+    saved({ kind: "organization.renamed", organizationId: id, name: r.organization.name });
+  };
+  const close = async (how) => {
+    setAsking(null);
+    const r = await run(() => how === "archive" ? auth.organizations.archive(id) : auth.organizations.delete(id), how);
+    if (!r.ok) return;
+    setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+    saved({ kind: how === "archive" ? "organization.archived" : "organization.deleted", organizationId: id });
+  };
+  const ask = (key, title, question, yes) => {
+    const { Confirm } = f.C;
+    if (!Confirm) return setAsking(key);
+    void Confirm({ title, body: question, confirmLabel: title, cancelLabel: f.t.cancel, danger: true }).then((ok) => {
+      if (ok) yes();
+    });
+  };
+  const confirming = (text, label2, yes) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("span", { role: "group", "aria-label": label2, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: text }),
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", disabled: f.busy, className: f.cx("providerButton"), onClick: yes, children: f.t.yes }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+  ] });
+  const leaveQuestion = f.t.memberLeaveConfirm.replace("{org}", seat.name);
+  const archiveQuestion = f.t.organizationArchiveConfirm.replace("{org}", seat.name);
+  const deleteQuestion = f.t.organizationDeleteConfirm.replace("{org}", seat.name);
+  const archiving = seat.can.archive && !hidden("archive");
+  const deleting = seat.can.delete && !hidden("delete");
+  const renaming = seat.can.update && !hidden("rename");
+  const alone = members !== null && members.every((m) => m.you);
+  const addOpen = adding || alone;
+  const open = (form) => {
+    setDone(null);
+    f.setError(null);
+    if (form === "add") setAdding(true);
+    else setRenamingOpen(true);
+  };
+  const cancelAdd = () => {
+    setEmail("");
+    f.setError(null);
+    setAdding(false);
+  };
+  const cancelRename = () => {
+    setName(seat.name);
+    f.setError(null);
+    setRenamingOpen(false);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "account", root, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "members", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Heading, { f, children: [
+        f.t.members,
+        " \xB7 ",
+        seat.name
+      ] }),
+      problem && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(problem) }),
+      members === null ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.membersHidden }),
+        auth.session && !hidden("leave") && (asking === auth.session.user.id ? confirming(leaveQuestion, f.t.memberLeave, () => void remove({ userId: auth.session.user.id, you: true })) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+          f.Button,
+          {
+            type: "button",
+            variant: "danger",
+            loading: f.loading(`remove:${auth.session.user.id}`),
+            disabled: f.busy,
+            className: f.cx("providerButton"),
+            onClick: () => ask(auth.session.user.id, f.t.memberLeave, leaveQuestion, () => void remove({ userId: auth.session.user.id, you: true })),
+            children: f.t.memberLeave
+          }
+        ))
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("sessions"), children: members.map((m) => {
+        const who = m.name || m.email;
+        const may = memberActions(seat, m);
+        const removable = may.remove && !(m.you && hidden("leave"));
+        const question = m.you ? leaveQuestion : f.t.memberRemoveConfirm.replace("{who}", who);
+        const action = m.you ? f.t.memberLeave : f.t.memberRemove;
+        const choices = giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable];
+        return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("li", { className: f.cx("session"), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("span", { children: [
+            who,
+            m.name ? ` \xB7 ${m.email}` : "",
+            m.you && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag, { f, plain: ` (${f.t.memberYou})`, children: f.t.memberYou }),
+            f.C.Badge ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+              m.invited && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag, { f, tone: "warning", plain: "", children: f.t.memberInvited }),
+              m.manager && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag, { f, tone: "success", plain: "", children: f.t.memberManager })
+            ] }) : `${m.invited ? ` \xB7 ${f.t.memberInvited}` : ""}${m.manager ? ` \xB7 ${f.t.memberManager}` : ""}`,
+            " \xB7 ",
+            when(m.since)
+          ] }),
+          " ",
+          may.changeRole && giveable.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+            Pick,
+            {
+              f,
+              name: `role_${m.userId}`,
+              label: `${f.t.memberRole}: ${who}`,
+              value: m.role,
