@reblu/site-next 1.1.0 → 1.2.0

package/dist/auth.js

@@ -0,0 +1,1053 @@
+"use client";
+
+// src/auth/login-form.tsx
+import * as React from "react";
+import { Button, Input, cn } from "@reblu/site-ui";
+import { Label } from "@reblu/site-ui/label";
+import { Tabs, TabsList, TabsTrigger, TabsContent } from "@reblu/site-ui/tabs";
+
+// src/auth/safe-redirect.ts
+function isSafeRedirectUrl(url) {
+  if (!url) return false;
+  const clean = url.replace(/[\t\n\r]/g, "");
+  if (!clean) return false;
+  if (/^[/\\]{2}/.test(clean)) return false;
+  const scheme = clean.split(":")[0].toLowerCase();
+  return ["http", "https"].includes(scheme) || clean.startsWith("/");
+}
+
+// src/auth/login-form.tsx
+import { jsx, jsxs } from "react/jsx-runtime";
+var DEFAULT_COPY = {
+  magicLinkTabLabel: "Enlace m\xE1gico",
+  passwordTabLabel: "Contrase\xF1a",
+  emailLabel: "Correo electr\xF3nico",
+  emailPlaceholder: "tu@email.com",
+  passwordLabel: "Contrase\xF1a",
+  passwordPlaceholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
+  passwordSubmitCta: "Iniciar sesi\xF3n",
+  forgotPasswordCta: "\xBFOlvidaste tu contrase\xF1a?",
+  magicLinkSubmitCta: "Enviar enlace de acceso",
+  magicLinkSuccessTitle: "\xA1Enlace enviado!",
+  magicLinkSuccessMessage: "Revisa tu correo para acceder.",
+  mfaTitle: "Verificaci\xF3n en dos pasos",
+  mfaMessage: "Introduce el c\xF3digo de 6 d\xEDgitos de tu aplicaci\xF3n autenticadora.",
+  mfaCodeLabel: "C\xF3digo de verificaci\xF3n",
+  mfaCodePlaceholder: "123456",
+  mfaSubmitCta: "Verificar c\xF3digo",
+  invalidEmailError: "Introduce un correo electr\xF3nico v\xE1lido.",
+  networkError: "No se pudo enviar el enlace. Int\xE9ntalo de nuevo.",
+  invalidCredentialsError: "Email o contrase\xF1a incorrectos",
+  mfaInvalidCodeError: "C\xF3digo incorrecto. Por favor, int\xE9ntalo de nuevo."
+};
+var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(value) {
+  return EMAIL_REGEX.test(value);
+}
+function LoginForm(props) {
+  const {
+    passwordLoginUrl,
+    mfaVerifyUrl,
+    magicLinkRequestUrl,
+    resetPasswordUrl,
+    copy,
+    className,
+    defaultMethod = "password",
+    onPasswordSubmitted,
+    onMagicLinkSubmitted,
+    onMfaSubmitted
+  } = props;
+  const c = { ...DEFAULT_COPY, ...copy };
+  const [method, setMethod] = React.useState(defaultMethod);
+  const [state, setState] = React.useState("idle");
+  const [error, setError] = React.useState(null);
+  const [email, setEmail] = React.useState("");
+  const [password, setPassword] = React.useState("");
+  const [mfa, setMfa] = React.useState(null);
+  const [mfaCode, setMfaCode] = React.useState("");
+  const resetTransientState = React.useCallback(() => {
+    setState("idle");
+    setError(null);
+    setMfa(null);
+    setMfaCode("");
+  }, []);
+  const handleTabChange = (next) => {
+    if (next !== "magic-link" && next !== "password") return;
+    setMethod(next);
+    resetTransientState();
+  };
+  const handleMagicLinkSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    const trimmed = email.trim().toLowerCase();
+    if (!isValidEmail(trimmed)) {
+      setError(c.invalidEmailError);
+      setState("error");
+      return;
+    }
+    setState("submitting");
+    try {
+      const res = await fetch(magicLinkRequestUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: trimmed })
+      });
+      if (res.ok) {
+        setState("magic-link-success");
+        onMagicLinkSubmitted?.(trimmed);
+        return;
+      }
+      setState("error");
+      setError(c.networkError);
+    } catch {
+      setState("error");
+      setError(c.networkError);
+    }
+  };
+  const handlePasswordSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    const trimmed = email.trim().toLowerCase();
+    if (!isValidEmail(trimmed)) {
+      setError(c.invalidEmailError);
+      setState("error");
+      return;
+    }
+    if (!password) {
+      setError(c.invalidCredentialsError);
+      setState("error");
+      return;
+    }
+    setState("submitting");
+    try {
+      const res = await fetch(passwordLoginUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: trimmed, password })
+      });
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok || !json.data) {
+        setState("error");
+        setError(json.error ?? c.invalidCredentialsError);
+        return;
+      }
+      onPasswordSubmitted?.(trimmed);
+      if (json.data.mfaRequired) {
+        setMfa({
+          factorId: json.data.factorId ?? "",
+          accessToken: json.data.accessToken ?? "",
+          refreshToken: json.data.refreshToken ?? ""
+        });
+        setState("mfa-required");
+        return;
+      }
+      const exchangeUrl = json.data.sessionExchangeUrl;
+      if (!exchangeUrl || !isSafeRedirectUrl(exchangeUrl)) {
+        setState("error");
+        setError(c.networkError);
+        return;
+      }
+      window.location.assign(exchangeUrl);
+    } catch {
+      setState("error");
+      setError(c.networkError);
+    }
+  };
+  const handleMfaSubmit = async (e) => {
+    e.preventDefault();
+    if (!mfa) return;
+    setError(null);
+    setState("submitting");
+    try {
