@massimo.mazzoleni/cognito-max 1.0.0

package/dist/ui/index.cjs

@@ -0,0 +1,1183 @@
+'use strict';
+
+var react = require('react');
+require('amazon-cognito-identity-js');
+require('@aws-sdk/client-cognito-identity-provider');
+var jsxRuntime = require('react/jsx-runtime');
+
+// src/ui/hooks/useSignInForm.ts
+var AuthContext = react.createContext(null);
+function useAuthContext() {
+  const ctx = react.useContext(AuthContext);
+  if (!ctx) {
+    throw new Error("useAuthContext must be used inside <AuthProvider>");
+  }
+  return ctx;
+}
+
+// src/react/hooks/useAuth.ts
+function useAuth() {
+  const { client, state, user, isLoading, isAuthenticated } = useAuthContext();
+  const actions = react.useMemo(
+    () => ({
+      signIn: (email, password) => client.signIn(email, password),
+      signOut: (global) => client.signOut(global),
+      signUp: (email, password, attributes) => client.signUp(email, password, attributes),
+      confirmSignUp: (email, code) => client.confirmSignUp(email, code),
+      resendConfirmationCode: (email) => client.resendConfirmationCode(email),
+      forgotPassword: (email) => client.forgotPassword(email),
+      confirmForgotPassword: (email, code, newPassword) => client.confirmForgotPassword(email, code, newPassword),
+      changePassword: (current, next) => client.changePassword(current, next),
+      respondToMfaChallenge: (challengeSession, code, mfaType) => client.respondToMfaChallenge(challengeSession, code, mfaType),
+      respondToNewPasswordChallenge: (challengeSession, newPassword, userAttributes) => client.respondToNewPasswordChallenge(challengeSession, newPassword, userAttributes),
+      setupTotpChallenge: (challengeSession) => client.setupTotpChallenge(challengeSession),
+      verifyTotpChallenge: (challengeSession, code) => client.verifyTotpChallenge(challengeSession, code)
+    }),
+    [client]
+  );
+  return {
+    // Stato
+    user,
+    state,
+    isLoading,
+    isAuthenticated,
+    // Azioni
+    ...actions,
+    // Client raw per casi avanzati
+    client
+  };
+}
+
+// src/ui/hooks/useSignInForm.ts
+function useSignInForm(options = {}) {
+  const {
+    signIn,
+    respondToMfaChallenge,
+    respondToNewPasswordChallenge,
+    setupTotpChallenge,
+    verifyTotpChallenge
+  } = useAuth();
+  const [step, setStep] = react.useState("credentials");
+  const [isLoading, setLoading] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  const [email, setEmail] = react.useState("");
+  const [password, setPassword] = react.useState("");
+  const [mfaType, setMfaType] = react.useState(null);
+  const [challengeSession, setChallengeSession] = react.useState(null);
+  const [mfaCode, setMfaCode] = react.useState("");
+  const [newPwd, setNewPwd] = react.useState("");
+  const [confirmPwd, setConfirmPwd] = react.useState("");
+  const [requiredAttributes, setRequiredAttributes] = react.useState([]);
+  const [mfaSetupQrCodeUri, setMfaSetupQrCodeUri] = react.useState(null);
+  const [mfaSetupSecretCode, setMfaSetupSecretCode] = react.useState(null);
+  const [mfaSetupTotpCode, setMfaSetupTotpCode] = react.useState("");
+  const handleSignInResult = react.useCallback(
+    (result) => {
+      if (result.status === "SUCCESS") {
+        options.onSuccess?.(result);
+      } else if (result.status === "MFA_REQUIRED") {
+        setMfaType(result.mfaType);
+        setChallengeSession(result.challengeSession);
+        setStep("mfa");
+      } else if (result.status === "NEW_PASSWORD_REQUIRED") {
+        setChallengeSession(result.challengeSession);
+        setRequiredAttributes(result.requiredAttributes);
+        setStep("new_password");
+      } else if (result.status === "MFA_SETUP_REQUIRED") {
+        setChallengeSession(result.challengeSession);
+        setStep("mfa_setup");
+      }
+    },
+    [options]
+  );
+  const handleCredentialsSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      setError(null);
+      setLoading(true);
+      try {
+        const result = await signIn(email, password);
+        handleSignInResult(result);
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [email, password, signIn, handleSignInResult, options]
+  );
+  const handleMfaSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (!challengeSession || !mfaType) return;
+      setError(null);
+      setLoading(true);
+      try {
+        const result = await respondToMfaChallenge(challengeSession, mfaCode, mfaType);
+        handleSignInResult(result);