+              disabled: f.busy,
+              options: choices.map((c) => ({ value: c.role, label: roleName(c) })),
+              onChange: (next) => void change(m, next)
+            }
+          ) : f.C.Badge ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.C.Badge, { tone: "neutral", children: label(m.role) }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: label(m.role) }),
+          " ",
+          asking === m.userId ? confirming(question, action, () => void remove(m)) : /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+            may.inviteAgain && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading(`invite:${m.userId}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
+            removable && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading(`remove:${m.userId}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask(m.userId, action, question, () => void remove(m)), children: action })
+          ] })
+        ] }, m.userId);
+      }) }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+    ] }),
+    manage && giveable.length > 0 && (addOpen ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "add-member", onSubmit: add, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.memberAdd }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(AddRole, { f, value: role, options: giveable.map((c) => ({ value: c.role, label: roleName(c) })), onChange: setRole }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading("add"), disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd }),
+      !alone && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancelAdd })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Wrap, { f, as: "div", slot: "section", section: "add-member", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => open("add"), children: f.t.memberAdd }) })),
+    (renaming || archiving || deleting) && /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "organization", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.organization }),
+      renaming && (renamingOpen ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", section: "rename", onSubmit: rename, noValidate: true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "organization", required: true, onChange: setName }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading("rename"), disabled: f.busy, className: f.cx("button"), children: f.t.organizationRename }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancelRename })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: seat.name }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => open("rename"), children: f.t.organizationRename })
+      ] })),
+      asking === "archive" ? confirming(archiveQuestion, f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(deleteQuestion, f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+        archiving && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading("archive"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask("archive", f.t.organizationArchive, archiveQuestion, () => void close("archive")), children: f.t.organizationArchive }),
+        deleting && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading("delete"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => ask("delete", f.t.organizationDelete, deleteQuestion, () => void close("delete")), children: f.t.organizationDelete })
+      ] })
+    ] })
+  ] });
+}
+function AddRole({ f, value, options, onChange }) {
+  const id = (0, import_react8.useId)();
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Labelled, { f, id, label: f.t.memberRole, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Pick, { f, id, name: "role", value, options, onChange }) });
+}
+function PasskeysPart({ props, account, accountUrl, when }) {
+  const auth = useAuth();
+  const { f, done, setDone, run, general } = useSection(props);
+  const [here, setHere] = (0, import_react8.useState)(null);
+  const [list, setList] = (0, import_react8.useState)([]);
+  const [name, setName] = (0, import_react8.useState)("");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [adding, setAdding] = (0, import_react8.useState)(false);
+  (0, import_react8.useEffect)(() => {
+    void auth.methods().then((m) => {
+      const can2 = m.passkeyHere && (0, import_js3.canUsePasskeys)();
+      setHere(can2);
+      if (can2) void auth.account.passkeys().then(setList);
+    });
+  }, []);
+  if (here === null) return null;
+  if (!here) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "passkeys", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.passkeys }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: accountUrl, children: f.t.managePasskeys })
+    ] });
+  }
+  const add = async (e, kind = "device") => {
+    e?.preventDefault();
+    if (account.hasPassword && !f.check((0, import_js3.checkPassword)(password))) return;
