@reblu/site-next 1.6.0 → 1.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +464 -0
  2. package/README.md +21 -0
  3. package/dist/auth.cjs +89 -7
  4. package/dist/auth.cjs.map +1 -1
  5. package/dist/auth.d.cts +82 -2
  6. package/dist/auth.d.ts +82 -2
  7. package/dist/auth.js +84 -6
  8. package/dist/auth.js.map +1 -1
  9. package/package.json +6 -5
package/dist/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/auth/login-form.tsx","../src/auth/safe-redirect.ts","../src/auth/auth-callback.tsx","../src/auth/login-errors.ts","../src/auth/auth-logo.tsx","../src/auth/reset-password-request.tsx","../src/auth/reset-password-confirm.tsx","../src/auth/set-password.tsx","../src/auth/auth-confirm.tsx"],"sourcesContent":["'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { Tabs, TabsList, TabsTrigger, TabsContent } from '@reblu/site-ui/tabs'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface LoginFormCopy {\n // Tab labels\n magicLinkTabLabel: string\n passwordTabLabel: string\n\n // Shared\n emailLabel: string\n emailPlaceholder: string\n\n // Password tab\n passwordLabel: string\n passwordPlaceholder: string\n passwordSubmitCta: string\n forgotPasswordCta: string\n\n // Magic-link tab\n magicLinkSubmitCta: string\n\n // Magic-link success\n magicLinkSuccessTitle: string\n magicLinkSuccessMessage: string\n\n // MFA prompt\n mfaTitle: string\n mfaMessage: string\n mfaCodeLabel: string\n mfaCodePlaceholder: string\n mfaSubmitCta: string\n\n // Errors\n invalidEmailError: string\n networkError: string\n invalidCredentialsError: string\n mfaInvalidCodeError: string\n}\n\nexport interface LoginFormProps {\n // Endpoint URLs (all required)\n passwordLoginUrl: string\n mfaVerifyUrl: string\n magicLinkRequestUrl: string\n resetPasswordUrl: string\n\n // UX\n copy?: Partial<LoginFormCopy>\n className?: string\n defaultMethod?: 'magic-link' | 'password'\n\n // Hooks\n onPasswordSubmitted?: (email: string) => void\n onMagicLinkSubmitted?: (email: string) => void\n onMfaSubmitted?: () => void\n}\n\nconst DEFAULT_COPY: LoginFormCopy = {\n magicLinkTabLabel: 'Enlace mágico',\n passwordTabLabel: 'Contraseña',\n emailLabel: 'Correo electrónico',\n emailPlaceholder: 'tu@email.com',\n passwordLabel: 'Contraseña',\n passwordPlaceholder: '••••••••',\n passwordSubmitCta: 'Iniciar sesión',\n forgotPasswordCta: '¿Olvidaste tu contraseña?',\n magicLinkSubmitCta: 'Enviar enlace de acceso',\n magicLinkSuccessTitle: '¡Enlace enviado!',\n magicLinkSuccessMessage: 'Revisa tu correo para acceder.',\n mfaTitle: 'Verificación en dos pasos',\n mfaMessage: 'Introduce el código de 6 dígitos de tu aplicación autenticadora.',\n mfaCodeLabel: 'Código de verificación',\n mfaCodePlaceholder: '123456',\n mfaSubmitCta: 'Verificar código',\n invalidEmailError: 'Introduce un correo electrónico válido.',\n networkError: 'No se pudo enviar el enlace. Inténtalo de nuevo.',\n invalidCredentialsError: 'Email o contraseña incorrectos',\n mfaInvalidCodeError: 'Código incorrecto. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nfunction isValidEmail(value: string): boolean {\n return EMAIL_REGEX.test(value)\n}\n\ntype FormState = 'idle' | 'submitting' | 'magic-link-success' | 'mfa-required' | 'error'\n\ninterface MfaState {\n factorId: string\n accessToken: string\n refreshToken: string\n}\n\ninterface PasswordLoginResponse {\n data?: {\n mfaRequired: boolean\n sessionExchangeUrl?: string\n factorId?: string\n accessToken?: string\n refreshToken?: string\n }\n error?: string\n}\n\ninterface MfaVerifyResponse {\n data?: { sessionExchangeUrl: string }\n error?: string\n}\n\nexport function LoginForm(props: LoginFormProps) {\n const {\n passwordLoginUrl,\n mfaVerifyUrl,\n magicLinkRequestUrl,\n resetPasswordUrl,\n copy,\n className,\n defaultMethod = 'password',\n onPasswordSubmitted,\n onMagicLinkSubmitted,\n onMfaSubmitted,\n } = props\n\n const c = { ...DEFAULT_COPY, ...copy }\n\n const [method, setMethod] = React.useState<'magic-link' | 'password'>(defaultMethod)\n const [state, setState] = React.useState<FormState>('idle')\n const [error, setError] = React.useState<string | null>(null)\n\n // Password & magic-link inputs\n const [email, setEmail] = React.useState('')\n const [password, setPassword] = React.useState('')\n\n // MFA state\n const [mfa, setMfa] = React.useState<MfaState | null>(null)\n const [mfaCode, setMfaCode] = React.useState('')\n\n const resetTransientState = React.useCallback(() => {\n setState('idle')\n setError(null)\n setMfa(null)\n setMfaCode('')\n }, [])\n\n const handleTabChange = (next: string) => {\n if (next !== 'magic-link' && next !== 'password') return\n setMethod(next)\n resetTransientState()\n }\n\n const handleMagicLinkSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!isValidEmail(trimmed)) {\n setError(c.invalidEmailError)\n setState('error')\n return\n }\n\n setState('submitting')\n try {\n const res = await fetch(magicLinkRequestUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed }),\n })\n\n if (res.ok) {\n setState('magic-link-success')\n onMagicLinkSubmitted?.(trimmed)\n return\n }\n\n setState('error')\n setError(c.networkError)\n } catch {\n setState('error')\n setError(c.networkError)\n }\n }\n\n const handlePasswordSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!isValidEmail(trimmed)) {\n setError(c.invalidEmailError)\n setState('error')\n return\n }\n if (!password) {\n setError(c.invalidCredentialsError)\n setState('error')\n return\n }\n\n setState('submitting')\n try {\n const res = await fetch(passwordLoginUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed, password }),\n })\n\n const json = (await res.json().catch(() => ({}))) as PasswordLoginResponse\n\n if (!res.ok || !json.data) {\n setState('error')\n setError(json.error ?? c.invalidCredentialsError)\n return\n }\n\n onPasswordSubmitted?.(trimmed)\n\n if (json.data.mfaRequired) {\n setMfa({\n factorId: json.data.factorId ?? '',\n accessToken: json.data.accessToken ?? '',\n refreshToken: json.data.refreshToken ?? '',\n })\n setState('mfa-required')\n return\n }\n\n const exchangeUrl = json.data.sessionExchangeUrl\n if (!exchangeUrl || !isSafeRedirectUrl(exchangeUrl)) {\n setState('error')\n setError(c.networkError)\n return\n }\n window.location.assign(exchangeUrl)\n } catch {\n setState('error')\n setError(c.networkError)\n }\n }\n\n const handleMfaSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n if (!mfa) return\n setError(null)\n setState('submitting')\n\n try {\n const res = await fetch(mfaVerifyUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n factorId: mfa.factorId,\n code: mfaCode,\n accessToken: mfa.accessToken,\n refreshToken: mfa.refreshToken,\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as MfaVerifyResponse\n\n if (\n !res.ok ||\n !json.data?.sessionExchangeUrl ||\n !isSafeRedirectUrl(json.data.sessionExchangeUrl)\n ) {\n // Stay in mfa-required state so user can retry the code\n setState('mfa-required')\n setError(json.error ?? c.mfaInvalidCodeError)\n setMfaCode('')\n return\n }\n\n onMfaSubmitted?.()\n window.location.assign(json.data.sessionExchangeUrl)\n } catch {\n setState('mfa-required')\n setError(c.networkError)\n }\n }\n\n // MFA prompt replaces the form entirely\n if (state === 'mfa-required' || (mfa && state === 'submitting')) {\n return (\n <div className={cn('space-y-6', className)}>\n <div className='space-y-1'>\n <h2 className='text-xl font-semibold'>{c.mfaTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.mfaMessage}</p>\n </div>\n <form onSubmit={(e) => void handleMfaSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-mfa-code'>{c.mfaCodeLabel}</Label>\n <Input\n id='login-mfa-code'\n type='text'\n inputMode='numeric'\n pattern='\\d{6}'\n maxLength={6}\n autoComplete='one-time-code'\n placeholder={c.mfaCodePlaceholder}\n value={mfaCode}\n onChange={(ev) => setMfaCode(ev.target.value.replace(/\\D/g, '').slice(0, 6))}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-mfa-error' : undefined}\n autoFocus\n />\n {error && (\n <p id='login-mfa-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button\n type='submit'\n className='w-full'\n disabled={state === 'submitting' || mfaCode.length !== 6}\n >\n {c.mfaSubmitCta}\n </Button>\n <button\n type='button'\n onClick={resetTransientState}\n className='text-muted-foreground hover:text-foreground w-full text-sm transition-colors'\n disabled={state === 'submitting'}\n >\n ← Volver\n </button>\n </form>\n </div>\n )\n }\n\n // Magic-link success replaces the form\n if (state === 'magic-link-success') {\n return (\n <div className={cn('space-y-2 text-center', className)}>\n <h2 className='text-xl font-semibold'>{c.magicLinkSuccessTitle}</h2>\n <p className='text-muted-foreground'>{c.magicLinkSuccessMessage}</p>\n </div>\n )\n }\n\n return (\n <div className={cn('space-y-6', className)}>\n <Tabs value={method} onValueChange={handleTabChange}>\n <TabsList className='grid w-full grid-cols-2'>\n <TabsTrigger value='password'>{c.passwordTabLabel}</TabsTrigger>\n <TabsTrigger value='magic-link'>{c.magicLinkTabLabel}</TabsTrigger>\n </TabsList>\n\n <TabsContent value='password' className='pt-4'>\n <form onSubmit={(e) => void handlePasswordSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-email-pwd'>{c.emailLabel}</Label>\n <Input\n id='login-email-pwd'\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(ev) => setEmail(ev.target.value)}\n disabled={state === 'submitting'}\n />\n </div>\n <div className='space-y-2'>\n <div className='flex items-center justify-between'>\n <Label htmlFor='login-password'>{c.passwordLabel}</Label>\n <a\n href={resetPasswordUrl}\n className='text-muted-foreground hover:text-foreground text-xs transition-colors'\n >\n {c.forgotPasswordCta}\n </a>\n </div>\n <Input\n id='login-password'\n type='password'\n autoComplete='current-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(ev) => setPassword(ev.target.value)}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-pwd-error' : undefined}\n />\n {error && (\n <p id='login-pwd-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n {c.passwordSubmitCta}\n </Button>\n </form>\n </TabsContent>\n\n <TabsContent value='magic-link' className='pt-4'>\n <form onSubmit={(e) => void handleMagicLinkSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-email-magic'>{c.emailLabel}</Label>\n <Input\n id='login-email-magic'\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(ev) => setEmail(ev.target.value)}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-magic-error' : undefined}\n />\n {error && (\n <p id='login-magic-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n {c.magicLinkSubmitCta}\n </Button>\n </form>\n </TabsContent>\n </Tabs>\n </div>\n )\n}\n","/**\n * Scheme + URL-trick allowlist for a server-returned redirect target\n * (`sessionExchangeUrl`, `redirectTo`, etc.). Shared by `AuthCallback`,\n * `AuthConfirm`, and `SetPassword` — see `CLAUDE.md` Regla A: a predicate\n * applied more than 3 times gets one home, not N inline copies that drift.\n *\n * IMPORTANT — this is NOT full open-redirect confinement: it does NOT\n * restrict absolute `http`/`https` URLs to a specific origin.\n * `isSafeRedirectUrl('https://evil.com')` returns `true`. What it DOES\n * reject:\n * - dangerous schemes (`javascript:`, `data:`, `vbscript:`, ...) — the\n * classic XSS-via-redirect vector\n * - protocol-relative URLs (`//evil.com`) — these start with `/` but\n * browsers resolve them as an absolute, CROSS-ORIGIN URL (the scheme is\n * inherited from the current page), so a naive \"starts with /\" check\n * would wrongly treat them as same-origin\n * - backslash-authority URLs (`/\\evil.com`, `\\\\evil.com`) — browsers\n * normalize `\\` to `/` for special schemes, so these resolve the same way\n * - the same tricks with an ASCII tab/LF/CR spliced between the slashes\n * (`/\\t/evil.com`) — the WHATWG URL parser strips ALL tab/LF/CR from the\n * input BEFORE parsing (anywhere in the string, not just leading/trailing),\n * so `/\\t/evil.com` is indistinguishable from `//evil.com` to the browser\n * even though a naive regex over the raw string wouldn't see two adjacent\n * slashes\n *\n * Full origin-pinning (rejecting any absolute URL whose origin isn't the\n * actual expected one) is a SEPARATE, not-yet-implemented layer. It can't\n * simply pin to `REBLU_API_BASE_URL`: that's a server-only env var\n * unavailable in these `'use client'` components, and per REB-218's\n * subdomain redirect architecture it would be the WRONG origin anyway\n * (production session-exchange lives at `nexus.<tenantDomain>`, not the\n * SITE's own `REBLU_API_BASE_URL`). It would need a dedicated prop\n * conveying the actual expected origin per deploy/routing mode.\n */\nexport function isSafeRedirectUrl(url: string): boolean {\n if (!url) return false\n\n // Match the WHATWG URL parser's own first step: strip ALL ASCII\n // tab/LF/CR from the input, anywhere in the string — not just\n // leading/trailing — before evaluating what the browser will actually\n // resolve. Without this, '/\\t/evil.com' looks like a single-'/' relative\n // path to a naive check but the browser sees '//evil.com'.\n const clean = url.replace(/[\\t\\n\\r]/g, '')\n if (!clean) return false\n\n // A relative path must start with a SINGLE '/' — '//' or '/\\' resolve as\n // an absolute, cross-origin URL in the browser despite \"starting with /\".\n if (/^[/\\\\]{2}/.test(clean)) return false\n\n const scheme = clean.split(':')[0].toLowerCase()\n return ['http', 'https'].includes(scheme) || clean.startsWith('/')\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface AuthCallbackCopy {\n loadingTitle: string\n loadingMessage: string\n successMessage: string\n expiredTitle: string\n expiredMessage: string\n expiredCta: string\n networkErrorTitle: string\n networkErrorMessage: string\n networkErrorRetryCta: string\n networkErrorBackCta: string\n malformedTitle: string\n malformedMessage: string\n malformedCta: string\n}\n\nexport interface AuthCallbackProps {\n exchangeUrl: string\n loginUrl: string\n copy?: Partial<AuthCallbackCopy>\n onSuccess?: (redirectTo: string) => void\n onError?: (state: 'expired' | 'network' | 'malformed', error?: Error) => void\n className?: string\n}\n\ntype State = 'mounting' | 'parsing' | 'exchanging' | 'success' | 'expired' | 'network' | 'malformed'\n\nconst DEFAULT_COPY: AuthCallbackCopy = {\n loadingTitle: 'Autenticando...',\n loadingMessage: 'Estamos verificando tu identidad.',\n successMessage: 'Iniciando sesión...',\n expiredTitle: 'Enlace caducado',\n expiredMessage: 'El enlace ha expirado o ya fue utilizado. Solicita uno nuevo.',\n expiredCta: 'Volver al login',\n networkErrorTitle: 'Error de conexión',\n networkErrorMessage: 'No pudimos completar el inicio de sesión. Inténtalo de nuevo.',\n networkErrorRetryCta: 'Reintentar',\n networkErrorBackCta: 'Volver al login',\n malformedTitle: 'Enlace inválido',\n malformedMessage: 'Enlace inválido. Solicita uno nuevo.',\n malformedCta: 'Volver al login',\n}\n\nfunction parseHash(hash: string): { access_token: string; refresh_token: string } | null {\n const raw = hash.startsWith('#') ? hash.slice(1) : hash\n if (!raw) return null\n const params = new URLSearchParams(raw)\n const access_token = params.get('access_token') ?? ''\n const refresh_token = params.get('refresh_token') ?? ''\n const type = params.get('type') ?? ''\n if (!access_token || !refresh_token || type !== 'magiclink') return null\n return { access_token, refresh_token }\n}\n\n/**\n * On failure Supabase redirects to the callback with the reason in the hash\n * fragment (e.g. `#error=access_denied&error_code=otp_expired`), never in the\n * query — the server cannot see it (REB-177). Detect it client-side and tell an\n * expired/used link (recoverable → 'expired') apart from any other failure\n * (→ 'malformed').\n */\nfunction parseHashError(hash: string): 'expired' | 'malformed' | null {\n const raw = hash.startsWith('#') ? hash.slice(1) : hash\n if (!raw) return null\n const params = new URLSearchParams(raw)\n const error = params.get('error')\n const errorCode = params.get('error_code')\n if (!error && !errorCode) return null\n // Expired or already-used magic links come back as access_denied / otp_expired.\n return errorCode === 'otp_expired' || error === 'access_denied' ? 'expired' : 'malformed'\n}\n\nexport function AuthCallback({\n exchangeUrl,\n loginUrl,\n copy,\n onSuccess,\n onError,\n className,\n}: AuthCallbackProps) {\n const [state, setState] = React.useState<State>('mounting')\n const [tokens, setTokens] = React.useState<{\n access_token: string\n refresh_token: string\n } | null>(null)\n const retryRef = React.useRef<HTMLButtonElement>(null)\n const linkRef = React.useRef<HTMLAnchorElement>(null)\n const c = { ...DEFAULT_COPY, ...copy }\n\n const exchange = React.useCallback(\n async (t: { access_token: string; refresh_token: string }) => {\n setState('exchanging')\n try {\n const res = await fetch(exchangeUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(t),\n })\n\n if (res.ok) {\n const raw = (await res.json()) as unknown\n const redirectTo =\n raw !== null &&\n typeof raw === 'object' &&\n 'redirectTo' in raw &&\n typeof (raw as { redirectTo: unknown }).redirectTo === 'string'\n ? (raw as { redirectTo: string }).redirectTo\n : null\n\n if (!redirectTo) {\n setState('network')\n onError?.('network', undefined)\n return\n }\n\n // Guard against dangerous schemes (javascript:, data:, etc.) AND\n // protocol-relative/backslash-authority URLs (//evil.com, /\\evil.com)\n // — see safe-redirect.ts.\n if (!isSafeRedirectUrl(redirectTo)) {\n setState('network')\n onError?.('network', undefined)\n return\n }\n\n history.replaceState({}, '', window.location.pathname)\n window.location.replace(redirectTo)\n setState('success')\n onSuccess?.(redirectTo)\n return\n }\n\n if (res.status === 401) {\n setState('expired')\n onError?.('expired')\n return\n }\n\n setState('network')\n onError?.('network', undefined)\n } catch (err) {\n setState('network')\n onError?.('network', err instanceof Error ? err : undefined)\n }\n },\n [exchangeUrl, onError, onSuccess],\n )\n\n React.useEffect(() => {\n setState('parsing')\n // A failure reported in the hash (expired/used/invalid link) is not a token\n // to exchange — surface it directly without hitting the network (REB-177).\n const hashError = parseHashError(window.location.hash)\n if (hashError) {\n setState(hashError)\n onError?.(hashError)\n return\n }\n const parsed = parseHash(window.location.hash)\n if (!parsed) {\n setState('malformed')\n onError?.('malformed')\n return\n }\n setTokens(parsed)\n void exchange(parsed)\n // `exchange`/`onError` are intentionally excluded: this effect must run\n // EXACTLY ONCE on mount to parse `window.location.hash` — re-running it\n // on every `exchange` identity change (which itself changes whenever\n // `onSuccess`/`onError` props change identity) would re-parse an\n // already-cleared hash and misfire.