@reblu/site-next 1.1.0 → 1.2.1

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/login-form.tsx","../src/auth/safe-redirect.ts","../src/auth/auth-callback.tsx","../src/auth/login-errors.ts","../src/auth/auth-logo.tsx","../src/auth/reset-password-request.tsx","../src/auth/reset-password-confirm.tsx","../src/auth/set-password.tsx","../src/auth/auth-confirm.tsx"],"sourcesContent":["'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { Tabs, TabsList, TabsTrigger, TabsContent } from '@reblu/site-ui/tabs'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface LoginFormCopy {\n  // Tab labels\n  magicLinkTabLabel: string\n  passwordTabLabel: string\n\n  // Shared\n  emailLabel: string\n  emailPlaceholder: string\n\n  // Password tab\n  passwordLabel: string\n  passwordPlaceholder: string\n  passwordSubmitCta: string\n  forgotPasswordCta: string\n\n  // Magic-link tab\n  magicLinkSubmitCta: string\n\n  // Magic-link success\n  magicLinkSuccessTitle: string\n  magicLinkSuccessMessage: string\n\n  // MFA prompt\n  mfaTitle: string\n  mfaMessage: string\n  mfaCodeLabel: string\n  mfaCodePlaceholder: string\n  mfaSubmitCta: string\n\n  // Errors\n  invalidEmailError: string\n  networkError: string\n  invalidCredentialsError: string\n  mfaInvalidCodeError: string\n}\n\nexport interface LoginFormProps {\n  // Endpoint URLs (all required)\n  passwordLoginUrl: string\n  mfaVerifyUrl: string\n  magicLinkRequestUrl: string\n  resetPasswordUrl: string\n\n  // UX\n  copy?: Partial<LoginFormCopy>\n  className?: string\n  defaultMethod?: 'magic-link' | 'password'\n\n  // Hooks\n  onPasswordSubmitted?: (email: string) => void\n  onMagicLinkSubmitted?: (email: string) => void\n  onMfaSubmitted?: () => void\n}\n\nconst DEFAULT_COPY: LoginFormCopy = {\n  magicLinkTabLabel: 'Enlace mágico',\n  passwordTabLabel: 'Contraseña',\n  emailLabel: 'Correo electrónico',\n  emailPlaceholder: 'tu@email.com',\n  passwordLabel: 'Contraseña',\n  passwordPlaceholder: '••••••••',\n  passwordSubmitCta: 'Iniciar sesión',\n  forgotPasswordCta: '¿Olvidaste tu contraseña?',\n  magicLinkSubmitCta: 'Enviar enlace de acceso',\n  magicLinkSuccessTitle: '¡Enlace enviado!',\n  magicLinkSuccessMessage: 'Revisa tu correo para acceder.',\n  mfaTitle: 'Verificación en dos pasos',\n  mfaMessage: 'Introduce el código de 6 dígitos de tu aplicación autenticadora.',\n  mfaCodeLabel: 'Código de verificación',\n  mfaCodePlaceholder: '123456',\n  mfaSubmitCta: 'Verificar código',\n  invalidEmailError: 'Introduce un correo electrónico válido.',\n  networkError: 'No se pudo enviar el enlace. Inténtalo de nuevo.',\n  invalidCredentialsError: 'Email o contraseña incorrectos',\n  mfaInvalidCodeError: 'Código incorrecto. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nfunction isValidEmail(value: string): boolean {\n  return EMAIL_REGEX.test(value)\n}\n\ntype FormState = 'idle' | 'submitting' | 'magic-link-success' | 'mfa-required' | 'error'\n\ninterface MfaState {\n  factorId: string\n  accessToken: string\n  refreshToken: string\n}\n\ninterface PasswordLoginResponse {\n  data?: {\n    mfaRequired: boolean\n    sessionExchangeUrl?: string\n    factorId?: string\n    accessToken?: string\n    refreshToken?: string\n  }\n  error?: string\n}\n\ninterface MfaVerifyResponse {\n  data?: { sessionExchangeUrl: string }\n  error?: string\n}\n\nexport function LoginForm(props: LoginFormProps) {\n  const {\n    passwordLoginUrl,\n    mfaVerifyUrl,\n    magicLinkRequestUrl,\n    resetPasswordUrl,\n    copy,\n    className,\n    defaultMethod = 'password',\n    onPasswordSubmitted,\n    onMagicLinkSubmitted,\n    onMfaSubmitted,\n  } = props\n\n  const c = { ...DEFAULT_COPY, ...copy }\n\n  const [method, setMethod] = React.useState<'magic-link' | 'password'>(defaultMethod)\n  const [state, setState] = React.useState<FormState>('idle')\n  const [error, setError] = React.useState<string | null>(null)\n\n  // Password & magic-link inputs\n  const [email, setEmail] = React.useState('')\n  const [password, setPassword] = React.useState('')\n\n  // MFA state\n  const [mfa, setMfa] = React.useState<MfaState | null>(null)\n  const [mfaCode, setMfaCode] = React.useState('')\n\n  const resetTransientState = React.useCallback(() => {\n    setState('idle')\n    setError(null)\n    setMfa(null)\n    setMfaCode('')\n  }, [])\n\n  const handleTabChange = (next: string) => {\n    if (next !== 'magic-link' && next !== 'password') return\n    setMethod(next)\n    resetTransientState()\n  }\n\n  const handleMagicLinkSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    setError(null)\n\n    const trimmed = email.trim().toLowerCase()\n    if (!isValidEmail(trimmed)) {\n      setError(c.invalidEmailError)\n      setState('error')\n      return\n    }\n\n    setState('submitting')\n    try {\n      const res = await fetch(magicLinkRequestUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email: trimmed }),\n      })\n\n      if (res.ok) {\n        setState('magic-link-success')\n        onMagicLinkSubmitted?.(trimmed)\n        return\n      }\n\n      setState('error')\n      setError(c.networkError)\n    } catch {\n      setState('error')\n      setError(c.networkError)\n    }\n  }\n\n  const handlePasswordSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    setError(null)\n\n    const trimmed = email.trim().toLowerCase()\n    if (!isValidEmail(trimmed)) {\n      setError(c.invalidEmailError)\n      setState('error')\n      return\n    }\n    if (!password) {\n      setError(c.invalidCredentialsError)\n      setState('error')\n      return\n    }\n\n    setState('submitting')\n    try {\n      const res = await fetch(passwordLoginUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email: trimmed, password }),\n      })\n\n      const json = (await res.json().catch(() => ({}))) as PasswordLoginResponse\n\n      if (!res.ok || !json.data) {\n        setState('error')\n        setError(json.error ?? c.invalidCredentialsError)\n        return\n      }\n\n      onPasswordSubmitted?.(trimmed)\n\n      if (json.data.mfaRequired) {\n        setMfa({\n          factorId: json.data.factorId ?? '',\n          accessToken: json.data.accessToken ?? '',\n          refreshToken: json.data.refreshToken ?? '',\n        })\n        setState('mfa-required')\n        return\n      }\n\n      const exchangeUrl = json.data.sessionExchangeUrl\n      if (!exchangeUrl || !isSafeRedirectUrl(exchangeUrl)) {\n        setState('error')\n        setError(c.networkError)\n        return\n      }\n      window.location.assign(exchangeUrl)\n    } catch {\n      setState('error')\n      setError(c.networkError)\n    }\n  }\n\n  const handleMfaSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    if (!mfa) return\n    setError(null)\n    setState('submitting')\n\n    try {\n      const res = await fetch(mfaVerifyUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          factorId: mfa.factorId,\n          code: mfaCode,\n          accessToken: mfa.accessToken,\n          refreshToken: mfa.refreshToken,\n        }),\n      })\n\n      const json = (await res.json().catch(() => ({}))) as MfaVerifyResponse\n\n      if (\n        !res.ok ||\n        !json.data?.sessionExchangeUrl ||\n        !isSafeRedirectUrl(json.data.sessionExchangeUrl)\n      ) {\n        // Stay in mfa-required state so user can retry the code\n        setState('mfa-required')\n        setError(json.error ?? c.mfaInvalidCodeError)\n        setMfaCode('')\n        return\n      }\n\n      onMfaSubmitted?.()\n      window.location.assign(json.data.sessionExchangeUrl)\n    } catch {\n      setState('mfa-required')\n      setError(c.networkError)\n    }\n  }\n\n  // MFA prompt replaces the form entirely\n  if (state === 'mfa-required' || (mfa && state === 'submitting')) {\n    return (\n      <div className={cn('space-y-6', className)}>\n        <div className='space-y-1'>\n          <h2 className='text-xl font-semibold'>{c.mfaTitle}</h2>\n          <p className='text-muted-foreground text-sm'>{c.mfaMessage}</p>\n        </div>\n        <form onSubmit={(e) => void handleMfaSubmit(e)} className='space-y-4' noValidate>\n          <div className='space-y-2'>\n            <Label htmlFor='login-mfa-code'>{c.mfaCodeLabel}</Label>\n            <Input\n              id='login-mfa-code'\n              type='text'\n              inputMode='numeric'\n              pattern='\\d{6}'\n              maxLength={6}\n              autoComplete='one-time-code'\n              placeholder={c.mfaCodePlaceholder}\n              value={mfaCode}\n              onChange={(ev) => setMfaCode(ev.target.value.replace(/\\D/g, '').slice(0, 6))}\n              disabled={state === 'submitting'}\n              aria-describedby={error ? 'login-mfa-error' : undefined}\n              autoFocus\n            />\n            {error && (\n              <p id='login-mfa-error' role='alert' className='text-destructive text-sm'>\n                {error}\n              </p>\n            )}\n          </div>\n          <Button\n            type='submit'\n            className='w-full'\n            disabled={state === 'submitting' || mfaCode.length !== 6}\n          >\n            {c.mfaSubmitCta}\n          </Button>\n          <button\n            type='button'\n            onClick={resetTransientState}\n            className='text-muted-foreground hover:text-foreground w-full text-sm transition-colors'\n            disabled={state === 'submitting'}\n          >\n            ← Volver\n          </button>\n        </form>\n      </div>\n    )\n  }\n\n  // Magic-link success replaces the form\n  if (state === 'magic-link-success') {\n    return (\n      <div className={cn('space-y-2 text-center', className)}>\n        <h2 className='text-xl font-semibold'>{c.magicLinkSuccessTitle}</h2>\n        <p className='text-muted-foreground'>{c.magicLinkSuccessMessage}</p>\n      </div>\n    )\n  }\n\n  return (\n    <div className={cn('space-y-6', className)}>\n      <Tabs value={method} onValueChange={handleTabChange}>\n        <TabsList className='grid w-full grid-cols-2'>\n          <TabsTrigger value='password'>{c.passwordTabLabel}</TabsTrigger>\n          <TabsTrigger value='magic-link'>{c.magicLinkTabLabel}</TabsTrigger>\n        </TabsList>\n\n        <TabsContent value='password' className='pt-4'>\n          <form onSubmit={(e) => void handlePasswordSubmit(e)} className='space-y-4' noValidate>\n            <div className='space-y-2'>\n              <Label htmlFor='login-email-pwd'>{c.emailLabel}</Label>\n              <Input\n                id='login-email-pwd'\n                type='email'\n                autoComplete='email'\n                placeholder={c.emailPlaceholder}\n                value={email}\n                onChange={(ev) => setEmail(ev.target.value)}\n                disabled={state === 'submitting'}\n              />\n            </div>\n            <div className='space-y-2'>\n              <div className='flex items-center justify-between'>\n                <Label htmlFor='login-password'>{c.passwordLabel}</Label>\n                <a\n                  href={resetPasswordUrl}\n                  className='text-muted-foreground hover:text-foreground text-xs transition-colors'\n                >\n                  {c.forgotPasswordCta}\n                </a>\n              </div>\n              <Input\n                id='login-password'\n                type='password'\n                autoComplete='current-password'\n                placeholder={c.passwordPlaceholder}\n                value={password}\n                onChange={(ev) => setPassword(ev.target.value)}\n                disabled={state === 'submitting'}\n                aria-describedby={error ? 'login-pwd-error' : undefined}\n              />\n              {error && (\n                <p id='login-pwd-error' role='alert' className='text-destructive text-sm'>\n                  {error}\n                </p>\n              )}\n            </div>\n            <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n              {c.passwordSubmitCta}\n            </Button>\n          </form>\n        </TabsContent>\n\n        <TabsContent value='magic-link' className='pt-4'>\n          <form onSubmit={(e) => void handleMagicLinkSubmit(e)} className='space-y-4' noValidate>\n            <div className='space-y-2'>\n              <Label htmlFor='login-email-magic'>{c.emailLabel}</Label>\n              <Input\n                id='login-email-magic'\n                type='email'\n                autoComplete='email'\n                placeholder={c.emailPlaceholder}\n                value={email}\n                onChange={(ev) => setEmail(ev.target.value)}\n                disabled={state === 'submitting'}\n                aria-describedby={error ? 