+    const r = await run(() => auth.account.addPasskey({ name, password, kind }), kind === "security_key" ? "security_key" : SUBMIT);
+    if (!r.ok) {
+      if (r.error.code === "cancelled") f.setError(null);
+      return;
+    }
+    setList([...list, r.passkey]);
+    setName("");
+    setPassword("");
+    setAdding(false);
+    setDone(f.t.passkeyAdded);
+    props.onSaved?.({ kind: "passkey.added", id: r.passkey.id });
+  };
+  const remove = async (id) => {
+    const r = await run(() => auth.account.removePasskey(id), `remove:${id}`);
+    if (!r.ok) return;
+    setList(list.filter((p) => p.id !== id));
+    props.onSaved?.({ kind: "passkey.removed", id });
+  };
+  const cancel = () => {
+    setName("");
+    setPassword("");
+    f.setError(null);
+    setAdding(false);
+  };
+  const listed = list.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.noPasskeys }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("sessions"), children: list.map((p) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("li", { className: f.cx("session"), children: [
+    p.name || f.t.passkeyUnnamed,
+    p.kind !== "unknown" && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag, { f, plain: ` \xB7 ${f.t.passkeyKinds[p.kind]}`, children: f.t.passkeyKinds[p.kind] }),
+    " \xB7 ",
+    when(p.createdAt),
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading(`remove:${p.id}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void remove(p.id), children: f.t.removePasskey })
+  ] }, p.id)) });
+  if (list.length > 0 && !adding) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "passkeys", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.passkeys }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.passkeysHelp }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      listed,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => {
+        setDone(null);
+        f.setError(null);
+        setAdding(true);
+      }, children: f.t.addAnotherPasskey }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "passkeys", onSubmit: add, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.passkeys }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.passkeysHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    listed,
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "name", type: "text", label: f.t.passkeyName, value: name, autoComplete: "off", onChange: setName }),
+    account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.addPasskeyDevice }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("security_key"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void add(null, "security_key"), children: f.t.addSecurityKey }),
+    list.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel }),
+    done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+  ] });
+}
+function Cancel({ f, onClick }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick, children: f.t.cancel });
+}
+function RecoveryCodes({ f, codes }) {
+  const [copied, setCopied] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => setCopied(null), [codes]);
+  const copy = async () => {
+    try {
+      await navigator.clipboard.writeText(codes.join("\n"));
+      setCopied(true);
+    } catch {
+      setCopied(false);
+    }
+  };
+  const download = () => {
+    const file = new Blob([`${f.t.recoveryCodes}
+
+${codes.join("\n")}
+`], { type: "text/plain;charset=utf-8" });
+    const url = URL.createObjectURL(file);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = "recovery-codes.txt";
+    document.body.appendChild(a);
+    a.click();
+    a.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 0);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.keepCodes }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("codes"), children: codes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("code", { children: c }) }, c)) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", className: f.cx("providerButton"), onClick: () => void copy(), children: f.t.copyCodes }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", className: f.cx("providerButton"), onClick: download, children: f.t.downloadCodes }),
+    copied === true && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: f.t.codesCopied }),
+    copied === false && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.t.codesNotCopied })
+  ] });
+}
+function ProfilePart({ props, account, onSaved }) {
+  const auth = useAuth();
+  const { f, done, setDone, run, general } = useSection(props);
+  const [name, setName] = (0, import_react8.useState)(account.name);
+  const [editing, setEditing] = (0, import_react8.useState)(account.name.trim() === "");
+  const submit = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.update({ name }));
+    if (!r.ok) return;
+    onSaved(r.account);
+    setName(r.account.name);
+    setEditing(r.account.name.trim() === "");
+    setDone(f.t.saved);