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [challengeSession, mfaType, mfaCode, respondToMfaChallenge, handleSignInResult, options]
+  );
+  const handleNewPasswordSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (!challengeSession) return;
+      if (newPwd !== confirmPwd) {
+        setError({ message: "Le password non coincidono", code: "INVALID_PASSWORD" });
+        return;
+      }
+      setError(null);
+      setLoading(true);
+      try {
+        const result = await respondToNewPasswordChallenge(challengeSession, newPwd);
+        handleSignInResult(result);
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [challengeSession, newPwd, confirmPwd, respondToNewPasswordChallenge, handleSignInResult, options]
+  );
+  const handleMfaSetupStart = react.useCallback(async () => {
+    if (!challengeSession) return;
+    setError(null);
+    setLoading(true);
+    try {
+      const result = await setupTotpChallenge(challengeSession);
+      setMfaSetupQrCodeUri(result.qrCodeUri);
+      setMfaSetupSecretCode(result.secretCode);
+    } catch (err) {
+      const authErr = err;
+      setError(authErr);
+      options.onError?.(authErr);
+    } finally {
+      setLoading(false);
+    }
+  }, [challengeSession, setupTotpChallenge, options]);
+  const handleMfaSetupVerify = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (!challengeSession) return;
+      setError(null);
+      setLoading(true);
+      try {
+        const result = await verifyTotpChallenge(challengeSession, mfaSetupTotpCode);
+        handleSignInResult(result);
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [challengeSession, mfaSetupTotpCode, verifyTotpChallenge, handleSignInResult, options]
+  );
+  const reset = react.useCallback(() => {
+    setStep("credentials");
+    setEmail("");
+    setPassword("");
+    setMfaCode("");
+    setNewPwd("");
+    setConfirmPwd("");
+    setError(null);
+    setMfaType(null);
+    setChallengeSession(null);
+    setMfaSetupQrCodeUri(null);
+    setMfaSetupSecretCode(null);
+    setMfaSetupTotpCode("");
+  }, []);
+  return {
+    step,
+    isLoading,
+    error,
+    mfaType,
+    credentials: { email, password, setEmail, setPassword, onSubmit: handleCredentialsSubmit },
+    mfa: { code: mfaCode, setCode: setMfaCode, onSubmit: handleMfaSubmit },
+    newPassword: {
+      password: newPwd,
+      confirmPassword: confirmPwd,
+      requiredAttributes,
+      setPassword: setNewPwd,
+      setConfirmPassword: setConfirmPwd,
+      onSubmit: handleNewPasswordSubmit
+    },
+    mfaSetup: {
+      qrCodeUri: mfaSetupQrCodeUri,
+      secretCode: mfaSetupSecretCode,
+      totpCode: mfaSetupTotpCode,
+      setTotpCode: setMfaSetupTotpCode,
+      start: handleMfaSetupStart,
+      onVerify: handleMfaSetupVerify
+    },
+    reset
+  };
+}
+function useRegisterForm(options = {}) {
+  const { signUp, confirmSignUp, resendConfirmationCode } = useAuth();
+  const [step, setStep] = react.useState("register");
+  const [isLoading, setLoading] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  const [email, setEmail] = react.useState("");
+  const [password, setPassword] = react.useState("");
+  const [confirmPassword, setConfirmPassword] = react.useState("");
+  const [code, setCode] = react.useState("");
+  const handleRegisterSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (password !== confirmPassword) {
+        setError({ message: "Le password non coincidono", code: "INVALID_PASSWORD" });
+        return;
+      }
+      setError(null);
+      setLoading(true);
+      try {
+        await signUp(email, password, options.extraAttributes);
+        setStep("confirm");
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [email, password, confirmPassword, signUp, options]
+  );
+  const handleConfirmSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      setError(null);
+      setLoading(true);
+      try {
+        await confirmSignUp(email, code);
+        options.onSuccess?.();
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [email, code, confirmSignUp, options]
+  );
+  const resend = react.useCallback(async () => {
+    setError(null);
+    try {
+      await resendConfirmationCode(email);
+    } catch (err) {
+      setError(err);
+    }
+  }, [email, resendConfirmationCode]);
+  const reset = react.useCallback(() => {
+    setStep("register");
+    setEmail("");
+    setPassword("");
+    setConfirmPassword("");
+    setCode("");
+    setError(null);
+  }, []);
+  return {