'login-magic-error' : undefined}\n              />\n              {error && (\n                <p id='login-magic-error' role='alert' className='text-destructive text-sm'>\n                  {error}\n                </p>\n              )}\n            </div>\n            <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n              {c.magicLinkSubmitCta}\n            </Button>\n          </form>\n        </TabsContent>\n      </Tabs>\n    </div>\n  )\n}\n","/**\n * Scheme + URL-trick allowlist for a server-returned redirect target\n * (`sessionExchangeUrl`, `redirectTo`, etc.). Shared by `AuthCallback`,\n * `AuthConfirm`, and `SetPassword` — see `CLAUDE.md` Regla A: a predicate\n * applied more than 3 times gets one home, not N inline copies that drift.\n *\n * IMPORTANT — this is NOT full open-redirect confinement: it does NOT\n * restrict absolute `http`/`https` URLs to a specific origin.\n * `isSafeRedirectUrl('https://evil.com')` returns `true`. What it DOES\n * reject:\n * - dangerous schemes (`javascript:`, `data:`, `vbscript:`, ...) — the\n *   classic XSS-via-redirect vector\n * - protocol-relative URLs (`//evil.com`) — these start with `/` but\n *   browsers resolve them as an absolute, CROSS-ORIGIN URL (the scheme is\n *   inherited from the current page), so a naive \"starts with /\" check\n *   would wrongly treat them as same-origin\n * - backslash-authority URLs (`/\\evil.com`, `\\\\evil.com`) — browsers\n *   normalize `\\` to `/` for special schemes, so these resolve the same way\n * - the same tricks with an ASCII tab/LF/CR spliced between the slashes\n *   (`/\\t/evil.com`) — the WHATWG URL parser strips ALL tab/LF/CR from the\n *   input BEFORE parsing (anywhere in the string, not just leading/trailing),\n *   so `/\\t/evil.com` is indistinguishable from `//evil.com` to the browser\n *   even though a naive regex over the raw string wouldn't see two adjacent\n *   slashes\n *\n * Full origin-pinning (rejecting any absolute URL whose origin isn't the\n * actual expected one) is a SEPARATE, not-yet-implemented layer. It can't\n * simply pin to `REBLU_API_BASE_URL`: that's a server-only env var\n * unavailable in these `'use client'` components, and per REB-218's\n * subdomain redirect architecture it would be the WRONG origin anyway\n * (production session-exchange lives at `nexus.<tenantDomain>`, not the\n * SITE's own `REBLU_API_BASE_URL`). It would need a dedicated prop\n * conveying the actual expected origin per deploy/routing mode.\n */\nexport function isSafeRedirectUrl(url: string): boolean {\n  if (!url) return false\n\n  // Match the WHATWG URL parser's own first step: strip ALL ASCII\n  // tab/LF/CR from the input, anywhere in the string — not just\n  // leading/trailing — before evaluating what the browser will actually\n  // resolve. Without this, '/\\t/evil.com' looks like a single-'/' relative\n  // path to a naive check but the browser sees '//evil.com'.\n  const clean = url.replace(/[\\t\\n\\r]/g, '')\n  if (!clean) return false\n\n  // A relative path must start with a SINGLE '/' — '//' or '/\\' resolve as\n  // an absolute, cross-origin URL in the browser despite \"starting with /\".\n  if (/^[/\\\\]{2}/.test(clean)) return false\n\n  const scheme = clean.split(':')[0].toLowerCase()\n  return ['http', 'https'].includes(scheme) || clean.startsWith('/')\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface AuthCallbackCopy {\n  loadingTitle: string\n  loadingMessage: string\n  successMessage: string\n  expiredTitle: string\n  expiredMessage: string\n  expiredCta: string\n  networkErrorTitle: string\n  networkErrorMessage: string\n  networkErrorRetryCta: string\n  networkErrorBackCta: string\n  malformedTitle: string\n  malformedMessage: string\n  malformedCta: string\n}\n\nexport interface AuthCallbackProps {\n  exchangeUrl: string\n  loginUrl: string\n  copy?: Partial<AuthCallbackCopy>\n  onSuccess?: (redirectTo: string) => void\n  onError?: (state: 'expired' | 'network' | 'malformed', error?: Error) => void\n  className?: string\n}\n\ntype State = 'mounting' | 'parsing' | 'exchanging' | 'success' | 'expired' | 'network' | 'malformed'\n\nconst DEFAULT_COPY: AuthCallbackCopy = {\n  loadingTitle: 'Autenticando...',\n  loadingMessage: 'Estamos verificando tu identidad.',\n  successMessage: 'Iniciando sesión...',\n  expiredTitle: 'Enlace caducado',\n  expiredMessage: 'El enlace ha expirado o ya fue utilizado. Solicita uno nuevo.',\n  expiredCta: 'Volver al login',\n  networkErrorTitle: 'Error de conexión',\n  networkErrorMessage: 'No pudimos completar el inicio de sesión. Inténtalo de nuevo.',\n  networkErrorRetryCta: 'Reintentar',\n  networkErrorBackCta: 'Volver al login',\n  malformedTitle: 'Enlace inválido',\n  malformedMessage: 'Enlace inválido. Solicita uno nuevo.',\n  malformedCta: 'Volver al login',\n}\n\nfunction parseHash(hash: string): { access_token: string; refresh_token: string } | null {\n  const raw = hash.startsWith('#') ? hash.slice(1) : hash\n  if (!raw) return null\n  const params = new URLSearchParams(raw)\n  const access_token = params.get('access_token') ?? ''\n  const refresh_token = params.get('refresh_token') ?? ''\n  const type = params.get('type') ?? ''\n  if (!access_token || !refresh_token || type !== 'magiclink') return null\n  return { access_token, refresh_token }\n}\n\n/**\n * On failure Supabase redirects to the callback with the reason in the hash\n * fragment (e.g. `#error=access_denied&error_code=otp_expired`), never in the\n * query — the server cannot see it (REB-177). Detect it client-side and tell an\n * expired/used link (recoverable → 'expired') apart from any other failure\n * (→ 'malformed').\n */\nfunction parseHashError(hash: string): 'expired' | 'malformed' | null {\n  const raw = hash.startsWith('#') ? hash.slice(1) : hash\n  if (!raw) return null\n  const params = new URLSearchParams(raw)\n  const error = params.get('error')\n  const errorCode = params.get('error_code')\n  if (!error && !errorCode) return null\n  // Expired or already-used magic links come back as access_denied / otp_expired.\n  return errorCode === 'otp_expired' || error === 'access_denied' ? 'expired' : 'malformed'\n}\n\nexport function AuthCallback({\n  exchangeUrl,\n  loginUrl,\n  copy,\n  onSuccess,\n  onError,\n  className,\n}: AuthCallbackProps) {\n  const [state, setState] = React.useState<State>('mounting')\n  const [tokens, setTokens] = React.useState<{\n    access_token: string\n    refresh_token: string\n  } | null>(null)\n  const retryRef = React.useRef<HTMLButtonElement>(null)\n  const linkRef = React.useRef<HTMLAnchorElement>(null)\n  const c = { ...DEFAULT_COPY, ...copy }\n\n  const exchange = React.useCallback(\n    async (t: { access_token: string; refresh_token: string }) => {\n      setState('exchanging')\n      try {\n        const res = await fetch(exchangeUrl, {\n          method: 'POST',\n          credentials: 'same-origin',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(t),\n        })\n\n        if (res.ok) {\n          const raw = (await res.json()) as unknown\n          const redirectTo =\n            raw !== null &&\n            typeof raw === 'object' &&\n            'redirectTo' in raw &&\n            typeof (raw as { redirectTo: unknown }).redirectTo === 'string'\n              ? (raw as { redirectTo: string }).redirectTo\n              : null\n\n          if (!redirectTo) {\n            setState('network')\n            onError?.('network', undefined)\n            return\n          }\n\n          // Guard against dangerous schemes (javascript:, data:, etc.) AND\n          // protocol-relative/backslash-authority URLs (//evil.com, /\\evil.com)\n          // — see safe-redirect.ts.\n          if (!isSafeRedirectUrl(redirectTo)) {\n            setState('network')\n            onError?.('network', undefined)\n            return\n          }\n\n          history.replaceState({}, '', window.location.pathname)\n          window.location.replace(redirectTo)\n          setState('success')\n          onSuccess?.(redirectTo)\n          return\n        }\n\n        if (res.status === 401) {\n          setState('expired')\n          onError?.('expired')\n          return\n        }\n\n        setState('network')\n        onError?.('network', undefined)\n      } catch (err) {\n        setState('network')\n        onError?.('network', err instanceof Error ? err : undefined)\n      }\n    },\n    [exchangeUrl, onError, onSuccess],\n  )\n\n  React.useEffect(() => {\n    setState('parsing')\n    // A failure reported in the hash (expired/used/invalid link) is not a token\n    // to exchange — surface it directly without hitting the network (REB-177).\n    const hashError = parseHashError(window.location.hash)\n    if (hashError) {\n      setState(hashError)\n      onError?.(hashError)\n      return\n    }\n    const parsed = parseHash(window.location.hash)\n    if (!parsed) {\n      setState('malformed')\n      onError?.('malformed')\n      return\n    }\n    setTokens(parsed)\n    void exchange(parsed)\n    // `exchange`/`onError` are intentionally excluded: this effect must run\n    // EXACTLY ONCE on mount to parse `window.location.hash` — re-running it\n    // on every `exchange` identity change (which itself changes whenever\n    // `onSuccess`/`onError` props change identity) would re-parse an\n    // already-cleared hash and misfire.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  React.useEffect(() => {\n    if (state === 'network') retryRef.current?.focus()\n    if (state === 'expired' || state === 'malformed') linkRef.current?.focus()\n  }, [state])\n\n  const isLoading = state === 'mounting' || state === 'parsing' || state === 'exchanging'\n\n  return (\n    <main className={cn('flex min-h-screen items-center justify-center', className)}>\n      <div aria-live='polite' className='w-full max-w-md space-y-4 p-6 text-center'>\n        {isLoading && (\n          <section>\n            <h2 className='text-xl font-semibold'>{c.loadingTitle}</h2>\n            <p className='text-muted-foreground mt-2'>{c.loadingMessage}</p>\n          </section>\n        )}\n\n        {state === 'success' && (\n          <section>\n            <p>{c.successMessage}</p>\n          </section>\n        )}\n\n        {state === 'expired' && (\n          <section className='space-y-4'>\n            <h2 className='text-xl font-semibold'>{c.expiredTitle}</h2>\n            <p className='text-muted-foreground'>{c.expiredMessage}</p>\n            <Button asChild variant='outline'>\n              <a href={loginUrl} ref={linkRef}>\n                {c.expiredCta}\n              </a>\n            </Button>\n          </section>\n        )}\n\n        {state === 'network' && (\n          <section className='space-y-4'>\n            <h2 className='text-xl font-semibold'>{c.networkErrorTitle}</h2>\n            <p className='text-muted-foreground'>{c.networkErrorMessage}</p>\n            <div className='flex flex-col gap-2'>\n              <Button type='button' ref={retryRef} onClick={() => tokens && void exchange(tokens)}>\n                {c.networkErrorRetryCta}\n              </Button>\n              <Button asChild variant='outline'>\n                <a href={loginUrl}>{c.networkErrorBackCta}</a>\n              </Button>\n            </div>\n          </section>\n        )}\n\n        {state === 'malformed' && (\n          <section className='space-y-4'>\n            <h2 className='text-xl font-semibold'>{c.malformedTitle}</h2>\n            <p className='text-muted-foreground'>{c.malformedMessage}</p>\n            <Button asChild variant='outline'>\n              <a href={loginUrl} ref={linkRef}>\n                {c.malformedCta}\n              </a>\n            </Button>\n          </section>\n        )}\n      </div>\n    </main>\n  )\n}\n","/**\n * Maps the raw `?error=` query param that Supabase appends when a magic link is\n * already consumed or expired to a user-facing Spanish message.\n *\n * Supabase redirects to /login?error=... with a raw English message (e.g.\n * \"Email link is invalid or has expired\"). Showing that verbatim is confusing,\n * so we translate the common cases and signal whether the \"Solicitar otro\n * enlace\" CTA should be offered.\n *\n * Matching is case-insensitive and whitespace-tolerant so it survives small\n * variations in how the error text arrives.\n *\n * Relocated from apps/demo-site/src/lib/utils/login-errors.ts (REB-510 slice\n * 2a) as a copy-injectable helper — Spanish defaults are unchanged, and a SITE\n * MAY override individual messages via `Partial<LoginErrorCopy>`.