+    props.onSaved?.({ kind: "profile.saved", name: r.account.name });
+  };
+  const cancel = () => {
+    setName(account.name);
+    f.setError(null);
+    setEditing(false);
+  };
+  if (!editing) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "profile", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.profile }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: account.name }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: account.email }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => {
+        setDone(null);
+        setEditing(true);
+      }, children: f.t.change }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "profile", onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.profile }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: account.email }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.save }),
+    account.name.trim() !== "" && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel }),
+    done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+  ] });
+}
+function EmailPart({ props, account }) {
+  const auth = useAuth();
+  const { f, done, setDone, run, general } = useSection(props);
+  const [email, setEmail] = (0, import_react8.useState)("");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [editing, setEditing] = (0, import_react8.useState)(false);
+  const submit = async (e) => {
+    e.preventDefault();
+    if (!f.check((0, import_js3.checkEmail)(email), account.hasPassword && (0, import_js3.checkPassword)(password))) return;
+    const r = await run(() => auth.account.changeEmail({ email, password }));
+    if (!r.ok) return;
+    setEmail("");
+    setPassword("");
+    setEditing(false);
+    setDone(f.t.emailSent.replace("{email}", r.email));
+    props.onSaved?.({ kind: "email.change_requested", email: r.email });
+  };
+  const cancel = () => {
+    setEmail("");
+    setPassword("");
+    f.setError(null);
+    setEditing(false);
+  };
+  if (!editing) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "email", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.emailAddress }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: account.email }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => {
+        setDone(null);
+        setEditing(true);
+      }, children: f.t.changeEmail }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "email", onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.emailAddress }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: account.email }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "email", type: "email", label: f.t.newEmail, value: email, autoComplete: "email", required: true, onChange: setEmail }),
+    account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.changeEmail }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel })
+  ] });
+}
+function LinkedPart({ props }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [linked, setLinked] = (0, import_react8.useState)(null);
+  const [offered, setOffered] = (0, import_react8.useState)([]);
+  const [came, setCame] = (0, import_react8.useState)(null);
+  (0, import_react8.useEffect)(() => {
+    void auth.account.identities().then(setLinked);
+    void auth.methods().then((m) => setOffered(m.providers));
+    const back = typeof window === "undefined" ? null : new URLSearchParams(window.location.search);
+    const provider = back?.get("linked");
+    if (provider) {
+      setCame(provider);
+      props.onSaved?.({ kind: "identity.linked", provider });
+    } else if (back?.get("auth_error")) f.setError({ code: back.get("auth_error"), message: "That account could not be linked. Try again." });
+  }, []);
+  if (linked === null) return null;
+  const name = (id) => offered.find((p) => p.id === id)?.name ?? id;
+  const unlink = async (provider) => {
+    const r = await run(() => auth.account.unlink(provider), `unlink:${provider}`);
+    if (!r.ok) return;
+    setLinked(linked.filter((x) => x.provider !== provider));
+    props.onSaved?.({ kind: "identity.unlinked", provider });
+  };
+  const here = typeof window === "undefined" ? void 0 : window.location.pathname;
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "linked", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.linkedAccounts }),
+    came && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: f.t.linked }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    linked.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.noLinkedAccounts }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("sessions"), children: linked.map((x) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("li", { className: f.cx("session"), children: [
+      name(x.provider),
+      x.email ? ` \xB7 ${x.email}` : "",
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading(`unlink:${x.provider}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void unlink(x.provider), children: f.t.unlink })
