@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.5

package/dist/identity/ui/SignInErrorView.js

@@ -0,0 +1,53 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useMemo, useRef } from 'react';
+import { Link as RouterLink } from 'react-router-dom';
+import { Box, Button, Card, CardContent, Stack, Typography, useTheme } from '@mui/material';
+import { useIdentityWebAdapters } from '../headless/index.js';
+import { createSignInErrorContent } from './sign-in-error-content.js';
+/**
+ * Full-page screen for a failed sign-in (#652), in the visual language of
+ * `LoginPage`: a centered card on the theme's default background.
+ *
+ * Refusals the person can act on (not on the allowlist, deactivated, cancelled)
+ * use calm `info`/`warning` palette colours; only real faults use `error`.
+ * The copy comes from {@link createSignInErrorContent}, naming the identity
+ * adapters' `appName`; nothing from the URL is rendered.
+ *
+ * @param props - see {@link SignInErrorViewProps}.
+ * @returns the screen.
+ *
+ * @stability stable
+ */
+export function SignInErrorView({ code, onSignInWithDifferentAccount, onTryAgain, loginPath = '/login', }) {
+    const theme = useTheme();
+    const headingRef = useRef(null);
+    const { appName = 'this app' } = useIdentityWebAdapters();
+    const content = useMemo(() => createSignInErrorContent(appName), [appName]);
+    const { severity, Icon, headline, explanation, nextSteps, primaryAction } = content[code];
+    const accent = theme.palette[severity];
+    // Move focus to the heading so a screen reader announces the outcome and
+    // keyboard users start at the top of the content.
+    useEffect(() => {
+        headingRef.current?.focus();
+    }, [code]);
+    return (_jsx(Box, { sx: {
+            minHeight: '100vh',
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+            backgroundColor: theme.palette.background.default,
+            p: 2,
+        }, children: _jsx(Card, { sx: { maxWidth: 440, width: '100%', boxShadow: theme.shadows[10] }, children: _jsx(CardContent, { sx: { p: { xs: 3, sm: 4 } }, children: _jsxs(Stack, { spacing: 3, sx: { alignItems: 'center', textAlign: 'center' }, children: [_jsx(Box, { "aria-hidden": true, sx: {
+                                width: 72,
+                                height: 72,
+                                borderRadius: '50%',
+                                display: 'flex',
+                                alignItems: 'center',
+                                justifyContent: 'center',
+                                color: accent.main,
+                                backgroundColor: theme.palette.action.hover,
+                                border: 2,
+                                borderColor: accent.main,
+                            }, children: _jsx(Icon, { sx: { fontSize: 36 } }) }), _jsxs(Box, { role: severity === 'error' ? 'alert' : 'status', children: [_jsx(Typography, { ref: headingRef, tabIndex: -1, variant: "h5", component: "h1", sx: { fontWeight: 'bold', outline: 'none' }, children: headline }), _jsx(Typography, { color: "text.secondary", sx: { mt: 1 }, children: explanation })] }), _jsx(Stack, { component: "ul", spacing: 1, sx: { m: 0, p: 0, listStyle: 'none', width: '100%' }, children: nextSteps.map((step) => (_jsx(Typography, { component: "li", variant: "body2", children: step }, step))) }), _jsxs(Stack, { spacing: 1.5, sx: { width: '100%' }, children: [primaryAction === 'different-account' && (_jsx(Button, { fullWidth: true, size: "large", variant: "contained", onClick: onSignInWithDifferentAccount, children: "Sign in with a different account" })), primaryAction === 'try-again' && (_jsx(Button, { fullWidth: true, size: "large", variant: "contained", onClick: onTryAgain, children: "Try again" })), _jsx(Button, { fullWidth: true, size: "large", variant: primaryAction === 'none' ? 'contained' : 'text', component: RouterLink, to: loginPath, children: "Back to sign in" })] })] }) }) }) }));
+}
+//# sourceMappingURL=SignInErrorView.js.map

package/dist/identity/ui/SignInErrorView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInErrorView.js","sourceRoot":"","sources":["../../../src/identity/ui/SignInErrorView.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAwB,MAAM,4BAA4B,CAAC;AAsB5F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EACJ,4BAA4B,EAC5B,UAAU,EACV,SAAS,GAAG,QAAQ,GACC;IACrB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,GAAG,UAAU,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvC,yEAAyE;IACzE,kDAAkD;IAClD,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,CACL,KAAC,GAAG,IACF,EAAE,EAAE;YACF,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,QAAQ;YACpB,cAAc,EAAE,QAAQ;YACxB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO;YACjD,CAAC,EAAE,CAAC;SACL,YAED,KAAC,IAAI,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,YACtE,KAAC,WAAW,IAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YACtC,MAAC,KAAK,IAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,aAClE,KAAC,GAAG,yBAEF,EAAE,EAAE;gCACF,KAAK,EAAE,EAAE;gCACT,MAAM,EAAE,EAAE;gCACV,YAAY,EAAE,KAAK;gCACnB,OAAO,EAAE,MAAM;gCACf,UAAU,EAAE,QAAQ;gCACpB,cAAc,EAAE,QAAQ;gCACxB,KAAK,EAAE,MAAM,CAAC,IAAI;gCAClB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;gCAC3C,MAAM,EAAE,CAAC;gCACT,WAAW,EAAE,MAAM,CAAC,IAAI;6BACzB,YAED,KAAC,IAAI,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAI,GAC1B,EAEN,MAAC,GAAG,IAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,aAClD,KAAC,UAAU,IACT,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,CAAC,CAAC,EACZ,OAAO,EAAC,IAAI,EACZ,SAAS,EAAC,IAAI,EACd,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAE1C,QAAQ,GACE,EACb,KAAC,UAAU,IAAC,KAAK,EAAC,gBAAgB,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAC7C,WAAW,GACD,IACT,EAEN,KAAC,KAAK,IACJ,SAAS,EAAC,IAAI,EACd,OAAO,EAAE,CAAC,EACV,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAEnD,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACvB,KAAC,UAAU,IAAY,SAAS,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,YAClD,IAAI,IADU,IAAI,CAER,CACd,CAAC,GACI,EAER,MAAC,KAAK,IAAC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aACvC,aAAa,KAAK,mBAAmB,IAAI,CACxC,KAAC,MAAM,IACL,SAAS,QACT,IAAI,EAAC,OAAO,EACZ,OAAO,EAAC,WAAW,EACnB,OAAO,EAAE,4BAA4B,iDAG9B,CACV,EACA,aAAa,KAAK,WAAW,IAAI,CAChC,KAAC,MAAM,IAAC,SAAS,QAAC,IAAI,EAAC,OAAO,EAAC,OAAO,EAAC,WAAW,EAAC,OAAO,EAAE,UAAU,0BAE7D,CACV,EACD,KAAC,MAAM,IACL,SAAS,QACT,IAAI,EAAC,OAAO,EACZ,OAAO,EAAE,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EACxD,SAAS,EAAE,UAAU,EACrB,EAAE,EAAE,SAAS,gCAGN,IACH,IACF,GACI,GACT,GACH,CACP,CAAC;AACJ,CAAC"}