\n */\n\nexport interface LoginErrorInfo {\n  /** Message shown in the error card. */\n  message: string\n  /** Whether to show the \"Solicitar otro enlace\" CTA. */\n  showRequestLink: boolean\n}\n\nexport interface LoginErrorCopy {\n  expiredMessage: string\n  missingTokenMessage: string\n  genericMessage: string\n}\n\nconst DEFAULT_COPY: LoginErrorCopy = {\n  expiredMessage: 'El enlace ha expirado o ya fue utilizado.',\n  missingTokenMessage: 'El enlace no es válido. Solicita uno nuevo.',\n  genericMessage: 'No se pudo completar el inicio de sesión. Intenta de nuevo.',\n}\n\nexport function mapLoginError(\n  error: string | null | undefined,\n  copy?: Partial<LoginErrorCopy>,\n): LoginErrorInfo | null {\n  if (!error) return null\n\n  const normalized = error.trim().toLowerCase()\n  if (normalized === '') return null\n\n  const c = { ...DEFAULT_COPY, ...copy }\n\n  if (\n    normalized.includes('email link is invalid or has expired') ||\n    normalized.includes('token has expired or is invalid')\n  ) {\n    return { message: c.expiredMessage, showRequestLink: true }\n  }\n\n  if (normalized.includes('missing_token')) {\n    return { message: c.missingTokenMessage, showRequestLink: true }\n  }\n\n  return { message: c.genericMessage, showRequestLink: true }\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useTheme } from 'next-themes'\nimport { cn } from '@reblu/site-ui'\n\nexport interface AuthLogoCopy {\n  /**\n   * Overrides the rendered `<img>` alt text. Pass `''` explicitly to mark the\n   * logo as decorative (e.g. when an adjacent heading already announces\n   * `siteName`, so screen readers shouldn't read it twice) — `undefined`\n   * (the key simply omitted from `copy`) is what falls back to `siteName`.\n   */\n  altText?: string\n  /** Shown when neither a logo URL nor `siteName` is available. */\n  fallbackLabel: string\n}\n\nexport interface AuthLogoProps {\n  logoLightExpandedUrl: string | null\n  logoDarkExpandedUrl: string | null\n  logoLightSmallUrl: string | null\n  logoDarkSmallUrl: string | null\n  siteName: string\n  /** @default 'expanded' */\n  variant?: 'expanded' | 'compact'\n  className?: string\n  copy?: Partial<AuthLogoCopy>\n  /**\n   * When `true`, renders `null` instead of the `siteName`/fallback-label text\n   * span whenever no logo URL resolves for the active variant+theme, rather\n   * than showing the text. Use this when the consumer already renders\n   * `siteName` as a heading elsewhere on the page — without it, a visitor\n   * with no logo configured (or only a light-mode logo, viewed in dark mode)\n   * would see/hear `siteName` twice: once from this fallback, once from the\n   * consumer's own heading.\n   * @default false\n   */\n  hideTextFallback?: boolean\n}\n\nconst DEFAULT_COPY: Required<Pick<AuthLogoCopy, 'fallbackLabel'>> = {\n  fallbackLabel: 'Inicio de sesión',\n}\n\nconst VARIANT_CLASS: Record<'expanded' | 'compact', string> = {\n  expanded: 'h-8 w-auto',\n  compact: 'h-8 w-8',\n}\n\n// Intrinsic `width`/`height` attributes so the browser reserves layout space\n// via its built-in aspect-ratio-from-attributes heuristic before the real\n// image loads (avoids vertical CLS at minimum; horizontal width still\n// depends on the tenant's actual logo aspect ratio, which `/api/site/config`\n// doesn't expose — an arbitrary-but-reasonable box, not a promise of zero\n// shift). `VARIANT_CLASS`'s `h-8` always wins for height regardless.\nconst VARIANT_INTRINSIC_SIZE: Record<'expanded' | 'compact', { width: number; height: number }> = {\n  expanded: { width: 160, height: 32 },\n  compact: { width: 32, height: 32 },\n}\n\n/**\n * Dynamic tenant logo for auth pages (REB-510 R1). Resolves expanded/compact ×\n * light/dark from the 4 `/api/site/config` logo URLs, switching light/dark\n * CLIENT-SIDE via `next-themes`. Falls back to `siteName` text, then a generic\n * `copy.fallbackLabel`, whenever the resolved URL for the active\n * variant+theme combination is `null` — it never silently swaps in the OTHER\n * theme's logo.\n *\n * Hydration-safe: `next-themes`' `resolvedTheme` is `undefined` until it\n * mounts client-side, so pre-mount `isDark` is always `false` — the same\n * light-first markup the server rendered, avoiding a hydration mismatch.\n *\n * Renders a plain `<img>`, not `next/image`: this is a distributable SDK\n * consumed by external SITE repos, so it cannot assume the consuming app's\n * `next.config` `images.remotePatterns` allowlists the tenant's logo CDN.\n */\nexport function AuthLogo(props: AuthLogoProps) {\n  const {\n    logoLightExpandedUrl,\n    logoDarkExpandedUrl,\n    logoLightSmallUrl,\n    logoDarkSmallUrl,\n    siteName,\n    variant = 'expanded',\n    className,\n    copy,\n    hideTextFallback = false,\n  } = props\n  const fallbackLabel = copy?.fallbackLabel ?? DEFAULT_COPY.fallbackLabel\n  const { resolvedTheme } = useTheme()\n  const isDark = resolvedTheme === 'dark'\n\n  const lightUrl = variant === 'compact' ? logoLightSmallUrl : logoLightExpandedUrl\n  const darkUrl = variant === 'compact' ? logoDarkSmallUrl : logoDarkExpandedUrl\n  const logoUrl = isDark ? darkUrl : lightUrl\n\n  // Tracks a broken/stale logo URL (404, CDN outage, etc.) — degrades to the\n  // text fallback instead of a broken-image glyph. Reset whenever `logoUrl`\n  // itself changes (e.g. a theme toggle resolves a DIFFERENT URL) so a past\n  // failure doesn't permanently block a future, valid attempt.\n  const [imgError, setImgError] = React.useState(false)\n  React.useEffect(() => {\n    setImgError(false)\n  }, [logoUrl])\n\n  const fallbackText = siteName || fallbackLabel\n  // `copy.altText` — a VALUE-defined key (including `''`) wins outright,\n  // that's how a consumer marks the logo decorative. A value-undefined key\n  // (whether omitted from `copy` entirely, or present with an explicit\n  // `undefined` value) falls back to siteName/fallbackLabel — checking value\n  // definedness, not `'altText' in copy` key presence, is what makes\n  // `copy={{ altText: undefined }}` behave the same as omitting the key.\n  const altText = copy?.altText !== undefined ? copy.altText : siteName || fallbackLabel\n\n  if (logoUrl && !imgError) {\n    const { width, height } = VARIANT_INTRINSIC_SIZE[variant]\n    return (\n      <img\n        src={logoUrl}\n        alt={altText}\n        width={width}\n        height={height}\n        className={cn(VARIANT_CLASS[variant], className)}\n        onError={() => setImgError(true)}\n      />\n    )\n  }\n\n  if (hideTextFallback) return null\n\n  return (\n    <span className={cn('text-lg font-semibold text-foreground', className)}>{fallbackText}</span>\n  )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\nexport interface ResetPasswordRequestCopy {\n  emailLabel: string\n  emailPlaceholder: string\n  submitCta: string\n  submittingCta: string\n  successTitle: string\n  successMessage: string\n  backToLoginCta: string\n  invalidEmailError: string\n  networkError: string\n}\n\nexport interface ResetPasswordRequestProps {\n  requestUrl: string\n  loginUrl: string\n  copy?: Partial<ResetPasswordRequestCopy>\n  className?: string\n  onSubmitted?: (email: string) => void\n}\n\nconst DEFAULT_COPY: ResetPasswordRequestCopy = {\n  emailLabel: 'Correo electrónico',\n  emailPlaceholder: 'tu@email.com',\n  submitCta: 'Enviar enlace de recuperación',\n  submittingCta: 'Enviando...',\n  successTitle: 'Revisa tu email',\n  successMessage:\n    'Si el email existe en nuestra plataforma, recibirás un enlace para restablecer tu contraseña en los próximos minutos.',\n  backToLoginCta: '← Volver al inicio de sesión',\n  invalidEmailError: 'Introduce un correo electrónico válido.',\n  networkError: 'Error de conexión. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Step 1 of the password-reset flow — anti-enumeration: always shows the same\n * generic success message on a 2xx response, regardless of whether the email\n * exists (the backend never leaks that).\n */\nexport function ResetPasswordRequest(props: ResetPasswordRequestProps) {\n  const { requestUrl, loginUrl, copy, className, onSubmitted } = props\n  const c = { ...DEFAULT_COPY, ...copy }\n\n  const [email, setEmail] = React.useState('')\n  const [loading, setLoading] = React.useState(false)\n  const [submitted, setSubmitted] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n\n  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    setError(null)\n\n    const trimmed = email.trim().toLowerCase()\n    if (!EMAIL_REGEX.test(trimmed)) {\n      setError(c.invalidEmailError)\n      return\n    }\n\n    setLoading(true)\n    // `succeeded` isolates the consumer's `onSubmitted` callback from this\n    // try/catch: if we called it INSIDE the try and it threw, that throw\n    // would land in the network `catch` below and misreport a successful\n    // request as a connection error.\n    let succeeded = false\n    try {\n      const res = await fetch(requestUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email: trimmed }),\n      })\n\n      if (!res.ok) {\n        const json = (await res.json().catch(() => ({}))) as { error?: string }\n        setError(json.error ?? c.networkError)\n        setLoading(false)\n        return\n      }\n\n      succeeded = true\n      setSubmitted(true)\n      setLoading(false)\n    } catch {\n      setError(c.networkError)\n      setLoading(false)\n      return\n    }\n\n    if (succeeded) {\n      try {\n        onSubmitted?.(trimmed)\n      } catch (err) {\n        console.error('[ResetPasswordRequest] onSubmitted callback threw:', err)\n      }\n    }\n  }\n\n  if (submitted) {\n    return (\n      <div className={cn('space-y-4 text-center', className)}>\n        <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n        <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n        <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n          {c.backToLoginCta}\n        </a>\n      </div>\n    )\n  }\n\n  return (\n    <form\n      onSubmit={(e) => void handleSubmit(e)}\n      className={cn('space-y-5', className)}\n      noValidate\n    >\n      <div className='space-y-1.5'>\n        <Label htmlFor='reset-request-email'>{c.emailLabel}</Label>\n        <Input\n          id='reset-request-email'\n          type='email'\n          autoComplete='email'\n          placeholder={c.emailPlaceholder}\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          disabled={loading}\n          aria-describedby={error ? 'reset-request-error' : undefined}\n          autoFocus\n        />\n        {error && (\n          <p id='reset-request-error' role='alert' className='text-destructive text-sm'>\n            {error}\n          </p>\n        )}\n      </div>\n      <Button type='submit' className='w-full' disabled={loading}>\n        {loading ? c.submittingCta : c.submitCta}\n      </Button>\n      <div className='text-center'>\n        <a\n          href={loginUrl}\n          className='text-muted-foreground hover:text-foreground text-sm transition-colors'\n        >\n          {c.backToLoginCta}\n        </a>\n      </div>\n    </form>\n  )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\n/**\n * Appends `key=value` to `url` without producing a malformed double `?` when\n * `url` (consumer-supplied `loginUrl`, e.g. `/login?tenant=acme`) already\n * carries a query string. Deliberately NOT `new URL(url)` — `loginUrl` is\n * typically a relative path and the WHATWG `URL` constructor requires a base\n * for those.\n */\nfunction withQueryParam(url: string, key: string, value: string): string {\n  const separator = url.includes('?') ? '&' : '?'\n  return `${url}${separator}${key}=${encodeURIComponent(value)}`\n}\n\nexport interface ResetPasswordConfirmCopy {\n  passwordLabel: string\n  passwordPlaceholder: string\n  confirmPasswordLabel: string\n  confirmPasswordPlaceholder: string\n  mfaCodeLabel: string\n  mfaCodePlaceholder: string\n  mfaHelpMessage: string\n  submitCta: string\n  submittingCta: string\n  passwordTooShortError: string\n  passwordMismatchError: string\n  mfaInvalidCodeError: string\n  genericError: string\n  missingTokensTitle: string\n  missingTokensMessage: string\n  requestNewLinkCta: string\n}\n\nexport interface ResetPasswordConfirmProps {\n  confirmUrl: string\n  loginUrl: string\n  resetRequestUrl: string\n  copy?: Partial<ResetPasswordConfirmCopy>\n  className?: string\n  onSuccess?: () => void\n}\n\nconst DEFAULT_COPY: ResetPasswordConfirmCopy = {\n  passwordLabel: 'Nueva contraseña',\n  passwordPlaceholder: 'Mínimo 8 caracteres',\n  confirmPasswordLabel: 'Confirmar contraseña',\n  confirmPasswordPlaceholder: 'Repite la contraseña',\n  mfaCodeLabel: 'Código de verificación (2FA)',\n  mfaCodePlaceholder: '6 dígitos',\n  mfaHelpMessage:\n    'Tu cuenta tiene verificación en dos pasos. Introduce el código de tu app de autenticación para completar el cambio.',\n  submitCta: 'Establecer nueva contraseña',\n  submittingCta: 'Actualizando contraseña...',\n  passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n  passwordMismatchError: 'Las contraseñas no coinciden',\n  mfaInvalidCodeError: 'Introduce el código de 6 dígitos de tu app de autenticación',\n  genericError: 'Error al restablecer la contraseña',\n  missingTokensTitle: 'Enlace inválido',\n  missingTokensMessage: 'El enlace ha expirado o no es válido. Solicita uno nuevo.',\n  requestNewLinkCta: 'Solicitar nuevo enlace',\n}\n\n/**\n * Step 2 of the password-reset flow. Reads `access_token`/`refresh_token`\n * straight off `useSearchParams` — no `window.location.search` + effect-timing\n * workaround needed here because, unlike a page-level default export, this is\n * a component the SITE mounts inside its own `<Suspense>` boundary.