@singlebase/elements 0.6.0 → 0.8.0

package/dist/{authui-display-CKfGK5va.js → authui-display-CRUABt43.js}

@@ -1,18 +1,18 @@
-var is = Object.defineProperty;
-var Ae = (l) => {
-  throw TypeError(l);
+var us = Object.defineProperty;
+var qe = (a) => {
+  throw TypeError(a);
 };
-var as = (l, t, e) => t in l ? is(l, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : l[t] = e;
-var b = (l, t, e) => as(l, typeof t != "symbol" ? t + "" : t, e), Me = (l, t, e) => t.has(l) || Ae("Cannot " + e);
-var r = (l, t, e) => (Me(l, t, "read from private field"), e ? e.call(l) : t.get(l)), n = (l, t, e) => t.has(l) ? Ae("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(l) : t.set(l, e), o = (l, t, e, s) => (Me(l, t, "write to private field"), s ? s.call(l, e) : t.set(l, e), e);
-import { LitElement as rs, html as a, nothing as d, css as Ge } from "lit";
-import { property as p, state as m, customElement as ye } from "lit/decorators.js";
-import { ifDefined as k } from "lit/directives/if-defined.js";
-import { SinglebaseAuthError as Ce, mapErrorToHint as ns, createFilesUploadApi as os, resolveScreen as ls } from "@singlebase/singlebase-sdk";
-import { s as hs, r as ds } from "./uploader-vfczkX51.js";
-import { t as cs, b as us, j as ps } from "./files-DDJWPzZW.js";
-import { getDefaultClient as gs, AUTHUI_PROP_KEYS as ms, authUIAttributeFor as bs, matchesPredicate as fs, validatePredicate as vs, getPath as Ne } from "@singlebase/core";
-class ws {
+var ps = (a, t, e) => t in a ? us(a, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : a[t] = e;
+var b = (a, t, e) => ps(a, typeof t != "symbol" ? t + "" : t, e), je = (a, t, e) => t.has(a) || qe("Cannot " + e);
+var n = (a, t, e) => (je(a, t, "read from private field"), e ? e.call(a) : t.get(a)), o = (a, t, e) => t.has(a) ? qe("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(a) : t.set(a, e), l = (a, t, e, s) => (je(a, t, "write to private field"), s ? s.call(a, e) : t.set(a, e), e);
+import { LitElement as gs, nothing as d, html as r, css as ts } from "lit";
+import { property as p, state as m, customElement as Te } from "lit/decorators.js";
+import { ifDefined as A } from "lit/directives/if-defined.js";
+import { SinglebaseAuthError as Ne, mapErrorToHint as ms, createFilesUploadApi as bs, resolveScreen as fs } from "@singlebase/singlebase-sdk";
+import { s as vs, r as ws } from "./uploader-Cz9yfzfV.js";
+import { t as $s, b as ys, j as Es } from "./files-DS-H-3yN.js";
+import { getDefaultClient as Ss, AUTHUI_PROP_KEYS as Cs, authUIAttributeFor as Ps, matchesPredicate as _s, validatePredicate as ks, getPath as Ke } from "@singlebase/core";
+class Ts {
   constructor(t) {
     b(this, "host");
     b(this, "client", null);
@@ -31,7 +31,7 @@ class ws {
     (t = this.unsubscribe) == null || t.call(this), this.unsubscribe = null;
   }
 }
-const Ie = {
+const Ve = {
   signInTitle: "Sign in",
   signUpTitle: "Create your account",
   forgotTitle: "Reset your password",
@@ -61,7 +61,7 @@ const Ie = {
   emailMethodMetaSignUp: "Create with an address",
   emailMethodMetaOtp: "One-time code",
   oauthMethodTitle: "Single sign-on",
-  oauthMethodMeta: "Google, GitHub, and more",
+  oauthMethodMeta: "Use an account you already have",
   fullNameLabel: "Full name",
   fullNamePlaceholder: "Ada Lovelace",
   emailLabel: "Email",
@@ -69,10 +69,17 @@ const Ie = {
   passwordLabel: "Password",
   passwordPlaceholder: "••••••••",
   newPasswordLabel: "New password",
-  newPasswordPlaceholder: "At least 10 characters",
+  newPasswordPlaceholder: "At least {min} characters",
+  newPasswordPlaceholderPlain: "Choose a password",
+  passwordRulesLabel: "Password requirements",
+  passwordRuleLength: "{min}–{max} characters",
+  passwordRuleMinLength: "At least {min} characters",
+  passwordRuleLowercase: "A lowercase letter",
+  passwordRuleUppercase: "An uppercase letter",
+  passwordRuleNumber: "A number",
+  passwordRuleSymbol: "A symbol",
   confirmPasswordLabel: "Confirm password",
   confirmPasswordPlaceholder: "Repeat it",
-  currentPasswordLabel: "Current password",
   firstNameLabel: "First name",
   firstNamePlaceholder: "Ada",
   lastNameLabel: "Last name",
@@ -88,7 +95,6 @@ const Ie = {
   footActionSignUp: "Sign in",
   resendQuestion: "Did not get it?",
   resendCta: "Resend code",
-  oauthPrimaryLabel: "Continue with Google",
   oauthContinueWith: "Continue with",
   blockedTitleDisabled: "Sign-in is turned off",
   blockedTitleUnavailable: "Sign-in unavailable",
@@ -136,14 +142,32 @@ const Ie = {
   newUsernameLabel: "New username",
   changeUsernameCta: "Send verification code",
   genericErrorMessage: "Something went wrong. Please try again.",
-  rateLimitedMessage: "Too many attempts. Try again in 5 minutes or reset your password.",
+  rateLimitedMessage: "Too many attempts. Wait a few minutes, then try again.",
   codeSentNeutral: "If an eligible account exists, a code has been sent.",
   invalidEmailError: "Enter a valid email address.",
   requiredError: "This cannot be empty.",
-  passwordMinError: "Use at least 10 characters.",
+  passwordTooShortError: "Use at least {min} characters.",
+  passwordTooLongError: "Use at most {max} characters.",
+  passwordNeedsLowercaseError: "Include a lowercase letter.",
+  passwordNeedsUppercaseError: "Include an uppercase letter.",
+  passwordNeedsNumberError: "Include a number.",
+  passwordNeedsSymbolError: "Include a symbol.",
+  invalidPasswordMessage: "That password doesn't meet the requirements.",
   passwordMatchError: "Both passwords must match.",
+  invalidCodeError: "That code is not valid. Check it and try again.",
+  invalidCredentialsError: "That email and password do not match.",
+  codeResentNotice: "New code sent.",
+  confirmNewPasswordLabel: "Confirm new password",
+  notSignedInNote: "Not signed in.",
+  connectProviderLabel: "Connect {name}",
+  digitLabel: "Digit {n}",
+  accountCreatedNotice: "Account created. Sign in to continue.",
+  inviteCodeLabel: "Invite code",
+  submittingStatus: "Submitting…",
+  doneStatus: "Done.",
   codeIncompleteError: "Enter all six digits.",
   invalidPhoneError: "Enter a valid phone number.",
+  firstNameRequiredError: "Enter your first name.",
   notYetSupported: "Not yet supported",
   alreadySignedInTitle: "You are already signed in",
   alreadySignedInSub: "Continue where you left off, or sign out to use another account.",
@@ -161,68 +185,74 @@ const Ie = {
   changeEmailElsewhereHint: "Your email is changed below, with a verification step.",
   confirmChangeCta: "Confirm change",
   codeLabel: "Verification code",
-  brandingLabel: "Auth by Singlebase",
   linkRequiresSignIn: "Sign in first, then link a provider.",
   oauthCallbackTitle: "Finishing sign-in",
   oauthCallbackSub: "One moment while we complete your sign-in.",
-  oauthDenied: "Sign-in was cancelled or denied."
+  oauthDenied: "Sign-in was cancelled or denied.",
+  oauthRetryMessage: "We couldn't finish signing you in with that provider. Please try again.",
+  oauthUnavailableMessage: "This sign-in option isn't available right now.",
+  oauthVerifiedEmailMessage: "Your provider account needs a verified email address. Verify it with the provider, then try again.",
+  providerConnectedNotice: "{name} is now connected to your account.",
+  signInToLinkMessage: "An account with this email already exists. Sign in first, then connect the provider from your account.",
+  providerAlreadyLinkedMessage: "That provider account is already connected to another account.",
+  oauthNoAccountMessage: "There's no account for that provider yet. Create an account first, or sign in another way."