package/dist/identity/ui/device/ActivationSuccess.d.ts

@@ -0,0 +1,7 @@
+interface ActivationSuccessProps {
+    success: boolean;
+    message: string;
+}
+export declare function ActivationSuccess({ success, message }: ActivationSuccessProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=ActivationSuccess.d.ts.map

package/dist/identity/ui/device/ActivationSuccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActivationSuccess.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/device/ActivationSuccess.tsx"],"names":[],"mappings":"AAOA,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,sBAAsB,+BAuD7E"}

package/dist/identity/ui/device/ActivationSuccess.js

@@ -0,0 +1,19 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Typography, Alert, Button, Stack } from '@mui/material';
+import { CheckCircle as CheckCircleIcon, Cancel as CancelIcon, } from '@mui/icons-material';
+import { useNavigate } from 'react-router-dom';
+export function ActivationSuccess({ success, message }) {
+    const navigate = useNavigate();
+    return (_jsxs(Box, { sx: { textAlign: 'center' }, children: [_jsx(Box, { sx: {
+                    display: 'flex',
+                    justifyContent: 'center',
+                    mb: 3,
+                }, children: success ? (_jsx(CheckCircleIcon, { sx: {
+                        fontSize: 80,
+                        color: 'success.main',
+                    } })) : (_jsx(CancelIcon, { sx: {
+                        fontSize: 80,
+                        color: 'error.main',
+                    } })) }), _jsx(Typography, { variant: "h5", sx: { fontWeight: 'bold' }, gutterBottom: true, children: success ? 'Device Authorized!' : 'Device Access Denied' }), _jsx(Alert, { severity: success ? 'success' : 'info', sx: { mb: 3, textAlign: 'left' }, children: message }), success && (_jsx(Typography, { variant: "body2", color: "text.secondary", sx: { mb: 3 }, children: "You can now close this page and return to your device." })), _jsxs(Stack, { direction: "row", spacing: 2, sx: { justifyContent: 'center' }, children: [_jsx(Button, { variant: "outlined", onClick: () => navigate('/'), children: "Go to Home" }), !success && (_jsx(Button, { variant: "contained", onClick: () => window.location.reload(), children: "Try Another Code" }))] })] }));
+}
+//# sourceMappingURL=ActivationSuccess.js.map

package/dist/identity/ui/device/ActivationSuccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActivationSuccess.js","sourceRoot":"","sources":["../../../../src/identity/ui/device/ActivationSuccess.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,WAAW,IAAI,eAAe,EAC9B,MAAM,IAAI,UAAU,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAO/C,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAA0B;IAC5E,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,OAAO,CACL,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAC9B,KAAC,GAAG,IACF,EAAE,EAAE;oBACF,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,QAAQ;oBACxB,EAAE,EAAE,CAAC;iBACN,YAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,eAAe,IACd,EAAE,EAAE;wBACF,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,cAAc;qBACtB,GACD,CACH,CAAC,CAAC,CAAC,CACF,KAAC,UAAU,IACT,EAAE,EAAE;wBACF,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,YAAY;qBACpB,GACD,CACH,GACG,EAEN,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,YAAY,kBAC9D,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,GAC7C,EAEb,KAAC,KAAK,IAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,YAC5E,OAAO,GACF,EAEP,OAAO,IAAI,CACV,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,uEAEnD,CACd,EAED,MAAC,KAAK,IAAC,SAAS,EAAC,KAAK,EAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,aACjE,KAAC,MAAM,IAAC,OAAO,EAAC,UAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,2BAE9C,EACR,CAAC,OAAO,IAAI,CACX,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,iCAE1D,CACV,IACK,IACJ,CACP,CAAC;AACJ,CAAC"}

package/dist/identity/ui/device/CredentialGrantNotice.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The "what am I actually granting?" banner above the Approve / Deny buttons.
+ *
+ * Issue #141 let the device flow mint a ~90-day personal access token instead
+ * of a short-lived session, chosen by the REQUESTING DEVICE via
+ * `clientInfo.tokenType`. The approving user saw no difference: a phishing
+ * device asking for the 90-day credential rendered exactly like a laptop asking
+ * for a week-long session. Consent to something you were not shown is not
+ * consent, and this component is where that is repaired.
+ *
+ * TWO CASES, DELIBERATELY ASYMMETRIC:
+ *
+ *   - `session` keeps today's calm, informational banner verbatim. It is the
+ *     ordinary case — the browser-driven activation that sends no `tokenType`
+ *     at all — and dressing it up in warning colours would teach people that
+ *     the yellow banner is just what this page looks like. That habit is
+ *     precisely what would make the PAT banner useless.
+ *   - `pat` switches severity, icon, title and copy, and names the lifetime,
+ *     the "survives sign-out" property, and where to revoke it.
+ *
+ * WHY NO EXTRA CONFIRMATION STEP: the decision here is already deliberate —
+ * the user typed or followed a code, and Approve/Deny are the only two things
+ * on screen. A second "are you sure?" dialog adds a click, not information,
+ * and the well-documented effect of a modal between a person and a button they
+ * have already decided to press is that they learn to dismiss it. What was
+ * missing was never a speed bump; it was the FACTS, in front of the first
+ * click. Revocability (below) is what makes a wrong "Approve" recoverable, so
+ * the mitigation is telling people where the undo lives — not making the
+ * mistake take two clicks instead of one.
+ */
+import { type DeviceCredentialKind } from '../../headless/index.js';
+interface CredentialGrantNoticeProps {
+    kind: DeviceCredentialKind;
+}
+export declare function CredentialGrantNotice({ kind }: CredentialGrantNoticeProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=CredentialGrantNotice.d.ts.map