+      const res = await fetch(mfaVerifyUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          factorId: mfa.factorId,
+          code: mfaCode,
+          accessToken: mfa.accessToken,
+          refreshToken: mfa.refreshToken
+        })
+      });
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok || !json.data?.sessionExchangeUrl || !isSafeRedirectUrl(json.data.sessionExchangeUrl)) {
+        setState("mfa-required");
+        setError(json.error ?? c.mfaInvalidCodeError);
+        setMfaCode("");
+        return;
+      }
+      onMfaSubmitted?.();
+      window.location.assign(json.data.sessionExchangeUrl);
+    } catch {
+      setState("mfa-required");
+      setError(c.networkError);
+    }
+  };
+  if (state === "mfa-required" || mfa && state === "submitting") {
+    return /* @__PURE__ */ jsxs("div", { className: cn("space-y-6", className), children: [
+      /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
+        /* @__PURE__ */ jsx("h2", { className: "text-xl font-semibold", children: c.mfaTitle }),
+        /* @__PURE__ */ jsx("p", { className: "text-muted-foreground text-sm", children: c.mfaMessage })
+      ] }),
+      /* @__PURE__ */ jsxs("form", { onSubmit: (e) => void handleMfaSubmit(e), className: "space-y-4", noValidate: true, children: [
+        /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+          /* @__PURE__ */ jsx(Label, { htmlFor: "login-mfa-code", children: c.mfaCodeLabel }),
+          /* @__PURE__ */ jsx(
+            Input,
+            {
+              id: "login-mfa-code",
+              type: "text",
+              inputMode: "numeric",
+              pattern: "\\d{6}",
+              maxLength: 6,
+              autoComplete: "one-time-code",
+              placeholder: c.mfaCodePlaceholder,
+              value: mfaCode,
+              onChange: (ev) => setMfaCode(ev.target.value.replace(/\D/g, "").slice(0, 6)),
+              disabled: state === "submitting",
+              "aria-describedby": error ? "login-mfa-error" : void 0,
+              autoFocus: true
+            }
+          ),
+          error && /* @__PURE__ */ jsx("p", { id: "login-mfa-error", role: "alert", className: "text-destructive text-sm", children: error })
+        ] }),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            type: "submit",
+            className: "w-full",
+            disabled: state === "submitting" || mfaCode.length !== 6,
+            children: c.mfaSubmitCta
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: resetTransientState,
+            className: "text-muted-foreground hover:text-foreground w-full text-sm transition-colors",
+            disabled: state === "submitting",
+            children: "\u2190 Volver"
+          }
+        )
+      ] })
+    ] });
+  }
+  if (state === "magic-link-success") {
+    return /* @__PURE__ */ jsxs("div", { className: cn("space-y-2 text-center", className), children: [
+      /* @__PURE__ */ jsx("h2", { className: "text-xl font-semibold", children: c.magicLinkSuccessTitle }),
+      /* @__PURE__ */ jsx("p", { className: "text-muted-foreground", children: c.magicLinkSuccessMessage })
+    ] });
+  }
+  return /* @__PURE__ */ jsx("div", { className: cn("space-y-6", className), children: /* @__PURE__ */ jsxs(Tabs, { value: method, onValueChange: handleTabChange, children: [
+    /* @__PURE__ */ jsxs(TabsList, { className: "grid w-full grid-cols-2", children: [
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "password", children: c.passwordTabLabel }),
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "magic-link", children: c.magicLinkTabLabel })
+    ] }),
+    /* @__PURE__ */ jsx(TabsContent, { value: "password", className: "pt-4", children: /* @__PURE__ */ jsxs("form", { onSubmit: (e) => void handlePasswordSubmit(e), className: "space-y-4", noValidate: true, children: [
+      /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+        /* @__PURE__ */ jsx(Label, { htmlFor: "login-email-pwd", children: c.emailLabel }),
+        /* @__PURE__ */ jsx(
+          Input,
+          {
+            id: "login-email-pwd",
+            type: "email",
+            autoComplete: "email",
+            placeholder: c.emailPlaceholder,
+            value: email,
+            onChange: (ev) => setEmail(ev.target.value),
+            disabled: state === "submitting"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+        /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between", children: [
+          /* @__PURE__ */ jsx(Label, { htmlFor: "login-password", children: c.passwordLabel }),
+          /* @__PURE__ */ jsx(
+            "a",
+            {
+              href: resetPasswordUrl,
+              className: "text-muted-foreground hover:text-foreground text-xs transition-colors",
+              children: c.forgotPasswordCta
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsx(
+          Input,
+          {
+            id: "login-password",
+            type: "password",
+            autoComplete: "current-password",
+            placeholder: c.passwordPlaceholder,
+            value: password,
+            onChange: (ev) => setPassword(ev.target.value),
+            disabled: state === "submitting",