 };
-function $s(l) {
-  return l ? { ...Ie, ...l } : Ie;
+function Os(a) {
+  return a ? { ...Ve, ...a } : Ve;
 }
-var ys = Object.defineProperty, Es = Object.getOwnPropertyDescriptor, _ = (l, t, e, s) => {
-  for (var i = Es(t, e), h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = c(t, e, i) || i);
-  return i && ys(t, e, i), i;
-}, T, U, L, A, M, N;
-class $ extends rs {
+var Ns = Object.defineProperty, As = Object.getOwnPropertyDescriptor, L = (a, t, e, s) => {
+  for (var i = As(t, e), h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = c(t, e, i) || i);
+  return i && Ns(t, e, i), i;
+}, D, B, H, q, j, K;
+class y extends gs {
   constructor() {
     super(...arguments);
-    n(this, T, null);
-    n(this, U, {});
-    n(this, L);
-    n(this, A);
-    n(this, M);
-    n(this, N);
-    b(this, "auth", new ws(this));
+    o(this, D, null);
+    o(this, B, {});
+    o(this, H);
+    o(this, q);
+    o(this, j);
+    o(this, K);
+    b(this, "auth", new Ts(this));
     /** Config keys already applied, so a later render does not fight the host. */
     b(this, "appliedConfig", /* @__PURE__ */ new Set());
   }
   get client() {
-    return r(this, T);
+    return n(this, D);
   }
   set client(e) {
-    o(this, T, e);
+    l(this, D, e);
   }
   get messages() {
-    return r(this, U);
+    return n(this, B);
   }
   set messages(e) {
-    o(this, U, e);
+    l(this, B, e);
   }
   get theme() {
-    return r(this, L);
+    return n(this, H);
   }
   set theme(e) {
-    o(this, L, e);
+    l(this, H, e);
   }
   get density() {
-    return r(this, A);
+    return n(this, q);
   }
   set density(e) {
-    o(this, A, e);
+    l(this, q, e);
   }
   get fieldStyle() {
-    return r(this, M);
+    return n(this, j);
   }
   set fieldStyle(e) {
-    o(this, M, e);
+    l(this, j, e);
   }
   get radius() {
-    return r(this, N);
+    return n(this, K);
   }
   set radius(e) {
-    o(this, N, e);
+    l(this, K, e);
   }
   /**
    * Resolution order: an explicit `.client`, then the page's default
@@ -238,7 +268,7 @@ class $ extends rs {
    */
   get resolvedClient() {
     var e;
-    return this.client ? this.client : ((e = gs()) == null ? void 0 : e.auth) ?? null;
+    return this.client ? this.client : ((e = Ss()) == null ? void 0 : e.auth) ?? null;
   }
   /** Page-wide UI config from SinglebaseClient({ authui }), if there is one. */
   get uiConfig() {
@@ -252,7 +282,7 @@ class $ extends rs {
   get msg() {
     var s;
     const e = (s = this.uiConfig) == null ? void 0 : s.messages;
-    return $s(e ? { ...e, ...this.messages } : this.messages);
+    return Os(e ? { ...e, ...this.messages } : this.messages);
   }
   /**
    * Copies the page-wide config onto this element.
@@ -266,9 +296,9 @@ class $ extends rs {
   applyUIConfig() {
     const e = this.uiConfig;
     if (e) {
-      for (const s of ms) {
+      for (const s of Cs) {
         const i = e[s];
-        i !== void 0 && s in this && (this.hasAttribute(bs(s)) || this.appliedConfig.has(s) || (this.appliedConfig.add(s), this[s] = i));
+        i !== void 0 && s in this && (this.hasAttribute(Ps(s)) || this.appliedConfig.has(s) || (this.appliedConfig.add(s), this[s] = i));
       }
       for (const [s, i] of Object.entries(e.tokens ?? {}))
         s.startsWith("--") && (this.style.getPropertyValue(s) || this.style.setProperty(s, i));
@@ -295,26 +325,26 @@ class $ extends rs {
     super.willUpdate(e), this.auth.bind(this.resolvedClient), this.applyUIConfig();
   }
 }
-T = new WeakMap(), U = new WeakMap(), L = new WeakMap(), A = new WeakMap(), M = new WeakMap(), N = new WeakMap(), b($, "styles", [cs, hs]);
-_([
+D = new WeakMap(), B = new WeakMap(), H = new WeakMap(), q = new WeakMap(), j = new WeakMap(), K = new WeakMap(), b(y, "styles", [$s, vs]);
+L([
   p({ attribute: !1 })
-], $.prototype, "client");
-_([
+], y.prototype, "client");
+L([
   p({ attribute: !1 })
-], $.prototype, "messages");
-_([
+], y.prototype, "messages");
+L([
   p({ reflect: !0 })
-], $.prototype, "theme");
-_([
+], y.prototype, "theme");
+L([
   p({ reflect: !0 })
-], $.prototype, "density");
-_([
+], y.prototype, "density");
+L([
   p({ reflect: !0, attribute: "field-style" })
-], $.prototype, "fieldStyle");
-_([
+], y.prototype, "fieldStyle");
+L([
   p({ reflect: !0 })
-], $.prototype, "radius");
-class ke {
+], y.prototype, "radius");
+class De {
   constructor(t) {
     b(this, "host");
     b(this, "client", null);
@@ -340,7 +370,7 @@ class ke {
     });
   }
 }
-const Ss = [
+const Ls = [
   "load",
   "success",
   "error",
@@ -355,7 +385,7 @@ const Ss = [
   "expired",
   "navigate",
   "goto"
-], Cs = {
+], xs = {
   load: "auth:ready",
   signin: "auth:signin",
   signup: "auth:signup",
@@ -365,31 +395,31 @@ const Ss = [
   error: "auth:error",
   navigate: "auth:navigate"
 };
-function Fe(l) {
-  return "on" + l.replace(/(^|-)([a-z])/g, (t, e, s) => s.toUpperCase());
+function Ge(a) {
+  return "on" + a.replace(/(^|-)([a-z])/g, (t, e, s) => s.toUpperCase());
 }
-class Ps {
+class Us {
   constructor(t) {
     b(this, "unsubscribes", []);
     b(this, "client", null);
     this.host = t, t.addController(this);
   }
   bind(t) {
-    t !== this.client && (this.release(), this.client = t, t && (this.unsubscribes = Ss.map(
+    t !== this.client && (this.release(), this.client = t, t && (this.unsubscribes = Ls.map(
       (e) => t.on(e, (s) => this.publish(e, s))
     )));
   }
   publish(t, e) {
-    const s = this.host[Fe(t)];
+    const s = this.host[Ge(t)];
     if (typeof s == "function")
       try {
         s.call(this.host, e);
       } catch (c) {
-        console.error(`[singlebase] ${Fe(t)} threw:`, c);
+        console.error(`[singlebase] ${Ge(t)} threw:`, c);
       }
     const i = { detail: e, bubbles: !0, composed: !0 };
     this.host.dispatchEvent(new CustomEvent(`singlebase-${t}`, i));
-    const h = Cs[t];
+    const h = xs[t];
     h && this.host.dispatchEvent(new CustomEvent(h, i));
   }
   release() {
@@ -399,36 +429,112 @@ class Ps {
     this.release(), this.client = null;
   }
 }
-var ks = Object.defineProperty, _s = Object.getOwnPropertyDescriptor, _e = (l, t, e, s) => {
-  for (var i = _s(t, e), h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = c(t, e, i) || i);
-  return i && ks(t, e, i), i;
-}, I, F, D;
-class Ee extends $ {
+const Ae = (a) => `${a}:link`, Ms = { google: "G", github: "GH", linkedin: "in", facebook: "f" };
+function es(a) {
+  var e;
+  const t = a == null ? void 0 : a.oauth_settings;
+  return !!(t != null && t.enabled) && !!((e = t.redirect_url) != null && e.trim());
+}
+function Is(a, t) {
+  return t === "signin" && (a != null && a.oauth_settings.allow_signup) ? "signup" : t;
+}
+function R(a, t) {
+  if (!a || !es(a)) return [];
+  const e = a.oauth_settings;
+  return t === "signin" && !e.allow_signin ? [] : t === "signup" && !e.allow_signup ? [] : Object.entries(a.oauth_providers ?? {}).filter(([, s]) => s.enabled).map(([s, i]) => ({
+    id: s,
+    name: i.provider_name,
+    mark: Ms[s] ?? i.provider_name.slice(0, 2)
+  }));
+}
+function Fe(a, t) {
+  if (!(a instanceof Ne)) return t.genericErrorMessage;
+  switch (ms(a.code)) {
+    case "disable_retry_show_rate_limited":
+      return t.rateLimitedMessage;
+    case "show_password_requirements":
+      return t.invalidPasswordMessage;
+    case "expired_or_invalid_code_message":
+      return t.invalidCodeError;
+    case "explain_verified_email_required":
+      return t.oauthVerifiedEmailMessage;
+    case "restart_oauth":
+    case "restart_oauth_new_nonce":
+      return t.oauthRetryMessage;
+    case "ask_signin_then_link":