package/dist/identity/ui/device/CredentialGrantNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialGrantNotice.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/device/CredentialGrantNotice.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AAEjC,UAAU,0BAA0B;IAClC,IAAI,EAAE,oBAAoB,CAAC;CAC5B;AAWD,wBAAgB,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,0BAA0B,+BAsEzE"}

package/dist/identity/ui/device/CredentialGrantNotice.js

@@ -0,0 +1,72 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The "what am I actually granting?" banner above the Approve / Deny buttons.
+ *
+ * Issue #141 let the device flow mint a ~90-day personal access token instead
+ * of a short-lived session, chosen by the REQUESTING DEVICE via
+ * `clientInfo.tokenType`. The approving user saw no difference: a phishing
+ * device asking for the 90-day credential rendered exactly like a laptop asking
+ * for a week-long session. Consent to something you were not shown is not
+ * consent, and this component is where that is repaired.
+ *
+ * TWO CASES, DELIBERATELY ASYMMETRIC:
+ *
+ *   - `session` keeps today's calm, informational banner verbatim. It is the
+ *     ordinary case — the browser-driven activation that sends no `tokenType`
+ *     at all — and dressing it up in warning colours would teach people that
+ *     the yellow banner is just what this page looks like. That habit is
+ *     precisely what would make the PAT banner useless.
+ *   - `pat` switches severity, icon, title and copy, and names the lifetime,
+ *     the "survives sign-out" property, and where to revoke it.
+ *
+ * WHY NO EXTRA CONFIRMATION STEP: the decision here is already deliberate —
+ * the user typed or followed a code, and Approve/Deny are the only two things
+ * on screen. A second "are you sure?" dialog adds a click, not information,
+ * and the well-documented effect of a modal between a person and a button they
+ * have already decided to press is that they learn to dismiss it. What was
+ * missing was never a speed bump; it was the FACTS, in front of the first
+ * click. Revocability (below) is what makes a wrong "Approve" recoverable, so
+ * the mitigation is telling people where the undo lives — not making the
+ * mistake take two clicks instead of one.
+ */
+import { Alert, AlertTitle, Box, Link, Typography } from '@mui/material';
+import { VpnKey as VpnKeyIcon } from '@mui/icons-material';
+import { DEVICE_PAT_APPROX_DAYS, } from '../../headless/index.js';
+/**
+ * Where a device-issued PAT is revoked. Kept next to the copy that promises it,
+ * so the promise and the destination cannot drift apart: `/settings/tokens`
+ * (`UserTokensPage`, registered in `config/userSettingsSections.tsx`) is the
+ * page that lists every PAT on the account, including the `Device: …` rows this
+ * flow creates.
+ */
+const TOKENS_PAGE_PATH = '/settings/tokens';
+export function CredentialGrantNotice({ kind }) {
+    if (kind !== 'pat') {
+        // UNCHANGED from before #141, down to the wording. Existing behaviour and
+        // existing tests both depend on the ordinary path reading exactly as it did.
+        return (_jsx(Alert, { severity: "info", sx: { mb: 3 }, children: "A device is requesting access to your account. Review the details below and choose whether to approve or deny this request." }));
+    }
+    return (_jsxs(Alert, { severity: "warning", 
+        // A key, not the default warning triangle: the triangle says "something
+        // went wrong", which is not true — nothing has failed, the request is
+        // simply for a different and more powerful kind of credential. The icon
+        // should name the thing being granted.
+        icon: _jsx(VpnKeyIcon, {}), sx: { mb: 3 }, children: [_jsx(AlertTitle, { sx: { fontWeight: 'bold' }, children: "This device is asking for a long-lived access token" }), _jsxs(Typography, { variant: "body2", sx: { mb: 1 }, children: ["A device is requesting access to your account. Approving does", ' ', _jsx(Box, { component: "strong", children: "not" }), " create a browser session \u2014 it issues a", ' ', _jsx(Box, { component: "strong", children: "personal access token" }), ", a credential that works like a password for this account's API."] }), _jsxs(Box, { component: "ul", sx: { pl: 2.5, m: 0, mb: 1 }, children: [_jsxs(Typography, { component: "li", variant: "body2", children: ["It stays valid for about ", DEVICE_PAT_APPROX_DAYS, " days."] }), _jsx(Typography, { component: "li", variant: "body2", children: "It keeps working while you are signed out, on a device you may not be holding \u2014 until it expires or you revoke it." }), _jsx(Typography, { component: "li", variant: "body2", children: "It can do anything your account can do through the API." })] }), _jsxs(Typography, { variant: "body2", children: ["You can revoke it at any time in", ' ', _jsx(Link
+                    // A PLAIN ANCHOR opening a new tab, not a router `<Link>`: navigating
+                    // in place would abandon a device code that is already counting down
+                    // (the codes live ~15 minutes) and there is no way back to this
+                    // pending approval afterwards. Opening a second tab lets someone
+                    // check the Access Tokens page and still return to a live decision.
+                    // `rel` is mandatory with `target="_blank"` — without `noopener` the
+                    // opened page gets a handle on this one via `window.opener`.
+                    , { 
+                        // A PLAIN ANCHOR opening a new tab, not a router `<Link>`: navigating
+                        // in place would abandon a device code that is already counting down
+                        // (the codes live ~15 minutes) and there is no way back to this
+                        // pending approval afterwards. Opening a second tab lets someone
+                        // check the Access Tokens page and still return to a live decision.
+                        // `rel` is mandatory with `target="_blank"` — without `noopener` the
+                        // opened page gets a handle on this one via `window.opener`.
+                        href: TOKENS_PAGE_PATH, target: "_blank", rel: "noopener noreferrer", underline: "always", children: "Settings \u2192 Access Tokens" }), ", where it will be listed under the device name shown below."] })] }));
+}
+//# sourceMappingURL=CredentialGrantNotice.js.map