+    step,
+    isLoading,
+    error,
+    register: { email, password, confirmPassword, setEmail, setPassword, setConfirmPassword, onSubmit: handleRegisterSubmit },
+    confirm: { email, code, setCode, onSubmit: handleConfirmSubmit, resend },
+    reset
+  };
+}
+function useForgotPasswordForm(options = {}) {
+  const { forgotPassword, confirmForgotPassword } = useAuth();
+  const [step, setStep] = react.useState("request");
+  const [isLoading, setLoading] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  const [email, setEmail] = react.useState("");
+  const [code, setCode] = react.useState("");
+  const [newPassword, setNewPassword] = react.useState("");
+  const [confirmPassword, setConfirmPassword] = react.useState("");
+  const handleRequestSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      setError(null);
+      setLoading(true);
+      try {
+        await forgotPassword(email);
+        setStep("reset");
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [email, forgotPassword, options]
+  );
+  const handleResetSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (newPassword !== confirmPassword) {
+        setError({ message: "Le password non coincidono", code: "INVALID_PASSWORD" });
+        return;
+      }
+      setError(null);
+      setLoading(true);
+      try {
+        await confirmForgotPassword(email, code, newPassword);
+        options.onSuccess?.();
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [email, code, newPassword, confirmPassword, confirmForgotPassword, options]
+  );
+  const restart = react.useCallback(() => {
+    setStep("request");
+    setCode("");
+    setNewPassword("");
+    setConfirmPassword("");
+    setError(null);
+  }, []);
+  return {
+    step,
+    isLoading,
+    error,
+    request: { email, setEmail, onSubmit: handleRequestSubmit },
+    reset: { email, code, newPassword, confirmPassword, setCode, setNewPassword, setConfirmPassword, onSubmit: handleResetSubmit },
+    restart
+  };
+}
+function useChangePasswordForm(options = {}) {
+  const { changePassword } = useAuth();
+  const [isLoading, setLoading] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  const [success, setSuccess] = react.useState(false);
+  const [currentPassword, setCurrentPassword] = react.useState("");
+  const [newPassword, setNewPassword] = react.useState("");
+  const [confirmPassword, setConfirmPassword] = react.useState("");
+  const handleSubmit = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      if (newPassword !== confirmPassword) {
+        setError({ message: "Le nuove password non coincidono", code: "INVALID_PASSWORD" });
+        return;
+      }
+      setError(null);
+      setLoading(true);
+      try {
+        await changePassword(currentPassword, newPassword);
+        setSuccess(true);
+        options.onSuccess?.();
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        options.onError?.(authErr);
+      } finally {
+        setLoading(false);
+      }
+    },
+    [currentPassword, newPassword, confirmPassword, changePassword, options]
+  );
+  const reset = react.useCallback(() => {
+    setCurrentPassword("");
+    setNewPassword("");
+    setConfirmPassword("");
+    setError(null);
+    setSuccess(false);
+  }, []);
+  return {
+    isLoading,
+    error,
+    success,
+    currentPassword,
+    newPassword,
+    confirmPassword,
+    setCurrentPassword,
+    setNewPassword,
+    setConfirmPassword,
+    onSubmit: handleSubmit,
+    reset
+  };
+}
+
+// src/react/hooks/useMfa.ts
+function useMfa() {
+  const { client } = useAuthContext();
+  return {
+    /** Avvia il setup TOTP — restituisce secretCode e qrCodeUri per l'app authenticator */
+    setup: () => client.setupTotp(),
+    /** Conferma il codice TOTP generato dall'app per completare il setup */
+    verifySetup: (code) => client.verifyTotpSetup(code),
+    /** Legge le preferenze MFA correnti (TOTP abilitato, SMS abilitato, preferito) */
+    getPreference: () => client.getMfaPreference(),
+    /** Imposta il tipo MFA preferito ('TOTP' | 'SMS') */
+    setPreference: (type) => client.setMfaPreference(type),
+    /** Disabilita completamente il secondo fattore */
+    disable: () => client.disableMfa()
+  };
+}
+
+// src/ui/hooks/useMfaSetup.ts
+function useMfaSetup(options = {}) {
+  const { setup, verifySetup } = useMfa();
+  const [step, setStep] = react.useState("idle");
+  const [error, setError] = react.useState(null);
+  const [qrCodeUri, setQrCodeUri] = react.useState(null);