\n *\n * REB-378: when the account has a verified MFA factor, the recovery session\n * (AAL1) cannot change the password on its own. The backend responds\n * `{ data: { mfaRequired: true } }` and this reveals a 6-digit TOTP field so\n * the user can resubmit with the code (the recovery tokens stay valid).\n */\nexport function ResetPasswordConfirm(props: ResetPasswordConfirmProps) {\n  const { confirmUrl, loginUrl, resetRequestUrl, copy, className, onSuccess } = props\n  const c = { ...DEFAULT_COPY, ...copy }\n  const router = useRouter()\n  const searchParams = useSearchParams()\n\n  const accessToken = searchParams.get('access_token')\n  const refreshToken = searchParams.get('refresh_token')\n  const hasTokens = Boolean(accessToken && refreshToken)\n\n  const [password, setPassword] = React.useState('')\n  const [confirmPassword, setConfirmPassword] = React.useState('')\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const [mfaRequired, setMfaRequired] = React.useState(false)\n  const [mfaCode, setMfaCode] = React.useState('')\n\n  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    setError(null)\n    if (!hasTokens) return\n\n    if (password.length < 8) {\n      setError(c.passwordTooShortError)\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(c.passwordMismatchError)\n      return\n    }\n    if (mfaRequired && !/^\\d{6}$/.test(mfaCode)) {\n      setError(c.mfaInvalidCodeError)\n      return\n    }\n\n    setLoading(true)\n    // `succeeded` isolates the consumer's `onSuccess` callback (and the\n    // navigation) from this try/catch: calling either INSIDE the try means a\n    // throwing callback lands in the network `catch` below and misreports an\n    // already-successful password change as a failure — the user retries\n    // with recovery tokens the backend has already consumed.\n    let succeeded = false\n    try {\n      const res = await fetch(confirmUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          access_token: accessToken,\n          refresh_token: refreshToken,\n          new_password: password,\n          ...(mfaRequired ? { mfa_code: mfaCode } : {}),\n        }),\n      })\n\n      const json = (await res.json().catch(() => ({}))) as {\n        error?: string\n        data?: { success?: boolean; mfaRequired?: boolean }\n      }\n\n      if (!res.ok) {\n        setError(json.error ?? c.genericError)\n        setLoading(false)\n        return\n      }\n\n      if (json.data?.mfaRequired) {\n        setMfaRequired(true)\n        setLoading(false)\n        return\n      }\n\n      succeeded = true\n      setLoading(false)\n    } catch {\n      setError(c.genericError)\n      setLoading(false)\n      return\n    }\n\n    if (succeeded) {\n      // Navigate FIRST, consumer callback SECOND (isolated in its own\n      // try/catch) — same reasoning as set-password.tsx: a throwing\n      // `onSuccess` can no longer block the redirect or escape as an\n      // unhandled rejection out of this fire-and-forget async handler.\n      router.replace(withQueryParam(loginUrl, 'reset', 'success'))\n      try {\n        onSuccess?.()\n      } catch (err) {\n        console.error('[ResetPasswordConfirm] onSuccess callback threw:', err)\n      }\n    }\n  }\n\n  if (!hasTokens) {\n    return (\n      <div className={cn('space-y-4 text-center', className)}>\n        <h2 className='text-lg font-semibold'>{c.missingTokensTitle}</h2>\n        <p className='text-muted-foreground text-sm'>{c.missingTokensMessage}</p>\n        <a href={resetRequestUrl} className='text-primary inline-block text-sm hover:underline'>\n          {c.requestNewLinkCta}\n        </a>\n      </div>\n    )\n  }\n\n  return (\n    <form\n      onSubmit={(e) => void handleSubmit(e)}\n      className={cn('space-y-5', className)}\n      noValidate\n    >\n      <div className='space-y-1.5'>\n        <Label htmlFor='reset-confirm-password'>{c.passwordLabel}</Label>\n        <Input\n          id='reset-confirm-password'\n          type='password'\n          autoComplete='new-password'\n          placeholder={c.passwordPlaceholder}\n          value={password}\n          onChange={(e) => setPassword(e.target.value)}\n          disabled={loading}\n          minLength={8}\n          aria-describedby={error ? 'reset-confirm-error' : undefined}\n          autoFocus\n        />\n      </div>\n      <div className='space-y-1.5'>\n        <Label htmlFor='reset-confirm-password-2'>{c.confirmPasswordLabel}</Label>\n        <Input\n          id='reset-confirm-password-2'\n          type='password'\n          autoComplete='new-password'\n          placeholder={c.confirmPasswordPlaceholder}\n          value={confirmPassword}\n          onChange={(e) => setConfirmPassword(e.target.value)}\n          disabled={loading}\n          minLength={8}\n          aria-describedby={error ? 'reset-confirm-error' : undefined}\n        />\n      </div>\n      {mfaRequired && (\n        <div className='space-y-1.5'>\n          <Label htmlFor='reset-confirm-mfa'>{c.mfaCodeLabel}</Label>\n          <Input\n            id='reset-confirm-mfa'\n            type='text'\n            inputMode='numeric'\n            autoComplete='one-time-code'\n            placeholder={c.mfaCodePlaceholder}\n            value={mfaCode}\n            onChange={(e) => setMfaCode(e.target.value.replace(/\\D/g, '').slice(0, 6))}\n            disabled={loading}\n            maxLength={6}\n            aria-describedby={error ? 'reset-confirm-error' : undefined}\n            autoFocus\n          />\n          <p className='text-muted-foreground text-xs'>{c.mfaHelpMessage}</p>\n        </div>\n      )}\n      {error && (\n        <p id='reset-confirm-error' role='alert' className='text-destructive text-sm'>\n          {error}\n        </p>\n      )}\n      <Button\n        type='submit'\n        className='w-full'\n        disabled={\n          loading || !password || !confirmPassword || (mfaRequired && mfaCode.length !== 6)\n        }\n      >\n        {loading ? c.submittingCta : c.submitCta}\n      </Button>\n    </form>\n  )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface SetPasswordCopy {\n  passwordLabel: string\n  passwordPlaceholder: string\n  confirmPasswordLabel: string\n  confirmPasswordPlaceholder: string\n  submitCta: string\n  submittingCta: string\n  passwordTooShortError: string\n  passwordMismatchError: string\n  genericError: string\n  missingTokenTitle: string\n  missingTokenMessage: string\n  backToLoginCta: string\n}\n\nexport interface SetPasswordProps {\n  submitUrl: string\n  loginUrl: string\n  copy?: Partial<SetPasswordCopy>\n  className?: string\n  onSuccess?: (sessionExchangeUrl: string) => void\n}\n\nconst DEFAULT_COPY: SetPasswordCopy = {\n  passwordLabel: 'Contraseña',\n  passwordPlaceholder: 'Mínimo 8 caracteres',\n  confirmPasswordLabel: 'Confirmar contraseña',\n  confirmPasswordPlaceholder: 'Repite la contraseña',\n  submitCta: 'Activar cuenta',\n  submittingCta: 'Activando cuenta...',\n  passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n  passwordMismatchError: 'Las contraseñas no coinciden',\n  genericError: 'Error al establecer la contraseña',\n  missingTokenTitle: 'Enlace inválido',\n  missingTokenMessage: 'El enlace de invitación ha expirado o no es válido.',\n  backToLoginCta: '← Volver al inicio de sesión',\n}\n\n/**\n * Invite flow — for a user setting their initial password. Reads\n * `session_exchange_token` off `useSearchParams`; on success, redirects via\n * `window.location.assign` (NOT the Next router) because the returned\n * `sessionExchangeUrl` points at base-api's own domain to set cookies, not a\n * same-origin SITE route.\n */\nexport function SetPassword(props: SetPasswordProps) {\n  const { submitUrl, loginUrl, copy, className, onSuccess } = props\n  const c = { ...DEFAULT_COPY, ...copy }\n  const searchParams = useSearchParams()\n  const sessionExchangeToken = searchParams.get('session_exchange_token')\n\n  const [password, setPassword] = React.useState('')\n  const [confirmPassword, setConfirmPassword] = React.useState('')\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n\n  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n    e.preventDefault()\n    setError(null)\n    if (!sessionExchangeToken) return\n\n    if (password.length < 8) {\n      setError(c.passwordTooShortError)\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(c.passwordMismatchError)\n      return\n    }\n\n    setLoading(true)\n    // `sessionExchangeUrl` isolates the consumer's `onSuccess` callback (and\n    // the actual navigation) from this try/catch: calling either INSIDE the\n    // try means a throwing callback lands in the network `catch` below and\n    // misreports an already-successful password-set as a connection error —\n    // stranding an activated user on a form that tells them it failed.\n    let sessionExchangeUrl: string | null = null\n    try {\n      const res = await fetch(submitUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          session_exchange_token: sessionExchangeToken,\n          new_password: password,\n        }),\n      })\n\n      const json = (await res.json().catch(() => ({}))) as {\n        data?: { sessionExchangeUrl?: string }\n        error?: string\n      }\n\n      if (!res.ok || !json.data?.sessionExchangeUrl) {\n        setError(json.error ?? c.genericError)\n        setLoading(false)\n        return\n      }\n\n      if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n        setError(c.genericError)\n        setLoading(false)\n        return\n      }\n\n      sessionExchangeUrl = json.data.sessionExchangeUrl\n    } catch {\n      setError(c.genericError)\n      setLoading(false)\n      return\n    }\n\n    // Navigate FIRST, consumer callback SECOND (isolated in its own\n    // try/catch): if `onSuccess` throws (ad blocker on an analytics call,\n    // etc.) the navigation has already been triggered and is unaffected, and\n    // the throw doesn't escape as an unhandled rejection out of this\n    // fire-and-forget async handler — the user is never stranded on this\n    // form by code that isn't even this component's own.\n    window.location.assign(sessionExchangeUrl)\n    try {\n      onSuccess?.(sessionExchangeUrl)\n    } catch (err) {\n      console.error('[SetPassword] onSuccess callback threw:', err)\n    }\n  }\n\n  if (!sessionExchangeToken) {\n    return (\n      <div className={cn('space-y-4 text-center', className)}>\n        <h2 className='text-lg font-semibold'>{c.missingTokenTitle}</h2>\n        <p className='text-muted-foreground text-sm'>{c.missingTokenMessage}</p>\n        <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n          {c.backToLoginCta}\n        </a>\n      </div>\n    )\n  }\n\n  return (\n    <form\n      onSubmit={(e) => void handleSubmit(e)}\n      className={cn('space-y-5', className)}\n      noValidate\n    >\n      <div className='space-y-1.5'>\n        <Label htmlFor='set-password-password'>{c.passwordLabel}</Label>\n        <Input\n          id='set-password-password'\n          type='password'\n          autoComplete='new-password'\n          placeholder={c.passwordPlaceholder}\n          value={password}\n          onChange={(e) => setPassword(e.target.value)}\n          disabled={loading}\n          minLength={8}\n          aria-describedby={error ? 'set-password-error' : undefined}\n          // Single-purpose activation page (this IS the whole page's task,\n          // there's no earlier content competing for attention) — same\n          // pattern as reset-password-confirm.tsx/reset-password-request.tsx.\n          autoFocus\n        />\n      </div>\n      <div className='space-y-1.5'>\n        <Label htmlFor='set-password-confirm'>{c.confirmPasswordLabel}</Label>\n        <Input\n          id='set-password-confirm'\n          type='password'\n          autoComplete='new-password'\n          placeholder={c.confirmPasswordPlaceholder}\n          value={confirmPassword}\n          onChange={(e) => setConfirmPassword(e.target.value)}\n          disabled={loading}\n          minLength={8}\n          aria-describedby={error ? 