package/dist/identity/ui/device/CredentialGrantNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialGrantNotice.js","sourceRoot":"","sources":["../../../../src/identity/ui/device/CredentialGrantNotice.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAMjC;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,UAAU,qBAAqB,CAAC,EAAE,IAAI,EAA8B;IACxE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,CACL,KAAC,KAAK,IAAC,QAAQ,EAAC,MAAM,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,4IAG5B,CACT,CAAC;IACJ,CAAC;IAED,OAAO,CACL,MAAC,KAAK,IACJ,QAAQ,EAAC,SAAS;QAClB,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,EAAE,KAAC,UAAU,KAAG,EACpB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aAEb,KAAC,UAAU,IAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,oEAEzB,EAEb,MAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,8EACuB,GAAG,EACjE,KAAC,GAAG,IAAC,SAAS,EAAC,QAAQ,oBAAU,kDAAwC,GAAG,EAC5E,KAAC,GAAG,IAAC,SAAS,EAAC,QAAQ,sCAA4B,yEAExC,EAEb,MAAC,GAAG,IAAC,SAAS,EAAC,IAAI,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,aAI9C,MAAC,UAAU,IAAC,SAAS,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,0CACd,sBAAsB,cACrC,EACb,KAAC,UAAU,IAAC,SAAS,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,wIAG7B,EACb,KAAC,UAAU,IAAC,SAAS,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,wEAE7B,IACT,EAEN,MAAC,UAAU,IAAC,OAAO,EAAC,OAAO,iDACQ,GAAG,EACpC,KAAC,IAAI;oBACH,sEAAsE;oBACtE,qEAAqE;oBACrE,gEAAgE;oBAChE,iEAAiE;oBACjE,oEAAoE;oBACpE,qEAAqE;oBACrE,6DAA6D;;wBAN7D,sEAAsE;wBACtE,qEAAqE;wBACrE,gEAAgE;wBAChE,iEAAiE;wBACjE,oEAAoE;wBACpE,qEAAqE;wBACrE,6DAA6D;wBAC7D,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAC,QAAQ,EACf,GAAG,EAAC,qBAAqB,EACzB,SAAS,EAAC,QAAQ,8CAGb,oEAEI,IACP,CACT,CAAC;AACJ,CAAC"}

package/dist/identity/ui/device/DeviceCodeInput.d.ts

@@ -0,0 +1,8 @@
+interface DeviceCodeInputProps {
+    initialCode?: string;
+    onVerify: (code: string) => Promise<void>;
+    error: string | null;
+}
+export declare function DeviceCodeInput({ initialCode, onVerify, error, }: DeviceCodeInputProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=DeviceCodeInput.d.ts.map

package/dist/identity/ui/device/DeviceCodeInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceCodeInput.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/device/DeviceCodeInput.tsx"],"names":[],"mappings":"AAUA,UAAU,oBAAoB;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,eAAe,CAAC,EAC9B,WAAgB,EAChB,QAAQ,EACR,KAAK,GACN,EAAE,oBAAoB,+BA6EtB"}

package/dist/identity/ui/device/DeviceCodeInput.js

@@ -0,0 +1,41 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Box, TextField, Button, Typography, Alert, CircularProgress, } from '@mui/material';
+export function DeviceCodeInput({ initialCode = '', onVerify, error, }) {
+    const [code, setCode] = useState(initialCode);
+    const [isVerifying, setIsVerifying] = useState(false);
+    const formatCode = (value) => {
+        // Remove all non-alphanumeric characters
+        const cleaned = value.replace(/[^A-Za-z0-9]/g, '').toUpperCase();
+        // Add dash after 4 characters
+        if (cleaned.length <= 4) {
+            return cleaned;
+        }
+        return `${cleaned.slice(0, 4)}-${cleaned.slice(4, 8)}`;
+    };
+    const handleCodeChange = (e) => {
+        const formatted = formatCode(e.target.value);
+        setCode(formatted);
+    };
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        if (code.length !== 9) {
+            return;
+        }
+        setIsVerifying(true);
+        try {
+            await onVerify(code);
+        }
+        finally {
+            setIsVerifying(false);
+        }
+    };
+    const isValidLength = code.length === 9; // XXXX-XXXX format
+    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, children: [_jsx(Typography, { variant: "body2", color: "text.secondary", sx: { mb: 2 }, children: "Enter the code shown on your device" }), _jsx(TextField, { fullWidth: true, label: "Device Code", placeholder: "XXXX-XXXX", value: code, onChange: handleCodeChange, slotProps: {
+                    htmlInput: {
+                        maxLength: 9,
+                        style: { textTransform: 'uppercase', letterSpacing: '0.1em', fontSize: '1.2rem' },
+                    },
+                }, sx: { mb: 2 }, autoFocus: true, error: !!error }), error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(Button, { fullWidth: true, type: "submit", variant: "contained", size: "large", disabled: !isValidLength || isVerifying, startIcon: isVerifying ? _jsx(CircularProgress, { size: 20 }) : undefined, children: isVerifying ? 'Verifying...' : 'Verify Code' })] }));
+}
+//# sourceMappingURL=DeviceCodeInput.js.map