\n // eslint-disable-next-line react-hooks/exhaustive-deps\n }, [])\n\n React.useEffect(() => {\n if (state === 'network') retryRef.current?.focus()\n if (state === 'expired' || state === 'malformed') linkRef.current?.focus()\n }, [state])\n\n const isLoading = state === 'mounting' || state === 'parsing' || state === 'exchanging'\n\n return (\n <main className={cn('flex min-h-screen items-center justify-center', className)}>\n <div aria-live='polite' className='w-full max-w-md space-y-4 p-6 text-center'>\n {isLoading && (\n <section>\n <h2 className='text-xl font-semibold'>{c.loadingTitle}</h2>\n <p className='text-muted-foreground mt-2'>{c.loadingMessage}</p>\n </section>\n )}\n\n {state === 'success' && (\n <section>\n <p>{c.successMessage}</p>\n </section>\n )}\n\n {state === 'expired' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.expiredTitle}</h2>\n <p className='text-muted-foreground'>{c.expiredMessage}</p>\n <Button asChild variant='outline'>\n <a href={loginUrl} ref={linkRef}>\n {c.expiredCta}\n </a>\n </Button>\n </section>\n )}\n\n {state === 'network' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.networkErrorTitle}</h2>\n <p className='text-muted-foreground'>{c.networkErrorMessage}</p>\n <div className='flex flex-col gap-2'>\n <Button type='button' ref={retryRef} onClick={() => tokens && void exchange(tokens)}>\n {c.networkErrorRetryCta}\n </Button>\n <Button asChild variant='outline'>\n <a href={loginUrl}>{c.networkErrorBackCta}</a>\n </Button>\n </div>\n </section>\n )}\n\n {state === 'malformed' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.malformedTitle}</h2>\n <p className='text-muted-foreground'>{c.malformedMessage}</p>\n <Button asChild variant='outline'>\n <a href={loginUrl} ref={linkRef}>\n {c.malformedCta}\n </a>\n </Button>\n </section>\n )}\n </div>\n </main>\n )\n}\n","/**\n * Maps the raw `?error=` query param that Supabase appends when a magic link is\n * already consumed or expired to a user-facing Spanish message.\n *\n * Supabase redirects to /login?error=... with a raw English message (e.g.\n * \"Email link is invalid or has expired\"). Showing that verbatim is confusing,\n * so we translate the common cases and signal whether the \"Solicitar otro\n * enlace\" CTA should be offered.\n *\n * Matching is case-insensitive and whitespace-tolerant so it survives small\n * variations in how the error text arrives.\n *\n * Relocated from apps/demo-site/src/lib/utils/login-errors.ts (REB-510 slice\n * 2a) as a copy-injectable helper — Spanish defaults are unchanged, and a SITE\n * MAY override individual messages via `Partial<LoginErrorCopy>`.\n */\n\nexport interface LoginErrorInfo {\n /** Message shown in the error card. */\n message: string\n /** Whether to show the \"Solicitar otro enlace\" CTA. */\n showRequestLink: boolean\n}\n\nexport interface LoginErrorCopy {\n expiredMessage: string\n missingTokenMessage: string\n genericMessage: string\n}\n\nconst DEFAULT_COPY: LoginErrorCopy = {\n expiredMessage: 'El enlace ha expirado o ya fue utilizado.',\n missingTokenMessage: 'El enlace no es válido. Solicita uno nuevo.',\n genericMessage: 'No se pudo completar el inicio de sesión. Intenta de nuevo.',\n}\n\nexport function mapLoginError(\n error: string | null | undefined,\n copy?: Partial<LoginErrorCopy>,\n): LoginErrorInfo | null {\n if (!error) return null\n\n const normalized = error.trim().toLowerCase()\n if (normalized === '') return null\n\n const c = { ...DEFAULT_COPY, ...copy }\n\n if (\n normalized.includes('email link is invalid or has expired') ||\n normalized.includes('token has expired or is invalid')\n ) {\n return { message: c.expiredMessage, showRequestLink: true }\n }\n\n if (normalized.includes('missing_token')) {\n return { message: c.missingTokenMessage, showRequestLink: true }\n }\n\n return { message: c.genericMessage, showRequestLink: true }\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useTheme } from 'next-themes'\nimport { cn } from '@reblu/site-ui'\n\nexport interface AuthLogoCopy {\n /**\n * Overrides the rendered `<img>` alt text. Pass `''` explicitly to mark the\n * logo as decorative (e.g. when an adjacent heading already announces\n * `siteName`, so screen readers shouldn't read it twice) — `undefined`\n * (the key simply omitted from `copy`) is what falls back to `siteName`.\n */\n altText?: string\n /** Shown when neither a logo URL nor `siteName` is available. */\n fallbackLabel: string\n}\n\nexport interface AuthLogoProps {\n logoLightExpandedUrl: string | null\n logoDarkExpandedUrl: string | null\n logoLightSmallUrl: string | null\n logoDarkSmallUrl: string | null\n siteName: string\n /** @default 'expanded' */\n variant?: 'expanded' | 'compact'\n className?: string\n copy?: Partial<AuthLogoCopy>\n /**\n * Heading level for the `siteName`/fallback-label text rendered when no logo\n * resolves. AuthLogo owns the auth page's heading, so this defaults to the\n * top-level `1`; pass a deeper level only if the page already has an `<h1>`\n * elsewhere that AuthLogo must sit beneath.\n * @default 1\n */\n headingLevel?: 1 | 2 | 3 | 4 | 5 | 6\n /**\n * When `true`, renders `null` instead of the `siteName`/fallback-label\n * heading whenever no logo URL resolves for the active variant+theme, rather\n * than showing the text. Use this ONLY when the consumer intentionally\n * renders `siteName` elsewhere itself — by default AuthLogo IS the heading\n * (\"logo XOR name\"), so the consumer should NOT add its own\n * `<h1>{siteName}</h1>`.\n * @default false\n */\n hideTextFallback?: boolean\n}\n\nconst DEFAULT_COPY: Required<Pick<AuthLogoCopy, 'fallbackLabel'>> = {\n fallbackLabel: 'Inicio de sesión',\n}\n\nconst VARIANT_CLASS: Record<'expanded' | 'compact', string> = {\n expanded: 'h-8 w-auto',\n compact: 'h-8 w-8',\n}\n\n// Intrinsic `width`/`height` attributes so the browser reserves layout space\n// via its built-in aspect-ratio-from-attributes heuristic before the real\n// image loads (avoids vertical CLS at minimum; horizontal width still\n// depends on the tenant's actual logo aspect ratio, which `/api/site/config`\n// doesn't expose — an arbitrary-but-reasonable box, not a promise of zero\n// shift). `VARIANT_CLASS`'s `h-8` always wins for height regardless.\nconst VARIANT_INTRINSIC_SIZE: Record<'expanded' | 'compact', { width: number; height: number }> = {\n expanded: { width: 160, height: 32 },\n compact: { width: 32, height: 32 },\n}\n\n/**\n * Dynamic tenant logo for auth pages (REB-510 R1). Resolves expanded/compact ×\n * light/dark from the 4 `/api/site/config` logo URLs, switching light/dark\n * CLIENT-SIDE via `next-themes`. Falls back to `siteName` text, then a generic\n * `copy.fallbackLabel`, whenever the resolved URL for the active\n * variant+theme combination is `null` — it never silently swaps in the OTHER\n * theme's logo.\n *\n * Hydration-safe: `next-themes`' `resolvedTheme` is `undefined` until it\n * mounts client-side, so pre-mount `isDark` is always `false` — the same\n * light-first markup the server rendered, avoiding a hydration mismatch.\n *\n * Renders a plain `<img>`, not `next/image`: this is a distributable SDK\n * consumed by external SITE repos, so it cannot assume the consuming app's\n * `next.config` `images.remotePatterns` allowlists the tenant's logo CDN.\n */\nexport function AuthLogo(props: AuthLogoProps) {\n const {\n logoLightExpandedUrl,\n logoDarkExpandedUrl,\n logoLightSmallUrl,\n logoDarkSmallUrl,\n siteName,\n variant = 'expanded',\n className,\n copy,\n headingLevel = 1,\n hideTextFallback = false,\n } = props\n const fallbackLabel = copy?.fallbackLabel ?? DEFAULT_COPY.fallbackLabel\n const { resolvedTheme } = useTheme()\n const isDark = resolvedTheme === 'dark'\n\n const lightUrl = variant === 'compact' ? logoLightSmallUrl : logoLightExpandedUrl\n const darkUrl = variant === 'compact' ? logoDarkSmallUrl : logoDarkExpandedUrl\n const logoUrl = isDark ? darkUrl : lightUrl\n\n // Tracks a broken/stale logo URL (404, CDN outage, etc.) — degrades to the\n // text fallback instead of a broken-image glyph. Reset whenever `logoUrl`\n // itself changes (e.g. a theme toggle resolves a DIFFERENT URL) so a past\n // failure doesn't permanently block a future, valid attempt.\n const [imgError, setImgError] = React.useState(false)\n React.useEffect(() => {\n setImgError(false)\n }, [logoUrl])\n\n const fallbackText = siteName || fallbackLabel\n // `copy.altText` — a VALUE-defined key (including `''`) wins outright,\n // that's how a consumer marks the logo decorative. A value-undefined key\n // (whether omitted from `copy` entirely, or present with an explicit\n // `undefined` value) falls back to siteName/fallbackLabel — checking value\n // definedness, not `'altText' in copy` key presence, is what makes\n // `copy={{ altText: undefined }}` behave the same as omitting the key.\n const altText = copy?.altText !== undefined ? copy.altText : siteName || fallbackLabel\n\n // AuthLogo is \"logo XOR name\": exactly ONE of the brand mark (logo image) or\n // the `siteName` text is shown, never both — and by default AuthLogo IS the\n // auth page's heading, so the consuming page must NOT add its own separate\n // `<h1>{siteName}</h1>` (which is what double-rendered the name before).\n const Heading = `h${headingLevel}` as const\n\n if (logoUrl && !imgError) {\n const { width, height } = VARIANT_INTRINSIC_SIZE[variant]\n // Decorative escape hatch: when the consumer hides the text fallback OR\n // marks the logo decorative (`alt=''`), it owns the page heading itself, so\n // render a bare image — wrapping a nameless image in a heading would emit\n // an empty, accessible-name-less heading.\n const bare = hideTextFallback || altText === ''\n const image = (\n <img\n src={logoUrl}\n alt={altText}\n width={width}\n height={height}\n className={cn(VARIANT_CLASS[variant], 'max-w-full', bare && className)}\n onError={() => setImgError(true)}\n />\n )\n if (bare) return image\n // Default: wrap the logo in the heading so the auth page ALWAYS has a\n // heading — even when only the brand image is visible — whose accessible\n // name is the logo's `alt` (= `siteName`). No visible, duplicated name text.\n return <Heading className={cn('inline-flex items-center max-w-full', className)}>{image}</Heading>\n }\n\n if (hideTextFallback) return null\n\n // No logo resolved → render `siteName` (or the generic fallback label) as the\n // page's heading text.\n return (\n <Heading className={cn('text-2xl font-bold tracking-tight text-foreground', className)}>\n {fallbackText}\n </Heading>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\nexport interface ResetPasswordRequestCopy {\n emailLabel: string\n emailPlaceholder: string\n submitCta: string\n submittingCta: string\n successTitle: string\n successMessage: string\n backToLoginCta: string\n invalidEmailError: string\n networkError: string\n}\n\nexport interface ResetPasswordRequestProps {\n requestUrl: string\n loginUrl: string\n copy?: Partial<ResetPasswordRequestCopy>\n className?: string\n onSubmitted?: (email: string) => void\n}\n\nconst DEFAULT_COPY: ResetPasswordRequestCopy = {\n emailLabel: 'Correo electrónico',\n emailPlaceholder: 'tu@email.com',\n submitCta: 'Enviar enlace de recuperación',\n submittingCta: 'Enviando...',\n successTitle: 'Revisa tu email',\n successMessage:\n 'Si el email existe en nuestra plataforma, recibirás un enlace para restablecer tu contraseña en los próximos minutos.',\n backToLoginCta: '← Volver al inicio de sesión',\n invalidEmailError: 'Introduce un correo electrónico válido.',\n networkError: 'Error de conexión. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Step 1 of the password-reset flow — anti-enumeration: always shows the same\n * generic success message on a 2xx response, regardless of whether the email\n * exists (the backend never leaks that).\n */\nexport function ResetPasswordRequest(props: ResetPasswordRequestProps) {\n const { requestUrl, loginUrl, copy, className, onSubmitted } = props\n const c = { ...DEFAULT_COPY, ...copy }\n\n const [email, setEmail] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [submitted, setSubmitted] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!EMAIL_REGEX.test(trimmed)) {\n setError(c.invalidEmailError)\n return\n }\n\n setLoading(true)\n // `succeeded` isolates the consumer's `onSubmitted` callback from this\n // try/catch: if we called it INSIDE the try and it threw, that throw\n // would land in the network `catch` below and misreport a successful\n // request as a connection error.\n let succeeded = false\n try {\n const res = await fetch(requestUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed }),\n })\n\n if (!res.ok) {\n const json = (await res.json().catch(() => ({}))) as { error?: string }\n setError(json.error ?? c.networkError)\n setLoading(false)\n return\n }\n\n succeeded = true\n setSubmitted(true)\n setLoading(false)\n } catch {\n setError(c.networkError)\n setLoading(false)\n return\n }\n\n if (succeeded) {\n try {\n onSubmitted?.(trimmed)\n } catch (err) {\n console.error('[ResetPasswordRequest] onSubmitted callback threw:', err)\n }\n }\n }\n\n if (submitted) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.backToLoginCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='reset-request-email'>{c.emailLabel}</Label>\n <Input\n id='reset-request-email'\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(e) => setEmail(e.target.value)}\n disabled={loading}\n aria-describedby={error ? 'reset-request-error' : undefined}\n autoFocus\n />\n {error && (\n <p id='reset-request-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={loading}>\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n <div className='text-center'>\n <a\n href={loginUrl}\n className='text-muted-foreground hover:text-foreground text-sm transition-colors'\n >\n {c.backToLoginCta}\n </a>\n </div>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\n/**\n * Appends `key=value` to `url` without producing a malformed double `?` when\n * `url` (consumer-supplied `loginUrl`, e.g. `/login?tenant=acme`) already\n * carries a query string. Deliberately NOT `new URL(url)` — `loginUrl` is\n * typically a relative path and the WHATWG `URL` constructor requires a base\n * for those.\n */\nfunction withQueryParam(url: string, key: string, value: string): string {\n const separator = url.includes('?') ? '&' : '?'\n return `${url}${separator}${key}=${encodeURIComponent(value)}`\n}\n\nexport interface ResetPasswordConfirmCopy {\n passwordLabel: string\n passwordPlaceholder: string\n confirmPasswordLabel: string\n confirmPasswordPlaceholder: string\n mfaCodeLabel: string\n mfaCodePlaceholder: string\n mfaHelpMessage: string\n submitCta: string\n submittingCta: string\n passwordTooShortError: string\n passwordMismatchError: string\n mfaInvalidCodeError: string\n genericError: string\n missingTokensTitle: string\n missingTokensMessage: string\n requestNewLinkCta: string\n}\n\nexport interface ResetPasswordConfirmProps {\n confirmUrl: string\n loginUrl: string\n resetRequestUrl: string\n copy?: Partial<ResetPasswordConfirmCopy>\n className?: string\n onSuccess?: () => void\n}\n\nconst DEFAULT_COPY: ResetPasswordConfirmCopy = {\n passwordLabel: 'Nueva contraseña',\n passwordPlaceholder: 'Mínimo 8 caracteres',\n confirmPasswordLabel: 'Confirmar contraseña',\n confirmPasswordPlaceholder: 'Repite la contraseña',\n mfaCodeLabel: 'Código de verificación (2FA)',\n mfaCodePlaceholder: '6 dígitos',\n mfaHelpMessage:\n 'Tu cuenta tiene verificación en dos pasos. Introduce el código de tu app de autenticación para completar el cambio.',\n submitCta: 'Establecer nueva contraseña',\n submittingCta: 'Actualizando contraseña...',\n passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n passwordMismatchError: 'Las contraseñas no coinciden',\n mfaInvalidCodeError: 'Introduce el código de 6 dígitos de tu app de autenticación',\n genericError: 'Error al restablecer la contraseña',\n missingTokensTitle: 'Enlace inválido',\n missingTokensMessage: 'El enlace ha expirado o no es válido. Solicita uno nuevo.',\n requestNewLinkCta: 'Solicitar nuevo enlace',\n}\n\n/**\n * Step 2 of the password-reset flow. Reads `access_token`/`refresh_token`\n * straight off `useSearchParams` — no `window.location.search` + effect-timing\n * workaround needed here because, unlike a page-level default export, this is\n * a component the SITE mounts inside its own `<Suspense>` boundary.\n *\n * REB-378: when the account has a verified MFA factor, the recovery session\n * (AAL1) cannot change the password on its own. The backend responds\n * `{ data: { mfaRequired: true } }` and this reveals a 6-digit TOTP field so\n * the user can resubmit with the code (the recovery tokens stay valid).\n */\nexport function ResetPasswordConfirm(props: ResetPasswordConfirmProps) {\n const { confirmUrl, loginUrl, resetRequestUrl, copy, className, onSuccess } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const router = useRouter()\n const searchParams = useSearchParams()\n\n const accessToken = searchParams.get('access_token')\n const refreshToken = searchParams.get('refresh_token')\n const hasTokens = Boolean(accessToken && refreshToken)\n\n const [password, setPassword] = React.useState('')\n const [confirmPassword, setConfirmPassword] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n const [mfaRequired, setMfaRequired] = React.useState(false)\n const [mfaCode, setMfaCode] = React.useState('')\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n if (!hasTokens) return\n\n if (password.length < 8) {\n setError(c.passwordTooShortError)\n return\n }\n if (password !== confirmPassword) {\n setError(c.passwordMismatchError)\n return\n }\n if (mfaRequired && !/^\\d{6}$/.test(mfaCode)) {\n setError(c.mfaInvalidCodeError)\n return\n }\n\n setLoading(true)\n // `succeeded` isolates the consumer's `onSuccess` callback (and the\n // navigation) from this try/catch: calling either INSIDE the try means a\n // throwing callback lands in the network `catch` below and misreports an\n // already-successful password change as a failure — the user retries\n // with recovery tokens the backend has already consumed.\n let succeeded = false\n try {\n const res = await fetch(confirmUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n access_token: accessToken,\n refresh_token: refreshToken,\n new_password: password,\n ...(mfaRequired ? { mfa_code: mfaCode } : {}),\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as {\n error?: string\n data?: { success?: boolean; mfaRequired?: boolean }\n }\n\n if (!res.ok) {\n setError(json.error ?? c.genericError)\n setLoading(false)\n return\n }\n\n if (json.data?.mfaRequired) {\n setMfaRequired(true)\n setLoading(false)\n return\n }\n\n succeeded = true\n setLoading(false)\n } catch {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n if (succeeded) {\n // Navigate FIRST, consumer callback SECOND (isolated in its own\n // try/catch) — same reasoning as set-password.tsx: a throwing\n // `onSuccess` can no longer block the redirect or escape as an\n // unhandled rejection out of this fire-and-forget async handler.\n router.replace(withQueryParam(loginUrl, 'reset', 'success'))\n try {\n onSuccess?.