'set-password-error' : undefined}\n        />\n      </div>\n      {error && (\n        <p id='set-password-error' role='alert' className='text-destructive text-sm'>\n          {error}\n        </p>\n      )}\n      <Button type='submit' className='w-full' disabled={loading || !password || !confirmPassword}>\n        {loading ? c.submittingCta : c.submitCta}\n      </Button>\n    </form>\n  )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface AuthConfirmCopy {\n  loadingMessage: string\n  successTitle: string\n  successMessage: string\n  successCta: string\n  errorTitle: string\n  errorMessage: string\n  errorCta: string\n}\n\nexport interface AuthConfirmProps {\n  confirmUrl: string\n  loginUrl: string\n  copy?: Partial<AuthConfirmCopy>\n  className?: string\n}\n\nconst DEFAULT_COPY: AuthConfirmCopy = {\n  loadingMessage: 'Confirmando tu email...',\n  successTitle: 'Email confirmado',\n  successMessage: 'Tu dirección de email ha sido verificada correctamente.',\n  successCta: 'Iniciar sesión',\n  errorTitle: 'Error al confirmar',\n  errorMessage: 'El enlace de confirmación no es válido o ha expirado.',\n  errorCta: 'Volver al inicio de sesión',\n}\n\ntype Status = 'loading' | 'success' | 'error'\n\n/**\n * Dual-mode email confirmation (signup / email-change):\n *\n * 1. `?success=true` — base-api already ran `verifyOtp` server-side and\n *    redirected here. Shows the confirmed message with no API call.\n * 2. `?token_hash=&type=` — client-initiated verify: POSTs to `confirmUrl`\n *    and follows the returned `sessionExchangeUrl`, or shows success/error\n *    copy based on the response.\n *\n * Neither param present → shown as an error state with a link back to login,\n * rather than a silent client-side redirect.\n */\nexport function AuthConfirm(props: AuthConfirmProps) {\n  const { confirmUrl, loginUrl, copy, className } = props\n  const c = { ...DEFAULT_COPY, ...copy }\n  const searchParams = useSearchParams()\n\n  const success = searchParams.get('success')\n  const tokenHash = searchParams.get('token_hash')\n  const type = searchParams.get('type')\n\n  const [status, setStatus] = React.useState<Status>(success === 'true' ? 'success' : 'loading')\n  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n\n  React.useEffect(() => {\n    if (success === 'true') {\n      setStatus('success')\n      return\n    }\n\n    if (tokenHash && type) {\n      // `token_hash` is single-use server-side — verifying it twice makes\n      // the SECOND call fail even though the first already succeeded. React\n      // Strict Mode's dev-only mount→cleanup→mount double-invoke would\n      // otherwise fire this fetch twice for the same token. Aborting the\n      // in-flight request on cleanup stops the CLIENT from processing that\n      // first response and swallows its `AbortError` below instead of\n      // surfacing a false \"confirmation failed\" — but `abort()` cannot\n      // retroactively un-send a request that already reached base-api\n      // before cleanup ran, so this reduces rather than deterministically\n      // eliminates the double-POST race (in practice React's dev\n      // double-invoke runs both phases synchronously in the same commit, so\n      // the abort typically wins, but that is not a spec guarantee). A\n      // fully deterministic fix needs server-side idempotency on\n      // `verify-otp`, which is out of this package's control. The same\n      // abort also guards a genuine unmount mid-request.\n      const controller = new AbortController()\n      setStatus('loading')\n      fetch(confirmUrl, {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ token_hash: tokenHash, type }),\n        signal: controller.signal,\n      })\n        .then(async (res) => {\n          const json = (await res.json().catch(() => ({}))) as {\n            data?: { sessionExchangeUrl?: string; success?: boolean }\n            error?: string\n          }\n\n          if (!res.ok) {\n            setStatus('error')\n            setErrorMessage(json.error ?? c.errorMessage)\n            return\n          }\n\n          if (json.data?.sessionExchangeUrl) {\n            if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n              setStatus('error')\n              setErrorMessage(c.errorMessage)\n              return\n            }\n            window.location.assign(json.data.sessionExchangeUrl)\n            return\n          }\n\n          setStatus('success')\n        })\n        .catch((err: unknown) => {\n          if (err instanceof Error && err.name === 'AbortError') return\n          setStatus('error')\n          setErrorMessage(c.errorMessage)\n        })\n\n      return () => controller.abort()\n    }\n\n    // Neither success=true nor token_hash+type — nothing to confirm.\n    setStatus('error')\n    // `c.errorMessage` (derived from the `copy` prop) is intentionally\n    // excluded: re-running this effect on every `copy` object identity\n    // change would re-fire the fetch. The URL params are the only real\n    // trigger for this effect.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [success, tokenHash, type, confirmUrl])\n\n  if (status === 'loading') {\n    return (\n      <div className={cn('space-y-4 text-center', className)}>\n        <p className='text-muted-foreground text-sm'>{c.loadingMessage}</p>\n      </div>\n    )\n  }\n\n  if (status === 'error') {\n    return (\n      <div className={cn('space-y-4 text-center', className)}>\n        <h2 className='text-lg font-semibold'>{c.errorTitle}</h2>\n        <p className='text-muted-foreground text-sm'>{errorMessage ?? c.errorMessage}</p>\n        <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n          {c.errorCta}\n        </a>\n      </div>\n    )\n  }\n\n  return (\n    <div className={cn('space-y-4 text-center', className)}>\n      <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n      <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n      <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n        {c.successCta}\n      </a>\n    </div>\n  )\n}\n"],"mappings":";;;AAEA,YAAY,WAAW;AACvB,SAAS,QAAQ,OAAO,UAAU;AAClC,SAAS,aAAa;AACtB,SAAS,MAAM,UAAU,aAAa,mBAAmB;;;AC6BlD,SAAS,kBAAkB,KAAsB;AACtD,MAAI,CAAC,IAAK,QAAO;AAOjB,QAAM,QAAQ,IAAI,QAAQ,aAAa,EAAE;AACzC,MAAI,CAAC,MAAO,QAAO;AAInB,MAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AAEpC,QAAM,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AAC/C,SAAO,CAAC,QAAQ,OAAO,EAAE,SAAS,MAAM,KAAK,MAAM,WAAW,GAAG;AACnE;;;ADkPQ,SACE,KADF;AAvOR,IAAM,eAA8B;AAAA,EAClC,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,EACvB,yBAAyB;AAAA,EACzB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,yBAAyB;AAAA,EACzB,qBAAqB;AACvB;AAEA,IAAM,cAAc;AAEpB,SAAS,aAAa,OAAwB;AAC5C,SAAO,YAAY,KAAK,KAAK;AAC/B;AA0BO,SAAS,UAAU,OAAuB;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,IAAI,EAAE,GAAG,cAAc,GAAG,KAAK;AAErC,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAoC,aAAa;AACnF,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAoB,MAAM;AAC1D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAwB,IAAI;AAG5D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAS,EAAE;AAC3C,QAAM,CAAC,UAAU,WAAW,IAAU,eAAS,EAAE;AAGjD,QAAM,CAAC,KAAK,MAAM,IAAU,eAA0B,IAAI;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,eAAS,EAAE;AAE/C,QAAM,sBAA4B,kBAAY,MAAM;AAClD,aAAS,MAAM;AACf,aAAS,IAAI;AACb,WAAO,IAAI;AACX,eAAW,EAAE;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,CAAC,SAAiB;AACxC,QAAI,SAAS,gBAAgB,SAAS,WAAY;AAClD,cAAU,IAAI;AACd,wBAAoB;AAAA,EACtB;AAEA,QAAM,wBAAwB,OAAO,MAAwC;AAC3E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,qBAAqB;AAAA,QAC3C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,IAAI,IAAI;AACV,iBAAS,oBAAoB;AAC7B,+BAAuB,OAAO;AAC9B;AAAA,MACF;AAEA,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAAuB,OAAO,MAAwC;AAC1E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,uBAAuB;AAClC,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,QACxC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,SAAS,CAAC;AAAA,MACnD,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM;AACzB,iBAAS,OAAO;AAChB,iBAAS,KAAK,SAAS,EAAE,uBAAuB;AAChD;AAAA,MACF;AAEA,4BAAsB,OAAO;AAE7B,UAAI,KAAK,KAAK,aAAa;AACzB,eAAO;AAAA,UACL,UAAU,KAAK,KAAK,YAAY;AAAA,UAChC,aAAa,KAAK,KAAK,eAAe;AAAA,UACtC,cAAc,KAAK,KAAK,gBAAgB;AAAA,QAC1C,CAAC;AACD,iBAAS,cAAc;AACvB;AAAA,MACF;AAEA,YAAM,cAAc,KAAK,KAAK;AAC9B,UAAI,CAAC,eAAe,CAAC,kBAAkB,WAAW,GAAG;AACnD,iBAAS,OAAO;AAChB,iBAAS,EAAE,YAAY;AACvB;AAAA,MACF;AACA,aAAO,SAAS,OAAO,WAAW;AAAA,IACpC,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,MAAwC;AACrE,MAAE,eAAe;AACjB,QAAI,CAAC,IAAK;AACV,aAAS,IAAI;AACb,aAAS,YAAY;AAErB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,cAAc;AAAA,QACpC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,UAAU,IAAI;AAAA,UACd,MAAM;AAAA,UACN,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UACE,CAAC,IAAI,MACL,CAAC,KAAK,MAAM,sBACZ,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAC/C;AAEA,iBAAS,cAAc;AACvB,iBAAS,KAAK,SAAS,EAAE,mBAAmB;AAC5C,mBAAW,EAAE;AACb;AAAA,MACF;AAEA,uBAAiB;AACjB,aAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AAAA,IACrD,QAAQ;AACN,eAAS,cAAc;AACvB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAGA,MAAI,UAAU,kBAAmB,OAAO,UAAU,cAAe;AAC/D,WACE,qBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,QAAG,WAAU,yBAAyB,YAAE,UAAS;AAAA,QAClD,oBAAC,OAAE,WAAU,iCAAiC,YAAE,YAAW;AAAA,SAC7D;AAAA,MACA,qBAAC,UAAK,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,GAAG,WAAU,aAAY,YAAU,MAC9E;AAAA,6BAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,cAAa;AAAA,UAChD;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAQ;AAAA,cACR,WAAW;AAAA,cACX,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,OAAO,WAAW,GAAG,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cAC3E,UAAU,UAAU;AAAA,cACpB,oBAAkB,QAAQ,oBAAoB;AAAA,cAC9C,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,WAEJ;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UAAU,UAAU,gBAAgB,QAAQ,WAAW;AAAA,YAEtD,YAAE;AAAA;AAAA,QACL;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS;AAAA,YACT,WAAU;AAAA,YACV,UAAU,UAAU;AAAA,YACrB;AAAA;AAAA,QAED;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,UAAU,sBAAsB;AAClC,WACE,qBAAC,SAAI,WAAW,GAAG,yBAAyB,SAAS,GACnD;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,uBAAsB;AAAA,MAC/D,oBAAC,OAAE,WAAU,yBAAyB,YAAE,yBAAwB;AAAA,OAClE;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC,+BAAC,QAAK,OAAO,QAAQ,eAAe,iBAClC;AAAA,yBAAC,YAAS,WAAU,2BAClB;AAAA,0BAAC,eAAY,OAAM,YAAY,YAAE,kBAAiB;AAAA,MAClD,oBAAC,eAAY,OAAM,cAAc,YAAE,mBAAkB;AAAA,OACvD;AAAA,IAEA,oBAAC,eAAY,OAAM,YAAW,WAAU,QACtC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,GAAG,WAAU,aAAY,YAAU,MACnF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,YAAW;AAAA,QAC/C;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA;AAAA,QACtB;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,6BAAC,SAAI,WAAU,qCACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,eAAc;AAAA,UACjD;AAAA,YAAC;AAAA;AAAA,cACC,MAAM;AAAA,cACN,WAAU;AAAA,cAET,YAAE;AAAA;AAAA,UACL;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,YAAY,GAAG,OAAO,KAAK;AAAA,YAC7C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,oBAAoB;AAAA;AAAA,QAChD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,mBACL;AAAA,OACF,GACF;AAAA,IAEA,oBAAC,eAAY,OAAM,cAAa,WAAU,QACxC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,GAAG,WAAU,aAAY,YAAU,MACpF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,qBAAqB,YAAE,YAAW;AAAA,QACjD;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,sBAAsB;AAAA;AAAA,QAClD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,qBAAoB,MAAK,SAAQ,WAAU,4BAC9C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,oBACL;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;;;AE9aA,YAAYA,YAAW;AACvB,SAAS,UAAAC,SAAQ,MAAAC,WAAU;AA4LjB,SACE,OAAAC,MADF,QAAAC,aAAA;AA9JV,IAAMC,gBAAiC;AAAA,EACrC,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,cAAc;AAChB;AAEA,SAAS,UAAU,MAAsE;AACvF,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AACnD,QAAM,gBAAgB,OAAO,IAAI,eAAe,KAAK;AACrD,QAAM,OAAO,OAAO,IAAI,MAAM,KAAK;AACnC,MAAI,CAAC,gBAAgB,CAAC,iBAAiB,SAAS,YAAa,QAAO;AACpE,SAAO,EAAE,cAAc,cAAc;AACvC;AASA,SAAS,eAAe,MAA8C;AACpE,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,YAAY,OAAO,IAAI,YAAY;AACzC,MAAI,CAAC,SAAS,CAAC,UAAW,QAAO;AAEjC,SAAO,cAAc,iBAAiB,UAAU,kBAAkB,YAAY;AAChF;AAEO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAsB;AACpB,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAgB,UAAU;AAC1D,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAGxB,IAAI;AACd,QAAM,WAAiB,cAA0B,IAAI;AACrD,QAAM,UAAgB,cAA0B,IAAI;AACpD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,QAAM,WAAiB;AAAA,IACrB,OAAO,MAAuD;AAC5D,eAAS,YAAY;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,aAAa;AAAA,UACnC,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,CAAC;AAAA,QACxB,CAAC;AAED,YAAI,IAAI,IAAI;AACV,gBAAM,MAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,aACJ,QAAQ,QACR,OAAO,QAAQ,YACf,gBAAgB,OAChB,OAAQ,IAAgC,eAAe,WAClD,IAA+B,aAChC;AAEN,cAAI,CAAC,YAAY;AACf,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAKA,cAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAEA,kBAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