package/dist/identity/ui/device/DeviceCodeInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceCodeInput.js","sourceRoot":"","sources":["../../../../src/identity/ui/device/DeviceCodeInput.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAA0B,MAAM,OAAO,CAAC;AACzD,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,UAAU,EACV,KAAK,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAQvB,MAAM,UAAU,eAAe,CAAC,EAC9B,WAAW,GAAG,EAAE,EAChB,QAAQ,EACR,KAAK,GACgB;IACrB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE;QAC3C,yCAAyC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjE,8BAA8B;QAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,CAAgC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAY,EAAE,EAAE;QAC1C,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,mBAAmB;IAE5D,OAAO,CACL,MAAC,GAAG,IAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAE,YAAY,aAC1C,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,oDAEnD,EAEb,KAAC,SAAS,IACR,SAAS,QACT,KAAK,EAAC,aAAa,EACnB,WAAW,EAAC,WAAW,EACvB,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE;oBACT,SAAS,EAAE;wBACT,SAAS,EAAE,CAAC;wBACZ,KAAK,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE;qBAClF;iBACF,EACD,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EACb,SAAS,QACT,KAAK,EAAE,CAAC,CAAC,KAAK,GACd,EAED,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAED,KAAC,MAAM,IACL,SAAS,QACT,IAAI,EAAC,QAAQ,EACb,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,OAAO,EACZ,QAAQ,EAAE,CAAC,aAAa,IAAI,WAAW,EACvC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,KAAC,gBAAgB,IAAC,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,CAAC,SAAS,YAElE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,GACtC,IACL,CACP,CAAC;AACJ,CAAC"}

package/dist/identity/ui/device/DeviceInfoCard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The review step of `/activate`: what the device says it is, WHAT IT WILL GET,
+ * and the Approve / Deny decision.
+ *
+ * Two things about this component are security-relevant, both from #141:
+ *
+ *   1. Everything under `deviceInfo.clientInfo` is attacker-chosen —
+ *      `POST /auth/device/code` is public and its body is stored verbatim — so
+ *      nothing here reads those fields directly. Every value goes through
+ *      `sanitizeDeviceText()` first, and the credential kind through
+ *      `readCredentialKind()`. See `credential.ts` for the threat model.
+ *   2. The card is now explicit about the KIND of credential being granted.
+ *      Before #141 there was only one kind; now the requesting device picks,
+ *      and the person approving is the one who carries the consequence.
+ *
+ * LAYOUT NOTE: `/activate` is routed OUTSIDE `Layout` (see `App.tsx` — it is a
+ * deliberate full-screen page with no AppBar, rail or bottom nav), so the five
+ * coupled `sm` breakpoint gates documented in `common/Layout.tsx` do not apply
+ * here and must not be imitated. This page's only responsive behaviour is the
+ * card padding in `ActivateDevicePage`; the content below is a single column
+ * that reflows on its own, which is why nothing here calls `useMediaQuery`.
+ */
+import type { DeviceActivationInfo } from '../../headless/index.js';
+interface DeviceInfoCardProps {
+    deviceInfo: DeviceActivationInfo;
+    onApprove: () => Promise<void>;
+    onDeny: () => Promise<void>;
+    error: string | null;
+}
+export declare function DeviceInfoCard({ deviceInfo, onApprove, onDeny, error, }: DeviceInfoCardProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=DeviceInfoCard.d.ts.map

package/dist/identity/ui/device/DeviceInfoCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceInfoCard.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/device/DeviceInfoCard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAUpE,UAAU,mBAAmB;IAC3B,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,SAAS,EACT,MAAM,EACN,KAAK,GACN,EAAE,mBAAmB,+BA8PrB"}