+  const [secretCode, setSecretCode] = react.useState(null);
+  const [totpCode, setTotpCode] = react.useState("");
+  const start = react.useCallback(async () => {
+    setError(null);
+    setStep("loading");
+    try {
+      const result = await setup();
+      setQrCodeUri(result.qrCodeUri);
+      setSecretCode(result.secretCode);
+      setStep("scan");
+    } catch (err) {
+      const authErr = err;
+      setError(authErr);
+      setStep("idle");
+      options.onError?.(authErr);
+    }
+  }, [setup, options]);
+  const handleVerify = react.useCallback(
+    async (e) => {
+      e.preventDefault();
+      setError(null);
+      setStep("loading");
+      try {
+        await verifySetup(totpCode);
+        setStep("done");
+        options.onSuccess?.();
+      } catch (err) {
+        const authErr = err;
+        setError(authErr);
+        setStep("verify");
+        options.onError?.(authErr);
+      }
+    },
+    [totpCode, verifySetup, options]
+  );
+  const reset = react.useCallback(() => {
+    setStep("idle");
+    setError(null);
+    setQrCodeUri(null);
+    setSecretCode(null);
+    setTotpCode("");
+  }, []);
+  return {
+    step,
+    isLoading: step === "loading",
+    error,
+    qrCodeUri,
+    secretCode,
+    totpCode,
+    setTotpCode,
+    start,
+    onVerify: handleVerify,
+    reset
+  };
+}
+function SignInForm({
+  className,
+  labels = {},
+  forgotPasswordLink,
+  registerLink,
+  renderQrCode,
+  onSuccess,
+  onError
+}) {
+  const uid = react.useId();
+  const form = useSignInForm({ onSuccess, onError });
+  const firstInputRef = react.useRef(null);
+  react.useEffect(() => {
+    firstInputRef.current?.focus();
+    if (form.step === "mfa_setup") {
+      void form.mfaSetup.start();
+    }
+  }, [form.step]);
+  const l = {
+    email: labels.email ?? "Email",
+    password: labels.password ?? "Password",
+    submit: labels.submit ?? "Accedi",
+    mfaCode: labels.mfaCode ?? "Codice",
+    mfaSubmit: labels.mfaSubmit ?? "Verifica",
+    newPassword: labels.newPassword ?? "Nuova password",
+    confirmNewPassword: labels.confirmNewPassword ?? "Conferma password",
+    newPasswordSubmit: labels.newPasswordSubmit ?? "Imposta password",
+    mfaSetupScanInstruction: labels.mfaSetupScanInstruction ?? "Scansiona il QR code con la tua app authenticator (Google Authenticator, Authy, 1Password\u2026)",
+    mfaSetupSecretLabel: labels.mfaSetupSecretLabel ?? "Oppure inserisci il codice manualmente",
+    mfaSetupCode: labels.mfaSetupCode ?? "Codice a 6 cifre",
+    mfaSetupSubmit: labels.mfaSetupSubmit ?? "Verifica e attiva"
+  };
+  const errorId = `${uid}-error`;
+  if (form.step === "mfa") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(
+      "form",
+      {
+        onSubmit: form.mfa.onSubmit,
+        className,
+        "aria-label": "Verifica codice MFA",
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+            "Inserisci il codice",
+            " ",
+            form.mfaType === "TOTP" ? "dall'app authenticator" : "ricevuto via SMS"
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-mfa-code`, children: l.mfaCode }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-mfa-code`,
+                ref: firstInputRef,
+                type: "text",
+                inputMode: "numeric",
+                maxLength: 6,
+                autoComplete: "one-time-code",
+                autoFocus: true,
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                "aria-describedby": form.error ? errorId : void 0,
+                value: form.mfa.code,
+                onChange: (e) => form.mfa.setCode(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+          ] }) : l.mfaSubmit })
+        ]
+      }
+    );
+  }
+  if (form.step === "new_password") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(
+      "form",
+      {
+        onSubmit: form.newPassword.onSubmit,
+        className,
+        "aria-label": "Imposta nuova password",
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsx("p", { children: "Devi impostare una nuova password per continuare." }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-new-password`, children: l.newPassword }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-new-password`,
+                ref: firstInputRef,
+                type: "password",
+                autoComplete: "new-password",
+                autoFocus: true,
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                "aria-describedby": form.error ? errorId : void 0,