()\n } catch (err) {\n console.error('[ResetPasswordConfirm] onSuccess callback threw:', err)\n }\n }\n }\n\n if (!hasTokens) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.missingTokensTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.missingTokensMessage}</p>\n <a href={resetRequestUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.requestNewLinkCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-password'>{c.passwordLabel}</Label>\n <Input\n id='reset-confirm-password'\n type='password'\n autoComplete='new-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(e) => setPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n autoFocus\n />\n </div>\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-password-2'>{c.confirmPasswordLabel}</Label>\n <Input\n id='reset-confirm-password-2'\n type='password'\n autoComplete='new-password'\n placeholder={c.confirmPasswordPlaceholder}\n value={confirmPassword}\n onChange={(e) => setConfirmPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n />\n </div>\n {mfaRequired && (\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-mfa'>{c.mfaCodeLabel}</Label>\n <Input\n id='reset-confirm-mfa'\n type='text'\n inputMode='numeric'\n autoComplete='one-time-code'\n placeholder={c.mfaCodePlaceholder}\n value={mfaCode}\n onChange={(e) => setMfaCode(e.target.value.replace(/\\D/g, '').slice(0, 6))}\n disabled={loading}\n maxLength={6}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n autoFocus\n />\n <p className='text-muted-foreground text-xs'>{c.mfaHelpMessage}</p>\n </div>\n )}\n {error && (\n <p id='reset-confirm-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n <Button\n type='submit'\n className='w-full'\n disabled={\n loading || !password || !confirmPassword || (mfaRequired && mfaCode.length !== 6)\n }\n >\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface SetPasswordCopy {\n passwordLabel: string\n passwordPlaceholder: string\n confirmPasswordLabel: string\n confirmPasswordPlaceholder: string\n submitCta: string\n submittingCta: string\n passwordTooShortError: string\n passwordMismatchError: string\n genericError: string\n missingTokenTitle: string\n missingTokenMessage: string\n backToLoginCta: string\n}\n\nexport interface SetPasswordProps {\n submitUrl: string\n loginUrl: string\n copy?: Partial<SetPasswordCopy>\n className?: string\n onSuccess?: (sessionExchangeUrl: string) => void\n}\n\nconst DEFAULT_COPY: SetPasswordCopy = {\n passwordLabel: 'Contraseña',\n passwordPlaceholder: 'Mínimo 8 caracteres',\n confirmPasswordLabel: 'Confirmar contraseña',\n confirmPasswordPlaceholder: 'Repite la contraseña',\n submitCta: 'Activar cuenta',\n submittingCta: 'Activando cuenta...',\n passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n passwordMismatchError: 'Las contraseñas no coinciden',\n genericError: 'Error al establecer la contraseña',\n missingTokenTitle: 'Enlace inválido',\n missingTokenMessage: 'El enlace de invitación ha expirado o no es válido.',\n backToLoginCta: '← Volver al inicio de sesión',\n}\n\n/**\n * Invite flow — for a user setting their initial password. Reads\n * `session_exchange_token` off `useSearchParams`; on success, redirects via\n * `window.location.assign` (NOT the Next router) because the returned\n * `sessionExchangeUrl` points at base-api's own domain to set cookies, not a\n * same-origin SITE route.\n */\nexport function SetPassword(props: SetPasswordProps) {\n const { submitUrl, loginUrl, copy, className, onSuccess } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const searchParams = useSearchParams()\n const sessionExchangeToken = searchParams.get('session_exchange_token')\n\n const [password, setPassword] = React.useState('')\n const [confirmPassword, setConfirmPassword] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n if (!sessionExchangeToken) return\n\n if (password.length < 8) {\n setError(c.passwordTooShortError)\n return\n }\n if (password !== confirmPassword) {\n setError(c.passwordMismatchError)\n return\n }\n\n setLoading(true)\n // `sessionExchangeUrl` isolates the consumer's `onSuccess` callback (and\n // the actual navigation) from this try/catch: calling either INSIDE the\n // try means a throwing callback lands in the network `catch` below and\n // misreports an already-successful password-set as a connection error —\n // stranding an activated user on a form that tells them it failed.\n let sessionExchangeUrl: string | null = null\n try {\n const res = await fetch(submitUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n session_exchange_token: sessionExchangeToken,\n new_password: password,\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as {\n data?: { sessionExchangeUrl?: string }\n error?: string\n }\n\n if (!res.ok || !json.data?.sessionExchangeUrl) {\n setError(json.error ?? c.genericError)\n setLoading(false)\n return\n }\n\n if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n sessionExchangeUrl = json.data.sessionExchangeUrl\n } catch {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n // Navigate FIRST, consumer callback SECOND (isolated in its own\n // try/catch): if `onSuccess` throws (ad blocker on an analytics call,\n // etc.) the navigation has already been triggered and is unaffected, and\n // the throw doesn't escape as an unhandled rejection out of this\n // fire-and-forget async handler — the user is never stranded on this\n // form by code that isn't even this component's own.\n window.location.assign(sessionExchangeUrl)\n try {\n onSuccess?.(sessionExchangeUrl)\n } catch (err) {\n console.error('[SetPassword] onSuccess callback threw:', err)\n }\n }\n\n if (!sessionExchangeToken) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.missingTokenTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.missingTokenMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.backToLoginCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='set-password-password'>{c.passwordLabel}</Label>\n <Input\n id='set-password-password'\n type='password'\n autoComplete='new-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(e) => setPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'set-password-error' : undefined}\n // Single-purpose activation page (this IS the whole page's task,\n // there's no earlier content competing for attention) — same\n // pattern as reset-password-confirm.tsx/reset-password-request.tsx.\n autoFocus\n />\n </div>\n <div className='space-y-1.5'>\n <Label htmlFor='set-password-confirm'>{c.confirmPasswordLabel}</Label>\n <Input\n id='set-password-confirm'\n type='password'\n autoComplete='new-password'\n placeholder={c.confirmPasswordPlaceholder}\n value={confirmPassword}\n onChange={(e) => setConfirmPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'set-password-error' : undefined}\n />\n </div>\n {error && (\n <p id='set-password-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n <Button type='submit' className='w-full' disabled={loading || !password || !confirmPassword}>\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface AuthConfirmCopy {\n loadingMessage: string\n successTitle: string\n successMessage: string\n successCta: string\n errorTitle: string\n errorMessage: string\n errorCta: string\n}\n\nexport interface AuthConfirmProps {\n confirmUrl: string\n loginUrl: string\n copy?: Partial<AuthConfirmCopy>\n className?: string\n}\n\nconst DEFAULT_COPY: AuthConfirmCopy = {\n loadingMessage: 'Confirmando tu email...',\n successTitle: 'Email confirmado',\n successMessage: 'Tu dirección de email ha sido verificada correctamente.',\n successCta: 'Iniciar sesión',\n errorTitle: 'Error al confirmar',\n errorMessage: 'El enlace de confirmación no es válido o ha expirado.',\n errorCta: 'Volver al inicio de sesión',\n}\n\ntype Status = 'loading' | 'success' | 'error'\n\n/**\n * Dual-mode email confirmation (signup / email-change):\n *\n * 1. `?success=true` — base-api already ran `verifyOtp` server-side and\n * redirected here. Shows the confirmed message with no API call.\n * 2. `?token_hash=&type=` — client-initiated verify: POSTs to `confirmUrl`\n * and follows the returned `sessionExchangeUrl`, or shows success/error\n * copy based on the response.\n *\n * Neither param present → shown as an error state with a link back to login,\n * rather than a silent client-side redirect.\n */\nexport function AuthConfirm(props: AuthConfirmProps) {\n const { confirmUrl, loginUrl, copy, className } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const searchParams = useSearchParams()\n\n const success = searchParams.get('success')\n const tokenHash = searchParams.get('token_hash')\n const type = searchParams.get('type')\n\n const [status, setStatus] = React.useState<Status>(success === 'true' ? 'success' : 'loading')\n const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n\n React.useEffect(() => {\n if (success === 'true') {\n setStatus('success')\n return\n }\n\n if (tokenHash && type) {\n // `token_hash` is single-use server-side — verifying it twice makes\n // the SECOND call fail even though the first already succeeded. React\n // Strict Mode's dev-only mount→cleanup→mount double-invoke would\n // otherwise fire this fetch twice for the same token. Aborting the\n // in-flight request on cleanup stops the CLIENT from processing that\n // first response and swallows its `AbortError` below instead of\n // surfacing a false \"confirmation failed\" — but `abort()` cannot\n // retroactively un-send a request that already reached base-api\n // before cleanup ran, so this reduces rather than deterministically\n // eliminates the double-POST race (in practice React's dev\n // double-invoke runs both phases synchronously in the same commit, so\n // the abort typically wins, but that is not a spec guarantee). A\n // fully deterministic fix needs server-side idempotency on\n // `verify-otp`, which is out of this package's control. The same\n // abort also guards a genuine unmount mid-request.\n const controller = new AbortController()\n setStatus('loading')\n fetch(confirmUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ token_hash: tokenHash, type }),\n signal: controller.signal,\n })\n .then(async (res) => {\n const json = (await res.json().catch(() => ({}))) as {\n data?: { sessionExchangeUrl?: string; success?: boolean }\n error?: string\n }\n\n if (!res.ok) {\n setStatus('error')\n setErrorMessage(json.error ?? c.errorMessage)\n return\n }\n\n if (json.data?.sessionExchangeUrl) {\n if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n setStatus('error')\n setErrorMessage(c.errorMessage)\n return\n }\n window.location.assign(json.data.sessionExchangeUrl)\n return\n }\n\n setStatus('success')\n })\n .catch((err: unknown) => {\n if (err instanceof Error && err.name === 'AbortError') return\n setStatus('error')\n setErrorMessage(c.errorMessage)\n })\n\n return () => controller.abort()\n }\n\n // Neither success=true nor token_hash+type — nothing to confirm.\n setStatus('error')\n // `c.errorMessage` (derived from the `copy` prop) is intentionally\n // excluded: re-running this effect on every `copy` object identity\n // change would re-fire the fetch. The URL params are the only real\n // trigger for this effect.\n // eslint-disable-next-line react-hooks/exhaustive-deps\n }, [success, tokenHash, type, confirmUrl])\n\n if (status === 'loading') {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <p className='text-muted-foreground text-sm'>{c.loadingMessage}</p>\n </div>\n )\n }\n\n if (status === 'error') {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.errorTitle}</h2>\n <p className='text-muted-foreground text-sm'>{errorMessage ?? c.errorMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.errorCta}\n </a>\n </div>\n )\n }\n\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.successCta}\n </a>\n </div>\n )\n}\n"],"mappings":";;;AAEA,YAAY,WAAW;AACvB,SAAS,QAAQ,OAAO,UAAU;AAClC,SAAS,aAAa;AACtB,SAAS,MAAM,UAAU,aAAa,mBAAmB;;;AC6BlD,SAAS,kBAAkB,KAAsB;AACtD,MAAI,CAAC,IAAK,QAAO;AAOjB,QAAM,QAAQ,IAAI,QAAQ,aAAa,EAAE;AACzC,MAAI,CAAC,MAAO,QAAO;AAInB,MAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AAEpC,QAAM,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AAC/C,SAAO,CAAC,QAAQ,OAAO,EAAE,SAAS,MAAM,KAAK,MAAM,WAAW,GAAG;AACnE;;;ADkPQ,SACE,KADF;AAvOR,IAAM,eAA8B;AAAA,EAClC,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,EACvB,yBAAyB;AAAA,EACzB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,yBAAyB;AAAA,EACzB,qBAAqB;AACvB;AAEA,IAAM,cAAc;AAEpB,SAAS,aAAa,OAAwB;AAC5C,SAAO,YAAY,KAAK,KAAK;AAC/B;AA0BO,SAAS,UAAU,OAAuB;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,IAAI,EAAE,GAAG,cAAc,GAAG,KAAK;AAErC,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAoC,aAAa;AACnF,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAoB,MAAM;AAC1D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAwB,IAAI;AAG5D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAS,EAAE;AAC3C,QAAM,CAAC,UAAU,WAAW,IAAU,eAAS,EAAE;AAGjD,QAAM,CAAC,KAAK,MAAM,IAAU,eAA0B,IAAI;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,eAAS,EAAE;AAE/C,QAAM,sBAA4B,kBAAY,MAAM;AAClD,aAAS,MAAM;AACf,aAAS,IAAI;AACb,WAAO,IAAI;AACX,eAAW,EAAE;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,CAAC,SAAiB;AACxC,QAAI,SAAS,gBAAgB,SAAS,WAAY;AAClD,cAAU,IAAI;AACd,wBAAoB;AAAA,EACtB;AAEA,QAAM,wBAAwB,OAAO,MAAwC;AAC3E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,qBAAqB;AAAA,QAC3C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,IAAI,IAAI;AACV,iBAAS,oBAAoB;AAC7B,+BAAuB,OAAO;AAC9B;AAAA,MACF;AAEA,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAAuB,OAAO,MAAwC;AAC1E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,uBAAuB;AAClC,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,QACxC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,SAAS,CAAC;AAAA,MACnD,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM;AACzB,iBAAS,OAAO;AAChB,iBAAS,KAAK,SAAS,EAAE,uBAAuB;AAChD;AAAA,MACF;AAEA,4BAAsB,OAAO;AAE7B,UAAI,KAAK,KAAK,aAAa;AACzB,eAAO;AAAA,UACL,UAAU,KAAK,KAAK,YAAY;AAAA,UAChC,aAAa,KAAK,KAAK,eAAe;AAAA,UACtC,cAAc,KAAK,KAAK,gBAAgB;AAAA,QAC1C,CAAC;AACD,iBAAS,cAAc;AACvB;AAAA,MACF;AAEA,YAAM,cAAc,KAAK,KAAK;AAC9B,UAAI,CAAC,eAAe,CAAC,kBAAkB,WAAW,GAAG;AACnD,iBAAS,OAAO;AAChB,iBAAS,EAAE,YAAY;AACvB;AAAA,MACF;AACA,aAAO,SAAS,OAAO,WAAW;AAAA,IACpC,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,MAAwC;AACrE,MAAE,eAAe;AACjB,QAAI,CAAC,IAAK;AACV,aAAS,IAAI;AACb,aAAS,YAAY;AAErB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,cAAc;AAAA,QACpC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,UAAU,IAAI;AAAA,UACd,MAAM;AAAA,UACN,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UACE,CAAC,IAAI,MACL,CAAC,KAAK,MAAM,sBACZ,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAC/C;AAEA,iBAAS,cAAc;AACvB,iBAAS,KAAK,SAAS,EAAE,mBAAmB;AAC5C,mBAAW,EAAE;AACb;AAAA,MACF;AAEA,uBAAiB;AACjB,aAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AAAA,IACrD,QAAQ;AACN,eAAS,cAAc;AACvB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAGA,MAAI,UAAU,kBAAmB,OAAO,UAAU,cAAe;AAC/D,WACE,qBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,QAAG,WAAU,yBAAyB,YAAE,UAAS;AAAA,QAClD,oBAAC,OAAE,WAAU,iCAAiC,YAAE,YAAW;AAAA,SAC7D;AAAA,MACA,qBAAC,UAAK,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,GAAG,WAAU,aAAY,YAAU,MAC9E;AAAA,6BAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,cAAa;AAAA,UAChD;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAQ;AAAA,cACR,WAAW;AAAA,cACX,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,OAAO,WAAW,GAAG,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cAC3E,UAAU,UAAU;AAAA,cACpB,oBAAkB,QAAQ,oBAAoB;AAAA,cAC9C,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,WAEJ;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UAAU,UAAU,gBAAgB,QAAQ,WAAW;AAAA,YAEtD,YAAE;AAAA;AAAA,QACL;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS;AAAA,YACT,WAAU;AAAA,YACV,UAAU,UAAU;AAAA,YACrB;AAAA;AAAA,QAED;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,UAAU,sBAAsB;AAClC,WACE,qBAAC,SAAI,WAAW,GAAG,yBAAyB,SAAS,GACnD;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,uBAAsB;AAAA,MAC/D,oBAAC,OAAE,WAAU,yBAAyB,YAAE,yBAAwB;AAAA,OAClE;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC,+BAAC,QAAK,OAAO,QAAQ,eAAe,iBAClC;AAAA,yBAAC,YAAS,WAAU,2BAClB;AAAA,0BAAC,eAAY,OAAM,YAAY,YAAE,kBAAiB;AAAA,MAClD,oBAAC,eAAY,OAAM,cAAc,YAAE,mBAAkB;AAAA,OACvD;AAAA,IAEA,oBAAC,eAAY,OAAM,YAAW,WAAU,QACtC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,GAAG,WAAU,aAAY,YAAU,MACnF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,YAAW;AAAA,QAC/C;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA;AAAA,QACtB;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,6BAAC,SAAI,WAAU,qCACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,eAAc;AAAA,UACjD;AAAA,YAAC;AAAA;AAAA,cACC,MAAM;AAAA,cACN,WAAU;AAAA,cAET,YAAE;AAAA;AAAA,UACL;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,YAAY,GAAG,OAAO,KAAK;AAAA,YAC7C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,oBAAoB;AAAA;AAAA,QAChD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,mBACL;AAAA,OACF,GACF;AAAA,IAEA,oBAAC,eAAY,OAAM,cAAa,WAAU,QACxC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,GAAG,WAAU,aAAY,YAAU,MACpF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,qBAAqB,YAAE,YAAW;AAAA,QACjD;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,sBAAsB;AAAA;AAAA,QAClD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,qBAAoB,MAAK,SAAQ,WAAU,4BAC9C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,oBACL;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;;;AE9aA,YAAYA,YAAW;AACvB,SAAS,UAAAC,SAAQ,MAAAC,WAAU;AA4LjB,SACE,OAAAC,MADF,QAAAC,aAAA;AA9JV,IAAMC,gBAAiC;AAAA,EACrC,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,cAAc;AAChB;AAEA,SAAS,UAAU,MAAsE;AACvF,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AACnD,QAAM,gBAAgB,OAAO,IAAI,eAAe,KAAK;AACrD,QAAM,OAAO,OAAO,IAAI,MAAM,KAAK;AACnC,MAAI,CAAC,gBAAgB,CAAC,iBAAiB,SAAS,YAAa,QAAO;AACpE,SAAO,EAAE,cAAc,cAAc;AACvC;AASA,SAAS,eAAe,MAA8C;AACpE,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,YAAY,OAAO,IAAI,YAAY;AACzC,MAAI,CAAC,SAAS,CAAC,UAAW,QAAO;AAEjC,SAAO,cAAc,iBAAiB,UAAU,kBAAkB,YAAY;AAChF;AAEO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAsB;AACpB,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAgB,UAAU;AAC1D,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAGxB,IAAI;AACd,QAAM,WAAiB,cAA0B,IAAI;AACrD,QAAM,UAAgB,cAA0B,IAAI;AACpD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,QAAM,WAAiB;AAAA,IACrB,OAAO,MAAuD;AAC5D,eAAS,YAAY;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,aAAa;AAAA,UACnC,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,CAAC;AAAA,QACxB,CAAC;AAED,YAAI,IAAI,IAAI;AACV,gBAAM,MAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,aACJ,QAAQ,QACR,OAAO,QAAQ,YACf,gBAAgB,OAChB,OAAQ,IAAgC,eAAe,WAClD,IAA+B,aAChC;AAEN,cAAI,CAAC,YAAY;AACf,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAKA,cAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAEA,kBAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,QAAQ;AACrD,iBAAO,SAAS,QAAQ,UAAU;AAClC,mBAAS,SAAS;AAClB,sBAAY,UAAU;AACtB;AAAA,QACF;AAEA,YAAI,IAAI,WAAW,KAAK;AACtB,mBAAS,SAAS;AAClB,oBAAU,SAAS;AACnB;AAAA,QACF;AAEA,iBAAS,SAAS;AAClB,kBAAU,WAAW,MAAS;AAAA,MAChC,SAAS,KAAK;AACZ,iBAAS,SAAS;AAClB,kBAAU,WAAW,eAAe,QAAQ,MAAM,MAAS;AAAA,MAC7D;AAAA,IACF;AAAA,IACA,CAAC,aAAa,SAAS,SAAS;AAAA,EAClC;AAEA,EAAM,iBAAU,MAAM;AACpB,aAAS,SAAS;AAGlB,UAAM,YAAY,eAAe,OAAO,SAAS,IAAI;AACrD,QAAI,WAAW;AACb,eAAS,SAAS;AAClB,gBAAU,SAAS;AACnB;AAAA,IACF;AACA,UAAM,SAAS,UAAU,OAAO,SAAS,IAAI;AAC7C,QAAI,CAAC,QAAQ;AACX,eAAS,WAAW;AACpB,gBAAU,WAAW;AACrB;AAAA,IACF;AACA,cAAU,MAAM;AAChB,SAAK,SAAS,MAAM;AAAA,EAOtB,GAAG,CAAC,CAAC;AAEL,EAAM,iBAAU,MAAM;AACpB,QAAI,UAAU,UAAW,UAAS,SAAS,MAAM;AACjD,QAAI,UAAU,aAAa,UAAU,YAAa,SAAQ,SAAS,MAAM;AAAA,EAC3E,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,YAAY,UAAU,cAAc,UAAU,aAAa,UAAU;AAE3E,SACE,gBAAAF,KAAC,UAAK,WAAWG,IAAG,iDAAiD,SAAS,GAC5E,0BAAAF,MAAC,SAAI,aAAU,UAAS,WAAU,6CAC/B;AAAA,iBACC,gBAAAA,MAAC,aACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,8BAA8B,YAAE,gBAAe;AAAA,OAC9D;AAAA,IAGD,UAAU,aACT,gBAAAA,KAAC,aACC,0BAAAA,KAAC,OAAG,YAAE,gBAAe,GACvB;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACvD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,YACL,GACF;AAAA,OACF;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,qBAAoB;AAAA,MAC5D,gBAAAC,MAAC,SAAI,WAAU,uBACb;AAAA,wBAAAD,KAACI,SAAA,EAAO,MAAK,UAAS,KAAK,UAAU,SAAS,MAAM,UAAU,KAAK,SAAS,MAAM,GAC/E,YAAE,sBACL;AAAA,QACA,gBAAAJ,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAW,YAAE,qBAAoB,GAC5C;AAAA,SACF;AAAA,OACF;AAAA,IAGD,UAAU,eACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACxD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,kBAAiB;AAAA,MACzD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,cACL,GACF;AAAA,OACF;AAAA,KAEJ,GACF;AAEJ;;;ACtNA,IAAMK,gBAA+B;AAAA,EACnC,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AAEO,SAAS,cACd,OACA,MACuB;AACvB,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,eAAe,GAAI,QAAO;AAE9B,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,MACE,WAAW,SAAS,sCAAsC,KAC1D,WAAW,SAAS,iCAAiC,GACrD;AACA,WAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAAA,EAC5D;AAEA,MAAI,WAAW,SAAS,eAAe,GAAG;AACxC,WAAO,EAAE,SAAS,EAAE,qBAAqB,iBAAiB,KAAK;AAAA,EACjE;AAEA,SAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAC5D;;;ACzDA,YAAYC,YAAW;AACvB,SAAS,gBAAgB;AACzB,SAAS,MAAAC,WAAU;AAqIb,gBAAAC,YAAA;AAzFN,IAAMC,gBAA8D;AAAA,EAClE,eAAe;AACjB;AAEA,IAAM,gBAAwD;AAAA,EAC5D,UAAU;AAAA,EACV,SAAS;AACX;AAQA,IAAM,yBAA4F;AAAA,EAChG,UAAU,EAAE,OAAO,KAAK,QAAQ,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,IAAI,QAAQ,GAAG;AACnC;AAkBO,SAAS,SAAS,OAAsB;AAC7C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,mBAAmB;AAAA,EACrB,IAAI;AACJ,QAAM,gBAAgB,MAAM,iBAAiBA,cAAa;AAC1D,QAAM,EAAE,cAAc,IAAI,SAAS;AACnC,QAAM,SAAS,kBAAkB;AAEjC,QAAM,WAAW,YAAY,YAAY,oBAAoB;AAC7D,QAAM,UAAU,YAAY,YAAY,mBAAmB;AAC3D,QAAM,UAAU,SAAS,UAAU;AAMnC,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,KAAK;AACpD,EAAM,iBAAU,MAAM;AACpB,gBAAY,KAAK;AAAA,EACnB,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,eAAe,YAAY;AAOjC,QAAM,UAAU,MAAM,YAAY,SAAY,KAAK,UAAU,YAAY;AAMzE,QAAM,UAAU,IAAI,YAAY;AAEhC,MAAI,WAAW,CAAC,UAAU;AACxB,UAAM,EAAE,OAAO,OAAO,IAAI,uBAAuB,OAAO;AAKxD,UAAM,OAAO,oBAAoB,YAAY;AAC7C,UAAM,QACJ,gBAAAD;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,WAAWD,IAAG,cAAc,OAAO,GAAG,cAAc,QAAQ,SAAS;AAAA,QACrE,SAAS,MAAM,YAAY,IAAI;AAAA;AAAA,IACjC;AAEF,QAAI,KAAM,QAAO;AAIjB,WAAO,gBAAAC,KAAC,WAAQ,WAAWD,IAAG,uCAAuC,SAAS,GAAI,iBAAM;AAAA,EAC1F;AAEA,MAAI,iBAAkB,QAAO;AAI7B,SACE,gBAAAC,KAAC,WAAQ,WAAWD,IAAG,qDAAqD,SAAS,GAClF,wBACH;AAEJ;;;AChKA,YAAYG,YAAW;AACvB,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAsGhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhFN,IAAMC,gBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBACE;AAAA,EACF,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,cAAc;AAChB;AAEA,IAAMC,eAAc;AAOb,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,MAAM,WAAW,YAAY,IAAI;AAC/D,QAAM,IAAI,EAAE,GAAGD,eAAc,GAAG,KAAK;AAErC,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,WAAW,YAAY,IAAU,gBAAS,KAAK;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAACC,aAAY,KAAK,OAAO,GAAG;AAC9B,eAAS,EAAE,iBAAiB;AAC5B;AAAA,IACF;AAEA,eAAW,IAAI;AAKf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,mBAAa,IAAI;AACjB,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AACb,UAAI;AACF,sBAAc,OAAO;AAAA,MACvB,SAAS,KAAK;AACZ,gBAAQ,MAAM,sDAAsD,GAAG;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW;AACb,WACE,gBAAAF,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,MAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,uBAAuB,YAAE,YAAW;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,cACxC,UAAU;AAAA,cACV,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,gBAAAG,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,WAEJ;AAAA,QACA,gBAAAA,KAACJ,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,SAChD,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA,QACA,gBAAAI,KAAC,SAAI,WAAU,eACb,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,WAAU;AAAA,YAET,YAAE;AAAA;AAAA,QACL,GACF;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACxJA,YAAYI,YAAW;AACvB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAyKhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhKN,SAAS,eAAe,KAAa,KAAa,OAAuB;AACvE,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,MAAM;AAC5C,SAAO,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC;AAC9D;AA8BA,IAAMC,gBAAyC;AAAA,EAC7C,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,gBACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,mBAAmB;AACrB;AAaO,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,iBAAiB,MAAM,WAAW,UAAU,IAAI;AAC9E,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AAErC,QAAM,cAAc,aAAa,IAAI,cAAc;AACnD,QAAM,eAAe,aAAa,IAAI,eAAe;AACrD,QAAM,YAAY,QAAQ,eAAe,YAAY;AAErD,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAU,gBAAS,KAAK;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,EAAE;AAE/C,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,UAAW;AAEhB,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,eAAe,CAAC,UAAU,KAAK,OAAO,GAAG;AAC3C,eAAS,EAAE,mBAAmB;AAC9B;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,cAAc;AAAA,UACd,eAAe;AAAA,UACf,cAAc;AAAA,UACd,GAAI,cAAc,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,IAAI;AACX,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,KAAK,MAAM,aAAa;AAC1B,uBAAe,IAAI;AACnB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AAKb,aAAO,QAAQ,eAAe,UAAU,SAAS,SAAS,CAAC;AAC3D,UAAI;AACF,oBAAY;AAAA,MACd,SAAS,KAAK;AACZ,gBAAQ,MAAM,oDAAoD,GAAG;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WACE,gBAAAD,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,oBAAmB;AAAA,MAC5D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,sBAAqB;AAAA,MACrE,gBAAAA,KAAC,OAAE,MAAM,iBAAiB,WAAU,qDACjC,YAAE,mBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,0BAA0B,YAAE,eAAc;AAAA,UACzD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,4BAA4B,YAAE,sBAAqB;AAAA,UAClE,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA;AAAA,UACpD;AAAA,WACF;AAAA,QACC,eACC,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,qBAAqB,YAAE,cAAa;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cACzE,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACA,gBAAAG,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,WACjE;AAAA,QAED,SACC,gBAAAA,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,QAEF,gBAAAA;AAAA,UAACJ;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UACE,WAAW,CAAC,YAAY,CAAC,mBAAoB,eAAe,QAAQ,WAAW;AAAA,YAGhF,oBAAU,EAAE,gBAAgB,EAAE;AAAA;AAAA,QACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5PA,YAAYO,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAmIhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAzGN,IAAMC,gBAAgC;AAAA,EACpC,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AASO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,WAAW,UAAU,MAAM,WAAW,UAAU,IAAI;AAC5D,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AACrC,QAAM,uBAAuB,aAAa,IAAI,wBAAwB;AAEtE,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,qBAAsB;AAE3B,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,qBAAoC;AACxC,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,WAAW;AAAA,QACjC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,wBAAwB;AAAA,UACxB,cAAc;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM,oBAAoB;AAC7C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,iBAAS,EAAE,YAAY;AACvB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,2BAAqB,KAAK,KAAK;AAAA,IACjC,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAQA,WAAO,SAAS,OAAO,kBAAkB;AACzC,QAAI;AACF,kBAAY,kBAAkB;AAAA,IAChC,SAAS,KAAK;AACZ,cAAQ,MAAM,2CAA2C,GAAG;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,CAAC,sBAAsB;AACzB,WACE,gBAAAF,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,qBAAoB;AAAA,MACpE,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWG,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAH,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,yBAAyB,YAAE,eAAc;AAAA,UACxD,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA,cAIjD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAL,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,wBAAwB,YAAE,sBAAqB;AAAA,UAC9D,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA;AAAA,UACnD;AAAA,WACF;AAAA,QACC,SACC,gBAAAN,KAAC,OAAE,IAAG,sBAAqB,MAAK,SAAQ,WAAU,4BAC/C,iBACH;AAAA,QAEF,gBAAAA,KAACO,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,WAAW,CAAC,YAAY,CAAC,iBACzE,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AChMA,YAAYC,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,MAAAC,WAAU;AAoIX,gBAAAC,MAOF,QAAAC,aAPE;AAhHR,IAAMC,gBAAgC;AAAA,EACpC,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,UAAU;AACZ;AAgBO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,YAAY,UAAU,MAAM,UAAU,IAAI;AAClD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AAErC,QAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,QAAM,YAAY,aAAa,IAAI,YAAY;AAC/C,QAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAAiB,YAAY,SAAS,YAAY,SAAS;AAC7F,QAAM,CAAC,cAAc,eAAe,IAAU,gBAAwB,IAAI;AAE1E,EAAM,iBAAU,MAAM;AACpB,QAAI,YAAY,QAAQ;AACtB,gBAAU,SAAS;AACnB;AAAA,IACF;AAEA,QAAI,aAAa,MAAM;AAgBrB,YAAM,aAAa,IAAI,gBAAgB;AACvC,gBAAU,SAAS;AACnB,YAAM,YAAY;AAAA,QAChB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,YAAY,WAAW,KAAK,CAAC;AAAA,QACpD,QAAQ,WAAW;AAAA,MACrB,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,YAAI,CAAC,IAAI,IAAI;AACX,oBAAU,OAAO;AACjB,0BAAgB,KAAK,SAAS,EAAE,YAAY;AAC5C;AAAA,QACF;AAEA,YAAI,KAAK,MAAM,oBAAoB;AACjC,cAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,sBAAU,OAAO;AACjB,4BAAgB,EAAE,YAAY;AAC9B;AAAA,UACF;AACA,iBAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AACnD;AAAA,QACF;AAEA,kBAAU,SAAS;AAAA,MACrB,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,eAAe,SAAS,IAAI,SAAS,aAAc;AACvD,kBAAU,OAAO;AACjB,wBAAgB,EAAE,YAAY;AAAA,MAChC,CAAC;AAEH,aAAO,MAAM,WAAW,MAAM;AAAA,IAChC;AAGA,cAAU,OAAO;AAAA,EAMnB,GAAG,CAAC,SAAS,WAAW,MAAM,UAAU,CAAC;AAEzC,MAAI,WAAW,WAAW;AACxB,WACE,gBAAAH,KAAC,SAAI,WAAWI,IAAG,yBAAyB,SAAS,GACnD,0BAAAJ,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe,GACjE;AAAA,EAEJ;AAEA,MAAI,WAAW,SAAS;AACtB,WACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,YAAW;AAAA,MACpD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,0BAAgB,EAAE,cAAa;AAAA,MAC7E,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,UACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,oBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,IACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,IAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,YACL;AAAA,KACF;AAEJ;","names":["React","Button","cn","jsx","jsxs","DEFAULT_COPY","cn","Button","DEFAULT_COPY","React","cn","jsx","DEFAULT_COPY","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","EMAIL_REGEX","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","React","useSearchParams","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn","Label","Input","Button","React","useSearchParams","cn","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn"]}
1
+ {"version":3,"sources":["../src/auth/login-form.tsx","../src/auth/safe-redirect.ts","../src/auth/magic-link-cooldown.ts","../src/auth/magic-link-events.ts","../src/auth/auth-callback.tsx","../src/auth/login-errors.ts","../src/auth/auth-logo.tsx","../src/auth/reset-password-request.tsx","../src/auth/reset-password-confirm.tsx","../src/auth/set-password.tsx","../src/auth/auth-confirm.tsx"],"sourcesContent":["'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { Tabs, TabsList, TabsTrigger, TabsContent } from '@reblu/site-ui/tabs'\nimport { isSafeRedirectUrl } from './safe-redirect'\nimport { MAGIC_LINK_COOLDOWN_SECONDS } from './magic-link-cooldown'\nimport { emitMagicLinkRequested } from './magic-link-events'\n\nexport interface LoginFormCopy {\n // Tab labels\n magicLinkTabLabel: string\n passwordTabLabel: string\n\n // Shared\n emailLabel: string\n emailPlaceholder: string\n\n // Password tab\n passwordLabel: string\n passwordPlaceholder: string\n passwordSubmitCta: string\n forgotPasswordCta: string\n\n // Magic-link tab\n magicLinkSubmitCta: string\n\n // Magic-link success\n magicLinkSuccessTitle: string\n magicLinkSuccessMessage: string\n /** Countdown line. `{seconds}` is replaced with the seconds remaining. */\n magicLinkCooldownMessage: string\n magicLinkResendCta: string\n\n // MFA prompt\n mfaTitle: string\n mfaMessage: string\n mfaCodeLabel: string\n mfaCodePlaceholder: string\n mfaSubmitCta: string\n\n // Errors\n invalidEmailError: string\n networkError: string\n invalidCredentialsError: string\n mfaInvalidCodeError: string\n}\n\nexport interface LoginFormProps {\n // Endpoint URLs (all required)\n passwordLoginUrl: string\n mfaVerifyUrl: string\n magicLinkRequestUrl: string\n resetPasswordUrl: string\n\n // UX\n copy?: Partial<LoginFormCopy>\n className?: string\n defaultMethod?: 'magic-link' | 'password'\n /**\n * Seconds the form refuses to request another magic link after a successful\n * request. Mirrors Supabase Auth's per-project \"minimum interval per user\",\n * which silently drops the second link — see `MAGIC_LINK_COOLDOWN_SECONDS`\n * for where the authoritative value lives and why this is a mirror. Override\n * only for a SITE whose Supabase project uses a different interval.\n */\n cooldownSeconds?: number\n\n // Hooks\n onPasswordSubmitted?: (email: string) => void\n onMagicLinkSubmitted?: (email: string) => void\n onMfaSubmitted?: () => void\n}\n\nconst DEFAULT_COPY: LoginFormCopy = {\n magicLinkTabLabel: 'Enlace mágico',\n passwordTabLabel: 'Contraseña',\n emailLabel: 'Correo electrónico',\n emailPlaceholder: 'tu@email.com',\n passwordLabel: 'Contraseña',\n passwordPlaceholder: '••••••••',\n passwordSubmitCta: 'Iniciar sesión',\n forgotPasswordCta: '¿Olvidaste tu contraseña?',\n magicLinkSubmitCta: 'Enviar enlace de acceso',\n magicLinkSuccessTitle: 'Revisa tu correo',\n // True in every branch, and leaks nothing: the request path answers an\n // identical 200 whether or not the account exists, and whether or not an\n // email actually went out (REB-762). \"¡Enlace enviado!\" asserted a send that\n // may never have happened — the user then waited for something that was not\n // coming.\n magicLinkSuccessMessage:\n 'Si la cuenta existe, recibirás un enlace en unos minutos. Si ya lo has pedido hace poco, espera antes de volver a intentarlo.',\n magicLinkCooldownMessage: 'Podrás pedir otro enlace en {seconds} s.',\n magicLinkResendCta: 'Pedir otro enlace',\n mfaTitle: 'Verificación en dos pasos',\n mfaMessage: 'Introduce el código de 6 dígitos de tu aplicación autenticadora.',\n mfaCodeLabel: 'Código de verificación',\n mfaCodePlaceholder: '123456',\n mfaSubmitCta: 'Verificar código',\n invalidEmailError: 'Introduce un correo electrónico válido.',\n networkError: 'No se pudo enviar el enlace. Inténtalo de nuevo.',\n invalidCredentialsError: 'Email o contraseña incorrectos',\n mfaInvalidCodeError: 'Código incorrecto. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nfunction isValidEmail(value: string): boolean {\n return EMAIL_REGEX.test(value)\n}\n\ntype FormState = 'idle' | 'submitting' | 'magic-link-success' | 'mfa-required' | 'error'\n\ninterface MfaState {\n factorId: string\n accessToken: string\n refreshToken: string\n}\n\ninterface PasswordLoginResponse {\n data?: {\n mfaRequired: boolean\n sessionExchangeUrl?: string\n factorId?: string\n accessToken?: string\n refreshToken?: string\n }\n error?: string\n}\n\ninterface MfaVerifyResponse {\n data?: { sessionExchangeUrl: string }\n error?: string\n}\n\nexport function LoginForm(props: LoginFormProps) {\n const {\n passwordLoginUrl,\n mfaVerifyUrl,\n magicLinkRequestUrl,\n resetPasswordUrl,\n copy,\n className,\n defaultMethod = 'password',\n cooldownSeconds = MAGIC_LINK_COOLDOWN_SECONDS,\n onPasswordSubmitted,\n onMagicLinkSubmitted,\n onMfaSubmitted,\n } = props\n\n const c = { ...DEFAULT_COPY, ...copy }\n\n const [method, setMethod] = React.useState<'magic-link' | 'password'>(defaultMethod)\n const [state, setState] = React.useState<FormState>('idle')\n const [error, setError] = React.useState<string | null>(null)\n\n // Password & magic-link inputs\n const [email, setEmail] = React.useState('')\n const [password, setPassword] = React.useState('')\n\n // MFA state\n const [mfa, setMfa] = React.useState<MfaState | null>(null)\n const [mfaCode, setMfaCode] = React.useState('')\n\n // Seconds left before another magic link may be requested (REB-762).\n const [cooldownLeft, setCooldownLeft] = React.useState(0)\n\n // The success panel REPLACES the form, so the submit button the user just\n // pressed is unmounted and focus falls to <body> — a keyboard or screen-reader\n // user is dropped at the top of the document with no idea what happened.\n // Move focus to the panel's heading instead (WCAG 2.4.3 / 4.1.3).\n const successHeadingRef = React.useRef<HTMLHeadingElement>(null)\n\n // …and the return trip has the same problem: \"Pedir otro enlace\" unmounts\n // the button it was pressed on. Focus the email field the user is being sent\n // back to fill, rather than letting focus fall to <body> — the keyboard user\n // who waited out the full cooldown is exactly the person this path is for.\n const magicEmailRef = React.useRef<HTMLInputElement>(null)\n const returningFromSuccessRef = React.useRef(false)\n\n // One interval for the whole countdown, keyed on whether it is running rather\n // than on the seconds themselves: re-subscribing every tick would restart the\n // timer each second, and a chain of one-shot timeouts cannot be driven by a\n // test's fake clock in a single step (each tick would need its own flush).\n const isCoolingDown = cooldownLeft > 0\n React.useEffect(() => {\n if (!isCoolingDown) return\n const id = setInterval(() => {\n setCooldownLeft((s) => Math.max(0, s - 1))\n }, 1000)\n return () => {\n clearInterval(id)\n }\n }, [isCoolingDown])\n\n React.useEffect(() => {\n if (state === 'magic-link-success') successHeadingRef.current?.focus()\n if (state === 'idle' && returningFromSuccessRef.current) {\n returningFromSuccessRef.current = false\n magicEmailRef.current?.focus()\n }\n }, [state])\n\n const resetTransientState = React.useCallback(() => {\n setState('idle')\n setError(null)\n setMfa(null)\n setMfaCode('')\n }, [])\n\n const handleResend = () => {\n returningFromSuccessRef.current = true\n resetTransientState()\n }\n\n const handleTabChange = (next: string) => {\n if (next !== 'magic-link' && next !== 'password') return\n setMethod(next)\n resetTransientState()\n }\n\n const handleMagicLinkSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!isValidEmail(trimmed)) {\n setError(c.invalidEmailError)\n setState('error')\n return\n }\n\n setState('submitting')\n try {\n const res = await fetch(magicLinkRequestUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed }),\n })\n\n if (res.ok) {\n setState('magic-link-success')\n setCooldownLeft(cooldownSeconds)\n // Tell any AuthCallback on this page that its verdict about the old\n // link is stale (REB-763). Fired before the SITE's own hook so a SITE\n // that navigates away in `onMagicLinkSubmitted` cannot swallow it.\n emitMagicLinkRequested()\n onMagicLinkSubmitted?.