package/dist/identity/ui/device/DeviceInfoCard.js

@@ -0,0 +1,112 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The review step of `/activate`: what the device says it is, WHAT IT WILL GET,
+ * and the Approve / Deny decision.
+ *
+ * Two things about this component are security-relevant, both from #141:
+ *
+ *   1. Everything under `deviceInfo.clientInfo` is attacker-chosen —
+ *      `POST /auth/device/code` is public and its body is stored verbatim — so
+ *      nothing here reads those fields directly. Every value goes through
+ *      `sanitizeDeviceText()` first, and the credential kind through
+ *      `readCredentialKind()`. See `credential.ts` for the threat model.
+ *   2. The card is now explicit about the KIND of credential being granted.
+ *      Before #141 there was only one kind; now the requesting device picks,
+ *      and the person approving is the one who carries the consequence.
+ *
+ * LAYOUT NOTE: `/activate` is routed OUTSIDE `Layout` (see `App.tsx` — it is a
+ * deliberate full-screen page with no AppBar, rail or bottom nav), so the five
+ * coupled `sm` breakpoint gates documented in `common/Layout.tsx` do not apply
+ * here and must not be imitated. This page's only responsive behaviour is the
+ * card padding in `ActivateDevicePage`; the content below is a single column
+ * that reflows on its own, which is why nothing here calls `useMediaQuery`.
+ */
+import { useState, useEffect } from 'react';
+import { Box, Card, CardContent, Typography, Stack, Chip, Divider, Alert, Button, CircularProgress, } from '@mui/material';
+import { Devices as DevicesIcon, Computer as ComputerIcon, AccessTime as AccessTimeIcon, LocationOn as LocationIcon, VpnKey as VpnKeyIcon, } from '@mui/icons-material';
+import { CredentialGrantNotice } from './CredentialGrantNotice.js';
+import { DEVICE_NAME_MAX_DISPLAY, IP_ADDRESS_MAX_DISPLAY, USER_AGENT_MAX_DISPLAY, readCredentialKind, sanitizeDeviceText, } from '../../headless/index.js';
+export function DeviceInfoCard({ deviceInfo, onApprove, onDeny, error, }) {
+    const [isApproving, setIsApproving] = useState(false);
+    const [isDenying, setIsDenying] = useState(false);
+    const [timeRemaining, setTimeRemaining] = useState('');
+    // The credential this approval actually mints. `clientInfo` may be absent
+    // entirely (the API declares it optional) and `tokenType` may be absent (rows
+    // predating #141) or an unexpected value (the column is not re-validated on
+    // read) — `readCredentialKind` resolves all of those to 'session', matching
+    // what the API would in fact issue for such a row.
+    const credentialKind = readCredentialKind(deviceInfo.clientInfo);
+    const isPat = credentialKind === 'pat';
+    // Read once, sanitised, into locals. Sanitising at the point of use rather
+    // than once here would make it easy for a future field to be added to the
+    // JSX raw — which is exactly the mistake this component is being fixed for.
+    const deviceName = sanitizeDeviceText(deviceInfo.clientInfo?.deviceName, DEVICE_NAME_MAX_DISPLAY);
+    const userAgent = sanitizeDeviceText(deviceInfo.clientInfo?.userAgent, USER_AGENT_MAX_DISPLAY);
+    const ipAddress = sanitizeDeviceText(deviceInfo.clientInfo?.ipAddress, IP_ADDRESS_MAX_DISPLAY);
+    // Calculate time remaining until the CODE expires (not the credential's
+    // lifetime — see the label below, which has to say so out loud now that a
+    // 90-day token can be the thing on offer).
+    useEffect(() => {
+        const updateTimeRemaining = () => {
+            const now = new Date().getTime();
+            const expires = new Date(deviceInfo.expiresAt).getTime();
+            const diff = expires - now;
+            if (diff <= 0) {
+                setTimeRemaining('Expired');
+                return;
+            }
+            const minutes = Math.floor(diff / 60000);
+            const seconds = Math.floor((diff % 60000) / 1000);
+            if (minutes > 0) {
+                setTimeRemaining(`${minutes}m ${seconds}s`);
+            }
+            else {
+                setTimeRemaining(`${seconds}s`);
+            }
+        };
+        updateTimeRemaining();
+        const interval = setInterval(updateTimeRemaining, 1000);
+        return () => clearInterval(interval);
+    }, [deviceInfo.expiresAt]);
+    const handleApprove = async () => {
+        setIsApproving(true);
+        try {
+            await onApprove();
+        }
+        finally {
+            setIsApproving(false);
+        }
+    };
+    const handleDeny = async () => {
+        setIsDenying(true);
+        try {
+            await onDeny();
+        }
+        finally {
+            setIsDenying(false);
+        }
+    };
+    const isExpired = timeRemaining === 'Expired';
+    return (_jsxs(Box, { children: [_jsx(CredentialGrantNotice, { kind: credentialKind }), _jsx(Card, { variant: "outlined", sx: {
+                    mb: 3,
+                    // The PAT case gets a warning-coloured border so the banner and the
+                    // details it describes read as ONE block. Without it the alert floats
+                    // above an identical-looking card and a skimming eye can take the
+                    // card as the "real" content and the banner as page furniture.
+                    ...(isPat && {
+                        borderColor: 'warning.main',
+                        borderWidth: 2,
+                    }),
+                }, children: _jsx(CardContent, { children: _jsxs(Stack, { spacing: 2.5, children: [_jsxs(Box, { sx: { display: 'flex', alignItems: 'flex-start' }, children: [_jsx(VpnKeyIcon, { sx: {
+                                            mr: 1.5,
+                                            mt: 0.5,
+                                            color: isPat ? 'warning.main' : 'text.secondary',
+                                        } }), _jsxs(Box, { children: [_jsx(Typography, { variant: "caption", color: "text.secondary", children: "Grants" }), _jsx(Box, { sx: { mt: 0.5 }, children: _jsx(Chip, { label: isPat
+                                                        ? 'Long-lived access token'
+                                                        : 'Standard sign-in session', size: "small", color: isPat ? 'warning' : 'default', variant: isPat ? 'filled' : 'outlined' }) })] })] }), deviceName && (_jsxs(Box, { sx: { display: 'flex', alignItems: 'flex-start' }, children: [_jsx(DevicesIcon, { sx: { mr: 1.5, mt: 0.5, color: 'text.secondary' } }), _jsxs(Box, { sx: { minWidth: 0 }, children: [_jsx(Typography, { variant: "caption", color: "text.secondary", children: "Device Name" }), _jsx(Typography, { variant: "body1", sx: { fontWeight: 'medium', wordBreak: 'break-word' }, children: deviceName })] })] })), userAgent && (_jsxs(Box, { sx: { display: 'flex', alignItems: 'flex-start' }, children: [_jsx(ComputerIcon, { sx: { mr: 1.5, mt: 0.5, color: 'text.secondary' } }), _jsxs(Box, { sx: { minWidth: 0 }, children: [_jsx(Typography, { variant: "caption", color: "text.secondary", children: "Browser / Device" }), _jsx(Typography, { variant: "body2", sx: { wordBreak: 'break-word' }, children: userAgent })] })] })), ipAddress && (_jsxs(Box, { sx: { display: 'flex', alignItems: 'flex-start' }, children: [_jsx(LocationIcon, { sx: { mr: 1.5, mt: 0.5, color: 'text.secondary' } }), _jsxs(Box, { sx: { minWidth: 0 }, children: [_jsx(Typography, { variant: "caption", color: "text.secondary", children: "IP Address" }), _jsx(Typography, { variant: "body2", sx: { wordBreak: 'break-word' }, children: ipAddress })] })] })), _jsx(Divider, {}), _jsxs(Box, { sx: { display: 'flex', alignItems: 'center', justifyContent: 'space-between' }, children: [_jsxs(Box, { sx: { display: 'flex', alignItems: 'center' }, children: [_jsx(AccessTimeIcon, { sx: { mr: 1.5, color: 'text.secondary' } }), _jsx(Typography, { variant: "body2", color: "text.secondary", children: "Code expires in" })] }), _jsx(Chip, { label: timeRemaining, size: "small", color: isExpired ? 'error' : 'primary', variant: "outlined" })] })] }) }) }), error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsxs(Stack, { direction: "row", spacing: 2, children: [_jsx(Button, { fullWidth: true, variant: "outlined", color: "error", size: "large", onClick: handleDeny, disabled: isApproving || isDenying || isExpired, startIcon: isDenying ? _jsx(CircularProgress, { size: 20 }) : undefined, children: isDenying ? 'Denying...' : 'Deny' }), _jsx(Button, { fullWidth: true, variant: "contained", color: "success", size: "large", onClick: handleApprove, disabled: isDenying || isApproving || isExpired, startIcon: isApproving ? _jsx(CircularProgress, { size: 20 }) : undefined, children: isApproving
+                            ? 'Approving...'
+                            : isPat
+                                ? 'Approve token'
+                                : 'Approve' })] }), isExpired && (_jsx(Alert, { severity: "error", sx: { mt: 2 }, children: "This code has expired. Please request a new one from your device." }))] }));
+}
+//# sourceMappingURL=DeviceInfoCard.js.map