+      return t.signInToLinkMessage;
+    case "provider_already_linked":
+      return t.providerAlreadyLinkedMessage;
+    case "hide_oauth":
+    case "remove_oauth_from_signin":
+    case "remove_oauth_from_signup":
+    case "refresh_settings_hide_provider":
+      return t.oauthUnavailableMessage;
+    case "show_integrator_config_error":
+      return console.warn(`[singlebase] Auth is misconfigured for this project (${a.code}).`), a.code === "MISSING_OAUTH_CREDENTIALS" ? t.oauthUnavailableMessage : t.genericErrorMessage;
+    default:
+      return t.genericErrorMessage;
+  }
+}
+function ss(a, t) {
+  var s;
+  const e = (s = a == null ? void 0 : a.LENGTH) == null ? void 0 : s[0];
+  return e ? t.newPasswordPlaceholder.replace("{min}", String(e)) : t.newPasswordPlaceholderPlain;
+}
+function is(a, t, e) {
+  if (!a) return e.requiredError;
+  if (!t) return "";
+  const [s, i] = t.LENGTH ?? [0, 0];
+  return s && a.length < s ? e.passwordTooShortError.replace("{min}", String(s)) : i && a.length > i ? e.passwordTooLongError.replace("{max}", String(i)) : t.LOWERCASE && !/[a-z]/.test(a) ? e.passwordNeedsLowercaseError : t.UPPERCASE && !/[A-Z]/.test(a) ? e.passwordNeedsUppercaseError : t.NUMBERS && !/\d/.test(a) ? e.passwordNeedsNumberError : t.SYMBOLS && !/[^A-Za-z0-9\s]/.test(a) ? e.passwordNeedsSymbolError : "";
+}
+function Rs(a, t) {
+  if (!a) return [];
+  const [e, s] = a.LENGTH ?? [0, 0], i = [];
+  if (e || s) {
+    const h = s ? t.passwordRuleLength.replace("{min}", String(e || 1)).replace("{max}", String(s)) : t.passwordRuleMinLength.replace("{min}", String(e));
+    i.push({ label: h });
+  }
+  return a.LOWERCASE && i.push({ label: t.passwordRuleLowercase }), a.UPPERCASE && i.push({ label: t.passwordRuleUppercase }), a.NUMBERS && i.push({ label: t.passwordRuleNumber }), a.SYMBOLS && i.push({ label: t.passwordRuleSymbol }), i;
+}
+function as(a, t) {
+  const e = Rs(a, t);
+  return e.length === 0 ? d : r`<details class="pw-rules" part="password-rules">
+    <summary>${t.passwordRulesLabel}</summary>
+    <ul>
+      ${e.map((s) => r`<li>${s.label}</li>`)}
+    </ul>
+  </details>`;
+}
+var Fs = Object.defineProperty, Ds = Object.getOwnPropertyDescriptor, Be = (a, t, e, s) => {
+  for (var i = Ds(t, e), h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = c(t, e, i) || i);
+  return i && Fs(t, e, i), i;
+}, V, G, W;
+class Oe extends y {
   constructor() {
     super(...arguments);
-    n(this, I, "idle");
-    n(this, F, "");
-    n(this, D, "");
+    o(this, V, "idle");
+    o(this, G, "");
+    o(this, W, "");
     b(this, "abortController", null);
   }
   get phase() {
-    return r(this, I);
+    return n(this, V);
   }
   set phase(e) {
-    o(this, I, e);
+    l(this, V, e);
   }
   get formError() {
-    return r(this, F);
+    return n(this, G);
   }
   set formError(e) {
-    o(this, F, e);
+    l(this, G, e);
   }
   get noticeMessage() {
-    return r(this, D);
+    return n(this, W);
   }
   set noticeMessage(e) {
-    o(this, D, e);
+    l(this, W, e);
   }
   disconnectedCallback() {
     var e;
@@ -452,88 +558,83 @@ class Ee extends $ {
     return e instanceof DOMException && e.name === "AbortError";
   }
   describeError(e) {
-    if (e instanceof Ce) {
-      const s = ns(e.code);
-      return s === "disable_retry_show_rate_limited" ? this.msg.rateLimitedMessage : s === "generic_credentials_message" ? this.msg.genericErrorMessage : this.msg.genericErrorMessage;
-    }
-    return this.msg.genericErrorMessage;
+    return Fe(e, this.msg);
   }
   get submitting() {
     return this.phase === "submitting";
   }
   /** aria-live region for async status — spec requires one per form. */
   renderStatus() {
-    return a`
+    return r`
       <div
         role="status"
         aria-live="polite"
         style="position:absolute;width:1px;height:1px;overflow:hidden;"
       >
-        ${this.phase === "submitting" ? "Submitting…" : ""}
-        ${this.phase === "success" ? "Done." : ""}
+        ${this.phase === "submitting" ? this.msg.submittingStatus : ""}
+        ${this.phase === "success" ? this.msg.doneStatus : ""}
       </div>
-      ${this.formError ? a`<p class="banner" role="alert">${this.formError}</p>` : null}
-      ${this.noticeMessage ? a`<p class="notice" role="status">${this.noticeMessage}</p>` : null}
+      ${this.formError ? r`<p class="banner" role="alert">${this.formError}</p>` : null}
+      ${this.noticeMessage ? r`<p class="notice" role="status">${this.noticeMessage}</p>` : null}
     `;
   }
 }
-I = new WeakMap(), F = new WeakMap(), D = new WeakMap();
-_e([
+V = new WeakMap(), G = new WeakMap(), W = new WeakMap();
+Be([
   m()
-], Ee.prototype, "phase");
-_e([
+], Oe.prototype, "phase");
+Be([
   m()
-], Ee.prototype, "formError");
-_e([
+], Oe.prototype, "formError");
+Be([
   m()
-], Ee.prototype, "noticeMessage");
-function Ke(l) {
-  return [l == null ? void 0 : l.first_name, l == null ? void 0 : l.last_name].filter(Boolean).join(" ").trim();
+], Oe.prototype, "noticeMessage");
+function rs(a) {
+  return [a == null ? void 0 : a.first_name, a == null ? void 0 : a.last_name].filter(Boolean).join(" ").trim();
 }
-function Ye(l) {
-  const t = Ke(l);
+function ns(a) {
+  const t = rs(a);
   if (t)
     return t.split(/\s+/).map((s) => s[0]).join("").slice(0, 2).toUpperCase();
-  const e = (l == null ? void 0 : l.email) ?? "";
+  const e = (a == null ? void 0 : a.email) ?? "";
   return e ? e[0].toUpperCase() : "·";
 }
-var Os = Object.defineProperty, xs = Object.getOwnPropertyDescriptor, v = (l, t, e, s) => {
-  for (var i = s > 1 ? void 0 : s ? xs(t, e) : t, h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
-  return s && i && Os(t, e, i), i;
+var Bs = Object.defineProperty, Hs = Object.getOwnPropertyDescriptor, w = (a, t, e, s) => {
+  for (var i = s > 1 ? void 0 : s ? Hs(t, e) : t, h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
+  return s && i && Bs(t, e, i), i;
 };
-const Ts = { profile_photo: !0 }, Us = ".jpg,.jpeg,.png,.webp,image/jpeg,image/png,image/webp";
-var B, R, j, H, q, V, G, K, Y, W, z, J, Q, X, Z, tt, et, st, it, at, rt, nt, ot, lt, ht, dt, Re;
-let f = (Re = class extends Ee {
+const qs = { profile_photo: !0 }, js = ".jpg,.jpeg,.png,.webp,image/jpeg,image/png,image/webp";
+var Y, z, J, Z, Q, X, tt, et, st, it, at, rt, nt, ot, lt, ht, dt, ct, ut, pt, gt, mt, bt, ft, vt, ze;
+let v = (ze = class extends Oe {
   constructor() {
     super(...arguments);
-    n(this, B, "");
-    n(this, R, "");
-    n(this, j, null);
-    n(this, H, "singlebase-oauth-nonce");
-    n(this, q, "");
-    n(this, V, "");
-    n(this, G, !1);
-    n(this, K, "");
-    n(this, Y, "");
-    n(this, W, "");
-    n(this, z, "");
-    n(this, J, "");
-    n(this, Q, 0);
-    n(this, X, "");
-    n(this, Z, "");
-    n(this, tt, "");
-    n(this, et, "");
-    n(this, st, "");
-    n(this, it, "request");
-    n(this, at, "");
-    n(this, rt, "");
-    n(this, nt, "");
-    n(this, ot, "");
-    n(this, lt, "");
-    n(this, ht, "");
-    n(this, dt, "");
-    b(this, "settingsCtl", new ke(this));
+    o(this, Y, "");
+    o(this, z, "");
+    o(this, J, null);
+    o(this, Z, "singlebase-oauth-nonce");
+    o(this, Q, "");
+    o(this, X, "");
+    o(this, tt, !1);
+    o(this, et, "");
+    o(this, st, "");
+    o(this, it, "");
+    o(this, at, "");
+    o(this, rt, "");
+    o(this, nt, 0);
+    o(this, ot, "");
+    o(this, lt, "");
+    o(this, ht, "");
+    o(this, dt, "");
+    o(this, ct, "");
+    o(this, ut, "request");
+    o(this, pt, "");
+    o(this, gt, "");
+    o(this, mt, "");
+    o(this, bt, "");
+    o(this, ft, "");
+    o(this, vt, "");