+            "aria-describedby": error ? "login-pwd-error" : void 0
+          }
+        ),
+        error && /* @__PURE__ */ jsx("p", { id: "login-pwd-error", role: "alert", className: "text-destructive text-sm", children: error })
+      ] }),
+      /* @__PURE__ */ jsx(Button, { type: "submit", className: "w-full", disabled: state === "submitting", children: c.passwordSubmitCta })
+    ] }) }),
+    /* @__PURE__ */ jsx(TabsContent, { value: "magic-link", className: "pt-4", children: /* @__PURE__ */ jsxs("form", { onSubmit: (e) => void handleMagicLinkSubmit(e), className: "space-y-4", noValidate: true, children: [
+      /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+        /* @__PURE__ */ jsx(Label, { htmlFor: "login-email-magic", children: c.emailLabel }),
+        /* @__PURE__ */ jsx(
+          Input,
+          {
+            id: "login-email-magic",
+            type: "email",
+            autoComplete: "email",
+            placeholder: c.emailPlaceholder,
+            value: email,
+            onChange: (ev) => setEmail(ev.target.value),
+            disabled: state === "submitting",
+            "aria-describedby": error ? "login-magic-error" : void 0
+          }
+        ),
+        error && /* @__PURE__ */ jsx("p", { id: "login-magic-error", role: "alert", className: "text-destructive text-sm", children: error })
+      ] }),
+      /* @__PURE__ */ jsx(Button, { type: "submit", className: "w-full", disabled: state === "submitting", children: c.magicLinkSubmitCta })
+    ] }) })
+  ] }) });
+}
+
+// src/auth/auth-callback.tsx
+import * as React2 from "react";
+import { Button as Button2, cn as cn2 } from "@reblu/site-ui";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+var DEFAULT_COPY2 = {
+  loadingTitle: "Autenticando...",
+  loadingMessage: "Estamos verificando tu identidad.",
+  successMessage: "Iniciando sesi\xF3n...",
+  expiredTitle: "Enlace caducado",
+  expiredMessage: "El enlace ha expirado o ya fue utilizado. Solicita uno nuevo.",
+  expiredCta: "Volver al login",
+  networkErrorTitle: "Error de conexi\xF3n",
+  networkErrorMessage: "No pudimos completar el inicio de sesi\xF3n. Int\xE9ntalo de nuevo.",
+  networkErrorRetryCta: "Reintentar",
+  networkErrorBackCta: "Volver al login",
+  malformedTitle: "Enlace inv\xE1lido",
+  malformedMessage: "Enlace inv\xE1lido. Solicita uno nuevo.",
+  malformedCta: "Volver al login"
+};
+function parseHash(hash) {
+  const raw = hash.startsWith("#") ? hash.slice(1) : hash;
+  if (!raw) return null;
+  const params = new URLSearchParams(raw);
+  const access_token = params.get("access_token") ?? "";
+  const refresh_token = params.get("refresh_token") ?? "";
+  const type = params.get("type") ?? "";
+  if (!access_token || !refresh_token || type !== "magiclink") return null;
+  return { access_token, refresh_token };
+}
+function parseHashError(hash) {
+  const raw = hash.startsWith("#") ? hash.slice(1) : hash;
+  if (!raw) return null;
+  const params = new URLSearchParams(raw);
+  const error = params.get("error");
+  const errorCode = params.get("error_code");
+  if (!error && !errorCode) return null;
+  return errorCode === "otp_expired" || error === "access_denied" ? "expired" : "malformed";
+}
+function AuthCallback({
+  exchangeUrl,
+  loginUrl,
+  copy,
+  onSuccess,
+  onError,
+  className
+}) {
+  const [state, setState] = React2.useState("mounting");
+  const [tokens, setTokens] = React2.useState(null);
+  const retryRef = React2.useRef(null);
+  const linkRef = React2.useRef(null);
+  const c = { ...DEFAULT_COPY2, ...copy };
+  const exchange = React2.useCallback(
+    async (t) => {
+      setState("exchanging");
+      try {
+        const res = await fetch(exchangeUrl, {
+          method: "POST",
+          credentials: "same-origin",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(t)
+        });
+        if (res.ok) {
+          const raw = await res.json();
+          const redirectTo = raw !== null && typeof raw === "object" && "redirectTo" in raw && typeof raw.redirectTo === "string" ? raw.redirectTo : null;
+          if (!redirectTo) {
+            setState("network");
+            onError?.("network", void 0);
+            return;
+          }
+          if (!isSafeRedirectUrl(redirectTo)) {
+            setState("network");
+            onError?.("network", void 0);
+            return;
+          }
+          history.replaceState({}, "", window.location.pathname);
+          window.location.replace(redirectTo);
+          setState("success");
+          onSuccess?.(redirectTo);
+          return;
+        }
+        if (res.status === 401) {
+          setState("expired");
+          onError?.("expired");
+          return;
+        }
+        setState("network");
+        onError?.("network", void 0);
+      } catch (err) {
+        setState("network");
+        onError?.("network", err instanceof Error ? err : void 0);
+      }
+    },
+    [exchangeUrl, onError, onSuccess]
+  );
+  React2.useEffect(() => {
+    setState("parsing");
+    const hashError = parseHashError(window.location.hash);
+    if (hashError) {
+      setState(hashError);
+      onError?.(hashError);
+      return;
+    }