+                value: form.newPassword.password,
+                onChange: (e) => form.newPassword.setPassword(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-confirm-password`, children: l.confirmNewPassword }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-confirm-password`,
+                type: "password",
+                autoComplete: "new-password",
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                value: form.newPassword.confirmPassword,
+                onChange: (e) => form.newPassword.setConfirmPassword(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+          ] }) : l.newPasswordSubmit })
+        ]
+      }
+    );
+  }
+  if (form.step === "mfa_setup") {
+    return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, children: [
+      /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+      form.isLoading && !form.mfaSetup.qrCodeUri && /* @__PURE__ */ jsxRuntime.jsx("p", { "aria-live": "polite", "aria-atomic": "true", children: "Inizializzazione in corso..." }),
+      form.mfaSetup.qrCodeUri && /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntime.jsx("p", { children: l.mfaSetupScanInstruction }),
+        renderQrCode ? renderQrCode(form.mfaSetup.qrCodeUri) : /* @__PURE__ */ jsxRuntime.jsx("code", { style: { wordBreak: "break-all", fontSize: "0.75em" }, children: form.mfaSetup.qrCodeUri }),
+        form.mfaSetup.secretCode && /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+          l.mfaSetupSecretLabel,
+          ": ",
+          /* @__PURE__ */ jsxRuntime.jsx("code", { children: form.mfaSetup.secretCode })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: form.mfaSetup.onVerify, "aria-label": "Verifica configurazione MFA", children: [
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-totp-code`, children: l.mfaSetupCode }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-totp-code`,
+              ref: firstInputRef,
+              type: "text",
+              inputMode: "numeric",
+              maxLength: 6,
+              autoComplete: "one-time-code",
+              autoFocus: true,
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              "aria-describedby": form.error ? errorId : void 0,
+              disabled: form.isLoading && !form.mfaSetup.qrCodeUri,
+              value: form.mfaSetup.totpCode,
+              onChange: (e) => form.mfaSetup.setTotpCode(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "submit",
+            disabled: form.isLoading || form.mfaSetup.totpCode.length !== 6,
+            "aria-busy": form.isLoading,
+            children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+              /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+            ] }) : l.mfaSetupSubmit
+          }
+        )
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "form",
+    {
+      onSubmit: form.credentials.onSubmit,
+      className,
+      "aria-label": "Accedi al tuo account",
+      children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-email`, children: l.email }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-email`,
+              ref: firstInputRef,
+              type: "email",
+              autoComplete: "email",
+              autoFocus: true,
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              "aria-describedby": form.error ? errorId : void 0,
+              value: form.credentials.email,
+              onChange: (e) => form.credentials.setEmail(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-password`, children: l.password }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-password`,
+              type: "password",
+              autoComplete: "current-password",
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              value: form.credentials.password,
+              onChange: (e) => form.credentials.setPassword(e.target.value)
+            }
+          )
+        ] }),
+        forgotPasswordLink,
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+          /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+        ] }) : l.submit }),
+        registerLink
+      ]
+    }
+  );
+}
+function RegisterForm({
+  className,
+  labels = {},
+  signInLink,
+  onSuccess,
+  onError,
+  extraAttributes
+}) {
+  const uid = react.useId();
+  const form = useRegisterForm({ onSuccess, onError, extraAttributes });
+  const firstInputRef = react.useRef(null);
+  react.useEffect(() => {