+    b(this, "settingsCtl", new De(this));
     b(this, "flashTimer");
     b(this, "uidBase", `sb-acct-${Math.random().toString(36).slice(2, 8)}`);
     // ── profile photo ─────────────────────────────────────────
@@ -563,160 +664,154 @@ let f = (Re = class extends Ee {
     });
   }
   get logoText() {
-    return r(this, B);
+    return n(this, Y);
   }
   set logoText(t) {
-    o(this, B, t);
+    l(this, Y, t);
   }
   get logoUrl() {
-    return r(this, R);
+    return n(this, z);
   }
   set logoUrl(t) {
-    o(this, R, t);
+    l(this, z, t);
   }
   get settings() {
-    return r(this, j);
+    return n(this, J);
   }
   set settings(t) {
-    o(this, j, t);
+    l(this, J, t);
   }
   get nonceStorageKey() {
-    return r(this, H);
+    return n(this, Z);
   }
   set nonceStorageKey(t) {
-    o(this, H, t);
+    l(this, Z, t);
   }
   get editMode() {
-    return r(this, q);
+    return n(this, Q);
   }
   set editMode(t) {
-    o(this, q, t);
+    l(this, Q, t);
   }
   get toast() {
-    return r(this, V);
+    return n(this, X);
   }
   set toast(t) {
-    o(this, V, t);
+    l(this, X, t);
   }
   get photoBusy() {
-    return r(this, G);
+    return n(this, tt);
   }
   set photoBusy(t) {
-    o(this, G, t);
+    l(this, tt, t);
   }
   get photoFailed() {
-    return r(this, K);
+    return n(this, et);
   }
   set photoFailed(t) {
-    o(this, K, t);
+    l(this, et, t);
   }
   get profileSaved() {
-    return r(this, Y);
+    return n(this, st);
   }
   set profileSaved(t) {
-    o(this, Y, t);
+    l(this, st, t);
   }
   get passSaved() {
-    return r(this, W);
+    return n(this, it);
   }
   set passSaved(t) {
-    o(this, W, t);
+    l(this, it, t);
   }
   get profileError() {
-    return r(this, z);
+    return n(this, at);
   }
   set profileError(t) {
-    o(this, z, t);
+    l(this, at, t);
   }
   get newPassError() {
-    return r(this, J);
+    return n(this, rt);
   }
   set newPassError(t) {
-    o(this, J, t);
+    l(this, rt, t);
   }
   get deleteStage() {
-    return r(this, Q);
+    return n(this, nt);
   }
   set deleteStage(t) {
-    o(this, Q, t);
+    l(this, nt, t);
   }
   get confirmText() {
-    return r(this, X);
+    return n(this, ot);
   }
   set confirmText(t) {
-    o(this, X, t);
+    l(this, ot, t);
   }
   get dFirst() {
-    return r(this, Z);
+    return n(this, lt);
   }
   set dFirst(t) {
-    o(this, Z, t);
+    l(this, lt, t);
   }
   get dLast() {
-    return r(this, tt);
+    return n(this, ht);
   }
   set dLast(t) {
-    o(this, tt, t);
+    l(this, ht, t);
   }
   get dPhone() {
-    return r(this, et);
+    return n(this, dt);
   }
   set dPhone(t) {
-    o(this, et, t);
+    l(this, dt, t);
   }
   get dEmail() {
-    return r(this, st);
+    return n(this, ct);
   }
   set dEmail(t) {
-    o(this, st, t);
+    l(this, ct, t);
   }
   get emailStep() {
-    return r(this, it);
+    return n(this, ut);
   }
   set emailStep(t) {
-    o(this, it, t);
+    l(this, ut, t);
   }
   get dNewEmail() {
-    return r(this, at);
+    return n(this, pt);
   }
   set dNewEmail(t) {
-    o(this, at, t);
+    l(this, pt, t);
   }
   get emailCode() {
-    return r(this, rt);
+    return n(this, gt);
   }
   set emailCode(t) {
-    o(this, rt, t);
+    l(this, gt, t);
   }
   get emailError() {
-    return r(this, nt);
+    return n(this, mt);
   }
   set emailError(t) {
-    o(this, nt, t);
+    l(this, mt, t);
   }
   get emailSaved() {
-    return r(this, ot);
+    return n(this, bt);
   }
   set emailSaved(t) {
-    o(this, ot, t);
-  }
-  get curPass() {
-    return r(this, lt);
-  }
-  set curPass(t) {
-    o(this, lt, t);
+    l(this, bt, t);
   }
   get newPass() {
-    return r(this, ht);
+    return n(this, ft);
   }
   set newPass(t) {
-    o(this, ht, t);
+    l(this, ft, t);
   }
   get confirmPass() {
-    return r(this, dt);
+    return n(this, vt);
   }
   set confirmPass(t) {
-    o(this, dt, t);
+    l(this, vt, t);
   }
   uid(t) {
     return `${this.uidBase}-${t}`;
@@ -734,22 +829,22 @@ let f = (Re = class extends Ee {
   }
   /** Matches the guest screens: image when given one, else the text label. */
   renderLogo() {
-    return this.logoUrl ? a`<img
+    return this.logoUrl ? r`<img
         part="logo"
         src=${this.logoUrl}
         alt=${this.logoText}
         style="display:block;align-self:flex-start;height:var(--sb-logo-height,20px);width:auto;max-width:100%"
-      />` : this.logoText ? a`<div class="logo-dot" part="logo">${this.logoText}</div>` : d;
+      />` : this.logoText ? r`<div class="logo-dot" part="logo">${this.logoText}</div>` : d;
   }
   get user() {
     const t = this.auth.state;
     return t.status === "authenticated" ? t.user : null;
   }
   get fullName() {
-    return Ke(this.user);
+    return rs(this.user);
   }
   get initials() {
-    return Ye(this.user);
+    return ns(this.user);
   }
   /**
    * The upload API bound to the same dispatcher as this widget's auth client,
@@ -758,7 +853,7 @@ let f = (Re = class extends Ee {
    */
   get uploadClient() {
     const t = this.resolvedClient;
-    return t ? (this.uploadClientFor !== t && (this.uploadClientFor = t, this.uploadClientCache = { files: os(t.dispatcher) }), this.uploadClientCache) : null;
+    return t ? (this.uploadClientFor !== t && (this.uploadClientFor = t, this.uploadClientCache = { files: bs(t.dispatcher) }), this.uploadClientCache) : null;
   }
   startProfileEdit() {
     const t = this.user;
@@ -766,45 +861,43 @@ let f = (Re = class extends Ee {
   }
   async onSaveProfile() {
     const t = this.resolvedClient;
-    if (t) {
-      if (!this.dFirst.trim() || !this.dLast.trim()) {
-        this.profileError = "First and last name cannot be empty.";
-        return;
-      }
-      if (this.dPhone.replace(/\D/g, "").length < 7) {
-        this.profileError = this.msg.invalidPhoneError;
-        return;
-      }
-      await this.run(async () => {
-        await t.updateAccount(
-          { first_name: this.dFirst, last_name: this.dLast, phone: this.dPhone },
-          this.signal
-        ), this.editMode = "", this.flash("profileSaved", this.msg.savedNote);
-      });
+    if (!t) return;
+    const e = this.dFirst.trim(), s = this.dLast.trim(), i = this.dPhone.trim();
+    if (!e) {
+      this.profileError = this.msg.firstNameRequiredError;
+      return;
+    }
+    if (i && i.replace(/\D/g, "").length < 7) {
+      this.profileError = this.msg.invalidPhoneError;
+      return;
     }
+    const h = this.user, c = {};
+    if (e !== ((h == null ? void 0 : h.first_name) ?? "") && (c.first_name = e), s !== ((h == null ? void 0 : h.last_name) ?? "") && (c.last_name = s), i !== ((h == null ? void 0 : h.phone) ?? "") && (c.phone = i), Object.keys(c).length === 0) {
+      this.editMode = "";
+      return;
+    }
+    await this.run(async () => {
+      await t.updateAccount(c, this.signal), this.editMode = "", this.flash("profileSaved", this.msg.savedNote);
+    });
   }
   startPassEdit() {
-    this.curPass = "", this.newPass = "", this.confirmPass = "", this.newPassError = "", this.passSaved = "", this.profileSaved = "", this.toast = "", this.editMode = "password";
+    this.newPass = "", this.confirmPass = "", this.newPassError = "", this.passSaved = "", this.profileSaved = "", this.toast = "", this.editMode = "password";
   }
   async onChangePass() {
     const t = this.resolvedClient;
-    if (t) {
-      if (!this.curPass) {
-        this.newPassError = "Enter your current password.";
-        return;
-      }
-      if (this.newPass.length < 10) {
-        this.newPassError = this.msg.passwordMinError;