+    ] }, x.provider)) }),
+    offered.filter((p) => !linked.some((x) => x.provider === p.id)).map((p) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+      f.Button,
+      {
+        type: "button",
+        variant: "secondary",
+        loading: f.loading(`link:${p.id}`),
+        disabled: f.busy,
+        className: f.cx("providerButton"),
+        onClick: () => {
+          f.setBusy(`link:${p.id}`);
+          auth.account.link(p.id, { returnTo: here });
+        },
+        children: [
+          f.t.linkWith,
+          " ",
+          p.name
+        ]
+      },
+      p.id
+    ))
+  ] });
+}
+function PasswordPart({ props }) {
+  const auth = useAuth();
+  const { f, done, setDone, run, general } = useSection(props);
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [newPassword, setNewPassword] = (0, import_react8.useState)("");
+  const [editing, setEditing] = (0, import_react8.useState)(false);
+  usePasswordPolicy(f, useMethods(auth));
+  const submit = async (e) => {
+    e.preventDefault();
+    if (!f.check((0, import_js3.checkPassword)(password), newPasswordProblem(newPassword, f.policy, "newPassword"))) return;
+    const r = await run(() => auth.account.changePassword({ password, newPassword }));
+    if (!r.ok) return;
+    setPassword("");
+    setNewPassword("");
+    setEditing(false);
+    setDone(f.t.passwordChangedHere);
+    props.onSaved?.({ kind: "password.changed" });
+  };
+  const cancel = () => {
+    setPassword("");
+    setNewPassword("");
+    f.setError(null);
+    setEditing(false);
+  };
+  if (!editing) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "password", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.password }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.passwordSet }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", disabled: f.busy, className: f.cx("providerButton"), onClick: () => {
+        setDone(null);
+        setEditing(true);
+      }, children: f.t.changePassword }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "success", children: done })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "password", onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.password }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "newPassword", type: "password", label: f.t.newPassword, value: newPassword, autoComplete: "new-password", required: true, onChange: setNewPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.changePassword }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel })
+  ] });
+}
+function SecondStepPart({ props, account, onChanged }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [code, setCode] = (0, import_react8.useState)("");
+  const [setup, setSetup] = (0, import_react8.useState)(null);
+  const [codes, setCodes] = (0, import_react8.useState)(null);
+  const [asking, setAsking] = (0, import_react8.useState)(null);
+  const start = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.mfa.setup({ password }));
+    if (r.ok) setSetup({ secret: r.secret, otpauthUri: r.otpauthUri, qr: r.qr ?? "" });
+  };
+  const confirm = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.mfa.verify({ code }));
+    if (!r.ok) return;
+    setSetup(null);
+    setCode("");
+    setPassword("");
+    setCodes(r.recoveryCodes);
+    onChanged(true);
+    props.onSaved?.({ kind: "mfa.enabled" });
+  };
+  const turnOff = async (key) => {
+    const r = await run(() => auth.account.mfa.disable({ password }), key);
+    if (!r.ok) return;
+    setPassword("");
+    setAsking(null);
+    setCodes(null);
+    onChanged(false);
+    props.onSaved?.({ kind: "mfa.disabled" });
+  };
+  const renew = async (key) => {
+    const r = await run(() => auth.account.mfa.recoveryCodes({ password }), key);
+    if (!r.ok) return;
+    setPassword("");
+    setAsking(null);
+    setCodes(r.recoveryCodes);
+    props.onSaved?.({ kind: "recovery_codes.regenerated" });
+  };
+  const press = (what) => {
+    f.setError(null);
+    if (!account.hasPassword) return void (what === "off" ? turnOff(what) : renew(what));
+    setPassword("");
+    setCodes(null);
+    setAsking(what);
+  };
+  const cancel = () => {
+    setPassword("");
+    f.setError(null);
+    setAsking(null);
+  };
+  const passwordField = account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword });
+  if (setup) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "secondStep", onSubmit: confirm, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.secondStep }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.addToApp }),
+      setup.qr && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("img", { className: f.cx("qr"), src: setup.qr, width: 220, height: 220, alt: f.t.qrAlt }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("code", { className: f.cx("secret"), children: setup.secret }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(A, { f, href: setup.otpauthUri, children: f.t.openInApp }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+    ] });