+    const parsed = parseHash(window.location.hash);
+    if (!parsed) {
+      setState("malformed");
+      onError?.("malformed");
+      return;
+    }
+    setTokens(parsed);
+    void exchange(parsed);
+  }, []);
+  React2.useEffect(() => {
+    if (state === "network") retryRef.current?.focus();
+    if (state === "expired" || state === "malformed") linkRef.current?.focus();
+  }, [state]);
+  const isLoading = state === "mounting" || state === "parsing" || state === "exchanging";
+  return /* @__PURE__ */ jsx2("main", { className: cn2("flex min-h-screen items-center justify-center", className), children: /* @__PURE__ */ jsxs2("div", { "aria-live": "polite", className: "w-full max-w-md space-y-4 p-6 text-center", children: [
+    isLoading && /* @__PURE__ */ jsxs2("section", { children: [
+      /* @__PURE__ */ jsx2("h2", { className: "text-xl font-semibold", children: c.loadingTitle }),
+      /* @__PURE__ */ jsx2("p", { className: "text-muted-foreground mt-2", children: c.loadingMessage })
+    ] }),
+    state === "success" && /* @__PURE__ */ jsx2("section", { children: /* @__PURE__ */ jsx2("p", { children: c.successMessage }) }),
+    state === "expired" && /* @__PURE__ */ jsxs2("section", { className: "space-y-4", children: [
+      /* @__PURE__ */ jsx2("h2", { className: "text-xl font-semibold", children: c.expiredTitle }),
+      /* @__PURE__ */ jsx2("p", { className: "text-muted-foreground", children: c.expiredMessage }),
+      /* @__PURE__ */ jsx2(Button2, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx2("a", { href: loginUrl, ref: linkRef, children: c.expiredCta }) })
+    ] }),
+    state === "network" && /* @__PURE__ */ jsxs2("section", { className: "space-y-4", children: [
+      /* @__PURE__ */ jsx2("h2", { className: "text-xl font-semibold", children: c.networkErrorTitle }),
+      /* @__PURE__ */ jsx2("p", { className: "text-muted-foreground", children: c.networkErrorMessage }),
+      /* @__PURE__ */ jsxs2("div", { className: "flex flex-col gap-2", children: [
+        /* @__PURE__ */ jsx2(Button2, { type: "button", ref: retryRef, onClick: () => tokens && void exchange(tokens), children: c.networkErrorRetryCta }),
+        /* @__PURE__ */ jsx2(Button2, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx2("a", { href: loginUrl, children: c.networkErrorBackCta }) })
+      ] })
+    ] }),
+    state === "malformed" && /* @__PURE__ */ jsxs2("section", { className: "space-y-4", children: [
+      /* @__PURE__ */ jsx2("h2", { className: "text-xl font-semibold", children: c.malformedTitle }),
+      /* @__PURE__ */ jsx2("p", { className: "text-muted-foreground", children: c.malformedMessage }),
+      /* @__PURE__ */ jsx2(Button2, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx2("a", { href: loginUrl, ref: linkRef, children: c.malformedCta }) })
+    ] })
+  ] }) });
+}
+
+// src/auth/login-errors.ts
+var DEFAULT_COPY3 = {
+  expiredMessage: "El enlace ha expirado o ya fue utilizado.",
+  missingTokenMessage: "El enlace no es v\xE1lido. Solicita uno nuevo.",
+  genericMessage: "No se pudo completar el inicio de sesi\xF3n. Intenta de nuevo."
+};
+function mapLoginError(error, copy) {
+  if (!error) return null;
+  const normalized = error.trim().toLowerCase();
+  if (normalized === "") return null;
+  const c = { ...DEFAULT_COPY3, ...copy };
+  if (normalized.includes("email link is invalid or has expired") || normalized.includes("token has expired or is invalid")) {
+    return { message: c.expiredMessage, showRequestLink: true };
+  }
+  if (normalized.includes("missing_token")) {
+    return { message: c.missingTokenMessage, showRequestLink: true };
+  }
+  return { message: c.genericMessage, showRequestLink: true };
+}
+
+// src/auth/auth-logo.tsx
+import * as React3 from "react";
+import { useTheme } from "next-themes";
+import { cn as cn3 } from "@reblu/site-ui";
+import { jsx as jsx3 } from "react/jsx-runtime";
+var DEFAULT_COPY4 = {
+  fallbackLabel: "Inicio de sesi\xF3n"
+};
+var VARIANT_CLASS = {
+  expanded: "h-8 w-auto",
+  compact: "h-8 w-8"
+};
+var VARIANT_INTRINSIC_SIZE = {
+  expanded: { width: 160, height: 32 },
+  compact: { width: 32, height: 32 }
+};
+function AuthLogo(props) {
+  const {
+    logoLightExpandedUrl,
+    logoDarkExpandedUrl,
+    logoLightSmallUrl,
+    logoDarkSmallUrl,
+    siteName,
+    variant = "expanded",
+    className,
+    copy,
+    hideTextFallback = false
+  } = props;
+  const fallbackLabel = copy?.fallbackLabel ?? DEFAULT_COPY4.fallbackLabel;
+  const { resolvedTheme } = useTheme();
+  const isDark = resolvedTheme === "dark";
+  const lightUrl = variant === "compact" ? logoLightSmallUrl : logoLightExpandedUrl;
+  const darkUrl = variant === "compact" ? logoDarkSmallUrl : logoDarkExpandedUrl;
+  const logoUrl = isDark ? darkUrl : lightUrl;
+  const [imgError, setImgError] = React3.useState(false);
+  React3.useEffect(() => {
+    setImgError(false);
+  }, [logoUrl]);
+  const fallbackText = siteName || fallbackLabel;
+  const altText = copy?.altText !== void 0 ? copy.altText : siteName || fallbackLabel;
+  if (logoUrl && !imgError) {
+    const { width, height } = VARIANT_INTRINSIC_SIZE[variant];
+    return /* @__PURE__ */ jsx3(