,QAAQ;AACrD,iBAAO,SAAS,QAAQ,UAAU;AAClC,mBAAS,SAAS;AAClB,sBAAY,UAAU;AACtB;AAAA,QACF;AAEA,YAAI,IAAI,WAAW,KAAK;AACtB,mBAAS,SAAS;AAClB,oBAAU,SAAS;AACnB;AAAA,QACF;AAEA,iBAAS,SAAS;AAClB,kBAAU,WAAW,MAAS;AAAA,MAChC,SAAS,KAAK;AACZ,iBAAS,SAAS;AAClB,kBAAU,WAAW,eAAe,QAAQ,MAAM,MAAS;AAAA,MAC7D;AAAA,IACF;AAAA,IACA,CAAC,aAAa,SAAS,SAAS;AAAA,EAClC;AAEA,EAAM,iBAAU,MAAM;AACpB,aAAS,SAAS;AAGlB,UAAM,YAAY,eAAe,OAAO,SAAS,IAAI;AACrD,QAAI,WAAW;AACb,eAAS,SAAS;AAClB,gBAAU,SAAS;AACnB;AAAA,IACF;AACA,UAAM,SAAS,UAAU,OAAO,SAAS,IAAI;AAC7C,QAAI,CAAC,QAAQ;AACX,eAAS,WAAW;AACpB,gBAAU,WAAW;AACrB;AAAA,IACF;AACA,cAAU,MAAM;AAChB,SAAK,SAAS,MAAM;AAAA,EAOtB,GAAG,CAAC,CAAC;AAEL,EAAM,iBAAU,MAAM;AACpB,QAAI,UAAU,UAAW,UAAS,SAAS,MAAM;AACjD,QAAI,UAAU,aAAa,UAAU,YAAa,SAAQ,SAAS,MAAM;AAAA,EAC3E,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,YAAY,UAAU,cAAc,UAAU,aAAa,UAAU;AAE3E,SACE,gBAAAF,KAAC,UAAK,WAAWG,IAAG,iDAAiD,SAAS,GAC5E,0BAAAF,MAAC,SAAI,aAAU,UAAS,WAAU,6CAC/B;AAAA,iBACC,gBAAAA,MAAC,aACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,8BAA8B,YAAE,gBAAe;AAAA,OAC9D;AAAA,IAGD,UAAU,aACT,gBAAAA,KAAC,aACC,0BAAAA,KAAC,OAAG,YAAE,gBAAe,GACvB;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACvD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,YACL,GACF;AAAA,OACF;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,qBAAoB;AAAA,MAC5D,gBAAAC,MAAC,SAAI,WAAU,uBACb;AAAA,wBAAAD,KAACI,SAAA,EAAO,MAAK,UAAS,KAAK,UAAU,SAAS,MAAM,UAAU,KAAK,SAAS,MAAM,GAC/E,YAAE,sBACL;AAAA,QACA,gBAAAJ,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAW,YAAE,qBAAoB,GAC5C;AAAA,SACF;AAAA,OACF;AAAA,IAGD,UAAU,eACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACxD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,kBAAiB;AAAA,MACzD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,cACL,GACF;AAAA,OACF;AAAA,KAEJ,GACF;AAEJ;;;ACtNA,IAAMK,gBAA+B;AAAA,EACnC,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AAEO,SAAS,cACd,OACA,MACuB;AACvB,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,eAAe,GAAI,QAAO;AAE9B,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,MACE,WAAW,SAAS,sCAAsC,KAC1D,WAAW,SAAS,iCAAiC,GACrD;AACA,WAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAAA,EAC5D;AAEA,MAAI,WAAW,SAAS,eAAe,GAAG;AACxC,WAAO,EAAE,SAAS,EAAE,qBAAqB,iBAAiB,KAAK;AAAA,EACjE;AAEA,SAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAC5D;;;ACzDA,YAAYC,YAAW;AACvB,SAAS,gBAAgB;AACzB,SAAS,MAAAC,WAAU;AAkHb,gBAAAC,YAAA;AA7EN,IAAMC,gBAA8D;AAAA,EAClE,eAAe;AACjB;AAEA,IAAM,gBAAwD;AAAA,EAC5D,UAAU;AAAA,EACV,SAAS;AACX;AAQA,IAAM,yBAA4F;AAAA,EAChG,UAAU,EAAE,OAAO,KAAK,QAAQ,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,IAAI,QAAQ,GAAG;AACnC;AAkBO,SAAS,SAAS,OAAsB;AAC7C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,EACrB,IAAI;AACJ,QAAM,gBAAgB,MAAM,iBAAiBA,cAAa;AAC1D,QAAM,EAAE,cAAc,IAAI,SAAS;AACnC,QAAM,SAAS,kBAAkB;AAEjC,QAAM,WAAW,YAAY,YAAY,oBAAoB;AAC7D,QAAM,UAAU,YAAY,YAAY,mBAAmB;AAC3D,QAAM,UAAU,SAAS,UAAU;AAMnC,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,KAAK;AACpD,EAAM,iBAAU,MAAM;AACpB,gBAAY,KAAK;AAAA,EACnB,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,eAAe,YAAY;AAOjC,QAAM,UAAU,MAAM,YAAY,SAAY,KAAK,UAAU,YAAY;AAEzE,MAAI,WAAW,CAAC,UAAU;AACxB,UAAM,EAAE,OAAO,OAAO,IAAI,uBAAuB,OAAO;AACxD,WACE,gBAAAD;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,WAAWD,IAAG,cAAc,OAAO,GAAG,SAAS;AAAA,QAC/C,SAAS,MAAM,YAAY,IAAI;AAAA;AAAA,IACjC;AAAA,EAEJ;AAEA,MAAI,iBAAkB,QAAO;AAE7B,SACE,gBAAAC,KAAC,UAAK,WAAWD,IAAG,yCAAyC,SAAS,GAAI,wBAAa;AAE3F;;;ACpIA,YAAYG,YAAW;AACvB,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAsGhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhFN,IAAMC,gBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBACE;AAAA,EACF,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,cAAc;AAChB;AAEA,IAAMC,eAAc;AAOb,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,MAAM,WAAW,YAAY,IAAI;AAC/D,QAAM,IAAI,EAAE,GAAGD,eAAc,GAAG,KAAK;AAErC,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,WAAW,YAAY,IAAU,gBAAS,KAAK;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAACC,aAAY,KAAK,OAAO,GAAG;AAC9B,eAAS,EAAE,iBAAiB;AAC5B;AAAA,IACF;AAEA,eAAW,IAAI;AAKf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,mBAAa,IAAI;AACjB,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AACb,UAAI;AACF,sBAAc,OAAO;AAAA,MACvB,SAAS,KAAK;AACZ,gBAAQ,MAAM,sDAAsD,GAAG;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW;AACb,WACE,gBAAAF,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,MAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,uBAAuB,YAAE,YAAW;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,cACxC,UAAU;AAAA,cACV,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,gBAAAG,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,WAEJ;AAAA,QACA,gBAAAA,KAACJ,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,SAChD,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA,QACA,gBAAAI,KAAC,SAAI,WAAU,eACb,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,WAAU;AAAA,YAET,YAAE;AAAA;AAAA,QACL,GACF;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACxJA,YAAYI,YAAW;AACvB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAyKhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhKN,SAAS,eAAe,KAAa,KAAa,OAAuB;AACvE,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,MAAM;AAC5C,SAAO,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC;AAC9D;AA8BA,IAAMC,gBAAyC;AAAA,EAC7C,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,gBACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,mBAAmB;AACrB;AAaO,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,iBAAiB,MAAM,WAAW,UAAU,IAAI;AAC9E,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AAErC,QAAM,cAAc,aAAa,IAAI,cAAc;AACnD,QAAM,eAAe,aAAa,IAAI,eAAe;AACrD,QAAM,YAAY,QAAQ,eAAe,YAAY;AAErD,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAU,gBAAS,KAAK;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,EAAE;AAE/C,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,UAAW;AAEhB,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,eAAe,CAAC,UAAU,KAAK,OAAO,GAAG;AAC3C,eAAS,EAAE,mBAAmB;AAC9B;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,cAAc;AAAA,UACd,eAAe;AAAA,UACf,cAAc;AAAA,UACd,GAAI,cAAc,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,IAAI;AACX,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,KAAK,MAAM,aAAa;AAC1B,uBAAe,IAAI;AACnB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AAKb,aAAO,QAAQ,eAAe,UAAU,SAAS,SAAS,CAAC;AAC3D,UAAI;AACF,oBAAY;AAAA,MACd,SAAS,KAAK;AACZ,gBAAQ,MAAM,oDAAoD,GAAG;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WACE,gBAAAD,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,oBAAmB;AAAA,MAC5D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,sBAAqB;AAAA,MACrE,gBAAAA,KAAC,OAAE,MAAM,iBAAiB,WAAU,qDACjC,YAAE,mBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,0BAA0B,YAAE,eAAc;AAAA,UACzD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,4BAA4B,YAAE,sBAAqB;AAAA,UAClE,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA;AAAA,UACpD;AAAA,WACF;AAAA,QACC,eACC,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,qBAAqB,YAAE,cAAa;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cACzE,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACA,gBAAAG,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,WACjE;AAAA,QAED,SACC,gBAAAA,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,QAEF,gBAAAA;AAAA,UAACJ;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UACE,WAAW,CAAC,YAAY,CAAC,mBAAoB,eAAe,QAAQ,WAAW;AAAA,YAGhF,oBAAU,EAAE,gBAAgB,EAAE;AAAA;AAAA,QACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5PA,YAAYO,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAmIhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAzGN,IAAMC,gBAAgC;AAAA,EACpC,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AASO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,WAAW,UAAU,MAAM,WAAW,UAAU,IAAI;AAC5D,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AACrC,QAAM,uBAAuB,aAAa,IAAI,wBAAwB;AAEtE,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,qBAAsB;AAE3B,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,qBAAoC;AACxC,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,WAAW;AAAA,QACjC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,wBAAwB;AAAA,UACxB,cAAc;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM,oBAAoB;AAC7C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,iBAAS,EAAE,YAAY;AACvB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,2BAAqB,KAAK,KAAK;AAAA,IACjC,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAQA,WAAO,SAAS,OAAO,kBAAkB;AACzC,QAAI;AACF,kBAAY,kBAAkB;AAAA,IAChC,SAAS,KAAK;AACZ,cAAQ,MAAM,2CAA2C,GAAG;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,CAAC,sBAAsB;AACzB,WACE,gBAAAF,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,qBAAoB;AAAA,MACpE,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWG,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAH,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,yBAAyB,YAAE,eAAc;AAAA,UACxD,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA,cAIjD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAL,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,wBAAwB,YAAE,sBAAqB;AAAA,UAC9D,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA;AAAA,UACnD;AAAA,WACF;AAAA,QACC,SACC,gBAAAN,KAAC,OAAE,IAAG,sBAAqB,MAAK,SAAQ,WAAU,4BAC/C,iBACH;AAAA,QAEF,gBAAAA,KAACO,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,WAAW,CAAC,YAAY,CAAC,iBACzE,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AChMA,YAAYC,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,MAAAC,WAAU;AAoIX,gBAAAC,MAOF,QAAAC,aAPE;AAhHR,IAAMC,gBAAgC;AAAA,EACpC,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,UAAU;AACZ;AAgBO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,YAAY,UAAU,MAAM,UAAU,IAAI;AAClD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AAErC,QAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,QAAM,YAAY,aAAa,IAAI,YAAY;AAC/C,QAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAAiB,YAAY,SAAS,YAAY,SAAS;AAC7F,QAAM,CAAC,cAAc,eAAe,IAAU,gBAAwB,IAAI;AAE1E,EAAM,iBAAU,MAAM;AACpB,QAAI,YAAY,QAAQ;AACtB,gBAAU,SAAS;AACnB;AAAA,IACF;AAEA,QAAI,aAAa,MAAM;AAgBrB,YAAM,aAAa,IAAI,gBAAgB;AACvC,gBAAU,SAAS;AACnB,YAAM,YAAY;AAAA,QAChB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,YAAY,WAAW,KAAK,CAAC;AAAA,QACpD,QAAQ,WAAW;AAAA,MACrB,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,YAAI,CAAC,IAAI,IAAI;AACX,oBAAU,OAAO;AACjB,0BAAgB,KAAK,SAAS,EAAE,YAAY;AAC5C;AAAA,QACF;AAEA,YAAI,KAAK,MAAM,oBAAoB;AACjC,cAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,sBAAU,OAAO;AACjB,4BAAgB,EAAE,YAAY;AAC9B;AAAA,UACF;AACA,iBAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AACnD;AAAA,QACF;AAEA,kBAAU,SAAS;AAAA,MACrB,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,eAAe,SAAS,IAAI,SAAS,aAAc;AACvD,kBAAU,OAAO;AACjB,wBAAgB,EAAE,YAAY;AAAA,MAChC,CAAC;AAEH,aAAO,MAAM,WAAW,MAAM;AAAA,IAChC;AAGA,cAAU,OAAO;AAAA,EAMnB,GAAG,CAAC,SAAS,WAAW,MAAM,UAAU,CAAC;AAEzC,MAAI,WAAW,WAAW;AACxB,WACE,gBAAAH,KAAC,SAAI,WAAWI,IAAG,yBAAyB,SAAS,GACnD,0BAAAJ,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe,GACjE;AAAA,EAEJ;AAEA,MAAI,WAAW,SAAS;AACtB,WACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,YAAW;AAAA,MACpD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,0BAAgB,EAAE,cAAa;AAAA,MAC7E,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,UACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,oBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,IACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,IAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,YACL;AAAA,KACF;AAEJ;","names":["React","Button","cn","jsx","jsxs","DEFAULT_COPY","cn","Button","DEFAULT_COPY","React","cn","jsx","DEFAULT_COPY","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","EMAIL_REGEX","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","React","useSearchParams","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn","Label","Input","Button","React","useSearchParams","cn","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn"]}

package/dist/route-handlers.cjs

@@ -0,0 +1,108 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/route-handlers.ts
+var route_handlers_exports = {};
+__export(route_handlers_exports, {
+  createProxyRoute: () => createProxyRoute
+});
+module.exports = __toCommonJS(route_handlers_exports);
+function jsonErrorResponse(status, error, message) {
+  return new Response(
+    JSON.stringify({ error, message, correlation_id: crypto.randomUUID() }),
+    { status, headers: { "Content-Type": "application/json; charset=utf-8" } }
+  );
+}
+function createProxyRoute(targetPath, opts = {}) {
+  const {
+    method = "POST",
+    forwardSetCookie = false,
+    requireJson = false,
+    invalidRequestMessage = "Solicitud no v\xE1lida",
+    timeoutMs = 8e3,
+    configurationErrorMessage = "Error de configuraci\xF3n del servidor.",
+    timeoutMessage = "La solicitud ha superado el tiempo de espera.",
+    proxyErrorMessage = "Error de conexi\xF3n con el servidor."