+  }
+  if (!account.mfaEnabled) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "secondStep", onSubmit: start, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.secondStep }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.secondStepOff }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      passwordField,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.turnOn })
+    ] });
+  }
+  if (asking) {
+    const submit = (e) => {
+      e.preventDefault();
+      void (asking === "off" ? turnOff(SUBMIT) : renew(SUBMIT));
+    };
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "secondStep", onSubmit: submit, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.secondStep }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.secondStepOn }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      passwordField,
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: asking === "off" ? "danger" : "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: asking === "off" ? f.t.turnOff : f.t.newRecoveryCodes }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "secondStep", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.secondStep }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.secondStepOn }),
+    codes && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(RecoveryCodes, { f, codes }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading("off"), disabled: f.busy, className: f.cx("button"), onClick: () => press("off"), children: f.t.turnOff }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "secondary", loading: f.loading("codes"), disabled: f.busy, className: f.cx("providerButton"), onClick: () => press("codes"), children: f.t.newRecoveryCodes })
+  ] });
+}
+function PhonePart({ props, account, onChanged }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [ways, setWays] = (0, import_react8.useState)(null);
+  const [number, setNumber] = (0, import_react8.useState)("");
+  const [channel, setChannel] = (0, import_react8.useState)("sms");
+  const [password, setPassword] = (0, import_react8.useState)("");
+  const [code, setCode] = (0, import_react8.useState)("");
+  const [sentTo, setSentTo] = (0, import_react8.useState)("");
+  const [codes, setCodes] = (0, import_react8.useState)(null);
+  const [removing, setRemoving] = (0, import_react8.useState)(false);
+  const load = () => auth.account.mfa.factors().then((w) => {
+    setWays(w);
+    if (w && w.phoneChannels.length > 0 && !w.phoneChannels.includes(channel)) setChannel(w.phoneChannels[0]);
+  });
+  (0, import_react8.useEffect)(() => {
+    void load();
+  }, []);
+  if (!ways || ways.phoneChannels.length === 0) return null;
+  const add = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.mfa.addPhone({ phone: number, channel, password }));
+    if (r.ok) setSentTo(r.sentTo);
+  };
+  const confirm = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.mfa.verifyPhone({ code }));
+    if (!r.ok) return;
+    setSentTo("");
+    setCode("");
+    setPassword("");
+    setNumber("");
+    if (r.recoveryCodes.length > 0) setCodes(r.recoveryCodes);
+    onChanged(true);
+    props.onSaved?.({ kind: "phone.added", channel });
+    await load();
+  };
+  const remove = async (key) => {
+    const r = await run(() => auth.account.mfa.removePhone({ password }), key);
+    if (!r.ok) return;
+    setPassword("");
+    setRemoving(false);
+    setCodes(null);
+    await load();
+    const left = await auth.account.mfa.factors();
+    onChanged(Boolean(left?.totp));
+    props.onSaved?.({ kind: "phone.removed" });
+  };
+  const press = () => {
+    f.setError(null);
+    if (!account.hasPassword) return void remove("remove");
+    setPassword("");
+    setRemoving(true);
+  };
+  const cancel = () => {
+    setPassword("");
+    f.setError(null);
+    setRemoving(false);
+  };
+  const passwordField = account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword });
+  if (sentTo) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "phone", onSubmit: confirm, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.phone }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.codeSent.replace("{to}", sentTo) }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+    ] });
+  }
+  if (ways.phone) {
+    const by = ways.phone.channel === "whatsapp" ? f.t.byWhatsapp : ways.phone.channel === "sms" ? f.t.bySms : "";
+    const on = /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Note, { f, children: [
+      f.t.phoneOn.replace("{to}", ways.phone.number),
+      by && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Tag, { f, plain: ` \xB7 ${by}`, children: by })
+    ] });
+    if (removing) {
+      return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "phone", onSubmit: (e) => {
+        e.preventDefault();
+        void remove(SUBMIT);