+      "img",
+      {
+        src: logoUrl,
+        alt: altText,
+        width,
+        height,
+        className: cn3(VARIANT_CLASS[variant], className),
+        onError: () => setImgError(true)
+      }
+    );
+  }
+  if (hideTextFallback) return null;
+  return /* @__PURE__ */ jsx3("span", { className: cn3("text-lg font-semibold text-foreground", className), children: fallbackText });
+}
+
+// src/auth/reset-password-request.tsx
+import * as React4 from "react";
+import { Button as Button3, Input as Input2, cn as cn4 } from "@reblu/site-ui";
+import { Label as Label2 } from "@reblu/site-ui/label";
+import { jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
+var DEFAULT_COPY5 = {
+  emailLabel: "Correo electr\xF3nico",
+  emailPlaceholder: "tu@email.com",
+  submitCta: "Enviar enlace de recuperaci\xF3n",
+  submittingCta: "Enviando...",
+  successTitle: "Revisa tu email",
+  successMessage: "Si el email existe en nuestra plataforma, recibir\xE1s un enlace para restablecer tu contrase\xF1a en los pr\xF3ximos minutos.",
+  backToLoginCta: "\u2190 Volver al inicio de sesi\xF3n",
+  invalidEmailError: "Introduce un correo electr\xF3nico v\xE1lido.",
+  networkError: "Error de conexi\xF3n. Por favor, int\xE9ntalo de nuevo."
+};
+var EMAIL_REGEX2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function ResetPasswordRequest(props) {
+  const { requestUrl, loginUrl, copy, className, onSubmitted } = props;
+  const c = { ...DEFAULT_COPY5, ...copy };
+  const [email, setEmail] = React4.useState("");
+  const [loading, setLoading] = React4.useState(false);
+  const [submitted, setSubmitted] = React4.useState(false);
+  const [error, setError] = React4.useState(null);
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    const trimmed = email.trim().toLowerCase();
+    if (!EMAIL_REGEX2.test(trimmed)) {
+      setError(c.invalidEmailError);
+      return;
+    }
+    setLoading(true);
+    let succeeded = false;
+    try {
+      const res = await fetch(requestUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: trimmed })
+      });
+      if (!res.ok) {
+        const json = await res.json().catch(() => ({}));
+        setError(json.error ?? c.networkError);
+        setLoading(false);
+        return;
+      }
+      succeeded = true;
+      setSubmitted(true);
+      setLoading(false);
+    } catch {
+      setError(c.networkError);
+      setLoading(false);
+      return;
+    }
+    if (succeeded) {
+      try {
+        onSubmitted?.(trimmed);
+      } catch (err) {
+        console.error("[ResetPasswordRequest] onSubmitted callback threw:", err);
+      }
+    }
+  };
+  if (submitted) {
+    return /* @__PURE__ */ jsxs3("div", { className: cn4("space-y-4 text-center", className), children: [
+      /* @__PURE__ */ jsx4("h2", { className: "text-lg font-semibold", children: c.successTitle }),
+      /* @__PURE__ */ jsx4("p", { className: "text-muted-foreground text-sm", children: c.successMessage }),
+      /* @__PURE__ */ jsx4("a", { href: loginUrl, className: "text-primary inline-block text-sm hover:underline", children: c.backToLoginCta })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs3(
+    "form",
+    {
+      onSubmit: (e) => void handleSubmit(e),
+      className: cn4("space-y-5", className),
+      noValidate: true,
+      children: [
+        /* @__PURE__ */ jsxs3("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx4(Label2, { htmlFor: "reset-request-email", children: c.emailLabel }),
+          /* @__PURE__ */ jsx4(
+            Input2,
+            {
+              id: "reset-request-email",
+              type: "email",
+              autoComplete: "email",
+              placeholder: c.emailPlaceholder,
+              value: email,
+              onChange: (e) => setEmail(e.target.value),
+              disabled: loading,
+              "aria-describedby": error ? "reset-request-error" : void 0,
+              autoFocus: true
+            }
+          ),
+          error && /* @__PURE__ */ jsx4("p", { id: "reset-request-error", role: "alert", className: "text-destructive text-sm", children: error })
+        ] }),
+        /* @__PURE__ */ jsx4(Button3, { type: "submit", className: "w-full", disabled: loading, children: loading ? c.submittingCta : c.submitCta }),
+        /* @__PURE__ */ jsx4("div", { className: "text-center", children: /* @__PURE__ */ jsx4(
+          "a",
+          {
+            href: loginUrl,
+            className: "text-muted-foreground hover:text-foreground text-sm transition-colors",
+            children: c.backToLoginCta
+          }
+        ) })
+      ]
+    }
+  );
+}
+
+// src/auth/reset-password-confirm.tsx
+import * as React5 from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { Button as Button4, Input as Input3, cn as cn5 } from "@reblu/site-ui";
+import { Label as Label3 } from "@reblu/site-ui/label";
+import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
+function withQueryParam(url, key, value) {
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}${key}=${encodeURIComponent(value)}`;
+}
+var DEFAULT_COPY6 = {
+  passwordLabel: "Nueva contrase\xF1a",
+  passwordPlaceholder: "M\xEDnimo 8 caracteres",