package/dist/identity/ui/device/DeviceInfoCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceInfoCard.js","sourceRoot":"","sources":["../../../../src/identity/ui/device/DeviceInfoCard.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,GAAG,EACH,IAAI,EACJ,WAAW,EACX,UAAU,EACV,KAAK,EACL,IAAI,EACJ,OAAO,EACP,KAAK,EACL,MAAM,EACN,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,OAAO,IAAI,WAAW,EACtB,QAAQ,IAAI,YAAY,EACxB,UAAU,IAAI,cAAc,EAC5B,UAAU,IAAI,YAAY,EAC1B,MAAM,IAAI,UAAU,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AASjC,MAAM,UAAU,cAAc,CAAC,EAC7B,UAAU,EACV,SAAS,EACT,MAAM,EACN,KAAK,GACe;IACpB,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAC;IAE/D,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,cAAc,KAAK,KAAK,CAAC;IAEvC,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,kBAAkB,CACnC,UAAU,CAAC,UAAU,EAAE,UAAU,EACjC,uBAAuB,CACxB,CAAC;IACF,MAAM,SAAS,GAAG,kBAAkB,CAClC,UAAU,CAAC,UAAU,EAAE,SAAS,EAChC,sBAAsB,CACvB,CAAC;IACF,MAAM,SAAS,GAAG,kBAAkB,CAClC,UAAU,CAAC,UAAU,EAAE,SAAS,EAChC,sBAAsB,CACvB,CAAC;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,2CAA2C;IAC3C,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,mBAAmB,GAAG,GAAG,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,OAAO,GAAG,GAAG,CAAC;YAE3B,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACd,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YAElD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,gBAAgB,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QAEF,mBAAmB,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAExD,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAE3B,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,aAAa,KAAK,SAAS,CAAC;IAE9C,OAAO,CACL,MAAC,GAAG,eACF,KAAC,qBAAqB,IAAC,IAAI,EAAE,cAAc,GAAI,EAE/C,KAAC,IAAI,IACH,OAAO,EAAC,UAAU,EAClB,EAAE,EAAE;oBACF,EAAE,EAAE,CAAC;oBACL,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,+DAA+D;oBAC/D,GAAG,CAAC,KAAK,IAAI;wBACX,WAAW,EAAE,cAAc;wBAC3B,WAAW,EAAE,CAAC;qBACf,CAAC;iBACH,YAED,KAAC,WAAW,cACV,MAAC,KAAK,IAAC,OAAO,EAAE,GAAG,aAKjB,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aACpD,KAAC,UAAU,IACT,EAAE,EAAE;4CACF,EAAE,EAAE,GAAG;4CACP,EAAE,EAAE,GAAG;4CACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB;yCACjD,GACD,EACF,MAAC,GAAG,eACF,KAAC,UAAU,IAAC,OAAO,EAAC,SAAS,EAAC,KAAK,EAAC,gBAAgB,uBAEvC,EACb,KAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAClB,KAAC,IAAI,IACH,KAAK,EACH,KAAK;wDACH,CAAC,CAAC,yBAAyB;wDAC3B,CAAC,CAAC,0BAA0B,EAEhC,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EACpC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,GACtC,GACE,IACF,IACF,EAGL,UAAU,IAAI,CACb,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aACpD,KAAC,WAAW,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAI,EAClE,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aACtB,KAAC,UAAU,IAAC,OAAO,EAAC,SAAS,EAAC,KAAK,EAAC,gBAAgB,4BAEvC,EAIb,KAAC,UAAU,IACT,OAAO,EAAC,OAAO,EACf,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAEpD,UAAU,GACA,IACT,IACF,CACP,EAGA,SAAS,IAAI,CACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aACpD,KAAC,YAAY,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAI,EACnE,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aACtB,KAAC,UAAU,IAAC,OAAO,EAAC,SAAS,EAAC,KAAK,EAAC,gBAAgB,iCAEvC,EACb,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,YACxD,SAAS,GACC,IACT,IACF,CACP,EAGA,SAAS,IAAI,CACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aACpD,KAAC,YAAY,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAI,EACnE,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aACtB,KAAC,UAAU,IAAC,OAAO,EAAC,SAAS,EAAC,KAAK,EAAC,gBAAgB,2BAEvC,EACb,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,YACxD,SAAS,GACC,IACT,IACF,CACP,EAED,KAAC,OAAO,KAAG,EAGX,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,aACjF,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAChD,KAAC,cAAc,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAI,EAM5D,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,gCAErC,IACT,EACN,KAAC,IAAI,IACH,KAAK,EAAE,aAAa,EACpB,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACtC,OAAO,EAAC,UAAU,GAClB,IACE,IACA,GACI,GACT,EAEN,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAGD,MAAC,KAAK,IAAC,SAAS,EAAC,KAAK,EAAC,OAAO,EAAE,CAAC,aAC/B,KAAC,MAAM,IACL,SAAS,QACT,OAAO,EAAC,UAAU,EAClB,KAAK,EAAC,OAAO,EACb,IAAI,EAAC,OAAO,EACZ,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,WAAW,IAAI,SAAS,IAAI,SAAS,EAC/C,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAC,gBAAgB,IAAC,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,CAAC,SAAS,YAEhE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,GAC3B,EACT,KAAC,MAAM,IACL,SAAS,QACT,OAAO,EAAC,WAAW,EACnB,KAAK,EAAC,SAAS,EACf,IAAI,EAAC,OAAO,EACZ,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,SAAS,IAAI,WAAW,IAAI,SAAS,EAC/C,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,KAAC,gBAAgB,IAAC,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,CAAC,SAAS,YAMlE,WAAW;4BACV,CAAC,CAAC,cAAc;4BAChB,CAAC,CAAC,KAAK;gCACL,CAAC,CAAC,eAAe;gCACjB,CAAC,CAAC,SAAS,GACR,IACH,EAEP,SAAS,IAAI,CACZ,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,kFAE7B,CACT,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/identity/ui/index.d.ts