+      }, noValidate: true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.phone }),
+        on,
+        general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+        passwordField,
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "danger", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.removePhone }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Cancel, { f, onClick: cancel })
+      ] });
+    }
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "div", slot: "section", section: "phone", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.phone }),
+      on,
+      codes && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(RecoveryCodes, { f, codes }),
+      general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading("remove"), disabled: f.busy, className: f.cx("button"), onClick: press, children: f.t.removePhone })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "form", slot: "section", section: "phone", onSubmit: add, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.phone }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: `${f.t.phoneOff} ${f.t.phoneHelp}` }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Field, { f, name: "phone", type: "tel", label: f.t.phone, value: number, autoComplete: "tel", required: true, onChange: setNumber }),
+    ways.phoneChannels.length > 1 && f.C.Select && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ChannelPick, { f, value: channel, channels: ways.phoneChannels, onChange: setChannel }),
+    ways.phoneChannels.length > 1 && !f.C.Select && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: f.cx("field"), role: "radiogroup", children: ways.phoneChannels.map((c) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("label", { className: f.cx("label"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("input", { type: "radio", name: "channel", value: c, checked: channel === c, disabled: f.busy, onChange: () => setChannel(c) }),
+      " ",
+      c === "whatsapp" ? f.t.byWhatsapp : f.t.bySms
+    ] }, c)) }),
+    passwordField,
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "submit", variant: "primary", loading: f.loading(), disabled: f.busy, className: f.cx("button"), children: f.t.addPhone })
+  ] });
+}
+function AgentsPart({ props, when }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [list, setList] = (0, import_react8.useState)([]);
+  (0, import_react8.useEffect)(() => {
+    void auth.account.agents().then(setList);
+  }, []);
+  if (list.length === 0) return null;
+  const disconnect = async (id) => {
+    const r = await run(() => auth.account.disconnectAgent(id), `disconnect:${id}`);
+    if (!r.ok) return;
+    setList(list.filter((a) => a.id !== id));
+    props.onSaved?.({ kind: "agent.disconnected", id });
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "agents", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.agents }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Note, { f, children: f.t.agentsHelp }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("sessions"), children: list.map((a) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("li", { className: f.cx("session"), children: [
+      a.name || f.t.anAgent,
+      a.redirectHost ? ` (${a.redirectHost})` : "",
+      " \u2192 ",
+      a.resource.name,
+      a.scopes.length > 0 ? ` \xB7 ${a.scopes.map((s) => s.description || s.name).join(", ")}` : "",
+      " \xB7 ",
+      when(a.lastUsedAt),
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading(`disconnect:${a.id}`), disabled: f.busy, className: f.cx("providerButton"), onClick: () => void disconnect(a.id), children: f.t.disconnect })
+    ] }, a.id)) })
+  ] });
+}
+function SessionsPart({ props, when }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [sessions, setSessions] = (0, import_react8.useState)([]);
+  (0, import_react8.useEffect)(() => {
+    void auth.account.sessions().then(setSessions);
+  }, []);
+  const end = async () => {
+    const r = await run(() => auth.account.signOutEverywhere(), SUBMIT, true);
+    if (!r.ok) return;
+    props.onSaved?.({ kind: "sessions.ended" });
+    if (props.onSignedOut) f.hold(props.onSignedOut());
+    else window.location.assign("/");
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Wrap, { f, as: "section", slot: "section", section: "sessions", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Heading, { f, children: f.t.sessions }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("ul", { className: f.cx("sessions"), children: sessions.map((s, i) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("li", { className: f.cx("session"), children: [
+      s.device || f.t.unknownDevice,
+      " \xB7 ",
+      s.ip,
+      " \xB7 ",
+      when(s.createdAt)
+    ] }, i)) }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Say, { f, tone: "danger", children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(f.Button, { type: "button", variant: "danger", loading: f.loading(), disabled: f.busy, className: f.cx("button"), onClick: () => void end(), children: f.t.signOutEverywhere })