-        return;
-      }
-      if (this.newPass !== this.confirmPass) {
-        this.newPassError = this.msg.passwordMatchError;
-        return;
-      }
-      await this.run(async () => {
-        await t.changePassword({ password: this.newPass }, this.signal), this.editMode = "", this.curPass = "", this.newPass = "", this.confirmPass = "", this.flash("passSaved", this.msg.passwordUpdatedNote);
-      });
+    if (!t) return;
+    const e = this.settings ?? this.settingsCtl.settings, s = is(this.newPass, e == null ? void 0 : e.auth_settings.password_policy, this.msg);
+    if (s) {
+      this.newPassError = s;
+      return;
+    }
+    if (this.newPass !== this.confirmPass) {
+      this.newPassError = this.msg.passwordMatchError;
+      return;
     }
+    await this.run(async () => {
+      await t.changePassword({ password: this.newPass }, this.signal), this.editMode = "", this.newPass = "", this.confirmPass = "", this.flash("passSaved", this.msg.passwordUpdatedNote);
+    });
   }
   // ── email change ─────────────────────────────────────────
   startEmailEdit() {
@@ -850,15 +943,15 @@ let f = (Re = class extends Ee {
   renderEmailSection() {
     var s;
     const t = this.editMode !== "email", e = this.editMode !== "" && this.editMode !== "email";
-    return a`
+    return r`
       <div class="rule"></div>
       <div class="section">
         <h3 class="sec-title">${this.msg.changeEmailTitle}</h3>
-        ${t ? a`
+        ${t ? r`
                 <div class="between">
                   <p class="hint">${((s = this.user) == null ? void 0 : s.email) ?? ""}</p>
                   <div class="btn-row-end">
-                    ${this.emailSaved ? a`<span role="status" class="saved-note">${this.emailSaved}</span>` : d}
+                    ${this.emailSaved ? r`<span role="status" class="saved-note">${this.emailSaved}</span>` : d}
                     <button
                       type="button"
                       class="edit-link"
@@ -869,7 +962,7 @@ let f = (Re = class extends Ee {
                     </button>
                   </div>
                 </div>
-              ` : this.emailStep === "request" ? a`
+              ` : this.emailStep === "request" ? r`
                   <div class="edit-card">
                     <div class="field">
                       <label for=${this.uid("newemail")}>${this.msg.newEmailLabel}</label>
@@ -887,7 +980,7 @@ let f = (Re = class extends Ee {
                       />
                       <p class="hint">${this.msg.changeEmailHint}</p>
                     </div>
-                    ${this.emailError ? a`<p class="err">${this.emailError}</p>` : d}
+                    ${this.emailError ? r`<p class="err">${this.emailError}</p>` : d}
                     <div class="edit-actions">
                       <button
                         type="button"
@@ -895,7 +988,7 @@ let f = (Re = class extends Ee {
                         ?disabled=${this.submitting}
                         @click=${this.onRequestEmailCode}
                       >
-                        ${this.submitting ? a`<span class="spinner"></span>` : d}
+                        ${this.submitting ? r`<span class="spinner"></span>` : d}
                         <span>${this.msg.changeEmailCta}</span>
                       </button>
                       <button
@@ -909,7 +1002,7 @@ let f = (Re = class extends Ee {
                       </button>
                     </div>
                   </div>
-                ` : a`
+                ` : r`
                   <div class="edit-card">
                     <p class="hint">${this.msg.codeSentNeutral}</p>
                     <div class="field">
@@ -930,7 +1023,7 @@ let f = (Re = class extends Ee {
                       />
                       <p class="hint">${this.msg.changeEmailConfirmHint} ${this.dNewEmail}</p>
                     </div>
-                    ${this.emailError ? a`<p class="err">${this.emailError}</p>` : d}
+                    ${this.emailError ? r`<p class="err">${this.emailError}</p>` : d}
                     <div class="edit-actions">
                       <button
                         type="button"
@@ -938,7 +1031,7 @@ let f = (Re = class extends Ee {
                         ?disabled=${this.submitting}
                         @click=${this.onConfirmEmailChange}
                       >
-                        ${this.submitting ? a`<span class="spinner"></span>` : d}
+                        ${this.submitting ? r`<span class="spinner"></span>` : d}
                         <span>${this.msg.confirmChangeCta}</span>
                       </button>
                       <button
@@ -965,9 +1058,9 @@ let f = (Re = class extends Ee {
   async onConnectProvider(t) {
     const e = this.resolvedClient, s = this.auth.state;
     !e || s.status !== "authenticated" || await this.run(async () => {
-      var c;
+      var c, f;
       const i = await e.createOAuthNonce(this.signal);
-      (c = globalThis.sessionStorage) == null || c.setItem(this.nonceStorageKey, i);
+      (c = globalThis.sessionStorage) == null || c.setItem(this.nonceStorageKey, i), (f = globalThis.sessionStorage) == null || f.setItem(Ae(this.nonceStorageKey), t);
       const { oauth_redirect_url: h } = await e.startOAuth(
         {
           provider: t,
@@ -982,29 +1075,17 @@ let f = (Re = class extends Ee {
     });
   }
   get availableProviders() {
-    const t = this.settings ?? this.settingsCtl.settings;
-    if (!t || !t.oauth_settings.enabled) return [];
-    const e = {
-      google: "G",
-      github: "GH",
-      linkedin: "in",
-      facebook: "f"
-    };
-    return Object.entries(t.oauth_providers).filter(([, s]) => s.enabled).map(([s, i]) => ({
-      id: s,
-      name: i.provider_name,
-      mark: e[s] ?? i.provider_name.slice(0, 2)
-    }));
+    return R(this.settings ?? this.settingsCtl.settings, "link");
   }
   // ── sections ──────────────────────────────────────────────
   renderIdentity() {
     const t = this.user, e = this.editMode !== "" && this.editMode !== "avatar", s = t != null && t.profile_photo && t.profile_photo !== this.photoFailed ? t.profile_photo : "";
-    return a`
+    return r`
       <div class="acct-nav">
         <div class="acct-who">
           <div class="avatar-col">
             <div class="avatar ${s ? "has-photo" : ""}" part="avatar">
-              ${s ? a`<img
+              ${s ? r`<img
                       src=${s}
                       alt=""
                       part="avatar-image"
@@ -1025,9 +1106,9 @@ let f = (Re = class extends Ee {
               view="button"
               max-files="1"
               branding="false"
-              accept=${Us}
+              accept=${js}
               .client=${this.uploadClient}
-              .options=${Ts}
+              .options=${qs}
               @singlebase-upload-selected=${this.onPhotoSelected}
               @singlebase-upload-complete=${this.onPhotoUploaded}
               @singlebase-upload-error=${this.onPhotoProblem}
@@ -1054,12 +1135,12 @@ let f = (Re = class extends Ee {
       [this.msg.phoneLabel, t.phone || "—"],
       [this.msg.emailLabel, t.email || "—"]
     ];
-    return a`
+    return r`
       <div class="section">
-        ${e ? a`
+        ${e ? r`
                 <div class="sum-list">
                   ${i.map(
-      ([h, c]) => a`
+      ([h, c]) => r`
                       <div class="sum-row">
                         <span class="sum-label">${h}</span>
                         <span class="sum-value">${c}</span>
@@ -1068,7 +1149,7 @@ let f = (Re = class extends Ee {
     )}