@@ -0,0 +1,33 @@
+export { LoginPage } from './LoginPage.js';
+export type { LoginPageProps, LoginPageSlots, LoginProvidersSlotProps } from './LoginPage.js';
+export { AuthCallbackPage } from './AuthCallbackPage.js';
+export type { AuthCallbackPageProps, AuthCallbackPageSlots } from './AuthCallbackPage.js';
+export { SignInErrorView } from './SignInErrorView.js';
+export type { SignInErrorViewProps } from './SignInErrorView.js';
+export { DEFAULT_SIGN_IN_ERROR_CODE, SIGN_IN_ERROR_CODES, createSignInErrorContent, resolveSignInErrorCode, } from './sign-in-error-content.js';
+export type { SignInErrorCode, SignInErrorContent, SignInErrorPrimaryAction, SignInErrorSeverity, } from './sign-in-error-content.js';
+export { BUILT_IN_AUTH_PROVIDERS, OAuthButton } from './OAuthButton.js';
+export type { OAuthButtonProps } from './OAuthButton.js';
+export { ActivateDevicePage } from './ActivateDevicePage.js';
+export type { ActivateDevicePageProps, ActivateDevicePageSlots } from './ActivateDevicePage.js';
+export { OrgSwitcher } from './OrgSwitcher.js';
+export { UserTokensPage } from './tokens/UserTokensPage.js';
+export type { UserTokensPageProps, UserTokensPageSlots } from './tokens/UserTokensPage.js';
+export { PersonalAccessTokens } from './tokens/PersonalAccessTokens.js';
+export { UsersPage } from './users/UsersPage.js';
+export type { UsersPageProps, UsersPageSlots, UsersPageTab } from './users/UsersPage.js';
+export { UserList } from './users/UserList.js';
+export type { UserListProps, UserListSlots } from './users/UserList.js';
+export { AllowlistTable } from './users/AllowlistTable.js';
+export { buildUserColumns } from './users/userListColumns.js';
+export { OrganizationPage } from './org/OrganizationPage.js';
+export type { OrganizationPageProps, OrganizationPageSlots } from './org/OrganizationPage.js';
+export { OrganizationsPage } from './org/OrganizationsPage.js';
+export type { OrganizationsPageProps, OrganizationsPageSlots } from './org/OrganizationsPage.js';
+export { OrgMembersPanel } from './org/OrgMembersPanel.js';
+export type { OrgMembersPanelProps, OrgMembersPanelSlots } from './org/OrgMembersPanel.js';
+export { OrgInvitesPanel } from './org/OrgInvitesPanel.js';
+export type { OrgInvitesPanelProps } from './org/OrgInvitesPanel.js';
+export { identityAdminSections, identityUserSettingsSections } from './settings.js';
+export type { IdentitySettingsCard } from './settings.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/ui/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/identity/ui/index.js

@@ -0,0 +1,24 @@
+// `@marinoscar/platform-web/identity/ui`: the identity slice's pages and
+// components (issue #727, PP-6.6), built on `/identity/headless` only.
+// "Packages own behaviour, apps own appearance": the app's theme styles them,
+// `slots` and the identity adapters (spinner, table) replace parts. Documented
+// in ../README.md. Explicit named exports only.
+export { LoginPage } from './LoginPage.js';
+export { AuthCallbackPage } from './AuthCallbackPage.js';
+export { SignInErrorView } from './SignInErrorView.js';
+export { DEFAULT_SIGN_IN_ERROR_CODE, SIGN_IN_ERROR_CODES, createSignInErrorContent, resolveSignInErrorCode, } from './sign-in-error-content.js';
+export { BUILT_IN_AUTH_PROVIDERS, OAuthButton } from './OAuthButton.js';
+export { ActivateDevicePage } from './ActivateDevicePage.js';
+export { OrgSwitcher } from './OrgSwitcher.js';
+export { UserTokensPage } from './tokens/UserTokensPage.js';
+export { PersonalAccessTokens } from './tokens/PersonalAccessTokens.js';
+export { UsersPage } from './users/UsersPage.js';
+export { UserList } from './users/UserList.js';
+export { AllowlistTable } from './users/AllowlistTable.js';
+export { buildUserColumns } from './users/userListColumns.js';
+export { OrganizationPage } from './org/OrganizationPage.js';
+export { OrganizationsPage } from './org/OrganizationsPage.js';
+export { OrgMembersPanel } from './org/OrgMembersPanel.js';
+export { OrgInvitesPanel } from './org/OrgInvitesPanel.js';
+export { identityAdminSections, identityUserSettingsSections } from './settings.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/ui/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,gDAAgD;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAOpC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}

package/dist/identity/ui/org/InviteMemberDialog.d.ts

@@ -0,0 +1,15 @@
+import type { OrgRole, RoleDescriptor } from '../../headless/index.js';
+interface InviteMemberDialogProps {
+    open: boolean;
+    onClose: () => void;
+    onInvite: (data: {
+        email: string;
+        roleName: OrgRole;
+        notes?: string;
+    }) => Promise<void>;
+    /** The org roles the API says may be assigned (`GET /api/roles?scope=org`, `assignable` only). */
+    roles: readonly RoleDescriptor[];
+}
+export declare function InviteMemberDialog({ open, onClose, onInvite, roles }: InviteMemberDialogProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=InviteMemberDialog.d.ts.map

package/dist/identity/ui/org/InviteMemberDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteMemberDialog.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/org/InviteMemberDialog.tsx"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEvE,UAAU,uBAAuB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kGAAkG;IAClG,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;CAClC;AAOD,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,uBAAuB,+BA0G7F"}