+  ] });
+}
+function ChannelPick({ f, value, channels, onChange }) {
+  const id = (0, import_react8.useId)();
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Labelled, { f, id, label: f.t.channel, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+    Pick,
+    {
+      f,
+      id,
+      name: "channel",
+      value,
+      options: channels.map((c) => ({ value: c, label: c === "whatsapp" ? f.t.byWhatsapp : f.t.bySms })),
+      onChange: (c) => onChange(c)
+    }
+  ) });
+}
+
+// src/organizations-view.tsx
+var import_jsx_runtime4 = require("react/jsx-runtime");
+var TEXTS3 = {
+  en: { title: "Your organizations", none: "You do not belong to any organization yet.", loading: "Loading your organizations\u2026", failed: "Your organizations could not be loaded.", retry: "Try again" },
+  es: { title: "Tus organizaciones", none: "Todav\xEDa no perteneces a ninguna organizaci\xF3n.", loading: "Cargando tus organizaciones\u2026", failed: "No se pudieron cargar tus organizaciones.", retry: "Intentar de nuevo" }
+};
+function Organizations(props) {
+  const { system, defaultOrganizationId, onSelect, showMembers, listClassNames, ...members } = props;
+  const { organizations, loading, error, reload } = useOrganizations({ system });
+  const [picked, setPicked] = (0, import_react10.useState)(defaultOrganizationId ?? null);
+  const heading = (0, import_react10.useId)();
+  const look = useThemeVariables();
+  const t = TEXTS3[props.locale ?? "en"];
+  const cx = (part) => listClassNames?.[part] ?? (props.unstyled ? void 0 : `cauthy-${part}`);
+  const root = props.unstyled ? {} : { "data-cauthy": "", style: look };
+  const current = organizations.find((o) => o.id === picked) ?? organizations[0] ?? null;
+  if (loading && organizations.length === 0) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("section", { className: cx("organizations"), ...root, "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { className: cx("notice"), role: "status", children: t.loading }) });
+  }
+  if (error && organizations.length === 0) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("section", { className: cx("organizations"), ...root, "aria-busy": loading || void 0, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { className: cx("error"), role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: t.failed }),
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("button", { type: "button", className: cx("retry"), disabled: loading, onClick: () => void reload(), children: t.retry })
+    ] });
+  }
+  if (organizations.length === 0) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("section", { className: cx("organizations"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { className: cx("notice"), children: t.none }) });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("section", { className: cx("organizations"), ...root, "aria-labelledby": heading, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("h2", { id: heading, className: cx("heading"), children: t.title }),
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("ul", { className: cx("organizationList"), children: organizations.map((o) => /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
+      "button",
+      {
+        type: "button",
+        className: cx("organization"),
+        "aria-current": o.id === current?.id ? "true" : void 0,
+        onClick: () => {
+          setPicked(o.id);
+          onSelect?.(o);
+        },
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { children: o.name }),
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: cx("organizationRole"), children: o.role })
+        ]
+      }
+    ) }, o.id)) }),
+    showMembers !== false && current && /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(OrganizationMembers, { ...members, organizationId: current.id }, current.id)
+  ] });
+}
+
+// src/index.ts
+var import_js5 = require("@cauthyhq/js");
+var import_theme3 = require("@cauthyhq/js/theme");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AcceptInvite,
+  Account,
+  AccountAgents,
+  AccountEmail,
+  AccountLinked,
+  AccountPasskeys,
+  AccountPassword,
+  AccountPhone,
+  AccountProfile,
+  AccountSecondStep,
+  AccountSessions,
+  CauthyError,
+  CauthyProvider,
+  ForgotPassword,
+  GoogleOneTap,
+  OrganizationMembers,
+  Organizations,
+  PendingTerms,
+  ResetPassword,
+  SignIn,
+  SignUp,
+  UserButton,
+  VerifyEmail,
+  can,
+  canAutofillPasskeys,
+  canUsePasskeys,
+  createAuthClient,
+  createSessionStore,
+  createSignInFlow,
+  definePolicy,
+  initialsOf,
+  themeFromCss,
+  themeFromStackmyth,
+  themeVariables,
+  tokensFromStackmyth,
+  unwrap,
+  useAuth,
+  useOrganizations,
+  useSession,
+  useSignInFlow
+});
+//# sourceMappingURL=index.js.map