+  confirmPasswordLabel: "Confirmar contrase\xF1a",
+  confirmPasswordPlaceholder: "Repite la contrase\xF1a",
+  mfaCodeLabel: "C\xF3digo de verificaci\xF3n (2FA)",
+  mfaCodePlaceholder: "6 d\xEDgitos",
+  mfaHelpMessage: "Tu cuenta tiene verificaci\xF3n en dos pasos. Introduce el c\xF3digo de tu app de autenticaci\xF3n para completar el cambio.",
+  submitCta: "Establecer nueva contrase\xF1a",
+  submittingCta: "Actualizando contrase\xF1a...",
+  passwordTooShortError: "La contrase\xF1a debe tener al menos 8 caracteres",
+  passwordMismatchError: "Las contrase\xF1as no coinciden",
+  mfaInvalidCodeError: "Introduce el c\xF3digo de 6 d\xEDgitos de tu app de autenticaci\xF3n",
+  genericError: "Error al restablecer la contrase\xF1a",
+  missingTokensTitle: "Enlace inv\xE1lido",
+  missingTokensMessage: "El enlace ha expirado o no es v\xE1lido. Solicita uno nuevo.",
+  requestNewLinkCta: "Solicitar nuevo enlace"
+};
+function ResetPasswordConfirm(props) {
+  const { confirmUrl, loginUrl, resetRequestUrl, copy, className, onSuccess } = props;
+  const c = { ...DEFAULT_COPY6, ...copy };
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const accessToken = searchParams.get("access_token");
+  const refreshToken = searchParams.get("refresh_token");
+  const hasTokens = Boolean(accessToken && refreshToken);
+  const [password, setPassword] = React5.useState("");
+  const [confirmPassword, setConfirmPassword] = React5.useState("");
+  const [loading, setLoading] = React5.useState(false);
+  const [error, setError] = React5.useState(null);
+  const [mfaRequired, setMfaRequired] = React5.useState(false);
+  const [mfaCode, setMfaCode] = React5.useState("");
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (!hasTokens) return;
+    if (password.length < 8) {
+      setError(c.passwordTooShortError);
+      return;
+    }
+    if (password !== confirmPassword) {
+      setError(c.passwordMismatchError);
+      return;
+    }
+    if (mfaRequired && !/^\d{6}$/.test(mfaCode)) {
+      setError(c.mfaInvalidCodeError);
+      return;
+    }
+    setLoading(true);
+    let succeeded = false;
+    try {
+      const res = await fetch(confirmUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          access_token: accessToken,
+          refresh_token: refreshToken,
+          new_password: password,
+          ...mfaRequired ? { mfa_code: mfaCode } : {}
+        })
+      });
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        setError(json.error ?? c.genericError);
+        setLoading(false);
+        return;
+      }
+      if (json.data?.mfaRequired) {
+        setMfaRequired(true);
+        setLoading(false);
+        return;
+      }
+      succeeded = true;
+      setLoading(false);
+    } catch {
+      setError(c.genericError);
+      setLoading(false);
+      return;
+    }
+    if (succeeded) {
+      router.replace(withQueryParam(loginUrl, "reset", "success"));
+      try {
+        onSuccess?.();
+      } catch (err) {
+        console.error("[ResetPasswordConfirm] onSuccess callback threw:", err);
+      }
+    }
+  };
+  if (!hasTokens) {
+    return /* @__PURE__ */ jsxs4("div", { className: cn5("space-y-4 text-center", className), children: [
+      /* @__PURE__ */ jsx5("h2", { className: "text-lg font-semibold", children: c.missingTokensTitle }),
+      /* @__PURE__ */ jsx5("p", { className: "text-muted-foreground text-sm", children: c.missingTokensMessage }),
+      /* @__PURE__ */ jsx5("a", { href: resetRequestUrl, className: "text-primary inline-block text-sm hover:underline", children: c.requestNewLinkCta })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs4(
+    "form",
+    {
+      onSubmit: (e) => void handleSubmit(e),
+      className: cn5("space-y-5", className),
+      noValidate: true,
+      children: [
+        /* @__PURE__ */ jsxs4("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx5(Label3, { htmlFor: "reset-confirm-password", children: c.passwordLabel }),
+          /* @__PURE__ */ jsx5(
+            Input3,
+            {
+              id: "reset-confirm-password",
+              type: "password",
+              autoComplete: "new-password",
+              placeholder: c.passwordPlaceholder,
+              value: password,
+              onChange: (e) => setPassword(e.target.value),
+              disabled: loading,
+              minLength: 8,
+              "aria-describedby": error ? "reset-confirm-error" : void 0,
+              autoFocus: true
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxs4("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx5(Label3, { htmlFor: "reset-confirm-password-2", children: c.confirmPasswordLabel }),
+          /* @__PURE__ */ jsx5(
+            Input3,
+            {
+              id: "reset-confirm-password-2",
+              type: "password",
+              autoComplete: "new-password",
+              placeholder: c.confirmPasswordPlaceholder,
+              value: confirmPassword,
+              onChange: (e) => setConfirmPassword(e.target.value),
+              disabled: loading,
+              minLength: 8,
+              "aria-describedby": error ? "reset-confirm-error" : void 0
+            }
+          )
+        ] }),