                 </div>
                 <div class="btn-row-end">
-                  ${this.profileSaved ? a`<span role="status" class="saved-note">${this.profileSaved}</span>` : d}
+                  ${this.profileSaved ? r`<span role="status" class="saved-note">${this.profileSaved}</span>` : d}
                   <button
                     type="button"
                     class="edit-link"
@@ -1078,7 +1159,7 @@ let f = (Re = class extends Ee {
                     ${this.msg.editAccountCta}
                   </button>
                 </div>
-              ` : a`
+              ` : r`
                 <div class="edit-card">
                   <div class="two-up">
                     <div class="field">
@@ -1136,7 +1217,7 @@ let f = (Re = class extends Ee {
                     />
                     <p class="hint">${this.msg.changeEmailElsewhereHint}</p>
                   </div>
-                  ${this.profileError ? a`<p class="err">${this.profileError}</p>` : d}
+                  ${this.profileError ? r`<p class="err">${this.profileError}</p>` : d}
                   <div class="edit-actions">
                     <button
                       type="button"
@@ -1144,7 +1225,7 @@ let f = (Re = class extends Ee {
                       ?disabled=${this.submitting}
                       @click=${this.onSaveProfile}
                     >
-                      ${this.submitting ? a`<span class="spinner"></span>` : d}
+                      ${this.submitting ? r`<span class="spinner"></span>` : d}
                       <span>${this.msg.saveChangesCta}</span>
                     </button>
                     <button
@@ -1163,16 +1244,17 @@ let f = (Re = class extends Ee {
     `;
   }
   renderPasswordSection() {
+    var s, i;
     const t = this.editMode !== "password", e = this.editMode !== "" && this.editMode !== "password";
-    return a`
+    return r`
       <div class="rule"></div>
       <div class="section">
         <h3 class="sec-title">${this.msg.passwordSectionTitle}</h3>
-        ${t ? a`
+        ${t ? r`
                 <div class="between">
                   <p class="hint">${this.msg.passwordChangedHint}</p>
                   <div class="btn-row-end">
-                    ${this.passSaved ? a`<span role="status" class="saved-note">${this.passSaved}</span>` : d}
+                    ${this.passSaved ? r`<span role="status" class="saved-note">${this.passSaved}</span>` : d}
                     <button
                       type="button"
                       class="edit-link"
@@ -1183,22 +1265,8 @@ let f = (Re = class extends Ee {
                     </button>
                   </div>
                 </div>
-              ` : a`
+              ` : r`
                 <div class="edit-card">
-                  <div class="field">
-                    <label for=${this.uid("curpass")}>${this.msg.currentPasswordLabel}</label>
-                    <input
-                      id=${this.uid("curpass")}
-                      type="password"
-                      part="input"
-                      .value=${this.curPass}
-                      placeholder=${this.msg.passwordPlaceholder}
-                      ?disabled=${this.submitting}
-                      @input=${(s) => {
-      this.curPass = s.target.value, this.newPassError = "";
-    }}
-                    />
-                  </div>
                   <div class="field">
                     <label for=${this.uid("newpass")}>${this.msg.newPasswordLabel}</label>
                     <input
@@ -1206,16 +1274,21 @@ let f = (Re = class extends Ee {
                       type="password"
                       part="input"
                       .value=${this.newPass}
-                      placeholder=${this.msg.newPasswordPlaceholder}
+                      placeholder=${ss(
+      (s = this.settings ?? this.settingsCtl.settings) == null ? void 0 : s.auth_settings.password_policy,
+      this.msg
+    )}
                       aria-invalid=${this.newPassError ? "true" : "false"}
                       ?disabled=${this.submitting}
-                      @input=${(s) => {
-      this.newPass = s.target.value, this.newPassError = "";
+                      @input=${(h) => {
+      this.newPass = h.target.value, this.newPassError = "";
     }}
                     />
                   </div>
                   <div class="field">
-                    <label for=${this.uid("confirmpass")}>Confirm new password</label>
+                    <label for=${this.uid("confirmpass")}
+                      >${this.msg.confirmNewPasswordLabel}</label
+                    >
                     <input
                       id=${this.uid("confirmpass")}
                       type="password"
@@ -1224,11 +1297,12 @@ let f = (Re = class extends Ee {
                       placeholder=${this.msg.confirmPasswordPlaceholder}
                       aria-invalid=${this.newPassError ? "true" : "false"}
                       ?disabled=${this.submitting}
-                      @input=${(s) => {
-      this.confirmPass = s.target.value, this.newPassError = "";
+                      @input=${(h) => {
+      this.confirmPass = h.target.value, this.newPassError = "";
     }}
                     />
-                    ${this.newPassError ? a`<p class="err">${this.newPassError}</p>` : d}
+                    ${as((i = this.settings ?? this.settingsCtl.settings) == null ? void 0 : i.auth_settings.password_policy, this.msg)}
+                    ${this.newPassError ? r`<p class="err">${this.newPassError}</p>` : d}
                   </div>
                   <div class="edit-actions">
                     <button
@@ -1237,7 +1311,7 @@ let f = (Re = class extends Ee {
                       ?disabled=${this.submitting}
                       @click=${this.onChangePass}
                     >
-                      ${this.submitting ? a`<span class="spinner"></span>` : d}
+                      ${this.submitting ? r`<span class="spinner"></span>` : d}
                       <span>${this.msg.updatePasswordCta}</span>
                     </button>
                     <button type="button" class="ghost-sm" @click=${() => this.editMode = ""}>
@@ -1251,7 +1325,7 @@ let f = (Re = class extends Ee {
   }
   /** Layout preserved from the mock; no enrolment operation exists yet. */
   renderTwoFactorSection() {
-    return a`
+    return r`
       <div class="rule"></div>
       <div class="section">
         <div class="between">
@@ -1278,7 +1352,7 @@ let f = (Re = class extends Ee {
   }
   renderConnectedSection() {
     const t = this.availableProviders;
-    return t.length === 0 ? d : a`
+    return t.length === 0 ? d : r`
       <div class="rule"></div>
       <div class="section">
         <h3 class="sec-title">${this.msg.connectedTitle}</h3>
@@ -1286,11 +1360,11 @@ let f = (Re = class extends Ee {
         <span class="sub-label">${this.msg.addAnotherLabel}</span>
         <div class="tile-grid">
           ${t.map(
-      (e) => a`
+      (e) => r`
               <button
                 type="button"
                 class="tile"
-                aria-label=${`Connect ${e.name}`}
+                aria-label=${this.msg.connectProviderLabel.replace("{name}", e.name)}
                 ?disabled=${this.submitting}
                 @click=${() => this.onConnectProvider(e.id)}
               >
@@ -1301,18 +1375,14 @@ let f = (Re = class extends Ee {
             `
     )}
         </div>
-        <p class="disabled-note">
-          ${this.msg.notYetSupported} — listing or disconnecting linked providers is not part of the
-          current API.