(trimmed)\n return\n }\n\n setState('error')\n setError(c.networkError)\n } catch {\n setState('error')\n setError(c.networkError)\n }\n }\n\n const handlePasswordSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!isValidEmail(trimmed)) {\n setError(c.invalidEmailError)\n setState('error')\n return\n }\n if (!password) {\n setError(c.invalidCredentialsError)\n setState('error')\n return\n }\n\n setState('submitting')\n try {\n const res = await fetch(passwordLoginUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed, password }),\n })\n\n const json = (await res.json().catch(() => ({}))) as PasswordLoginResponse\n\n if (!res.ok || !json.data) {\n setState('error')\n setError(json.error ?? c.invalidCredentialsError)\n return\n }\n\n onPasswordSubmitted?.(trimmed)\n\n if (json.data.mfaRequired) {\n setMfa({\n factorId: json.data.factorId ?? '',\n accessToken: json.data.accessToken ?? '',\n refreshToken: json.data.refreshToken ?? '',\n })\n setState('mfa-required')\n return\n }\n\n const exchangeUrl = json.data.sessionExchangeUrl\n if (!exchangeUrl || !isSafeRedirectUrl(exchangeUrl)) {\n setState('error')\n setError(c.networkError)\n return\n }\n window.location.assign(exchangeUrl)\n } catch {\n setState('error')\n setError(c.networkError)\n }\n }\n\n const handleMfaSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n if (!mfa) return\n setError(null)\n setState('submitting')\n\n try {\n const res = await fetch(mfaVerifyUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n factorId: mfa.factorId,\n code: mfaCode,\n accessToken: mfa.accessToken,\n refreshToken: mfa.refreshToken,\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as MfaVerifyResponse\n\n if (\n !res.ok ||\n !json.data?.sessionExchangeUrl ||\n !isSafeRedirectUrl(json.data.sessionExchangeUrl)\n ) {\n // Stay in mfa-required state so user can retry the code\n setState('mfa-required')\n setError(json.error ?? c.mfaInvalidCodeError)\n setMfaCode('')\n return\n }\n\n onMfaSubmitted?.()\n window.location.assign(json.data.sessionExchangeUrl)\n } catch {\n setState('mfa-required')\n setError(c.networkError)\n }\n }\n\n // MFA prompt replaces the form entirely\n if (state === 'mfa-required' || (mfa && state === 'submitting')) {\n return (\n <div className={cn('space-y-6', className)}>\n <div className='space-y-1'>\n <h2 className='text-xl font-semibold'>{c.mfaTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.mfaMessage}</p>\n </div>\n <form onSubmit={(e) => void handleMfaSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-mfa-code'>{c.mfaCodeLabel}</Label>\n <Input\n id='login-mfa-code'\n type='text'\n inputMode='numeric'\n pattern='\\d{6}'\n maxLength={6}\n autoComplete='one-time-code'\n placeholder={c.mfaCodePlaceholder}\n value={mfaCode}\n onChange={(ev) => setMfaCode(ev.target.value.replace(/\\D/g, '').slice(0, 6))}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-mfa-error' : undefined}\n autoFocus\n />\n {error && (\n <p id='login-mfa-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button\n type='submit'\n className='w-full'\n disabled={state === 'submitting' || mfaCode.length !== 6}\n >\n {c.mfaSubmitCta}\n </Button>\n <button\n type='button'\n onClick={resetTransientState}\n className='text-muted-foreground hover:text-foreground w-full text-sm transition-colors'\n disabled={state === 'submitting'}\n >\n ← Volver\n </button>\n </form>\n </div>\n )\n }\n\n // Magic-link success replaces the form. It stays in place for the whole\n // cooldown, which is what makes the throttle legible: there is no submit\n // button to press again while Supabase would silently drop the request\n // (REB-762). The countdown is shown to every address alike — existing or\n // not — so it is not an account-existence oracle.\n if (state === 'magic-link-success') {\n return (\n <div className={cn('space-y-3 text-center', className)}>\n <h2 className='text-xl font-semibold' ref={successHeadingRef} tabIndex={-1}>\n {c.magicLinkSuccessTitle}\n </h2>\n <p className='text-muted-foreground'>{c.magicLinkSuccessMessage}</p>\n {/*\n The live region is mounted for the WHOLE panel and stays empty during\n the wait — a region inserted with its content already in place is\n routinely not announced at all (screen readers watch mounted regions\n for changes), so a region that appears together with its text proves\n only that the role is in the DOM. Same shape AuthCallback already\n uses: one always-present `aria-live` wrapper, contents swapped inside.\n */}\n <div role='status' aria-live='polite' className='sr-only'>\n {cooldownLeft > 0 ? '' : c.magicLinkResendCta}\n </div>\n {cooldownLeft > 0 ? (\n // A ticking number is VISUAL. Every text mutation inside a live\n // region is a separate announcement, so marking this one would queue\n // ~60 polite interruptions; the heading above already took focus and\n // spoke the new state once. The only transition worth announcing is\n // the end of the wait, which the region above carries.\n <p className='text-muted-foreground text-sm'>\n {c.magicLinkCooldownMessage.replaceAll('{seconds}', String(cooldownLeft))}\n </p>\n ) : (\n <Button type='button' variant='outline' onClick={handleResend}>\n {c.magicLinkResendCta}\n </Button>\n )}\n </div>\n )\n }\n\n return (\n <div className={cn('space-y-6', className)}>\n <Tabs value={method} onValueChange={handleTabChange}>\n <TabsList className='grid w-full grid-cols-2'>\n <TabsTrigger value='password'>{c.passwordTabLabel}</TabsTrigger>\n <TabsTrigger value='magic-link'>{c.magicLinkTabLabel}</TabsTrigger>\n </TabsList>\n\n <TabsContent value='password' className='pt-4'>\n <form onSubmit={(e) => void handlePasswordSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-email-pwd'>{c.emailLabel}</Label>\n <Input\n id='login-email-pwd'\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(ev) => setEmail(ev.target.value)}\n disabled={state === 'submitting'}\n />\n </div>\n <div className='space-y-2'>\n <div className='flex items-center justify-between'>\n <Label htmlFor='login-password'>{c.passwordLabel}</Label>\n <a\n href={resetPasswordUrl}\n className='text-muted-foreground hover:text-foreground text-xs transition-colors'\n >\n {c.forgotPasswordCta}\n </a>\n </div>\n <Input\n id='login-password'\n type='password'\n autoComplete='current-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(ev) => setPassword(ev.target.value)}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-pwd-error' : undefined}\n />\n {error && (\n <p id='login-pwd-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n {c.passwordSubmitCta}\n </Button>\n </form>\n </TabsContent>\n\n <TabsContent value='magic-link' className='pt-4'>\n <form onSubmit={(e) => void handleMagicLinkSubmit(e)} className='space-y-4' noValidate>\n <div className='space-y-2'>\n <Label htmlFor='login-email-magic'>{c.emailLabel}</Label>\n <Input\n id='login-email-magic'\n ref={magicEmailRef}\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(ev) => setEmail(ev.target.value)}\n disabled={state === 'submitting'}\n aria-describedby={error ? 'login-magic-error' : undefined}\n />\n {error && (\n <p id='login-magic-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={state === 'submitting'}>\n {c.magicLinkSubmitCta}\n </Button>\n </form>\n </TabsContent>\n </Tabs>\n </div>\n )\n}\n","/**\n * Scheme + URL-trick allowlist for a server-returned redirect target\n * (`sessionExchangeUrl`, `redirectTo`, etc.). Shared by `AuthCallback`,\n * `AuthConfirm`, and `SetPassword` — see `CLAUDE.md` Regla A: a predicate\n * applied more than 3 times gets one home, not N inline copies that drift.\n *\n * IMPORTANT — this is NOT full open-redirect confinement: it does NOT\n * restrict absolute `http`/`https` URLs to a specific origin.\n * `isSafeRedirectUrl('https://evil.com')` returns `true`. What it DOES\n * reject:\n * - dangerous schemes (`javascript:`, `data:`, `vbscript:`, ...) — the\n * classic XSS-via-redirect vector\n * - protocol-relative URLs (`//evil.com`) — these start with `/` but\n * browsers resolve them as an absolute, CROSS-ORIGIN URL (the scheme is\n * inherited from the current page), so a naive \"starts with /\" check\n * would wrongly treat them as same-origin\n * - backslash-authority URLs (`/\\evil.com`, `\\\\evil.com`) — browsers\n * normalize `\\` to `/` for special schemes, so these resolve the same way\n * - the same tricks with an ASCII tab/LF/CR spliced between the slashes\n * (`/\\t/evil.com`) — the WHATWG URL parser strips ALL tab/LF/CR from the\n * input BEFORE parsing (anywhere in the string, not just leading/trailing),\n * so `/\\t/evil.com` is indistinguishable from `//evil.com` to the browser\n * even though a naive regex over the raw string wouldn't see two adjacent\n * slashes\n *\n * Full origin-pinning (rejecting any absolute URL whose origin isn't the\n * actual expected one) is a SEPARATE, not-yet-implemented layer. It can't\n * simply pin to `REBLU_API_BASE_URL`: that's a server-only env var\n * unavailable in these `'use client'` components, and per REB-218's\n * subdomain redirect architecture it would be the WRONG origin anyway\n * (production session-exchange lives at `nexus.<tenantDomain>`, not the\n * SITE's own `REBLU_API_BASE_URL`). It would need a dedicated prop\n * conveying the actual expected origin per deploy/routing mode.\n */\nexport function isSafeRedirectUrl(url: string): boolean {\n if (!url) return false\n\n // Match the WHATWG URL parser's own first step: strip ALL ASCII\n // tab/LF/CR from the input, anywhere in the string — not just\n // leading/trailing — before evaluating what the browser will actually\n // resolve. Without this, '/\\t/evil.com' looks like a single-'/' relative\n // path to a naive check but the browser sees '//evil.com'.\n const clean = url.replace(/[\\t\\n\\r]/g, '')\n if (!clean) return false\n\n // A relative path must start with a SINGLE '/' — '//' or '/\\' resolve as\n // an absolute, cross-origin URL in the browser despite \"starting with /\".\n if (/^[/\\\\]{2}/.test(clean)) return false\n\n const scheme = clean.split(':')[0].toLowerCase()\n return ['http', 'https'].includes(scheme) || clean.startsWith('/')\n}\n","/**\n * How long the request form refuses to ask for another magic link (REB-762).\n *\n * ## This number is not ours\n *\n * The throttle that actually fires is Supabase Auth's per-project **\"Minimum\n * interval per user\"** (GoTrue `SMTP_MAX_FREQUENCY`; dashboard →\n * Authentication → Emails → SMTP settings). A second magic link requested\n * inside that window is **dropped before any email is sent**, silently — our\n * route still answers 200, so nothing on the wire says a wait is needed.\n *\n * Measured on the Dermamedicin project on 25-Sep-2026: **60 seconds**. The\n * LOCAL tenant stack sets `max_frequency = \"1s\"`\n * (`packages/tenant-db/supabase/config.toml`, `[auth.email]`), so the\n * authoritative value already differs per environment.\n *\n * ## Why it is mirrored rather than read\n *\n * It cannot be read at runtime from where it is needed. It lives in the\n * tenant's Supabase project config, reachable only through the Management API\n * with a PAT that must never reach a SITE, and our provisioning never writes it\n * (`patchAuthConfig` sets `site_url`, the redirect allow-list, SMTP relay and\n * templates — not the interval), so we do not own a copy to read either.\n *\n * So this is a **mirror of somebody else's setting, declared exactly once**.\n * The two CAN diverge: an operator changing the interval on a Supabase project\n * does not change this constant. When that happens, override it for that SITE\n * through `LoginForm`'s `cooldownSeconds` prop — do not add a second literal.\n *\n * Divergence is not symmetric: a mirror that is too SHORT re-opens the bug (the\n * user retries into a silent drop), while one that is too LONG only makes an\n * honest wait a little longer than it had to be.\n */\nexport const MAGIC_LINK_COOLDOWN_SECONDS = 60\n","/**\n * \"A magic link was just requested\" — the single fact `LoginForm` and\n * `AuthCallback` must share (REB-763).\n *\n * ## Why an event and not a prop\n *\n * A SITE can land on `/auth/callback` with an expired link and re-request from\n * the form rendered on that same page. `AuthCallback` then holds a verdict\n * (\"Enlace caducado\") about a link the user has already replaced, and the\n * expired notice is the louder of the two messages on screen.\n *\n * Both components are published SDK surface and a SITE may render **only one**\n * of them, so neither may require the other. Lifting the state into the page\n * would make every consuming SITE write the wiring (and the existing ones would\n * keep the bug until they did). A DOM event on `window` couples them at zero\n * API cost: rendering one alone is a dispatch nobody listens to, or a listener\n * nobody fires. No prop is added to `AuthCallback`, so an already-published\n * SITE page picks the fix up by upgrading the package alone.\n *\n * `window` rather than a module-scoped emitter on purpose: the `./auth` entry\n * ships both ESM and CJS builds, and a consumer that reaches the two components\n * through different formats would get two module instances — and a listener\n * registered on the wrong one. There is exactly one `window`.\n */\n\n/** Public event name — stable surface; a SITE may dispatch or observe it. */\nexport const MAGIC_LINK_REQUESTED_EVENT = 'reblu:magic-link-requested'\n\n/** Announce that a magic-link request just succeeded. No-op during SSR. */\nexport function emitMagicLinkRequested(): void {\n if (typeof window === 'undefined') return\n window.dispatchEvent(new CustomEvent(MAGIC_LINK_REQUESTED_EVENT))\n}\n\n/**\n * Observe magic-link requests. Returns an unsubscribe function, so it plugs\n * straight into a `useEffect` cleanup. No-op during SSR.\n */\nexport function onMagicLinkRequested(listener: () => void): () => void {\n if (typeof window === 'undefined') return () => {}\n const handler = () => {\n listener()\n }\n window.addEventListener(MAGIC_LINK_REQUESTED_EVENT, handler)\n return () => {\n window.removeEventListener(MAGIC_LINK_REQUESTED_EVENT, handler)\n }\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\nimport { onMagicLinkRequested } from './magic-link-events'\n\nexport interface AuthCallbackCopy {\n loadingTitle: string\n loadingMessage: string\n successMessage: string\n expiredTitle: string\n expiredMessage: string\n expiredCta: string\n networkErrorTitle: string\n networkErrorMessage: string\n networkErrorRetryCta: string\n networkErrorBackCta: string\n malformedTitle: string\n malformedMessage: string\n malformedCta: string\n}\n\nexport interface AuthCallbackProps {\n exchangeUrl: string\n loginUrl: string\n copy?: Partial<AuthCallbackCopy>\n onSuccess?: (redirectTo: string) => void\n onError?: (state: 'expired' | 'network' | 'malformed', error?: Error) => void\n className?: string\n}\n\ntype State =\n | 'mounting'\n | 'parsing'\n | 'exchanging'\n | 'success'\n | 'expired'\n | 'network'\n | 'malformed'\n // The verdict below was about a link the user has since replaced — render\n // nothing, so the request form's own message is the only one on screen\n // (REB-763). Deliberately not a greyed-out or struck-through notice: a stale\n // alarm that is merely dimmed is still read as current.\n | 'stale'\n\n/**\n * Terminal verdicts about the link this page was opened with. All of them are\n * made obsolete by a fresh request, not just the expired one the bug was\n * reported against: an invalid or already-used link lands in 'expired' or\n * 'malformed' depending on what Supabase put in the hash, and a failed exchange\n * lands in 'network'. Clearing the class rather than the reported case is the\n * point — the loading states and 'success' are excluded because a request in\n * flight or a redirect already issued is not a verdict to retract.\n */\nconst TERMINAL_FAILURE_STATES: readonly State[] = ['expired', 'network', 'malformed']\n\nconst DEFAULT_COPY: AuthCallbackCopy = {\n loadingTitle: 'Autenticando...',\n loadingMessage: 'Estamos verificando tu identidad.',\n successMessage: 'Iniciando sesión...',\n expiredTitle: 'Enlace caducado',\n expiredMessage: 'El enlace ha expirado o ya fue utilizado. Solicita uno nuevo.',\n expiredCta: 'Volver al login',\n networkErrorTitle: 'Error de conexión',\n networkErrorMessage: 'No pudimos completar el inicio de sesión. Inténtalo de nuevo.',\n networkErrorRetryCta: 'Reintentar',\n networkErrorBackCta: 'Volver al login',\n malformedTitle: 'Enlace inválido',\n malformedMessage: 'Enlace inválido. Solicita uno nuevo.',\n malformedCta: 'Volver al login',\n}\n\nfunction parseHash(hash: string): { access_token: string; refresh_token: string } | null {\n const raw = hash.startsWith('#') ? hash.slice(1) : hash\n if (!raw) return null\n const params = new URLSearchParams(raw)\n const access_token = params.get('access_token') ?? ''\n const refresh_token = params.get('refresh_token') ?? ''\n const type = params.get('type') ?? ''\n if (!access_token || !refresh_token || type !== 'magiclink') return null\n return { access_token, refresh_token }\n}\n\n/**\n * On failure Supabase redirects to the callback with the reason in the hash\n * fragment (e.g. `#error=access_denied&error_code=otp_expired`), never in the\n * query — the server cannot see it (REB-177). Detect it client-side and tell an\n * expired/used link (recoverable → 'expired') apart from any other failure\n * (→ 'malformed').\n */\nfunction parseHashError(hash: string): 'expired' | 'malformed' | null {\n const raw = hash.startsWith('#') ? hash.slice(1) : hash\n if (!raw) return null\n const params = new URLSearchParams(raw)\n const error = params.get('error')\n const errorCode = params.get('error_code')\n if (!error && !errorCode) return null\n // Expired or already-used magic links come back as access_denied / otp_expired.\n return errorCode === 'otp_expired' || error === 'access_denied' ? 'expired' : 'malformed'\n}\n\nexport function AuthCallback({\n exchangeUrl,\n loginUrl,\n copy,\n onSuccess,\n onError,\n className,\n}: AuthCallbackProps) {\n const [state, setState] = React.useState<State>('mounting')\n const [tokens, setTokens] = React.useState<{\n access_token: string\n refresh_token: string\n } | null>(null)\n const retryRef = React.useRef<HTMLButtonElement>(null)\n const linkRef = React.useRef<HTMLAnchorElement>(null)\n const c = { ...DEFAULT_COPY, ...copy }\n\n const exchange = React.useCallback(\n async (t: { access_token: string; refresh_token: string }) => {\n setState('exchanging')\n try {\n const res = await fetch(exchangeUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(t),\n })\n\n if (res.ok) {\n const raw = (await res.json()) as unknown\n const redirectTo =\n raw !== null &&\n typeof raw === 'object' &&\n 'redirectTo' in raw &&\n typeof (raw as { redirectTo: unknown }).redirectTo === 'string'\n ? (raw as { redirectTo: string }).redirectTo\n : null\n\n if (!redirectTo) {\n setState('network')\n onError?.('network', undefined)\n return\n }\n\n // Guard against dangerous schemes (javascript:, data:, etc.) AND\n // protocol-relative/backslash-authority URLs (//evil.com, /\\evil.com)\n // — see safe-redirect.ts.\n if (!isSafeRedirectUrl(redirectTo)) {\n setState('network')\n onError?.('network', undefined)\n return\n }\n\n history.replaceState({}, '', window.location.pathname)\n window.location.replace(redirectTo)\n setState('success')\n onSuccess?.(redirectTo)\n return\n }\n\n if (res.status === 401) {\n setState('expired')\n onError?.('expired')\n return\n }\n\n setState('network')\n onError?.