+  } = opts;
+  return async function handler(request) {
+    if (requireJson) {
+      const contentType = request.headers.get("content-type") ?? "";
+      if (!contentType.includes("application/json")) {
+        return jsonErrorResponse(400, "invalid_request", invalidRequestMessage);
+      }
+    }
+    const baseUrl = opts.baseUrl ?? process.env.REBLU_API_BASE_URL ?? "";
+    const apiKey = opts.apiKey ?? process.env.REBLU_API_KEY ?? "";
+    if (!baseUrl || !apiKey) {
+      console.error(
+        `[createProxyRoute] Missing configuration for ${targetPath}: ` + `${!baseUrl ? "baseUrl/REBLU_API_BASE_URL " : ""}${!apiKey ? "apiKey/REBLU_API_KEY" : ""}`.trim()
+      );
+      return jsonErrorResponse(500, "missing_configuration", configurationErrorMessage);
+    }
+    const forwardedHeaders = {};
+    const ua = request.headers.get("user-agent");
+    if (ua) forwardedHeaders["user-agent"] = ua;
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) forwardedHeaders["x-forwarded-for"] = xff;
+    const xri = request.headers.get("x-real-ip");
+    if (xri) forwardedHeaders["x-real-ip"] = xri;
+    const upperMethod = method.toUpperCase();
+    const body = upperMethod === "GET" || upperMethod === "HEAD" ? void 0 : await request.text();
+    const search = request.nextUrl?.search ?? "";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${baseUrl}${targetPath}${search}`, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          "X-Reblu-Api-Key": apiKey,
+          ...forwardedHeaders
+        },
+        ...body ? { body } : {},
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const data = await res.text();
+      const responseHeaders = new Headers({
+        "Content-Type": res.headers.get("Content-Type") ?? "application/json"
+      });
+      if (forwardSetCookie) {
+        for (const cookie of res.headers.getSetCookie()) {
+          responseHeaders.append("set-cookie", cookie);
+        }
+      }
+      return new Response(data, { status: res.status, headers: responseHeaders });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        console.error(`[createProxyRoute] Timed out forwarding to ${targetPath} after ${timeoutMs}ms`);
+        return jsonErrorResponse(502, "upstream_timeout", timeoutMessage);
+      }
+      console.error(`[createProxyRoute] Error forwarding to ${targetPath}:`, err);
+      return jsonErrorResponse(502, "proxy_error", proxyErrorMessage);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createProxyRoute
+});
+//# sourceMappingURL=route-handlers.cjs.map

package/dist/route-handlers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/route-handlers.ts"],"sourcesContent":["/**\n * `@reblu/site-next/route-handlers` — server-only, dependency-free Route\n * Handler factory (REB-510 / design doc \"site-auth-package\").\n *\n * This module MUST stay dependency-free (no `@reblu/site-ui`, no React): it is\n * imported directly by `app/api/*` Route Handler files, and its own tsup entry\n * carries NO `'use client'` directive (mirrors the `cache` subpath's R4\n * precedent for the opposite direction — see `tsup.config.ts`).\n *\n * Scope: this factory covers the `/api/site/auth/*` proxy shape specifically\n * (fixed target path, JSON body passthrough, optional `Set-Cookie` forward) —\n * the same shape as every one of demo-site's 8 auth Route Handlers. It is\n * modeled on `apps/demo-site/src/lib/api/proxy.ts` (`proxyToBaseApi`) but is\n * NOT a drop-in replacement for every one of that helper's call sites: it\n * does not support a per-request DYNAMIC `targetPath` (e.g.\n * `api/shop/order/[sessionId]/route.ts`'s `` `/api/site/shop/order/${id}` ``)\n * or an arbitrary extra-`headers` passthrough — both are genuinely out of\n * scope for REB-510 (auth only). demo-site's non-auth proxy routes keep using\n * `proxyToBaseApi` directly; only the 8 auth routes are candidates to adopt\n * this factory.\n *\n *   export const POST = createProxyRoute('/api/site/auth/login')\n *\n * Deliberate behavior change vs the original (R6): `proxy.ts` reads\n * `REBLU_API_BASE_URL`/`REBLU_API_KEY` at MODULE LOAD. This factory reads them\n * LAZILY, inside the returned handler, on every request — `opts.baseUrl` /\n * `opts.apiKey` still take priority when provided.\n *\n * Why this factory reads `process.env` at all, unlike `@reblu/site-client`\n * (whose own docblock states \"the SDK never reads `process.env` itself\"):\n * `site-client` is instantiated ONCE by the consuming SITE, which already\n * owns and injects its env at that single call site. `createProxyRoute` is\n * the opposite shape on purpose — a ZERO-CONFIG one-liner meant to be called\n * once per Route Handler FILE (8+ files in a typical SITE), so requiring\n * every file to re-thread `baseUrl`/`apiKey` would defeat the \"one line\"\n * value proposition documented in the README. The env fallback is this\n * factory's deliberate ergonomic default; `opts.baseUrl`/`opts.apiKey` remain\n * available for a SITE that wants explicit, non-`process.env` control.\n *\n * Trust note on header forwarding: `X-Forwarded-For`/`X-Real-IP` are copied\n * from the incoming request VERBATIM (same as the original `proxy.ts`). On\n * Vercel the platform itself sets/overwrites these ahead of the Route\n * Handler, so they're trustworthy there — but this is a distributable SDK a\n * SITE can deploy anywhere. On a host where nothing strips inbound spoofed\n * values, a client can forge the IP base-api rate-limits on. Deploy this\n * factory only behind a platform that normalizes/overwrites these headers,\n * or in front of infra that strips client-supplied ones.\n */\nimport type { NextRequest } from 'next/server'\n\nexport interface CreateProxyRouteOptions {\n  /** Overrides `REBLU_API_BASE_URL`. Read lazily per-request when omitted. */\n  baseUrl?: string\n  /** Overrides `REBLU_API_KEY`. Read lazily per-request when omitted. */\n  apiKey?: string\n  /** @default 'POST' */\n  method?: string\n  /** Forward upstream `Set-Cookie` headers to the browser. @default false */\n  forwardSetCookie?: boolean\n  /**\n   * Reject non-`application/json` requests with a Spanish 400 before ever\n   * reaching the network — mirrors `magic-link-exchange/route.ts`'s guard.\n   * @default false\n   */\n  requireJson?: boolean\n  /**\n   * Overrides the Spanish `message` field of the `requireJson` 400 body, for\n   * a non-Spanish-default SITE. The `error` code (`invalid_request`) and\n   * shape stay fixed — only the human-facing text is overridable.\n   * @default 'Solicitud no válida'\n   */\n  invalidRequestMessage?: string\n  /**\n   * Hard timeout (ms) for the upstream fetch, enforced via `AbortController`\n   * — mirrors `@reblu/site-client`'s own `timeoutMs` (default `8000`, same\n   * value). Without this, a hung base-api response would hang the SITE's\n   * Route Handler indefinitely instead of degrading.\n   * @default 8000\n   */\n  timeoutMs?: number\n  /**\n   * Overrides the `message` field of the 500 body returned when neither\n   * `opts.baseUrl`/`opts.apiKey` nor `REBLU_API_BASE_URL`/`REBLU_API_KEY`\n   * resolve to a non-empty value.\n   * @default 'Error de configuración del servidor.'\n   */\n  configurationErrorMessage?: string\n  /**\n   * Overrides the `message` field of the 502 body returned when the\n   * upstream fetch times out.\n   * @default 'La solicitud ha superado el tiempo de espera.'\n   */\n  timeoutMessage?: string\n  /**\n   * Overrides the `message` field of the 502 body returned when the\n   * upstream fetch fails for any other reason (DNS, connection refused,\n   * etc.).\n   * @default 'Error de conexión con el servidor.'\n   */\n  proxyErrorMessage?: string\n}\n\nfunction jsonErrorResponse(status: number, error: string, message: string): Response {\n  return new Response(\n    JSON.stringify({ error, message, correlation_id: crypto.randomUUID() }),\n    { status, headers: { 'Content-Type': 'application/json; charset=utf-8' } },\n  )\n}\n\n/**\n * Creates a Next.js Route Handler that proxies `request` to\n * `${baseUrl}${targetPath}` at base-api, injecting the `X-Reblu-Api-Key`\n * server-side so it never reaches the browser.\n */\nexport function createProxyRoute(targetPath: string, opts: CreateProxyRouteOptions = {}) {\n  const {\n    method = 'POST',\n    forwardSetCookie = false,\n    requireJson = false,\n    invalidRequestMessage = 'Solicitud no válida',\n    timeoutMs = 8000,\n    configurationErrorMessage = 'Error de configuración del servidor.',\n    timeoutMessage = 'La solicitud ha superado el tiempo de espera.',\n    proxyErrorMessage = 'Error de conexión con el servidor.',\n  } = opts\n\n  return async function handler(request: NextRequest): Promise<Response> {\n    if (requireJson) {\n      const contentType = request.headers.get('content-type') ?? ''\n      if (!contentType.includes('application/json')) {\n        return jsonErrorResponse(400, 'invalid_request', invalidRequestMessage)\n      }\n    }\n\n    // Lazy, per-request env read (R6) — opts win when provided.\n    const baseUrl = opts.baseUrl ?? process.env.REBLU_API_BASE_URL ?? ''\n    const apiKey = opts.apiKey ?? process.env.REBLU_API_KEY ?? ''\n\n    if (!baseUrl || !apiKey) {\n      console.error(\n        `[createProxyRoute] Missing configuration for ${targetPath}: ` +\n          `${!baseUrl ? 'baseUrl/REBLU_API_BASE_URL ' : ''}${!apiKey ? 'apiKey/REBLU_API_KEY' : ''}`.trim(),\n      )\n      return jsonErrorResponse(500, 'missing_configuration', configurationErrorMessage)\n    }\n\n    const forwardedHeaders: Record<string, string> = {}\n    const ua = request.headers.get('user-agent')\n    if (ua) forwardedHeaders['user-agent'] = ua\n    const xff = request.headers.get('x-forwarded-for')\n    if (xff) forwardedHeaders['x-forwarded-for'] = xff\n    const xri = request.headers.get('x-real-ip')\n    if (xri) forwardedHeaders['x-real-ip'] = xri\n\n    const upperMethod = method.toUpperCase()\n    const body =\n      upperMethod === 'GET' || upperMethod === 'HEAD' ? undefined : await request.text()\n    // Forward the original query string (e.g. `?slug=x`) regardless of\n    // method — `targetPath` is fixed at factory-call time, so without this a\n    // GET route configured via `{ method: 'GET' }` would silently drop it.\n    const search = request.nextUrl?.search ?? ''\n\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n\n    try {\n      const res = await fetch(`${baseUrl}${targetPath}${search}`, {\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          'X-Reblu-Api-Key': apiKey,\n          ...forwardedHeaders,\n        },\n        ...(body ? { body } : {}),\n        cache: 'no-store',\n        signal: controller.signal,\n      })\n\n      const data = await res.text()\n      const responseHeaders = new Headers({\n        'Content-Type': res.headers.get('Content-Type') ?? 'application/json',\n      })\n\n      if (forwardSetCookie) {\n        for (const cookie of res.headers.getSetCookie()) {\n          responseHeaders.append('set-cookie', cookie)\n        }\n      }\n\n      return new Response(data, { status: res.status, headers: responseHeaders })\n    } catch (err) {\n      if (err instanceof Error && err.name === 'AbortError') {\n        console.error(`[createProxyRoute] Timed out forwarding to ${targetPath} after ${timeoutMs}ms`)\n        return jsonErrorResponse(502, 'upstream_timeout', timeoutMessage)\n      }\n      console.error(`[createProxyRoute] Error forwarding to ${targetPath}:`, err)\n      return jsonErrorResponse(502, 'proxy_error', proxyErrorMessage)\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAsGA,SAAS,kBAAkB,QAAgB,OAAe,SAA2B;AACnF,SAAO,IAAI;AAAA,IACT,KAAK,UAAU,EAAE,OAAO,SAAS,gBAAgB,OAAO,WAAW,EAAE,CAAC;AAAA,IACtE,EAAE,QAAQ,SAAS,EAAE,gBAAgB,kCAAkC,EAAE;AAAA,EAC3E;AACF;AAOO,SAAS,iBAAiB,YAAoB,OAAgC,CAAC,GAAG;AACvF,QAAM;AAAA,IACJ,SAAS;AAAA,IACT,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,wBAAwB;AAAA,IACxB,YAAY;AAAA,IACZ,4BAA4B;AAAA,IAC5B,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,EACtB,IAAI;AAEJ,SAAO,eAAe,QAAQ,SAAyC;AACrE,QAAI,aAAa;AACf,YAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,UAAI,CAAC,YAAY,SAAS,kBAAkB,GAAG;AAC7C,eAAO,kBAAkB,KAAK,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAGA,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI,sBAAsB;AAClE,UAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AAE3D,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,cAAQ;AAAA,QACN,gDAAgD,UAAU,OACxD,GAAG,CAAC,UAAU,gCAAgC,EAAE,GAAG,CAAC,SAAS,yBAAyB,EAAE,GAAG,KAAK;AAAA,MACpG;AACA,aAAO,kBAAkB,KAAK,yBAAyB,yBAAyB;AAAA,IAClF;AAEA,UAAM,mBAA2C,CAAC;AAClD,UAAM,KAAK,QAAQ,QAAQ,IAAI,YAAY;AAC3C,QAAI,GAAI,kBAAiB,YAAY,IAAI;AACzC,UAAM,MAAM,QAAQ,QAAQ,IAAI,iBAAiB;AACjD,QAAI,IAAK,kBAAiB,iBAAiB,IAAI;AAC/C,UAAM,MAAM,QAAQ,QAAQ,IAAI,WAAW;AAC3C,QAAI,IAAK,kBAAiB,WAAW,IAAI;AAEzC,UAAM,cAAc,OAAO,YAAY;AACvC,UAAM,OACJ,gBAAgB,SAAS,gBAAgB,SAAS,SAAY,MAAM,QAAQ,KAAK;AAInF,UAAM,SAAS,QAAQ,SAAS,UAAU;AAE1C,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE5D,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI;AAAA,QAC1D;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,mBAAmB;AAAA,UACnB,GAAG;AAAA,QACL;AAAA,QACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,OAAO;AAAA,QACP,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,kBAAkB,IAAI,QAAQ;AAAA,QAClC,gBAAgB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACrD,CAAC;AAED,UAAI,kBAAkB;AACpB,mBAAW,UAAU,IAAI,QAAQ,aAAa,GAAG;AAC/C,0BAAgB,OAAO,cAAc,MAAM;AAAA,QAC7C;AAAA,MACF;AAEA,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,QAAQ,SAAS,gBAAgB,CAAC;AAAA,IAC5E,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,gBAAQ,MAAM,8CAA8C,UAAU,UAAU,SAAS,IAAI;AAC7F,eAAO,kBAAkB,KAAK,oBAAoB,cAAc;AAAA,MAClE;AACA,cAAQ,MAAM,0CAA0C,UAAU,KAAK,GAAG;AAC1E,aAAO,kBAAkB,KAAK,eAAe,iBAAiB;AAAA,IAChE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;","names":[]}

package/dist/route-handlers.d.cts

@@ -0,0 +1,110 @@
+import { NextRequest } from 'next/server';
+
+/**
+ * `@reblu/site-next/route-handlers` — server-only, dependency-free Route
+ * Handler factory (REB-510 / design doc "site-auth-package").