+    firstInputRef.current?.focus();
+  }, [form.step]);
+  const l = {
+    email: labels.email ?? "Email",
+    password: labels.password ?? "Password",
+    confirmPassword: labels.confirmPassword ?? "Conferma password",
+    submit: labels.submit ?? "Registrati",
+    code: labels.code ?? "Codice di verifica",
+    confirmSubmit: labels.confirmSubmit ?? "Conferma",
+    resend: labels.resend ?? "Invia di nuovo"
+  };
+  const errorId = `${uid}-error`;
+  if (form.step === "confirm") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(
+      "form",
+      {
+        onSubmit: form.confirm.onSubmit,
+        className,
+        "aria-label": "Conferma registrazione",
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+            "Controlla la tua email ",
+            /* @__PURE__ */ jsxRuntime.jsx("strong", { children: form.confirm.email }),
+            " e inserisci il codice ricevuto."
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-code`, children: l.code }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-code`,
+                ref: firstInputRef,
+                type: "text",
+                inputMode: "numeric",
+                maxLength: 6,
+                autoComplete: "one-time-code",
+                autoFocus: true,
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                "aria-describedby": form.error ? errorId : void 0,
+                value: form.confirm.code,
+                onChange: (e) => form.confirm.setCode(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+          ] }) : l.confirmSubmit }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: form.confirm.resend, children: l.resend })
+        ]
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "form",
+    {
+      onSubmit: form.register.onSubmit,
+      className,
+      "aria-label": "Crea un nuovo account",
+      children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-email`, children: l.email }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-email`,
+              ref: firstInputRef,
+              type: "email",
+              autoComplete: "email",
+              autoFocus: true,
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              "aria-describedby": form.error ? errorId : void 0,
+              value: form.register.email,
+              onChange: (e) => form.register.setEmail(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-password`, children: l.password }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-password`,
+              type: "password",
+              autoComplete: "new-password",
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              value: form.register.password,
+              onChange: (e) => form.register.setPassword(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-confirm-password`, children: l.confirmPassword }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-confirm-password`,
+              type: "password",
+              autoComplete: "new-password",
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              value: form.register.confirmPassword,
+              onChange: (e) => form.register.setConfirmPassword(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+          /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+        ] }) : l.submit }),
+        signInLink
+      ]
+    }
+  );
+}
+function ForgotPasswordForm({
+  className,
+  labels = {},
+  signInLink,
+  onSuccess,
+  onError
+}) {
+  const uid = react.useId();
+  const form = useForgotPasswordForm({ onSuccess, onError });
+  const firstInputRef = react.useRef(null);
+  react.useEffect(() => {
+    firstInputRef.current?.focus();
+  }, [form.step]);
+  const l = {
+    email: labels.email ?? "Email",
+    requestSubmit: labels.requestSubmit ?? "Invia codice",
+    code: labels.code ?? "Codice di verifica",
+    newPassword: labels.newPassword ?? "Nuova password",
+    confirmPassword: labels.confirmPassword ?? "Conferma password",
+    resetSubmit: labels.resetSubmit ?? "Reimposta password"
+  };
+  const errorId = `${uid}-error`;
+  if (form.step === "reset") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(
+      "form",
+      {
+        onSubmit: form.reset.onSubmit,
+        className,
+        "aria-label": "Reimposta password",
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+            "Abbiamo inviato un codice a ",
+            /* @__PURE__ */ jsxRuntime.jsx("strong", { children: form.reset.email }),
+            "."