('network', undefined)\n } catch (err) {\n setState('network')\n onError?.('network', err instanceof Error ? err : undefined)\n }\n },\n [exchangeUrl, onError, onSuccess],\n )\n\n React.useEffect(() => {\n setState('parsing')\n // A failure reported in the hash (expired/used/invalid link) is not a token\n // to exchange — surface it directly without hitting the network (REB-177).\n const hashError = parseHashError(window.location.hash)\n if (hashError) {\n setState(hashError)\n onError?.(hashError)\n return\n }\n const parsed = parseHash(window.location.hash)\n if (!parsed) {\n setState('malformed')\n onError?.('malformed')\n return\n }\n setTokens(parsed)\n void exchange(parsed)\n // `exchange`/`onError` are intentionally excluded: this effect must run\n // EXACTLY ONCE on mount to parse `window.location.hash` — re-running it\n // on every `exchange` identity change (which itself changes whenever\n // `onSuccess`/`onError` props change identity) would re-parse an\n // already-cleared hash and misfire.\n // eslint-disable-next-line react-hooks/exhaustive-deps\n }, [])\n\n React.useEffect(() => {\n if (state === 'network') retryRef.current?.focus()\n if (state === 'expired' || state === 'malformed') linkRef.current?.focus()\n }, [state])\n\n // A new link was just requested — from the form a SITE may render on this very\n // page — so any verdict about the OLD link is stale and must go (REB-763).\n // Subscribing costs nothing when the SITE renders this component alone.\n React.useEffect(\n () =>\n onMagicLinkRequested(() => {\n setState((current) => (TERMINAL_FAILURE_STATES.includes(current) ? 'stale' : current))\n }),\n [],\n )\n\n const isLoading = state === 'mounting' || state === 'parsing' || state === 'exchanging'\n\n // Render NOTHING, not an empty screen: the wrapper is `min-h-screen`, so\n // keeping it would leave a full blank viewport where the retracted notice\n // used to be and push the sibling request form's confirmation below the fold\n // — the user would watch the thing they were reading disappear and see no\n // replacement (REB-763).\n if (state === 'stale') return null\n\n return (\n <main className={cn('flex min-h-screen items-center justify-center', className)}>\n <div aria-live='polite' className='w-full max-w-md space-y-4 p-6 text-center'>\n {isLoading && (\n <section>\n <h2 className='text-xl font-semibold'>{c.loadingTitle}</h2>\n <p className='text-muted-foreground mt-2'>{c.loadingMessage}</p>\n </section>\n )}\n\n {state === 'success' && (\n <section>\n <p>{c.successMessage}</p>\n </section>\n )}\n\n {state === 'expired' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.expiredTitle}</h2>\n <p className='text-muted-foreground'>{c.expiredMessage}</p>\n <Button asChild variant='outline'>\n <a href={loginUrl} ref={linkRef}>\n {c.expiredCta}\n </a>\n </Button>\n </section>\n )}\n\n {state === 'network' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.networkErrorTitle}</h2>\n <p className='text-muted-foreground'>{c.networkErrorMessage}</p>\n <div className='flex flex-col gap-2'>\n <Button type='button' ref={retryRef} onClick={() => tokens && void exchange(tokens)}>\n {c.networkErrorRetryCta}\n </Button>\n <Button asChild variant='outline'>\n <a href={loginUrl}>{c.networkErrorBackCta}</a>\n </Button>\n </div>\n </section>\n )}\n\n {state === 'malformed' && (\n <section className='space-y-4'>\n <h2 className='text-xl font-semibold'>{c.malformedTitle}</h2>\n <p className='text-muted-foreground'>{c.malformedMessage}</p>\n <Button asChild variant='outline'>\n <a href={loginUrl} ref={linkRef}>\n {c.malformedCta}\n </a>\n </Button>\n </section>\n )}\n </div>\n </main>\n )\n}\n","/**\n * Maps the raw `?error=` query param that Supabase appends when a magic link is\n * already consumed or expired to a user-facing Spanish message.\n *\n * Supabase redirects to /login?error=... with a raw English message (e.g.\n * \"Email link is invalid or has expired\"). Showing that verbatim is confusing,\n * so we translate the common cases and signal whether the \"Solicitar otro\n * enlace\" CTA should be offered.\n *\n * Matching is case-insensitive and whitespace-tolerant so it survives small\n * variations in how the error text arrives.\n *\n * Relocated from apps/demo-site/src/lib/utils/login-errors.ts (REB-510 slice\n * 2a) as a copy-injectable helper — Spanish defaults are unchanged, and a SITE\n * MAY override individual messages via `Partial<LoginErrorCopy>`.\n */\n\nexport interface LoginErrorInfo {\n /** Message shown in the error card. */\n message: string\n /** Whether to show the \"Solicitar otro enlace\" CTA. */\n showRequestLink: boolean\n}\n\nexport interface LoginErrorCopy {\n expiredMessage: string\n missingTokenMessage: string\n genericMessage: string\n}\n\nconst DEFAULT_COPY: LoginErrorCopy = {\n expiredMessage: 'El enlace ha expirado o ya fue utilizado.',\n missingTokenMessage: 'El enlace no es válido. Solicita uno nuevo.',\n genericMessage: 'No se pudo completar el inicio de sesión. Intenta de nuevo.',\n}\n\nexport function mapLoginError(\n error: string | null | undefined,\n copy?: Partial<LoginErrorCopy>,\n): LoginErrorInfo | null {\n if (!error) return null\n\n const normalized = error.trim().toLowerCase()\n if (normalized === '') return null\n\n const c = { ...DEFAULT_COPY, ...copy }\n\n if (\n normalized.includes('email link is invalid or has expired') ||\n normalized.includes('token has expired or is invalid')\n ) {\n return { message: c.expiredMessage, showRequestLink: true }\n }\n\n if (normalized.includes('missing_token')) {\n return { message: c.missingTokenMessage, showRequestLink: true }\n }\n\n return { message: c.genericMessage, showRequestLink: true }\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useTheme } from 'next-themes'\nimport { cn } from '@reblu/site-ui'\n\nexport interface AuthLogoCopy {\n /**\n * Overrides the rendered `<img>` alt text. Pass `''` explicitly to mark the\n * logo as decorative (e.g. when an adjacent heading already announces\n * `siteName`, so screen readers shouldn't read it twice) — `undefined`\n * (the key simply omitted from `copy`) is what falls back to `siteName`.\n */\n altText?: string\n /** Shown when neither a logo URL nor `siteName` is available. */\n fallbackLabel: string\n}\n\nexport interface AuthLogoProps {\n logoLightExpandedUrl: string | null\n logoDarkExpandedUrl: string | null\n logoLightSmallUrl: string | null\n logoDarkSmallUrl: string | null\n siteName: string\n /** @default 'expanded' */\n variant?: 'expanded' | 'compact'\n className?: string\n copy?: Partial<AuthLogoCopy>\n /**\n * Heading level for the `siteName`/fallback-label text rendered when no logo\n * resolves. AuthLogo owns the auth page's heading, so this defaults to the\n * top-level `1`; pass a deeper level only if the page already has an `<h1>`\n * elsewhere that AuthLogo must sit beneath.\n * @default 1\n */\n headingLevel?: 1 | 2 | 3 | 4 | 5 | 6\n /**\n * When `true`, renders `null` instead of the `siteName`/fallback-label\n * heading whenever no logo URL resolves for the active variant+theme, rather\n * than showing the text. Use this ONLY when the consumer intentionally\n * renders `siteName` elsewhere itself — by default AuthLogo IS the heading\n * (\"logo XOR name\"), so the consumer should NOT add its own\n * `<h1>{siteName}</h1>`.\n * @default false\n */\n hideTextFallback?: boolean\n}\n\nconst DEFAULT_COPY: Required<Pick<AuthLogoCopy, 'fallbackLabel'>> = {\n fallbackLabel: 'Inicio de sesión',\n}\n\nconst VARIANT_CLASS: Record<'expanded' | 'compact', string> = {\n expanded: 'h-8 w-auto',\n compact: 'h-8 w-8',\n}\n\n// Intrinsic `width`/`height` attributes so the browser reserves layout space\n// via its built-in aspect-ratio-from-attributes heuristic before the real\n// image loads (avoids vertical CLS at minimum; horizontal width still\n// depends on the tenant's actual logo aspect ratio, which `/api/site/config`\n// doesn't expose — an arbitrary-but-reasonable box, not a promise of zero\n// shift). `VARIANT_CLASS`'s `h-8` always wins for height regardless.\nconst VARIANT_INTRINSIC_SIZE: Record<'expanded' | 'compact', { width: number; height: number }> = {\n expanded: { width: 160, height: 32 },\n compact: { width: 32, height: 32 },\n}\n\n/**\n * Dynamic tenant logo for auth pages (REB-510 R1). Resolves expanded/compact ×\n * light/dark from the 4 `/api/site/config` logo URLs, switching light/dark\n * CLIENT-SIDE via `next-themes`. Falls back to `siteName` text, then a generic\n * `copy.fallbackLabel`, whenever the resolved URL for the active\n * variant+theme combination is `null` — it never silently swaps in the OTHER\n * theme's logo.\n *\n * Hydration-safe: `next-themes`' `resolvedTheme` is `undefined` until it\n * mounts client-side, so pre-mount `isDark` is always `false` — the same\n * light-first markup the server rendered, avoiding a hydration mismatch.\n *\n * Renders a plain `<img>`, not `next/image`: this is a distributable SDK\n * consumed by external SITE repos, so it cannot assume the consuming app's\n * `next.config` `images.remotePatterns` allowlists the tenant's logo CDN.\n */\nexport function AuthLogo(props: AuthLogoProps) {\n const {\n logoLightExpandedUrl,\n logoDarkExpandedUrl,\n logoLightSmallUrl,\n logoDarkSmallUrl,\n siteName,\n variant = 'expanded',\n className,\n copy,\n headingLevel = 1,\n hideTextFallback = false,\n } = props\n const fallbackLabel = copy?.fallbackLabel ?? DEFAULT_COPY.fallbackLabel\n const { resolvedTheme } = useTheme()\n const isDark = resolvedTheme === 'dark'\n\n const lightUrl = variant === 'compact' ? logoLightSmallUrl : logoLightExpandedUrl\n const darkUrl = variant === 'compact' ? logoDarkSmallUrl : logoDarkExpandedUrl\n const logoUrl = isDark ? darkUrl : lightUrl\n\n // Tracks a broken/stale logo URL (404, CDN outage, etc.) — degrades to the\n // text fallback instead of a broken-image glyph. Reset whenever `logoUrl`\n // itself changes (e.g. a theme toggle resolves a DIFFERENT URL) so a past\n // failure doesn't permanently block a future, valid attempt.\n const [imgError, setImgError] = React.useState(false)\n React.useEffect(() => {\n setImgError(false)\n }, [logoUrl])\n\n const fallbackText = siteName || fallbackLabel\n // `copy.altText` — a VALUE-defined key (including `''`) wins outright,\n // that's how a consumer marks the logo decorative. A value-undefined key\n // (whether omitted from `copy` entirely, or present with an explicit\n // `undefined` value) falls back to siteName/fallbackLabel — checking value\n // definedness, not `'altText' in copy` key presence, is what makes\n // `copy={{ altText: undefined }}` behave the same as omitting the key.\n const altText = copy?.altText !== undefined ? copy.altText : siteName || fallbackLabel\n\n // AuthLogo is \"logo XOR name\": exactly ONE of the brand mark (logo image) or\n // the `siteName` text is shown, never both — and by default AuthLogo IS the\n // auth page's heading, so the consuming page must NOT add its own separate\n // `<h1>{siteName}</h1>` (which is what double-rendered the name before).\n const Heading = `h${headingLevel}` as const\n\n if (logoUrl && !imgError) {\n const { width, height } = VARIANT_INTRINSIC_SIZE[variant]\n // Decorative escape hatch: when the consumer hides the text fallback OR\n // marks the logo decorative (`alt=''`), it owns the page heading itself, so\n // render a bare image — wrapping a nameless image in a heading would emit\n // an empty, accessible-name-less heading.\n const bare = hideTextFallback || altText === ''\n const image = (\n <img\n src={logoUrl}\n alt={altText}\n width={width}\n height={height}\n className={cn(VARIANT_CLASS[variant], 'max-w-full', bare && className)}\n onError={() => setImgError(true)}\n />\n )\n if (bare) return image\n // Default: wrap the logo in the heading so the auth page ALWAYS has a\n // heading — even when only the brand image is visible — whose accessible\n // name is the logo's `alt` (= `siteName`). No visible, duplicated name text.\n return <Heading className={cn('inline-flex items-center max-w-full', className)}>{image}</Heading>\n }\n\n if (hideTextFallback) return null\n\n // No logo resolved → render `siteName` (or the generic fallback label) as the\n // page's heading text.\n return (\n <Heading className={cn('text-2xl font-bold tracking-tight text-foreground', className)}>\n {fallbackText}\n </Heading>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\nexport interface ResetPasswordRequestCopy {\n emailLabel: string\n emailPlaceholder: string\n submitCta: string\n submittingCta: string\n successTitle: string\n successMessage: string\n backToLoginCta: string\n invalidEmailError: string\n networkError: string\n}\n\nexport interface ResetPasswordRequestProps {\n requestUrl: string\n loginUrl: string\n copy?: Partial<ResetPasswordRequestCopy>\n className?: string\n onSubmitted?: (email: string) => void\n}\n\nconst DEFAULT_COPY: ResetPasswordRequestCopy = {\n emailLabel: 'Correo electrónico',\n emailPlaceholder: 'tu@email.com',\n submitCta: 'Enviar enlace de recuperación',\n submittingCta: 'Enviando...',\n successTitle: 'Revisa tu email',\n successMessage:\n 'Si el email existe en nuestra plataforma, recibirás un enlace para restablecer tu contraseña en los próximos minutos.',\n backToLoginCta: '← Volver al inicio de sesión',\n invalidEmailError: 'Introduce un correo electrónico válido.',\n networkError: 'Error de conexión. Por favor, inténtalo de nuevo.',\n}\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Step 1 of the password-reset flow — anti-enumeration: always shows the same\n * generic success message on a 2xx response, regardless of whether the email\n * exists (the backend never leaks that).\n */\nexport function ResetPasswordRequest(props: ResetPasswordRequestProps) {\n const { requestUrl, loginUrl, copy, className, onSubmitted } = props\n const c = { ...DEFAULT_COPY, ...copy }\n\n const [email, setEmail] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [submitted, setSubmitted] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n\n const trimmed = email.trim().toLowerCase()\n if (!EMAIL_REGEX.test(trimmed)) {\n setError(c.invalidEmailError)\n return\n }\n\n setLoading(true)\n // `succeeded` isolates the consumer's `onSubmitted` callback from this\n // try/catch: if we called it INSIDE the try and it threw, that throw\n // would land in the network `catch` below and misreport a successful\n // request as a connection error.\n let succeeded = false\n try {\n const res = await fetch(requestUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email: trimmed }),\n })\n\n if (!res.ok) {\n const json = (await res.json().catch(() => ({}))) as { error?: string }\n setError(json.error ?? c.networkError)\n setLoading(false)\n return\n }\n\n succeeded = true\n setSubmitted(true)\n setLoading(false)\n } catch {\n setError(c.networkError)\n setLoading(false)\n return\n }\n\n if (succeeded) {\n try {\n onSubmitted?.(trimmed)\n } catch (err) {\n console.error('[ResetPasswordRequest] onSubmitted callback threw:', err)\n }\n }\n }\n\n if (submitted) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.backToLoginCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='reset-request-email'>{c.emailLabel}</Label>\n <Input\n id='reset-request-email'\n type='email'\n autoComplete='email'\n placeholder={c.emailPlaceholder}\n value={email}\n onChange={(e) => setEmail(e.target.value)}\n disabled={loading}\n aria-describedby={error ? 'reset-request-error' : undefined}\n autoFocus\n />\n {error && (\n <p id='reset-request-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n </div>\n <Button type='submit' className='w-full' disabled={loading}>\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n <div className='text-center'>\n <a\n href={loginUrl}\n className='text-muted-foreground hover:text-foreground text-sm transition-colors'\n >\n {c.backToLoginCta}\n </a>\n </div>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\n\n/**\n * Appends `key=value` to `url` without producing a malformed double `?` when\n * `url` (consumer-supplied `loginUrl`, e.g. `/login?tenant=acme`) already\n * carries a query string. Deliberately NOT `new URL(url)` — `loginUrl` is\n * typically a relative path and the WHATWG `URL` constructor requires a base\n * for those.\n */\nfunction withQueryParam(url: string, key: string, value: string): string {\n const separator = url.includes('?') ? '&' : '?'\n return `${url}${separator}${key}=${encodeURIComponent(value)}`\n}\n\nexport interface ResetPasswordConfirmCopy {\n passwordLabel: string\n passwordPlaceholder: string\n confirmPasswordLabel: string\n confirmPasswordPlaceholder: string\n mfaCodeLabel: string\n mfaCodePlaceholder: string\n mfaHelpMessage: string\n submitCta: string\n submittingCta: string\n passwordTooShortError: string\n passwordMismatchError: string\n mfaInvalidCodeError: string\n genericError: string\n missingTokensTitle: string\n missingTokensMessage: string\n requestNewLinkCta: string\n}\n\nexport interface ResetPasswordConfirmProps {\n confirmUrl: string\n loginUrl: string\n resetRequestUrl: string\n copy?: Partial<ResetPasswordConfirmCopy>\n className?: string\n onSuccess?: () => void\n}\n\nconst DEFAULT_COPY: ResetPasswordConfirmCopy = {\n passwordLabel: 'Nueva contraseña',\n passwordPlaceholder: 'Mínimo 8 caracteres',\n confirmPasswordLabel: 'Confirmar contraseña',\n confirmPasswordPlaceholder: 'Repite la contraseña',\n mfaCodeLabel: 'Código de verificación (2FA)',\n mfaCodePlaceholder: '6 dígitos',\n mfaHelpMessage:\n 'Tu cuenta tiene verificación en dos pasos. Introduce el código de tu app de autenticación para completar el cambio.',\n submitCta: 'Establecer nueva contraseña',\n submittingCta: 'Actualizando contraseña...',\n passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n passwordMismatchError: 'Las contraseñas no coinciden',\n mfaInvalidCodeError: 'Introduce el código de 6 dígitos de tu app de autenticación',\n genericError: 'Error al restablecer la contraseña',\n missingTokensTitle: 'Enlace inválido',\n missingTokensMessage: 'El enlace ha expirado o no es válido. Solicita uno nuevo.',\n requestNewLinkCta: 'Solicitar nuevo enlace',\n}\n\n/**\n * Step 2 of the password-reset flow. Reads `access_token`/`refresh_token`\n * straight off `useSearchParams` — no `window.location.search` + effect-timing\n * workaround needed here because, unlike a page-level default export, this is\n * a component the SITE mounts inside its own `<Suspense>` boundary.\n *\n * REB-378: when the account has a verified MFA factor, the recovery session\n * (AAL1) cannot change the password on its own. The backend responds\n * `{ data: { mfaRequired: true } }` and this reveals a 6-digit TOTP field so\n * the user can resubmit with the code (the recovery tokens stay valid).\n */\nexport function ResetPasswordConfirm(props: ResetPasswordConfirmProps) {\n const { confirmUrl, loginUrl, resetRequestUrl, copy, className, onSuccess } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const router = useRouter()\n const searchParams = useSearchParams()\n\n const accessToken = searchParams.get('access_token')\n const refreshToken = searchParams.get('refresh_token')\n const hasTokens = Boolean(accessToken && refreshToken)\n\n const [password, setPassword] = React.useState('')\n const [confirmPassword, setConfirmPassword] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n const [mfaRequired, setMfaRequired] = React.useState(false)\n const [mfaCode, setMfaCode] = React.useState('')\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n if (!hasTokens) return\n\n if (password.length < 8) {\n setError(c.passwordTooShortError)\n return\n }\n if (password !