-        </p>
       </div>
     `;
   }
   renderDangerSection() {
-    return a`
+    return r`
       <div class="rule"></div>
       <div class="section">
-        ${this.deleteStage === 0 ? a`<button
+        ${this.deleteStage === 0 ? r`<button
                 type="button"
                 class="danger-link"
                 disabled
@@ -1327,12 +1397,12 @@ let f = (Re = class extends Ee {
     `;
   }
   render() {
-    return this.user ? a`
+    return this.user ? r`
       <div class="acct-root">
         ${this.renderLogo()} ${this.renderIdentity()}
         <div class="acct-body">
-          ${this.toast ? a`<div class="notice" role="status">${this.toast}</div>` : d}
-          ${this.formError ? a`<div class="banner" role="alert">${this.formError}</div>` : d}
+          ${this.toast ? r`<div class="notice" role="status">${this.toast}</div>` : d}
+          ${this.formError ? r`<div class="banner" role="alert">${this.formError}</div>` : d}
           ${this.renderProfileSection()} ${this.renderEmailSection()}
           ${this.renderPasswordSection()}
           ${d}
@@ -1340,171 +1410,155 @@ let f = (Re = class extends Ee {
           ${d}
         </div>
       </div>
-    ` : a`<p class="disabled-note">Not signed in.</p>`;
+    ` : r`<p class="disabled-note">${this.msg.notSignedInNote}</p>`;
   }
-}, B = new WeakMap(), R = new WeakMap(), j = new WeakMap(), H = new WeakMap(), q = new WeakMap(), V = new WeakMap(), G = new WeakMap(), K = new WeakMap(), Y = new WeakMap(), W = new WeakMap(), z = new WeakMap(), J = new WeakMap(), Q = new WeakMap(), X = new WeakMap(), Z = new WeakMap(), tt = new WeakMap(), et = new WeakMap(), st = new WeakMap(), it = new WeakMap(), at = new WeakMap(), rt = new WeakMap(), nt = new WeakMap(), ot = new WeakMap(), lt = new WeakMap(), ht = new WeakMap(), dt = new WeakMap(), Re);
-v([
+}, Y = new WeakMap(), z = new WeakMap(), J = new WeakMap(), Z = new WeakMap(), Q = new WeakMap(), X = new WeakMap(), tt = new WeakMap(), et = new WeakMap(), st = new WeakMap(), it = new WeakMap(), at = new WeakMap(), rt = new WeakMap(), nt = new WeakMap(), ot = new WeakMap(), lt = new WeakMap(), ht = new WeakMap(), dt = new WeakMap(), ct = new WeakMap(), ut = new WeakMap(), pt = new WeakMap(), gt = new WeakMap(), mt = new WeakMap(), bt = new WeakMap(), ft = new WeakMap(), vt = new WeakMap(), ze);
+w([
   p({ attribute: "logo-text" })
-], f.prototype, "logoText", 1);
-v([
+], v.prototype, "logoText", 1);
+w([
   p({ attribute: "logo-url" })
-], f.prototype, "logoUrl", 1);
-v([
+], v.prototype, "logoUrl", 1);
+w([
   p({ attribute: !1 })
-], f.prototype, "settings", 1);
-v([
+], v.prototype, "settings", 1);
+w([
   p({ attribute: "nonce-storage-key" })
-], f.prototype, "nonceStorageKey", 1);
-v([
-  m()
-], f.prototype, "editMode", 1);
-v([
+], v.prototype, "nonceStorageKey", 1);
+w([
   m()
-], f.prototype, "toast", 1);
-v([
+], v.prototype, "editMode", 1);
+w([
   m()
-], f.prototype, "photoBusy", 1);
-v([
+], v.prototype, "toast", 1);
+w([
   m()
-], f.prototype, "photoFailed", 1);
-v([
+], v.prototype, "photoBusy", 1);
+w([
   m()
-], f.prototype, "profileSaved", 1);
-v([
+], v.prototype, "photoFailed", 1);
+w([
   m()
-], f.prototype, "passSaved", 1);
-v([
+], v.prototype, "profileSaved", 1);
+w([
   m()
-], f.prototype, "profileError", 1);
-v([
+], v.prototype, "passSaved", 1);
+w([
   m()
-], f.prototype, "newPassError", 1);
-v([
+], v.prototype, "profileError", 1);
+w([
   m()
-], f.prototype, "deleteStage", 1);
-v([
+], v.prototype, "newPassError", 1);
+w([
   m()
-], f.prototype, "confirmText", 1);
-v([
+], v.prototype, "deleteStage", 1);
+w([
   m()
-], f.prototype, "dFirst", 1);
-v([
+], v.prototype, "confirmText", 1);
+w([
   m()
-], f.prototype, "dLast", 1);
-v([
+], v.prototype, "dFirst", 1);
+w([
   m()
-], f.prototype, "dPhone", 1);
-v([
+], v.prototype, "dLast", 1);
+w([
   m()
-], f.prototype, "dEmail", 1);
-v([
+], v.prototype, "dPhone", 1);
+w([
   m()
-], f.prototype, "emailStep", 1);
-v([
+], v.prototype, "dEmail", 1);
+w([
   m()
-], f.prototype, "dNewEmail", 1);
-v([
+], v.prototype, "emailStep", 1);
+w([
   m()
-], f.prototype, "emailCode", 1);
-v([
+], v.prototype, "dNewEmail", 1);
+w([
   m()
-], f.prototype, "emailError", 1);
-v([
+], v.prototype, "emailCode", 1);
+w([
   m()
-], f.prototype, "emailSaved", 1);
-v([
+], v.prototype, "emailError", 1);
+w([
   m()
-], f.prototype, "curPass", 1);
-v([
+], v.prototype, "emailSaved", 1);
+w([
   m()
-], f.prototype, "newPass", 1);
-v([
+], v.prototype, "newPass", 1);
+w([
   m()
-], f.prototype, "confirmPass", 1);
-f = v([
-  ye("singlebase-authui-account")
-], f);
-var Ls = Object.defineProperty, As = Object.getOwnPropertyDescriptor, C = (l, t, e, s) => {
-  for (var i = s > 1 ? void 0 : s ? As(t, e) : t, h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
-  return s && i && Ls(t, e, i), i;
-}, ct, ut, pt, gt, mt, bt, ft, je;
-let E = (je = class extends Ee {
+], v.prototype, "confirmPass", 1);
+v = w([
+  Te("singlebase-authui-account")
+], v);
+var Ks = Object.defineProperty, Vs = Object.getOwnPropertyDescriptor, _ = (a, t, e, s) => {
+  for (var i = s > 1 ? void 0 : s ? Vs(t, e) : t, h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
+  return s && i && Ks(t, e, i), i;
+}, wt, $t, yt, Et, St, Ct, Pt, Je;
+let S = (Je = class extends Oe {
   constructor() {
     super(...arguments);
-    n(this, ct, "signout");
-    n(this, ut, "signin");
-    n(this, pt, "");
-    n(this, gt, "");
-    n(this, mt, !1);
-    n(this, bt, null);
-    n(this, ft, "singlebase-oauth-nonce");
-    b(this, "settingsCtl", new ke(this));
+    o(this, wt, "signout");
+    o(this, $t, "signin");
+    o(this, yt, "");
+    o(this, Et, "");
+    o(this, St, !1);
+    o(this, Ct, null);
+    o(this, Pt, "singlebase-oauth-nonce");
+    b(this, "settingsCtl", new De(this));
   }
   get type() {
-    return r(this, ct);
+    return n(this, wt);
   }
   set type(t) {
-    o(this, ct, t);
+    l(this, wt, t);
   }
   get intent() {
-    return r(this, ut);
+    return n(this, $t);
   }
   set intent(t) {
-    o(this, ut, t);
+    l(this, $t, t);
   }
   get provider() {
-    return r(this, pt);
+    return n(this, yt);
   }
   set provider(t) {
-    o(this, pt, t);
+    l(this, yt, t);
   }
   get providerName() {
-    return r(this, gt);
+    return n(this, Et);
   }
   set providerName(t) {
-    o(this, gt, t);
+    l(this, Et, t);
   }
   get embedded() {
-    return r(this, mt);
+    return n(this, St);
   }
   set embedded(t) {