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-code`, children: l.code }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-code`,
+                ref: firstInputRef,
+                type: "text",
+                inputMode: "numeric",
+                maxLength: 6,
+                autoComplete: "one-time-code",
+                autoFocus: true,
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                "aria-describedby": form.error ? errorId : void 0,
+                value: form.reset.code,
+                onChange: (e) => form.reset.setCode(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-new-password`, children: l.newPassword }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-new-password`,
+                type: "password",
+                autoComplete: "new-password",
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                value: form.reset.newPassword,
+                onChange: (e) => form.reset.setNewPassword(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-confirm-password`, children: l.confirmPassword }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              "input",
+              {
+                id: `${uid}-confirm-password`,
+                type: "password",
+                autoComplete: "new-password",
+                required: true,
+                "aria-required": "true",
+                "aria-invalid": !!form.error,
+                value: form.reset.confirmPassword,
+                onChange: (e) => form.reset.setConfirmPassword(e.target.value)
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+          ] }) : l.resetSubmit }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: form.restart, children: "Torna all'inizio" })
+        ]
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "form",
+    {
+      onSubmit: form.request.onSubmit,
+      className,
+      "aria-label": "Richiedi codice di reimpostazione password",
+      children: [
+        /* @__PURE__ */ jsxRuntime.jsx("p", { children: "Inserisci la tua email per ricevere il codice di reimpostazione." }),
+        /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-email`, children: l.email }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-email`,
+              ref: firstInputRef,
+              type: "email",
+              autoComplete: "email",
+              autoFocus: true,
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              "aria-describedby": form.error ? errorId : void 0,
+              value: form.request.email,
+              onChange: (e) => form.request.setEmail(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+          /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+        ] }) : l.requestSubmit }),
+        signInLink
+      ]
+    }
+  );
+}
+function ChangePasswordForm({
+  className,
+  labels = {},
+  onSuccess,
+  onError
+}) {
+  const uid = react.useId();
+  const form = useChangePasswordForm({ onSuccess, onError });
+  const firstInputRef = react.useRef(null);
+  const l = {
+    currentPassword: labels.currentPassword ?? "Password attuale",
+    newPassword: labels.newPassword ?? "Nuova password",
+    confirmPassword: labels.confirmPassword ?? "Conferma nuova password",
+    submit: labels.submit ?? "Cambia password",
+    successMessage: labels.successMessage ?? "Password aggiornata con successo."
+  };
+  const errorId = `${uid}-error`;
+  if (form.success) {
+    return /* @__PURE__ */ jsxRuntime.jsx("p", { role: "status", children: l.successMessage });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "form",
+    {
+      onSubmit: form.onSubmit,
+      className,
+      "aria-label": "Cambia password",
+      children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: form.error?.message }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-current-password`, children: l.currentPassword }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-current-password`,
+              ref: firstInputRef,
+              type: "password",
+              autoComplete: "current-password",
+              autoFocus: true,
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              "aria-describedby": form.error ? errorId : void 0,
+              value: form.currentPassword,
+              onChange: (e) => form.setCurrentPassword(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-new-password`, children: l.newPassword }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-new-password`,
+              type: "password",
+              autoComplete: "new-password",
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              value: form.newPassword,
+              onChange: (e) => form.setNewPassword(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-confirm-password`, children: l.confirmPassword }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              id: `${uid}-confirm-password`,
+              type: "password",
+              autoComplete: "new-password",
+              required: true,
+              "aria-required": "true",
+              "aria-invalid": !!form.error,
+              value: form.confirmPassword,
+              onChange: (e) => form.setConfirmPassword(e.target.value)
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: form.isLoading, "aria-busy": form.isLoading, children: form.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+          /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+        ] }) : l.submit })
+      ]
+    }
+  );
+}
+function MfaSetupWizard({
+  className,
+  labels = {},
+  renderQrCode,
+  onSuccess,
+  onError
+}) {
+  const uid = react.useId();
+  const wizard = useMfaSetup({ onSuccess, onError });
+  const firstInputRef = react.useRef(null);
+  react.useEffect(() => {
+    firstInputRef.current?.focus();
+  }, [wizard.step]);
+  const l = {
+    start: labels.start ?? "Configura autenticazione a due fattori (TOTP)",
+    scanInstruction: labels.scanInstruction ?? "Scansiona il QR code con la tua app authenticator (Google Authenticator, Authy, 1Password\u2026)",
+    manualEntry: labels.manualEntry ?? "Oppure inserisci il codice manualmente:",
+    codeLabel: labels.codeLabel ?? "Codice a 6 cifre",
+    verifySubmit: labels.verifySubmit ?? "Verifica e attiva",
+    successMessage: labels.successMessage ?? "Autenticazione a due fattori attivata con successo."