== confirmPassword) {\n setError(c.passwordMismatchError)\n return\n }\n if (mfaRequired && !/^\\d{6}$/.test(mfaCode)) {\n setError(c.mfaInvalidCodeError)\n return\n }\n\n setLoading(true)\n // `succeeded` isolates the consumer's `onSuccess` callback (and the\n // navigation) from this try/catch: calling either INSIDE the try means a\n // throwing callback lands in the network `catch` below and misreports an\n // already-successful password change as a failure — the user retries\n // with recovery tokens the backend has already consumed.\n let succeeded = false\n try {\n const res = await fetch(confirmUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n access_token: accessToken,\n refresh_token: refreshToken,\n new_password: password,\n ...(mfaRequired ? { mfa_code: mfaCode } : {}),\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as {\n error?: string\n data?: { success?: boolean; mfaRequired?: boolean }\n }\n\n if (!res.ok) {\n setError(json.error ?? c.genericError)\n setLoading(false)\n return\n }\n\n if (json.data?.mfaRequired) {\n setMfaRequired(true)\n setLoading(false)\n return\n }\n\n succeeded = true\n setLoading(false)\n } catch {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n if (succeeded) {\n // Navigate FIRST, consumer callback SECOND (isolated in its own\n // try/catch) — same reasoning as set-password.tsx: a throwing\n // `onSuccess` can no longer block the redirect or escape as an\n // unhandled rejection out of this fire-and-forget async handler.\n router.replace(withQueryParam(loginUrl, 'reset', 'success'))\n try {\n onSuccess?.()\n } catch (err) {\n console.error('[ResetPasswordConfirm] onSuccess callback threw:', err)\n }\n }\n }\n\n if (!hasTokens) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.missingTokensTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.missingTokensMessage}</p>\n <a href={resetRequestUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.requestNewLinkCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-password'>{c.passwordLabel}</Label>\n <Input\n id='reset-confirm-password'\n type='password'\n autoComplete='new-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(e) => setPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n autoFocus\n />\n </div>\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-password-2'>{c.confirmPasswordLabel}</Label>\n <Input\n id='reset-confirm-password-2'\n type='password'\n autoComplete='new-password'\n placeholder={c.confirmPasswordPlaceholder}\n value={confirmPassword}\n onChange={(e) => setConfirmPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n />\n </div>\n {mfaRequired && (\n <div className='space-y-1.5'>\n <Label htmlFor='reset-confirm-mfa'>{c.mfaCodeLabel}</Label>\n <Input\n id='reset-confirm-mfa'\n type='text'\n inputMode='numeric'\n autoComplete='one-time-code'\n placeholder={c.mfaCodePlaceholder}\n value={mfaCode}\n onChange={(e) => setMfaCode(e.target.value.replace(/\\D/g, '').slice(0, 6))}\n disabled={loading}\n maxLength={6}\n aria-describedby={error ? 'reset-confirm-error' : undefined}\n autoFocus\n />\n <p className='text-muted-foreground text-xs'>{c.mfaHelpMessage}</p>\n </div>\n )}\n {error && (\n <p id='reset-confirm-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n <Button\n type='submit'\n className='w-full'\n disabled={\n loading || !password || !confirmPassword || (mfaRequired && mfaCode.length !== 6)\n }\n >\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { Button, Input, cn } from '@reblu/site-ui'\nimport { Label } from '@reblu/site-ui/label'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface SetPasswordCopy {\n passwordLabel: string\n passwordPlaceholder: string\n confirmPasswordLabel: string\n confirmPasswordPlaceholder: string\n submitCta: string\n submittingCta: string\n passwordTooShortError: string\n passwordMismatchError: string\n genericError: string\n missingTokenTitle: string\n missingTokenMessage: string\n backToLoginCta: string\n}\n\nexport interface SetPasswordProps {\n submitUrl: string\n loginUrl: string\n copy?: Partial<SetPasswordCopy>\n className?: string\n onSuccess?: (sessionExchangeUrl: string) => void\n}\n\nconst DEFAULT_COPY: SetPasswordCopy = {\n passwordLabel: 'Contraseña',\n passwordPlaceholder: 'Mínimo 8 caracteres',\n confirmPasswordLabel: 'Confirmar contraseña',\n confirmPasswordPlaceholder: 'Repite la contraseña',\n submitCta: 'Activar cuenta',\n submittingCta: 'Activando cuenta...',\n passwordTooShortError: 'La contraseña debe tener al menos 8 caracteres',\n passwordMismatchError: 'Las contraseñas no coinciden',\n genericError: 'Error al establecer la contraseña',\n missingTokenTitle: 'Enlace inválido',\n missingTokenMessage: 'El enlace de invitación ha expirado o no es válido.',\n backToLoginCta: '← Volver al inicio de sesión',\n}\n\n/**\n * Invite flow — for a user setting their initial password. Reads\n * `session_exchange_token` off `useSearchParams`; on success, redirects via\n * `window.location.assign` (NOT the Next router) because the returned\n * `sessionExchangeUrl` points at base-api's own domain to set cookies, not a\n * same-origin SITE route.\n */\nexport function SetPassword(props: SetPasswordProps) {\n const { submitUrl, loginUrl, copy, className, onSuccess } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const searchParams = useSearchParams()\n const sessionExchangeToken = searchParams.get('session_exchange_token')\n\n const [password, setPassword] = React.useState('')\n const [confirmPassword, setConfirmPassword] = React.useState('')\n const [loading, setLoading] = React.useState(false)\n const [error, setError] = React.useState<string | null>(null)\n\n const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {\n e.preventDefault()\n setError(null)\n if (!sessionExchangeToken) return\n\n if (password.length < 8) {\n setError(c.passwordTooShortError)\n return\n }\n if (password !== confirmPassword) {\n setError(c.passwordMismatchError)\n return\n }\n\n setLoading(true)\n // `sessionExchangeUrl` isolates the consumer's `onSuccess` callback (and\n // the actual navigation) from this try/catch: calling either INSIDE the\n // try means a throwing callback lands in the network `catch` below and\n // misreports an already-successful password-set as a connection error —\n // stranding an activated user on a form that tells them it failed.\n let sessionExchangeUrl: string | null = null\n try {\n const res = await fetch(submitUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n session_exchange_token: sessionExchangeToken,\n new_password: password,\n }),\n })\n\n const json = (await res.json().catch(() => ({}))) as {\n data?: { sessionExchangeUrl?: string }\n error?: string\n }\n\n if (!res.ok || !json.data?.sessionExchangeUrl) {\n setError(json.error ?? c.genericError)\n setLoading(false)\n return\n }\n\n if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n sessionExchangeUrl = json.data.sessionExchangeUrl\n } catch {\n setError(c.genericError)\n setLoading(false)\n return\n }\n\n // Navigate FIRST, consumer callback SECOND (isolated in its own\n // try/catch): if `onSuccess` throws (ad blocker on an analytics call,\n // etc.) the navigation has already been triggered and is unaffected, and\n // the throw doesn't escape as an unhandled rejection out of this\n // fire-and-forget async handler — the user is never stranded on this\n // form by code that isn't even this component's own.\n window.location.assign(sessionExchangeUrl)\n try {\n onSuccess?.(sessionExchangeUrl)\n } catch (err) {\n console.error('[SetPassword] onSuccess callback threw:', err)\n }\n }\n\n if (!sessionExchangeToken) {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.missingTokenTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.missingTokenMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.backToLoginCta}\n </a>\n </div>\n )\n }\n\n return (\n <form\n onSubmit={(e) => void handleSubmit(e)}\n className={cn('space-y-5', className)}\n noValidate\n >\n <div className='space-y-1.5'>\n <Label htmlFor='set-password-password'>{c.passwordLabel}</Label>\n <Input\n id='set-password-password'\n type='password'\n autoComplete='new-password'\n placeholder={c.passwordPlaceholder}\n value={password}\n onChange={(e) => setPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'set-password-error' : undefined}\n // Single-purpose activation page (this IS the whole page's task,\n // there's no earlier content competing for attention) — same\n // pattern as reset-password-confirm.tsx/reset-password-request.tsx.\n autoFocus\n />\n </div>\n <div className='space-y-1.5'>\n <Label htmlFor='set-password-confirm'>{c.confirmPasswordLabel}</Label>\n <Input\n id='set-password-confirm'\n type='password'\n autoComplete='new-password'\n placeholder={c.confirmPasswordPlaceholder}\n value={confirmPassword}\n onChange={(e) => setConfirmPassword(e.target.value)}\n disabled={loading}\n minLength={8}\n aria-describedby={error ? 'set-password-error' : undefined}\n />\n </div>\n {error && (\n <p id='set-password-error' role='alert' className='text-destructive text-sm'>\n {error}\n </p>\n )}\n <Button type='submit' className='w-full' disabled={loading || !password || !confirmPassword}>\n {loading ? c.submittingCta : c.submitCta}\n </Button>\n </form>\n )\n}\n","'use client'\n\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport { cn } from '@reblu/site-ui'\nimport { isSafeRedirectUrl } from './safe-redirect'\n\nexport interface AuthConfirmCopy {\n loadingMessage: string\n successTitle: string\n successMessage: string\n successCta: string\n errorTitle: string\n errorMessage: string\n errorCta: string\n}\n\nexport interface AuthConfirmProps {\n confirmUrl: string\n loginUrl: string\n copy?: Partial<AuthConfirmCopy>\n className?: string\n}\n\nconst DEFAULT_COPY: AuthConfirmCopy = {\n loadingMessage: 'Confirmando tu email...',\n successTitle: 'Email confirmado',\n successMessage: 'Tu dirección de email ha sido verificada correctamente.',\n successCta: 'Iniciar sesión',\n errorTitle: 'Error al confirmar',\n errorMessage: 'El enlace de confirmación no es válido o ha expirado.',\n errorCta: 'Volver al inicio de sesión',\n}\n\ntype Status = 'loading' | 'success' | 'error'\n\n/**\n * Dual-mode email confirmation (signup / email-change):\n *\n * 1. `?success=true` — base-api already ran `verifyOtp` server-side and\n * redirected here. Shows the confirmed message with no API call.\n * 2. `?token_hash=&type=` — client-initiated verify: POSTs to `confirmUrl`\n * and follows the returned `sessionExchangeUrl`, or shows success/error\n * copy based on the response.\n *\n * Neither param present → shown as an error state with a link back to login,\n * rather than a silent client-side redirect.\n */\nexport function AuthConfirm(props: AuthConfirmProps) {\n const { confirmUrl, loginUrl, copy, className } = props\n const c = { ...DEFAULT_COPY, ...copy }\n const searchParams = useSearchParams()\n\n const success = searchParams.get('success')\n const tokenHash = searchParams.get('token_hash')\n const type = searchParams.get('type')\n\n const [status, setStatus] = React.useState<Status>(success === 'true' ? 'success' : 'loading')\n const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n\n React.useEffect(() => {\n if (success === 'true') {\n setStatus('success')\n return\n }\n\n if (tokenHash && type) {\n // `token_hash` is single-use server-side — verifying it twice makes\n // the SECOND call fail even though the first already succeeded. React\n // Strict Mode's dev-only mount→cleanup→mount double-invoke would\n // otherwise fire this fetch twice for the same token. Aborting the\n // in-flight request on cleanup stops the CLIENT from processing that\n // first response and swallows its `AbortError` below instead of\n // surfacing a false \"confirmation failed\" — but `abort()` cannot\n // retroactively un-send a request that already reached base-api\n // before cleanup ran, so this reduces rather than deterministically\n // eliminates the double-POST race (in practice React's dev\n // double-invoke runs both phases synchronously in the same commit, so\n // the abort typically wins, but that is not a spec guarantee). A\n // fully deterministic fix needs server-side idempotency on\n // `verify-otp`, which is out of this package's control. The same\n // abort also guards a genuine unmount mid-request.\n const controller = new AbortController()\n setStatus('loading')\n fetch(confirmUrl, {\n method: 'POST',\n credentials: 'same-origin',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ token_hash: tokenHash, type }),\n signal: controller.signal,\n })\n .then(async (res) => {\n const json = (await res.json().catch(() => ({}))) as {\n data?: { sessionExchangeUrl?: string; success?: boolean }\n error?: string\n }\n\n if (!res.ok) {\n setStatus('error')\n setErrorMessage(json.error ?? c.errorMessage)\n return\n }\n\n if (json.data?.sessionExchangeUrl) {\n if (!isSafeRedirectUrl(json.data.sessionExchangeUrl)) {\n setStatus('error')\n setErrorMessage(c.errorMessage)\n return\n }\n window.location.assign(json.data.sessionExchangeUrl)\n return\n }\n\n setStatus('success')\n })\n .catch((err: unknown) => {\n if (err instanceof Error && err.name === 'AbortError') return\n setStatus('error')\n setErrorMessage(c.errorMessage)\n })\n\n return () => controller.abort()\n }\n\n // Neither success=true nor token_hash+type — nothing to confirm.\n setStatus('error')\n // `c.errorMessage` (derived from the `copy` prop) is intentionally\n // excluded: re-running this effect on every `copy` object identity\n // change would re-fire the fetch. The URL params are the only real\n // trigger for this effect.\n // eslint-disable-next-line react-hooks/exhaustive-deps\n }, [success, tokenHash, type, confirmUrl])\n\n if (status === 'loading') {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <p className='text-muted-foreground text-sm'>{c.loadingMessage}</p>\n </div>\n )\n }\n\n if (status === 'error') {\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.errorTitle}</h2>\n <p className='text-muted-foreground text-sm'>{errorMessage ?? c.errorMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.errorCta}\n </a>\n </div>\n )\n }\n\n return (\n <div className={cn('space-y-4 text-center', className)}>\n <h2 className='text-lg font-semibold'>{c.successTitle}</h2>\n <p className='text-muted-foreground text-sm'>{c.successMessage}</p>\n <a href={loginUrl} className='text-primary inline-block text-sm hover:underline'>\n {c.successCta}\n </a>\n </div>\n )\n}\n"],"mappings":";;;AAEA,YAAY,WAAW;AACvB,SAAS,QAAQ,OAAO,UAAU;AAClC,SAAS,aAAa;AACtB,SAAS,MAAM,UAAU,aAAa,mBAAmB;;;AC6BlD,SAAS,kBAAkB,KAAsB;AACtD,MAAI,CAAC,IAAK,QAAO;AAOjB,QAAM,QAAQ,IAAI,QAAQ,aAAa,EAAE;AACzC,MAAI,CAAC,MAAO,QAAO;AAInB,MAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AAEpC,QAAM,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AAC/C,SAAO,CAAC,QAAQ,OAAO,EAAE,SAAS,MAAM,KAAK,MAAM,WAAW,GAAG;AACnE;;;AClBO,IAAM,8BAA8B;;;ACPpC,IAAM,6BAA6B;AAGnC,SAAS,yBAA+B;AAC7C,MAAI,OAAO,WAAW,YAAa;AACnC,SAAO,cAAc,IAAI,YAAY,0BAA0B,CAAC;AAClE;AAMO,SAAS,qBAAqB,UAAkC;AACrE,MAAI,OAAO,WAAW,YAAa,QAAO,MAAM;AAAA,EAAC;AACjD,QAAM,UAAU,MAAM;AACpB,aAAS;AAAA,EACX;AACA,SAAO,iBAAiB,4BAA4B,OAAO;AAC3D,SAAO,MAAM;AACX,WAAO,oBAAoB,4BAA4B,OAAO;AAAA,EAChE;AACF;;;AH6TQ,SACE,KADF;AAjSR,IAAM,eAA8B;AAAA,EAClC,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvB,yBACE;AAAA,EACF,0BAA0B;AAAA,EAC1B,oBAAoB;AAAA,EACpB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,yBAAyB;AAAA,EACzB,qBAAqB;AACvB;AAEA,IAAM,cAAc;AAEpB,SAAS,aAAa,OAAwB;AAC5C,SAAO,YAAY,KAAK,KAAK;AAC/B;AA0BO,SAAS,UAAU,OAAuB;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,IAAI,EAAE,GAAG,cAAc,GAAG,KAAK;AAErC,QAAM,CAAC,QAAQ,SAAS,IAAU,eAAoC,aAAa;AACnF,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAoB,MAAM;AAC1D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAwB,IAAI;AAG5D,QAAM,CAAC,OAAO,QAAQ,IAAU,eAAS,EAAE;AAC3C,QAAM,CAAC,UAAU,WAAW,IAAU,eAAS,EAAE;AAGjD,QAAM,CAAC,KAAK,MAAM,IAAU,eAA0B,IAAI;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,eAAS,EAAE;AAG/C,QAAM,CAAC,cAAc,eAAe,IAAU,eAAS,CAAC;AAMxD,QAAM,oBAA0B,aAA2B,IAAI;AAM/D,QAAM,gBAAsB,aAAyB,IAAI;AACzD,QAAM,0BAAgC,aAAO,KAAK;AAMlD,QAAM,gBAAgB,eAAe;AACrC,EAAM,gBAAU,MAAM;AACpB,QAAI,CAAC,cAAe;AACpB,UAAM,KAAK,YAAY,MAAM;AAC3B,sBAAgB,CAAC,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC;AAAA,IAC3C,GAAG,GAAI;AACP,WAAO,MAAM;AACX,oBAAc,EAAE;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,aAAa,CAAC;AAElB,EAAM,gBAAU,MAAM;AACpB,QAAI,UAAU,qBAAsB,mBAAkB,SAAS,MAAM;AACrE,QAAI,UAAU,UAAU,wBAAwB,SAAS;AACvD,8BAAwB,UAAU;AAClC,oBAAc,SAAS,MAAM;AAAA,IAC/B;AAAA,EACF,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,sBAA4B,kBAAY,MAAM;AAClD,aAAS,MAAM;AACf,aAAS,IAAI;AACb,WAAO,IAAI;AACX,eAAW,EAAE;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM;AACzB,4BAAwB,UAAU;AAClC,wBAAoB;AAAA,EACtB;AAEA,QAAM,kBAAkB,CAAC,SAAiB;AACxC,QAAI,SAAS,gBAAgB,SAAS,WAAY;AAClD,cAAU,IAAI;AACd,wBAAoB;AAAA,EACtB;AAEA,QAAM,wBAAwB,OAAO,MAAwC;AAC3E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,qBAAqB;AAAA,QAC3C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,IAAI,IAAI;AACV,iBAAS,oBAAoB;AAC7B,wBAAgB,eAAe;AAI/B,+BAAuB;AACvB,+BAAuB,OAAO;AAC9B;AAAA,MACF;AAEA,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAAuB,OAAO,MAAwC;AAC1E,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAAC,aAAa,OAAO,GAAG;AAC1B,eAAS,EAAE,iBAAiB;AAC5B,eAAS,OAAO;AAChB;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,uBAAuB;AAClC,eAAS,OAAO;AAChB;AAAA,IACF;AAEA,aAAS,YAAY;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,QACxC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,SAAS,CAAC;AAAA,MACnD,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM;AACzB,iBAAS,OAAO;AAChB,iBAAS,KAAK,SAAS,EAAE,uBAAuB;AAChD;AAAA,MACF;AAEA,4BAAsB,OAAO;AAE7B,UAAI,KAAK,KAAK,aAAa;AACzB,eAAO;AAAA,UACL,UAAU,KAAK,KAAK,YAAY;AAAA,UAChC,aAAa,KAAK,KAAK,eAAe;AAAA,UACtC,cAAc,KAAK,KAAK,gBAAgB;AAAA,QAC1C,CAAC;AACD,iBAAS,cAAc;AACvB;AAAA,MACF;AAEA,YAAM,cAAc,KAAK,KAAK;AAC9B,UAAI,CAAC,eAAe,CAAC,kBAAkB,WAAW,GAAG;AACnD,iBAAS,OAAO;AAChB,iBAAS,EAAE,YAAY;AACvB;AAAA,MACF;AACA,aAAO,SAAS,OAAO,WAAW;AAAA,IACpC,QAAQ;AACN,eAAS,OAAO;AAChB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,MAAwC;AACrE,MAAE,eAAe;AACjB,QAAI,CAAC,IAAK;AACV,aAAS,IAAI;AACb,aAAS,YAAY;AAErB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,cAAc;AAAA,QACpC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,UAAU,IAAI;AAAA,UACd,MAAM;AAAA,UACN,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAE/C,UACE,CAAC,IAAI,MACL,CAAC,KAAK,MAAM,sBACZ,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAC/C;AAEA,iBAAS,cAAc;AACvB,iBAAS,KAAK,SAAS,EAAE,mBAAmB;AAC5C,mBAAW,EAAE;AACb;AAAA,MACF;AAEA,uBAAiB;AACjB,aAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AAAA,IACrD,QAAQ;AACN,eAAS,cAAc;AACvB,eAAS,EAAE,YAAY;AAAA,IACzB;AAAA,EACF;AAGA,MAAI,UAAU,kBAAmB,OAAO,UAAU,cAAe;AAC/D,WACE,qBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,QAAG,WAAU,yBAAyB,YAAE,UAAS;AAAA,QAClD,oBAAC,OAAE,WAAU,iCAAiC,YAAE,YAAW;AAAA,SAC7D;AAAA,MACA,qBAAC,UAAK,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,GAAG,WAAU,aAAY,YAAU,MAC9E;AAAA,6BAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,cAAa;AAAA,UAChD;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAQ;AAAA,cACR,WAAW;AAAA,cACX,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,OAAO,WAAW,GAAG,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cAC3E,UAAU,UAAU;AAAA,cACpB,oBAAkB,QAAQ,oBAAoB;AAAA,cAC9C,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,WAEJ;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UAAU,UAAU,gBAAgB,QAAQ,WAAW;AAAA,YAEtD,YAAE;AAAA;AAAA,QACL;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS;AAAA,YACT,WAAU;AAAA,YACV,UAAU,UAAU;AAAA,YACrB;AAAA;AAAA,QAED;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAOA,MAAI,UAAU,sBAAsB;AAClC,WACE,qBAAC,SAAI,WAAW,GAAG,yBAAyB,SAAS,GACnD;AAAA,0BAAC,QAAG,WAAU,yBAAwB,KAAK,mBAAmB,UAAU,IACrE,YAAE,uBACL;AAAA,MACA,oBAAC,OAAE,WAAU,yBAAyB,YAAE,yBAAwB;AAAA,MAShE,oBAAC,SAAI,MAAK,UAAS,aAAU,UAAS,WAAU,WAC7C,yBAAe,IAAI,KAAK,EAAE,oBAC7B;AAAA,MACC,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMd,oBAAC,OAAE,WAAU,iCACV,YAAE,yBAAyB,WAAW,aAAa,OAAO,YAAY,CAAC,GAC1E;AAAA,UAEA,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,cAC9C,YAAE,oBACL;AAAA,OAEJ;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAW,GAAG,aAAa,SAAS,GACvC,+BAAC,QAAK,OAAO,QAAQ,eAAe,iBAClC;AAAA,yBAAC,YAAS,WAAU,2BAClB;AAAA,0BAAC,eAAY,OAAM,YAAY,YAAE,kBAAiB;AAAA,MAClD,oBAAC,eAAY,OAAM,cAAc,YAAE,mBAAkB;AAAA,OACvD;AAAA,IAEA,oBAAC,eAAY,OAAM,YAAW,WAAU,QACtC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,GAAG,WAAU,aAAY,YAAU,MACnF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,YAAW;AAAA,QAC/C;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA;AAAA,QACtB;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,6BAAC,SAAI,WAAU,qCACb;AAAA,8BAAC,SAAM,SAAQ,kBAAkB,YAAE,eAAc;AAAA,UACjD;AAAA,YAAC;AAAA;AAAA,cACC,MAAM;AAAA,cACN,WAAU;AAAA,cAET,YAAE;AAAA;AAAA,UACL;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,YAAY,GAAG,OAAO,KAAK;AAAA,YAC7C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,oBAAoB;AAAA;AAAA,QAChD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,mBAAkB,MAAK,SAAQ,WAAU,4BAC5C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,mBACL;AAAA,OACF,GACF;AAAA,IAEA,oBAAC,eAAY,OAAM,cAAa,WAAU,QACxC,+BAAC,UAAK,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,GAAG,WAAU,aAAY,YAAU,MACpF;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,qBAAqB,YAAE,YAAW;AAAA,QACjD;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,KAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAa,EAAE;AAAA,YACf,OAAO;AAAA,YACP,UAAU,CAAC,OAAO,SAAS,GAAG,OAAO,KAAK;AAAA,YAC1C,UAAU,UAAU;AAAA,YACpB,oBAAkB,QAAQ,sBAAsB;AAAA;AAAA,QAClD;AAAA,QACC,SACC,oBAAC,OAAE,IAAG,qBAAoB,MAAK,SAAQ,WAAU,4BAC9C,iBACH;AAAA,SAEJ;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,UAAS,UAAU,UAAU,cAC1D,YAAE,oBACL;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;;;AIrhBA,YAAYA,YAAW;AACvB,SAAS,UAAAC,SAAQ,MAAAC,WAAU;AAsOjB,SACE,OAAAC,MADF,QAAAC,aAAA;AAlLV,IAAM,0BAA4C,CAAC,WAAW,WAAW,WAAW;AAEpF,IAAMC,gBAAiC;AAAA,EACrC,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,cAAc;AAChB;AAEA,SAAS,UAAU,MAAsE;AACvF,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AACnD,QAAM,gBAAgB,OAAO,IAAI,eAAe,KAAK;AACrD,QAAM,OAAO,OAAO,IAAI,MAAM,KAAK;AACnC,MAAI,CAAC,gBAAgB,CAAC,iBAAiB,SAAS,YAAa,QAAO;AACpE,SAAO,EAAE,cAAc,cAAc;AACvC;AASA,SAAS,eAAe,MAA8C;AACpE,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,YAAY,OAAO,IAAI,YAAY;AACzC,MAAI,CAAC,SAAS,CAAC,UAAW,QAAO;AAEjC,SAAO,cAAc,iBAAiB,UAAU,kBAAkB,YAAY;AAChF;AAEO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAsB;AACpB,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAgB,UAAU;AAC1D,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAGxB,IAAI;AACd,QAAM,WAAiB,cAA0B,IAAI;AACrD,QAAM,UAAgB,cAA0B,IAAI;AACpD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,QAAM,WAAiB;AAAA,IACrB,OAAO,MAAuD;AAC5D,eAAS,YAAY;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,aAAa;AAAA,UACnC,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,CAAC;AAAA,QACxB,CAAC;AAED,YAAI,IAAI,IAAI;AACV,gBAAM,MAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,aACJ,QAAQ,QACR,OAAO,QAAQ,YACf,gBAAgB,OAChB,OAAQ,IAAgC,eAAe,WAClD,IAA+B,aAChC;AAEN,cAAI,CAAC,YAAY;AACf,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAKA,cAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,qBAAS,SAAS;AAClB,sBAAU,WAAW,MAAS;AAC9B;AAAA,UACF;AAEA,kBAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,QAAQ;AACrD,iBAAO,SAAS,QAAQ,UAAU;AAClC,mBAAS,SAAS;AAClB,sBAAY,UAAU;AACtB;AAAA,QACF;AAEA,YAAI,IAAI,WAAW,KAAK;AACtB,mBAAS,SAAS;AAClB,oBAAU,SAAS;AACnB;AAAA,QACF;AAEA,iBAAS,SAAS;AAClB,kBAAU,WAAW,MAAS;AAAA,MAChC,SAAS,KAAK;AACZ,iBAAS,SAAS;AAClB,kBAAU,WAAW,eAAe,QAAQ,MAAM,MAAS;AAAA,MAC7D;AAAA,IACF;AAAA,IACA,CAAC,aAAa,SAAS,SAAS;AAAA,EAClC;AAEA,EAAM,iBAAU,MAAM;AACpB,aAAS,SAAS;AAGlB,UAAM,YAAY,eAAe,OAAO,SAAS,IAAI;AACrD,QAAI,WAAW;AACb,eAAS,SAAS;AAClB,gBAAU,SAAS;AACnB;AAAA,IACF;AACA,UAAM,SAAS,UAAU,OAAO,SAAS,IAAI;AAC7C,QAAI,CAAC,QAAQ;AACX,eAAS,WAAW;AACpB,gBAAU,WAAW;AACrB;AAAA,IACF;AACA,cAAU,MAAM;AAChB,SAAK,SAAS,MAAM;AAAA,EAOtB,GAAG,CAAC,CAAC;AAEL,EAAM,iBAAU,MAAM;AACpB,QAAI,UAAU,UAAW,UAAS,SAAS,MAAM;AACjD,QAAI,UAAU,aAAa,UAAU,YAAa,SAAQ,SAAS,MAAM;AAAA,EAC3E,GAAG,CAAC,KAAK,CAAC;AAKV,EAAM;AAAA,IACJ,MACE,qBAAqB,MAAM;AACzB,eAAS,CAAC,YAAa,wBAAwB,SAAS,OAAO,IAAI,UAAU,OAAQ;AAAA,IACvF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,UAAU,cAAc,UAAU,aAAa,UAAU;AAO3E,MAAI,UAAU,QAAS,QAAO;AAE9B,SACE,gBAAAF,KAAC,UAAK,WAAWG,IAAG,iDAAiD,SAAS,GAC5E,0BAAAF,MAAC,SAAI,aAAU,UAAS,WAAU,6CAC/B;AAAA,iBACC,gBAAAA,MAAC,aACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,8BAA8B,YAAE,gBAAe;AAAA,OAC9D;AAAA,IAGD,UAAU,aACT,gBAAAA,KAAC,aACC,0BAAAA,KAAC,OAAG,YAAE,gBAAe,GACvB;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACvD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,YACL,GACF;AAAA,OACF;AAAA,IAGD,UAAU,aACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,qBAAoB;AAAA,MAC5D,gBAAAC,MAAC,SAAI,WAAU,uBACb;AAAA,wBAAAD,KAACI,SAAA,EAAO,MAAK,UAAS,KAAK,UAAU,SAAS,MAAM,UAAU,KAAK,SAAS,MAAM,GAC/E,YAAE,sBACL;AAAA,QACA,gBAAAJ,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAW,YAAE,qBAAoB,GAC5C;AAAA,SACF;AAAA,OACF;AAAA,IAGD,UAAU,eACT,gBAAAC,MAAC,aAAQ,WAAU,aACjB;AAAA,sBAAAD,KAAC,QAAG,WAAU,yBAAyB,YAAE,gBAAe;AAAA,MACxD,gBAAAA,KAAC,OAAE,WAAU,yBAAyB,YAAE,kBAAiB;AAAA,MACzD,gBAAAA,KAACI,SAAA,EAAO,SAAO,MAAC,SAAQ,WACtB,0BAAAJ,KAAC,OAAE,MAAM,UAAU,KAAK,SACrB,YAAE,cACL,GACF;AAAA,OACF;AAAA,KAEJ,GACF;AAEJ;;;AChQA,IAAMK,gBAA+B;AAAA,EACnC,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AAEO,SAAS,cACd,OACA,MACuB;AACvB,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,eAAe,GAAI,QAAO;AAE9B,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AAErC,MACE,WAAW,SAAS,sCAAsC,KAC1D,WAAW,SAAS,iCAAiC,GACrD;AACA,WAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAAA,EAC5D;AAEA,MAAI,WAAW,SAAS,eAAe,GAAG;AACxC,WAAO,EAAE,SAAS,EAAE,qBAAqB,iBAAiB,KAAK;AAAA,EACjE;AAEA,SAAO,EAAE,SAAS,EAAE,gBAAgB,iBAAiB,KAAK;AAC5D;;;ACzDA,YAAYC,YAAW;AACvB,SAAS,gBAAgB;AACzB,SAAS,MAAAC,WAAU;AAqIb,gBAAAC,YAAA;AAzFN,IAAMC,gBAA8D;AAAA,EAClE,eAAe;AACjB;AAEA,IAAM,gBAAwD;AAAA,EAC5D,UAAU;AAAA,EACV,SAAS;AACX;AAQA,IAAM,yBAA4F;AAAA,EAChG,UAAU,EAAE,OAAO,KAAK,QAAQ,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,IAAI,QAAQ,GAAG;AACnC;AAkBO,SAAS,SAAS,OAAsB;AAC7C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,mBAAmB;AAAA,EACrB,IAAI;AACJ,QAAM,gBAAgB,MAAM,iBAAiBA,cAAa;AAC1D,QAAM,EAAE,cAAc,IAAI,SAAS;AACnC,QAAM,SAAS,kBAAkB;AAEjC,QAAM,WAAW,YAAY,YAAY,oBAAoB;AAC7D,QAAM,UAAU,YAAY,YAAY,mBAAmB;AAC3D,QAAM,UAAU,SAAS,UAAU;AAMnC,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,KAAK;AACpD,EAAM,iBAAU,MAAM;AACpB,gBAAY,KAAK;AAAA,EACnB,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,eAAe,YAAY;AAOjC,QAAM,UAAU,MAAM,YAAY,SAAY,KAAK,UAAU,YAAY;AAMzE,QAAM,UAAU,IAAI,YAAY;AAEhC,MAAI,WAAW,CAAC,UAAU;AACxB,UAAM,EAAE,OAAO,OAAO,IAAI,uBAAuB,OAAO;AAKxD,UAAM,OAAO,oBAAoB,YAAY;AAC7C,UAAM,QACJ,gBAAAD;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,WAAWD,IAAG,cAAc,OAAO,GAAG,cAAc,QAAQ,SAAS;AAAA,QACrE,SAAS,MAAM,YAAY,IAAI;AAAA;AAAA,IACjC;AAEF,QAAI,KAAM,QAAO;AAIjB,WAAO,gBAAAC,KAAC,WAAQ,WAAWD,IAAG,uCAAuC,SAAS,GAAI,iBAAM;AAAA,EAC1F;AAEA,MAAI,iBAAkB,QAAO;AAI7B,SACE,gBAAAC,KAAC,WAAQ,WAAWD,IAAG,qDAAqD,SAAS,GAClF,wBACH;AAEJ;;;AChKA,YAAYG,YAAW;AACvB,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAsGhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhFN,IAAMC,gBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBACE;AAAA,EACF,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,cAAc;AAChB;AAEA,IAAMC,eAAc;AAOb,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,MAAM,WAAW,YAAY,IAAI;AAC/D,QAAM,IAAI,EAAE,GAAGD,eAAc,GAAG,KAAK;AAErC,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAS,EAAE;AAC3C,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,WAAW,YAAY,IAAU,gBAAS,KAAK;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AAEb,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAI,CAACC,aAAY,KAAK,OAAO,GAAG;AAC9B,eAAS,EAAE,iBAAiB;AAC5B;AAAA,IACF;AAEA,eAAW,IAAI;AAKf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,MACzC,CAAC;AAED,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,mBAAa,IAAI;AACjB,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AACb,UAAI;AACF,sBAAc,OAAO;AAAA,MACvB,SAAS,KAAK;AACZ,gBAAQ,MAAM,sDAAsD,GAAG;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW;AACb,WACE,gBAAAF,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,MACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,MAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,uBAAuB,YAAE,YAAW;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,cACxC,UAAU;AAAA,cACV,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACC,SACC,gBAAAG,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,WAEJ;AAAA,QACA,gBAAAA,KAACJ,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,SAChD,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA,QACA,gBAAAI,KAAC,SAAI,WAAU,eACb,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,WAAU;AAAA,YAET,YAAE;AAAA;AAAA,QACL,GACF;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACxJA,YAAYI,YAAW;AACvB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAyKhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAhKN,SAAS,eAAe,KAAa,KAAa,OAAuB;AACvE,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,MAAM;AAC5C,SAAO,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC;AAC9D;AA8BA,IAAMC,gBAAyC;AAAA,EAC7C,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,gBACE;AAAA,EACF,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,mBAAmB;AACrB;AAaO,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,YAAY,UAAU,iBAAiB,MAAM,WAAW,UAAU,IAAI;AAC9E,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AAErC,QAAM,cAAc,aAAa,IAAI,cAAc;AACnD,QAAM,eAAe,aAAa,IAAI,eAAe;AACrD,QAAM,YAAY,QAAQ,eAAe,YAAY;AAErD,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAU,gBAAS,KAAK;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,EAAE;AAE/C,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,UAAW;AAEhB,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,eAAe,CAAC,UAAU,KAAK,OAAO,GAAG;AAC3C,eAAS,EAAE,mBAAmB;AAC9B;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,YAAY;AAAA,QAClC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,cAAc;AAAA,UACd,eAAe;AAAA,UACf,cAAc;AAAA,UACd,GAAI,cAAc,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,IAAI;AACX,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,KAAK,MAAM,aAAa;AAC1B,uBAAe,IAAI;AACnB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,kBAAY;AACZ,iBAAW,KAAK;AAAA,IAClB,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAEA,QAAI,WAAW;AAKb,aAAO,QAAQ,eAAe,UAAU,SAAS,SAAS,CAAC;AAC3D,UAAI;AACF,oBAAY;AAAA,MACd,SAAS,KAAK;AACZ,gBAAQ,MAAM,oDAAoD,GAAG;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WACE,gBAAAD,MAAC,SAAI,WAAWH,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAE,KAAC,QAAG,WAAU,yBAAyB,YAAE,oBAAmB;AAAA,MAC5D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,sBAAqB;AAAA,MACrE,gBAAAA,KAAC,OAAE,MAAM,iBAAiB,WAAU,qDACjC,YAAE,mBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWH,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAG,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,0BAA0B,YAAE,eAAc;AAAA,UACzD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,4BAA4B,YAAE,sBAAqB;AAAA,UAClE,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA;AAAA,UACpD;AAAA,WACF;AAAA,QACC,eACC,gBAAAI,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACD,QAAA,EAAM,SAAQ,qBAAqB,YAAE,cAAa;AAAA,UACnD,gBAAAC;AAAA,YAACH;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,WAAU;AAAA,cACV,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,cACzE,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,wBAAwB;AAAA,cAClD,WAAS;AAAA;AAAA,UACX;AAAA,UACA,gBAAAG,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,WACjE;AAAA,QAED,SACC,gBAAAA,KAAC,OAAE,IAAG,uBAAsB,MAAK,SAAQ,WAAU,4BAChD,iBACH;AAAA,QAEF,gBAAAA;AAAA,UAACJ;AAAA,UAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,UACE,WAAW,CAAC,YAAY,CAAC,mBAAoB,eAAe,QAAQ,WAAW;AAAA,YAGhF,oBAAU,EAAE,gBAAgB,EAAE;AAAA;AAAA,QACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5PA,YAAYO,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,UAAAC,SAAQ,SAAAC,QAAO,MAAAC,WAAU;AAClC,SAAS,SAAAC,cAAa;AAmIhB,SACE,OAAAC,MADF,QAAAC,aAAA;AAzGN,IAAMC,gBAAgC;AAAA,EACpC,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,WAAW;AAAA,EACX,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,gBAAgB;AAClB;AASO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,WAAW,UAAU,MAAM,WAAW,UAAU,IAAI;AAC5D,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AACrC,QAAM,uBAAuB,aAAa,IAAI,wBAAwB;AAEtE,QAAM,CAAC,UAAU,WAAW,IAAU,gBAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAU,gBAAS,EAAE;AAC/D,QAAM,CAAC,SAAS,UAAU,IAAU,gBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAU,gBAAwB,IAAI;AAE5D,QAAM,eAAe,OAAO,MAAwC;AAClE,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,QAAI,CAAC,qBAAsB;AAE3B,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,qBAAqB;AAChC;AAAA,IACF;AAEA,eAAW,IAAI;AAMf,QAAI,qBAAoC;AACxC,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,WAAW;AAAA,QACjC,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,wBAAwB;AAAA,UACxB,cAAc;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAED,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,UAAI,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM,oBAAoB;AAC7C,iBAAS,KAAK,SAAS,EAAE,YAAY;AACrC,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,UAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,iBAAS,EAAE,YAAY;AACvB,mBAAW,KAAK;AAChB;AAAA,MACF;AAEA,2BAAqB,KAAK,KAAK;AAAA,IACjC,QAAQ;AACN,eAAS,EAAE,YAAY;AACvB,iBAAW,KAAK;AAChB;AAAA,IACF;AAQA,WAAO,SAAS,OAAO,kBAAkB;AACzC,QAAI;AACF,kBAAY,kBAAkB;AAAA,IAChC,SAAS,KAAK;AACZ,cAAQ,MAAM,2CAA2C,GAAG;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,CAAC,sBAAsB;AACzB,WACE,gBAAAF,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,mBAAkB;AAAA,MAC3D,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,qBAAoB;AAAA,MACpE,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,gBACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC;AAAA,IAAC;AAAA;AAAA,MACC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC;AAAA,MACpC,WAAWG,IAAG,aAAa,SAAS;AAAA,MACpC,YAAU;AAAA,MAEV;AAAA,wBAAAH,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,yBAAyB,YAAE,eAAc;AAAA,UACxD,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,cAC3C,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA,cAIjD,WAAS;AAAA;AAAA,UACX;AAAA,WACF;AAAA,QACA,gBAAAL,MAAC,SAAI,WAAU,eACb;AAAA,0BAAAD,KAACK,QAAA,EAAM,SAAQ,wBAAwB,YAAE,sBAAqB;AAAA,UAC9D,gBAAAL;AAAA,YAACM;AAAA,YAAA;AAAA,cACC,IAAG;AAAA,cACH,MAAK;AAAA,cACL,cAAa;AAAA,cACb,aAAa,EAAE;AAAA,cACf,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,cAClD,UAAU;AAAA,cACV,WAAW;AAAA,cACX,oBAAkB,QAAQ,uBAAuB;AAAA;AAAA,UACnD;AAAA,WACF;AAAA,QACC,SACC,gBAAAN,KAAC,OAAE,IAAG,sBAAqB,MAAK,SAAQ,WAAU,4BAC/C,iBACH;AAAA,QAEF,gBAAAA,KAACO,SAAA,EAAO,MAAK,UAAS,WAAU,UAAS,UAAU,WAAW,CAAC,YAAY,CAAC,iBACzE,oBAAU,EAAE,gBAAgB,EAAE,WACjC;AAAA;AAAA;AAAA,EACF;AAEJ;;;AChMA,YAAYC,YAAW;AACvB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,MAAAC,WAAU;AAoIX,gBAAAC,MAOF,QAAAC,aAPE;AAhHR,IAAMC,gBAAgC;AAAA,EACpC,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,UAAU;AACZ;AAgBO,SAAS,YAAY,OAAyB;AACnD,QAAM,EAAE,YAAY,UAAU,MAAM,UAAU,IAAI;AAClD,QAAM,IAAI,EAAE,GAAGA,eAAc,GAAG,KAAK;AACrC,QAAM,eAAeC,iBAAgB;AAErC,QAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,QAAM,YAAY,aAAa,IAAI,YAAY;AAC/C,QAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAM,CAAC,QAAQ,SAAS,IAAU,gBAAiB,YAAY,SAAS,YAAY,SAAS;AAC7F,QAAM,CAAC,cAAc,eAAe,IAAU,gBAAwB,IAAI;AAE1E,EAAM,iBAAU,MAAM;AACpB,QAAI,YAAY,QAAQ;AACtB,gBAAU,SAAS;AACnB;AAAA,IACF;AAEA,QAAI,aAAa,MAAM;AAgBrB,YAAM,aAAa,IAAI,gBAAgB;AACvC,gBAAU,SAAS;AACnB,YAAM,YAAY;AAAA,QAChB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,YAAY,WAAW,KAAK,CAAC;AAAA,QACpD,QAAQ,WAAW;AAAA,MACrB,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAK/C,YAAI,CAAC,IAAI,IAAI;AACX,oBAAU,OAAO;AACjB,0BAAgB,KAAK,SAAS,EAAE,YAAY;AAC5C;AAAA,QACF;AAEA,YAAI,KAAK,MAAM,oBAAoB;AACjC,cAAI,CAAC,kBAAkB,KAAK,KAAK,kBAAkB,GAAG;AACpD,sBAAU,OAAO;AACjB,4BAAgB,EAAE,YAAY;AAC9B;AAAA,UACF;AACA,iBAAO,SAAS,OAAO,KAAK,KAAK,kBAAkB;AACnD;AAAA,QACF;AAEA,kBAAU,SAAS;AAAA,MACrB,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,eAAe,SAAS,IAAI,SAAS,aAAc;AACvD,kBAAU,OAAO;AACjB,wBAAgB,EAAE,YAAY;AAAA,MAChC,CAAC;AAEH,aAAO,MAAM,WAAW,MAAM;AAAA,IAChC;AAGA,cAAU,OAAO;AAAA,EAMnB,GAAG,CAAC,SAAS,WAAW,MAAM,UAAU,CAAC;AAEzC,MAAI,WAAW,WAAW;AACxB,WACE,gBAAAH,KAAC,SAAI,WAAWI,IAAG,yBAAyB,SAAS,GACnD,0BAAAJ,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe,GACjE;AAAA,EAEJ;AAEA,MAAI,WAAW,SAAS;AACtB,WACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,sBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,YAAW;AAAA,MACpD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,0BAAgB,EAAE,cAAa;AAAA,MAC7E,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,UACL;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,gBAAAC,MAAC,SAAI,WAAWG,IAAG,yBAAyB,SAAS,GACnD;AAAA,oBAAAJ,KAAC,QAAG,WAAU,yBAAyB,YAAE,cAAa;AAAA,IACtD,gBAAAA,KAAC,OAAE,WAAU,iCAAiC,YAAE,gBAAe;AAAA,IAC/D,gBAAAA,KAAC,OAAE,MAAM,UAAU,WAAU,qDAC1B,YAAE,YACL;AAAA,KACF;AAEJ;","names":["React","Button","cn","jsx","jsxs","DEFAULT_COPY","cn","Button","DEFAULT_COPY","React","cn","jsx","DEFAULT_COPY","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","EMAIL_REGEX","React","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","React","useSearchParams","Button","Input","cn","Label","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn","Label","Input","Button","React","useSearchParams","cn","jsx","jsxs","DEFAULT_COPY","useSearchParams","cn"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@reblu/site-next",
3
- "version": "1.6.0",
3
+ "version": "1.7.1",
4
4
  "description": "Next.js RSC glue for Reblu SITEs — cache + CTA + auth server/client components.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Reblu — Adolfo Unturbe",
@@ -25,7 +25,8 @@
25
25
  "type": "module",
26
26
  "sideEffects": false,
27
27
  "files": [
28
- "dist"
28
+ "dist",
29
+ "CHANGELOG.md"
29
30
  ],
30
31
  "main": "./dist/index.cjs",
31
32
  "module": "./dist/index.js",
@@ -121,9 +122,9 @@
121
122
  "react": ">=19"
122
123
  },
123
124
  "dependencies": {
124
- "@reblu/site-client": "^4.0.0",
125
- "@reblu/site-contracts": "^0.5.0",
126
- "@reblu/site-ui": "^0.5.0"
125
+ "@reblu/site-client": "^5.0.1",
126
+ "@reblu/site-contracts": "^1.0.1",
127
+ "@reblu/site-ui": "^0.5.1"
127
128
  },
128
129
  "devDependencies": {
129
130
  "@testing-library/jest-dom": "^6.9.1",