+        mfaRequired && /* @__PURE__ */ jsxs4("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx5(Label3, { htmlFor: "reset-confirm-mfa", children: c.mfaCodeLabel }),
+          /* @__PURE__ */ jsx5(
+            Input3,
+            {
+              id: "reset-confirm-mfa",
+              type: "text",
+              inputMode: "numeric",
+              autoComplete: "one-time-code",
+              placeholder: c.mfaCodePlaceholder,
+              value: mfaCode,
+              onChange: (e) => setMfaCode(e.target.value.replace(/\D/g, "").slice(0, 6)),
+              disabled: loading,
+              maxLength: 6,
+              "aria-describedby": error ? "reset-confirm-error" : void 0,
+              autoFocus: true
+            }
+          ),
+          /* @__PURE__ */ jsx5("p", { className: "text-muted-foreground text-xs", children: c.mfaHelpMessage })
+        ] }),
+        error && /* @__PURE__ */ jsx5("p", { id: "reset-confirm-error", role: "alert", className: "text-destructive text-sm", children: error }),
+        /* @__PURE__ */ jsx5(
+          Button4,
+          {
+            type: "submit",
+            className: "w-full",
+            disabled: loading || !password || !confirmPassword || mfaRequired && mfaCode.length !== 6,
+            children: loading ? c.submittingCta : c.submitCta
+          }
+        )
+      ]
+    }
+  );
+}
+
+// src/auth/set-password.tsx
+import * as React6 from "react";
+import { useSearchParams as useSearchParams2 } from "next/navigation";
+import { Button as Button5, Input as Input4, cn as cn6 } from "@reblu/site-ui";
+import { Label as Label4 } from "@reblu/site-ui/label";
+import { jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
+var DEFAULT_COPY7 = {
+  passwordLabel: "Contrase\xF1a",
+  passwordPlaceholder: "M\xEDnimo 8 caracteres",
+  confirmPasswordLabel: "Confirmar contrase\xF1a",
+  confirmPasswordPlaceholder: "Repite la contrase\xF1a",
+  submitCta: "Activar cuenta",
+  submittingCta: "Activando cuenta...",
+  passwordTooShortError: "La contrase\xF1a debe tener al menos 8 caracteres",
+  passwordMismatchError: "Las contrase\xF1as no coinciden",
+  genericError: "Error al establecer la contrase\xF1a",
+  missingTokenTitle: "Enlace inv\xE1lido",
+  missingTokenMessage: "El enlace de invitaci\xF3n ha expirado o no es v\xE1lido.",
+  backToLoginCta: "\u2190 Volver al inicio de sesi\xF3n"
+};
+function SetPassword(props) {
+  const { submitUrl, loginUrl, copy, className, onSuccess } = props;
+  const c = { ...DEFAULT_COPY7, ...copy };
+  const searchParams = useSearchParams2();
+  const sessionExchangeToken = searchParams.get("session_exchange_token");
+  const [password, setPassword] = React6.useState("");
+  const [confirmPassword, setConfirmPassword] = React6.useState("");
+  const [loading, setLoading] = React6.useState(false);
+  const [error, setError] = React6.useState(null);
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (!sessionExchangeToken) return;
+    if (password.length < 8) {
+      setError(c.passwordTooShortError);
+      return;
+    }
+    if (password !== confirmPassword) {
+      setError(c.passwordMismatchError);
+      return;
+    }
+    setLoading(true);
+    let sessionExchangeUrl = null;
+    try {
+      const res = await fetch(submitUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          session_exchange_token: sessionExchangeToken,
+          new_password: password
+        })
+      });
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok || !json.data?.sessionExchangeUrl) {
+        setError(json.error ?? c.genericError);
+        setLoading(false);
+        return;
+      }
+      if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {
+        setError(c.genericError);
+        setLoading(false);
+        return;
+      }
+      sessionExchangeUrl = json.data.sessionExchangeUrl;
+    } catch {
+      setError(c.genericError);
+      setLoading(false);
+      return;
+    }
+    window.location.assign(sessionExchangeUrl);
+    try {
+      onSuccess?.(sessionExchangeUrl);
+    } catch (err) {
+      console.error("[SetPassword] onSuccess callback threw:", err);
+    }
+  };
+  if (!sessionExchangeToken) {
+    return /* @__PURE__ */ jsxs5("div", { className: cn6("space-y-4 text-center", className), children: [
+      /* @__PURE__ */ jsx6("h2", { className: "text-lg font-semibold", children: c.missingTokenTitle }),
+      /* @__PURE__ */ jsx6("p", { className: "text-muted-foreground text-sm", children: c.missingTokenMessage }),
+      /* @__PURE__ */ jsx6("a", { href: loginUrl, className: "text-primary inline-block text-sm hover:underline", children: c.backToLoginCta })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs5(
+    "form",
+    {
+      onSubmit: (e) => void handleSubmit(e),
+      className: cn6("space-y-5", className),
+      noValidate: true,
+      children: [
+        /* @__PURE__ */ jsxs5("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx6(Label4, { htmlFor: "set-password-password", children: c.passwordLabel }),
+          /* @__PURE__ */ jsx6(
+            Input4,
+            {
+              id: "set-password-password",
+              type: "password",