+  };
+  const errorId = `${uid}-error`;
+  if (wizard.step === "done") {
+    return /* @__PURE__ */ jsxRuntime.jsx("p", { role: "status", children: l.successMessage });
+  }
+  if (wizard.step === "idle") {
+    return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, children: [
+      /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: wizard.error?.message }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", autoFocus: true, onClick: wizard.start, children: l.start })
+    ] });
+  }
+  if (wizard.step === "loading") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "aria-live": "polite", "aria-atomic": "true", children: "..." });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, children: [
+    /* @__PURE__ */ jsxRuntime.jsx("div", { id: errorId, role: "alert", "aria-live": "assertive", "aria-atomic": "true", children: wizard.error?.message }),
+    wizard.qrCodeUri && /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+      /* @__PURE__ */ jsxRuntime.jsx("p", { children: l.scanInstruction }),
+      renderQrCode ? renderQrCode(wizard.qrCodeUri) : /* @__PURE__ */ jsxRuntime.jsx("code", { style: { wordBreak: "break-all", fontSize: "0.75em" }, children: wizard.qrCodeUri }),
+      wizard.secretCode && /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+        l.manualEntry,
+        " ",
+        /* @__PURE__ */ jsxRuntime.jsx("code", { children: wizard.secretCode })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: wizard.onVerify, "aria-label": "Verifica dispositivo TOTP", children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntime.jsx("label", { htmlFor: `${uid}-totp-code`, children: l.codeLabel }),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "input",
+          {
+            id: `${uid}-totp-code`,
+            ref: firstInputRef,
+            type: "text",
+            inputMode: "numeric",
+            maxLength: 6,
+            autoComplete: "one-time-code",
+            autoFocus: true,
+            required: true,
+            "aria-required": "true",
+            "aria-invalid": !!wizard.error,
+            "aria-describedby": wizard.error ? errorId : void 0,
+            value: wizard.totpCode,
+            onChange: (e) => wizard.setTotpCode(e.target.value)
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "submit",
+          disabled: wizard.isLoading || wizard.totpCode.length !== 6,
+          "aria-busy": wizard.isLoading,
+          children: wizard.isLoading ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { "aria-hidden": "true", children: "..." }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "sr-only", children: "Caricamento..." })
+          ] }) : l.verifySubmit
+        }
+      )
+    ] })
+  ] });
+}
+
+exports.ChangePasswordForm = ChangePasswordForm;
+exports.ForgotPasswordForm = ForgotPasswordForm;
+exports.MfaSetupWizard = MfaSetupWizard;
+exports.RegisterForm = RegisterForm;
+exports.SignInForm = SignInForm;
+exports.useChangePasswordForm = useChangePasswordForm;
+exports.useForgotPasswordForm = useForgotPasswordForm;
+exports.useMfaSetup = useMfaSetup;
+exports.useRegisterForm = useRegisterForm;
+exports.useSignInForm = useSignInForm;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map