+ *
+ * This module MUST stay dependency-free (no `@reblu/site-ui`, no React): it is
+ * imported directly by `app/api/*` Route Handler files, and its own tsup entry
+ * carries NO `'use client'` directive (mirrors the `cache` subpath's R4
+ * precedent for the opposite direction — see `tsup.config.ts`).
+ *
+ * Scope: this factory covers the `/api/site/auth/*` proxy shape specifically
+ * (fixed target path, JSON body passthrough, optional `Set-Cookie` forward) —
+ * the same shape as every one of demo-site's 8 auth Route Handlers. It is
+ * modeled on `apps/demo-site/src/lib/api/proxy.ts` (`proxyToBaseApi`) but is
+ * NOT a drop-in replacement for every one of that helper's call sites: it
+ * does not support a per-request DYNAMIC `targetPath` (e.g.
+ * `api/shop/order/[sessionId]/route.ts`'s `` `/api/site/shop/order/${id}` ``)
+ * or an arbitrary extra-`headers` passthrough — both are genuinely out of
+ * scope for REB-510 (auth only). demo-site's non-auth proxy routes keep using
+ * `proxyToBaseApi` directly; only the 8 auth routes are candidates to adopt
+ * this factory.
+ *
+ *   export const POST = createProxyRoute('/api/site/auth/login')
+ *
+ * Deliberate behavior change vs the original (R6): `proxy.ts` reads
+ * `REBLU_API_BASE_URL`/`REBLU_API_KEY` at MODULE LOAD. This factory reads them
+ * LAZILY, inside the returned handler, on every request — `opts.baseUrl` /
+ * `opts.apiKey` still take priority when provided.
+ *
+ * Why this factory reads `process.env` at all, unlike `@reblu/site-client`
+ * (whose own docblock states "the SDK never reads `process.env` itself"):
+ * `site-client` is instantiated ONCE by the consuming SITE, which already
+ * owns and injects its env at that single call site. `createProxyRoute` is
+ * the opposite shape on purpose — a ZERO-CONFIG one-liner meant to be called
+ * once per Route Handler FILE (8+ files in a typical SITE), so requiring
+ * every file to re-thread `baseUrl`/`apiKey` would defeat the "one line"
+ * value proposition documented in the README. The env fallback is this
+ * factory's deliberate ergonomic default; `opts.baseUrl`/`opts.apiKey` remain
+ * available for a SITE that wants explicit, non-`process.env` control.
+ *
+ * Trust note on header forwarding: `X-Forwarded-For`/`X-Real-IP` are copied
+ * from the incoming request VERBATIM (same as the original `proxy.ts`). On
+ * Vercel the platform itself sets/overwrites these ahead of the Route
+ * Handler, so they're trustworthy there — but this is a distributable SDK a
+ * SITE can deploy anywhere. On a host where nothing strips inbound spoofed
+ * values, a client can forge the IP base-api rate-limits on. Deploy this
+ * factory only behind a platform that normalizes/overwrites these headers,
+ * or in front of infra that strips client-supplied ones.
+ */
+
+interface CreateProxyRouteOptions {
+    /** Overrides `REBLU_API_BASE_URL`. Read lazily per-request when omitted. */
+    baseUrl?: string;
+    /** Overrides `REBLU_API_KEY`. Read lazily per-request when omitted. */
+    apiKey?: string;
+    /** @default 'POST' */
+    method?: string;
+    /** Forward upstream `Set-Cookie` headers to the browser. @default false */
+    forwardSetCookie?: boolean;
+    /**
+     * Reject non-`application/json` requests with a Spanish 400 before ever
+     * reaching the network — mirrors `magic-link-exchange/route.ts`'s guard.
+     * @default false
+     */
+    requireJson?: boolean;
+    /**
+     * Overrides the Spanish `message` field of the `requireJson` 400 body, for
+     * a non-Spanish-default SITE. The `error` code (`invalid_request`) and
+     * shape stay fixed — only the human-facing text is overridable.
+     * @default 'Solicitud no válida'
+     */
+    invalidRequestMessage?: string;
+    /**
+     * Hard timeout (ms) for the upstream fetch, enforced via `AbortController`
+     * — mirrors `@reblu/site-client`'s own `timeoutMs` (default `8000`, same
+     * value). Without this, a hung base-api response would hang the SITE's
+     * Route Handler indefinitely instead of degrading.
+     * @default 8000
+     */
+    timeoutMs?: number;
+    /**
+     * Overrides the `message` field of the 500 body returned when neither
+     * `opts.baseUrl`/`opts.apiKey` nor `REBLU_API_BASE_URL`/`REBLU_API_KEY`
+     * resolve to a non-empty value.
+     * @default 'Error de configuración del servidor.'
+     */
+    configurationErrorMessage?: string;
+    /**
+     * Overrides the `message` field of the 502 body returned when the
+     * upstream fetch times out.
+     * @default 'La solicitud ha superado el tiempo de espera.'
+     */
+    timeoutMessage?: string;
+    /**
+     * Overrides the `message` field of the 502 body returned when the
+     * upstream fetch fails for any other reason (DNS, connection refused,
+     * etc.).
+     * @default 'Error de conexión con el servidor.'
+     */
+    proxyErrorMessage?: string;
+}
+/**
+ * Creates a Next.js Route Handler that proxies `request` to
+ * `${baseUrl}${targetPath}` at base-api, injecting the `X-Reblu-Api-Key`
+ * server-side so it never reaches the browser.
+ */
+declare function createProxyRoute(targetPath: string, opts?: CreateProxyRouteOptions): (request: NextRequest) => Promise<Response>;
+
+export { type CreateProxyRouteOptions, createProxyRoute };

package/dist/route-handlers.d.ts

@@ -0,0 +1,110 @@
+import { NextRequest } from 'next/server';
+
+/**
+ * `@reblu/site-next/route-handlers` — server-only, dependency-free Route
+ * Handler factory (REB-510 / design doc "site-auth-package").
+ *
+ * This module MUST stay dependency-free (no `@reblu/site-ui`, no React): it is
+ * imported directly by `app/api/*` Route Handler files, and its own tsup entry
+ * carries NO `'use client'` directive (mirrors the `cache` subpath's R4
+ * precedent for the opposite direction — see `tsup.config.ts`).
+ *
+ * Scope: this factory covers the `/api/site/auth/*` proxy shape specifically
+ * (fixed target path, JSON body passthrough, optional `Set-Cookie` forward) —
+ * the same shape as every one of demo-site's 8 auth Route Handlers. It is
+ * modeled on `apps/demo-site/src/lib/api/proxy.ts` (`proxyToBaseApi`) but is
+ * NOT a drop-in replacement for every one of that helper's call sites: it
+ * does not support a per-request DYNAMIC `targetPath` (e.g.
+ * `api/shop/order/[sessionId]/route.ts`'s `` `/api/site/shop/order/${id}` ``)
+ * or an arbitrary extra-`headers` passthrough — both are genuinely out of
+ * scope for REB-510 (auth only). demo-site's non-auth proxy routes keep using
+ * `proxyToBaseApi` directly; only the 8 auth routes are candidates to adopt
+ * this factory.
+ *
+ *   export const POST = createProxyRoute('/api/site/auth/login')
+ *
+ * Deliberate behavior change vs the original (R6): `proxy.ts` reads
+ * `REBLU_API_BASE_URL`/`REBLU_API_KEY` at MODULE LOAD. This factory reads them
+ * LAZILY, inside the returned handler, on every request — `opts.baseUrl` /
+ * `opts.apiKey` still take priority when provided.
+ *
+ * Why this factory reads `process.env` at all, unlike `@reblu/site-client`
+ * (whose own docblock states "the SDK never reads `process.env` itself"):
+ * `site-client` is instantiated ONCE by the consuming SITE, which already
+ * owns and injects its env at that single call site. `createProxyRoute` is
+ * the opposite shape on purpose — a ZERO-CONFIG one-liner meant to be called
+ * once per Route Handler FILE (8+ files in a typical SITE), so requiring
+ * every file to re-thread `baseUrl`/`apiKey` would defeat the "one line"
+ * value proposition documented in the README. The env fallback is this
+ * factory's deliberate ergonomic default; `opts.baseUrl`/`opts.apiKey` remain
+ * available for a SITE that wants explicit, non-`process.env` control.
+ *
+ * Trust note on header forwarding: `X-Forwarded-For`/`X-Real-IP` are copied
+ * from the incoming request VERBATIM (same as the original `proxy.ts`). On
+ * Vercel the platform itself sets/overwrites these ahead of the Route
+ * Handler, so they're trustworthy there — but this is a distributable SDK a
+ * SITE can deploy anywhere. On a host where nothing strips inbound spoofed
+ * values, a client can forge the IP base-api rate-limits on. Deploy this
+ * factory only behind a platform that normalizes/overwrites these headers,
+ * or in front of infra that strips client-supplied ones.
+ */
+
+interface CreateProxyRouteOptions {
+    /** Overrides `REBLU_API_BASE_URL`. Read lazily per-request when omitted. */
+    baseUrl?: string;
+    /** Overrides `REBLU_API_KEY`. Read lazily per-request when omitted. */
+    apiKey?: string;
+    /** @default 'POST' */
+    method?: string;
+    /** Forward upstream `Set-Cookie` headers to the browser. @default false */
+    forwardSetCookie?: boolean;
+    /**
+     * Reject non-`application/json` requests with a Spanish 400 before ever
+     * reaching the network — mirrors `magic-link-exchange/route.ts`'s guard.
+     * @default false
+     */
+    requireJson?: boolean;
+    /**
+     * Overrides the Spanish `message` field of the `requireJson` 400 body, for
+     * a non-Spanish-default SITE. The `error` code (`invalid_request`) and
+     * shape stay fixed — only the human-facing text is overridable.
+     * @default 'Solicitud no válida'
+     */
+    invalidRequestMessage?: string;
+    /**
+     * Hard timeout (ms) for the upstream fetch, enforced via `AbortController`
+     * — mirrors `@reblu/site-client`'s own `timeoutMs` (default `8000`, same
+     * value). Without this, a hung base-api response would hang the SITE's
+     * Route Handler indefinitely instead of degrading.
+     * @default 8000
+     */
+    timeoutMs?: number;
+    /**
+     * Overrides the `message` field of the 500 body returned when neither
+     * `opts.baseUrl`/`opts.apiKey` nor `REBLU_API_BASE_URL`/`REBLU_API_KEY`
+     * resolve to a non-empty value.
+     * @default 'Error de configuración del servidor.'
+     */
+    configurationErrorMessage?: string;
+    /**
+     * Overrides the `message` field of the 502 body returned when the
+     * upstream fetch times out.
+     * @default 'La solicitud ha superado el tiempo de espera.'
+     */
+    timeoutMessage?: string;
+    /**
+     * Overrides the `message` field of the 502 body returned when the
+     * upstream fetch fails for any other reason (DNS, connection refused,
+     * etc.).
+     * @default 'Error de conexión con el servidor.'
+     */
+    proxyErrorMessage?: string;
+}
+/**
+ * Creates a Next.js Route Handler that proxies `request` to
+ * `${baseUrl}${targetPath}` at base-api, injecting the `X-Reblu-Api-Key`
+ * server-side so it never reaches the browser.
+ */
+declare function createProxyRoute(targetPath: string, opts?: CreateProxyRouteOptions): (request: NextRequest) => Promise<Response>;
+
+export { type CreateProxyRouteOptions, createProxyRoute };