+              autoComplete: "new-password",
+              placeholder: c.passwordPlaceholder,
+              value: password,
+              onChange: (e) => setPassword(e.target.value),
+              disabled: loading,
+              minLength: 8,
+              "aria-describedby": error ? "set-password-error" : void 0,
+              autoFocus: true
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxs5("div", { className: "space-y-1.5", children: [
+          /* @__PURE__ */ jsx6(Label4, { htmlFor: "set-password-confirm", children: c.confirmPasswordLabel }),
+          /* @__PURE__ */ jsx6(
+            Input4,
+            {
+              id: "set-password-confirm",
+              type: "password",
+              autoComplete: "new-password",
+              placeholder: c.confirmPasswordPlaceholder,
+              value: confirmPassword,
+              onChange: (e) => setConfirmPassword(e.target.value),
+              disabled: loading,
+              minLength: 8,
+              "aria-describedby": error ? "set-password-error" : void 0
+            }
+          )
+        ] }),
+        error && /* @__PURE__ */ jsx6("p", { id: "set-password-error", role: "alert", className: "text-destructive text-sm", children: error }),
+        /* @__PURE__ */ jsx6(Button5, { type: "submit", className: "w-full", disabled: loading || !password || !confirmPassword, children: loading ? c.submittingCta : c.submitCta })
+      ]
+    }
+  );
+}
+
+// src/auth/auth-confirm.tsx
+import * as React7 from "react";
+import { useSearchParams as useSearchParams3 } from "next/navigation";
+import { cn as cn7 } from "@reblu/site-ui";
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
+var DEFAULT_COPY8 = {
+  loadingMessage: "Confirmando tu email...",
+  successTitle: "Email confirmado",
+  successMessage: "Tu direcci\xF3n de email ha sido verificada correctamente.",
+  successCta: "Iniciar sesi\xF3n",
+  errorTitle: "Error al confirmar",
+  errorMessage: "El enlace de confirmaci\xF3n no es v\xE1lido o ha expirado.",
+  errorCta: "Volver al inicio de sesi\xF3n"
+};
+function AuthConfirm(props) {
+  const { confirmUrl, loginUrl, copy, className } = props;
+  const c = { ...DEFAULT_COPY8, ...copy };
+  const searchParams = useSearchParams3();
+  const success = searchParams.get("success");
+  const tokenHash = searchParams.get("token_hash");
+  const type = searchParams.get("type");
+  const [status, setStatus] = React7.useState(success === "true" ? "success" : "loading");
+  const [errorMessage, setErrorMessage] = React7.useState(null);
+  React7.useEffect(() => {
+    if (success === "true") {
+      setStatus("success");
+      return;
+    }
+    if (tokenHash && type) {
+      const controller = new AbortController();
+      setStatus("loading");
+      fetch(confirmUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token_hash: tokenHash, type }),
+        signal: controller.signal
+      }).then(async (res) => {
+        const json = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus("error");
+          setErrorMessage(json.error ?? c.errorMessage);
+          return;
+        }
+        if (json.data?.sessionExchangeUrl) {
+          if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {
+            setStatus("error");
+            setErrorMessage(c.errorMessage);
+            return;
+          }
+          window.location.assign(json.data.sessionExchangeUrl);
+          return;
+        }
+        setStatus("success");
+      }).catch((err) => {
+        if (err instanceof Error && err.name === "AbortError") return;
+        setStatus("error");
+        setErrorMessage(c.errorMessage);
+      });
+      return () => controller.abort();
+    }
+    setStatus("error");
+  }, [success, tokenHash, type, confirmUrl]);
+  if (status === "loading") {
+    return /* @__PURE__ */ jsx7("div", { className: cn7("space-y-4 text-center", className), children: /* @__PURE__ */ jsx7("p", { className: "text-muted-foreground text-sm", children: c.loadingMessage }) });
+  }
+  if (status === "error") {
+    return /* @__PURE__ */ jsxs6("div", { className: cn7("space-y-4 text-center", className), children: [
+      /* @__PURE__ */ jsx7("h2", { className: "text-lg font-semibold", children: c.errorTitle }),
+      /* @__PURE__ */ jsx7("p", { className: "text-muted-foreground text-sm", children: errorMessage ?? c.errorMessage }),
+      /* @__PURE__ */ jsx7("a", { href: loginUrl, className: "text-primary inline-block text-sm hover:underline", children: c.errorCta })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs6("div", { className: cn7("space-y-4 text-center", className), children: [
+    /* @__PURE__ */ jsx7("h2", { className: "text-lg font-semibold", children: c.successTitle }),
+    /* @__PURE__ */ jsx7("p", { className: "text-muted-foreground text-sm", children: c.successMessage }),
+    /* @__PURE__ */ jsx7("a", { href: loginUrl, className: "text-primary inline-block text-sm hover:underline", children: c.successCta })
+  ] });
+}
+export {
+  AuthCallback,
+  AuthConfirm,
+  AuthLogo,
+  LoginForm,
+  ResetPasswordConfirm,
+  ResetPasswordRequest,
+  SetPassword,
+  mapLoginError
+};
+//# sourceMappingURL=auth.js.map