-    o(this, mt, t);
+    l(this, St, t);
   }
   get settings() {
-    return r(this, bt);
+    return n(this, Ct);
   }
   set settings(t) {
-    o(this, bt, t);
+    l(this, Ct, t);
   }
   get nonceStorageKey() {
-    return r(this, ft);
+    return n(this, Pt);
   }
   set nonceStorageKey(t) {
-    o(this, ft, t);
+    l(this, Pt, t);
   }
   willUpdate(t) {
-    super.willUpdate(t), this.type === "oauth" && this.settingsCtl.load(this.resolvedClient, this.settings);
+    super.willUpdate(t), this.type !== "signout" && this.settingsCtl.load(this.resolvedClient, this.settings);
   }
   get effectiveSettings() {
     return this.settings ?? this.settingsCtl.settings;
   }
   // ── oauth ────────────────────────────────────────────────
   get providers() {
-    const t = this.effectiveSettings;
-    if (!t || !t.oauth_settings.enabled) return [];
-    if (!(this.intent === "signup" ? t.oauth_settings.allow_signup : t.oauth_settings.allow_signin) && this.intent !== "link") return [];
-    const s = {
-      google: "G",
-      github: "GH",
-      linkedin: "in",
-      facebook: "f"
-    };
-    return Object.entries(t.oauth_providers).filter(([, i]) => i.enabled).map(([i, h]) => ({
-      id: i,
-      name: h.provider_name,
-      mark: s[i] ?? h.provider_name.slice(0, 2)
-    }));
+    return R(this.effectiveSettings, this.intent);
   }
   /** Shared by the oauth and link flows: nonce, start, redirect. */
   async startOAuth(t, e, s = !1) {
@@ -1512,36 +1566,38 @@ let E = (je = class extends Ee {
     if (!i) return;
     let h, c;
     if (s) {
-      const w = this.auth.state;
-      if (w.status !== "authenticated") {
+      const f = this.auth.state;
+      if (f.status !== "authenticated") {
         this.formError = this.msg.linkRequiresSignIn, this.phase = "error";
         return;
       }
-      h = w.session.id_token, c = w.session.refresh_token;
+      h = f.session.id_token, c = f.session.refresh_token;
     }
     await this.run(async () => {
-      var Se;
-      const w = await i.createOAuthNonce(this.signal);
-      (Se = globalThis.sessionStorage) == null || Se.setItem(this.nonceStorageKey, w);
-      const { oauth_redirect_url: y } = await i.startOAuth(
+      var C, k, T;
+      const f = await i.createOAuthNonce(this.signal);
+      (C = globalThis.sessionStorage) == null || C.setItem(this.nonceStorageKey, f);
+      const $ = Ae(this.nonceStorageKey);
+      s ? (k = globalThis.sessionStorage) == null || k.setItem($, t) : (T = globalThis.sessionStorage) == null || T.removeItem($);
+      const { oauth_redirect_url: E } = await i.startOAuth(
         {
           provider: t,
-          nonce: w,
-          intent: e,
+          nonce: f,
+          intent: Is(this.effectiveSettings, e),
           ...s ? { id_token: h, refresh_token: c } : {}
         },
         this.signal
       );
-      globalThis.location.assign(y);
+      globalThis.location.assign(E);
     });
   }
   renderOAuth() {
     const t = this.providers;
     if (t.length === 0) return d;
     const [e, ...s] = t;
-    return a`
+    return r`
       <div class="stack">
-        ${this.formError ? a`<div class="banner" part="banner" role="alert">${this.formError}</div>` : d}
+        ${this.formError ? r`<div class="banner" part="banner" role="alert">${this.formError}</div>` : d}
 
         <button
           type="button"
@@ -1554,10 +1610,10 @@ let E = (je = class extends Ee {
           <span>${this.msg.oauthContinueWith} ${e.name}</span>
         </button>
 
-        ${s.length ? a`
+        ${s.length ? r`
                 <div class="icon-row">
                   ${s.map(
-      (i) => a`
+      (i) => r`
                       <button
                         type="button"
                         class="icon-btn"
@@ -1578,7 +1634,10 @@ let E = (je = class extends Ee {
   }
   // ── link ─────────────────────────────────────────────────
   renderLink() {
-    return a`
+    const t = this.effectiveSettings, e = R(t, "link").find((i) => i.id === this.provider);
+    if (t && !e) return d;
+    const s = this.providerName || (e == null ? void 0 : e.name) || this.provider;
+    return r`
       <div class="stack">
         ${this.renderStatus()}
         <button
@@ -1588,8 +1647,8 @@ let E = (je = class extends Ee {
           ?disabled=${this.submitting}
           @click=${() => this.startOAuth(this.provider, "link", !0)}
         >
-          ${this.submitting ? a`<span class="spinner"></span>` : d}
-          <span>${this.msg.oauthContinueWith} ${this.providerName || this.provider}</span>
+          ${this.submitting ? r`<span class="spinner"></span>` : d}
+          <span>${this.msg.oauthContinueWith} ${s}</span>
         </button>
       </div>
     `;
@@ -1602,7 +1661,7 @@ let E = (je = class extends Ee {
     });
   }
   renderSignOut() {
-    return this.embedded ? a`<button
+    return this.embedded ? r`<button
         type="button"
         class="link-sm"
         part="button-signout"
@@ -1610,9 +1669,9 @@ let E = (je = class extends Ee {
         @click=${this.onSignOut}
       >
         ${this.msg.signOutCta}
-      </button>` : a`
+      </button>` : r`
       <div class="stack">
-        ${this.formError ? a`<p class="banner" role="alert">${this.formError}</p>` : d}
+        ${this.formError ? r`<p class="banner" role="alert">${this.formError}</p>` : d}
         <button
           type="button"
           class="link-sm"
@@ -1628,37 +1687,37 @@ let E = (je = class extends Ee {
   render() {
     return this.type === "oauth" ? this.renderOAuth() : this.type === "link" ? this.renderLink() : this.renderSignOut();
   }
-}, ct = new WeakMap(), ut = new WeakMap(), pt = new WeakMap(), gt = new WeakMap(), mt = new WeakMap(), bt = new WeakMap(), ft = new WeakMap(), je);
-C([
+}, wt = new WeakMap(), $t = new WeakMap(), yt = new WeakMap(), Et = new WeakMap(), St = new WeakMap(), Ct = new WeakMap(), Pt = new WeakMap(), Je);
+_([
   p()
-], E.prototype, "type", 1);
-C([
+], S.prototype, "type", 1);
+_([
   p()
-], E.prototype, "intent", 1);
-C([
+], S.prototype, "intent", 1);
+_([
   p()
-], E.prototype, "provider", 1);
-C([
+], S.prototype, "provider", 1);
+_([
   p({ attribute: "provider-name" })
-], E.prototype, "providerName", 1);
-C([
+], S.prototype, "providerName", 1);
+_([
   p({ type: Boolean })
-], E.prototype, "embedded", 1);
-C([
+], S.prototype, "embedded", 1);
+_([
   p({ attribute: !1 })
-], E.prototype, "settings", 1);
-C([
+], S.prototype, "settings", 1);
+_([
   p({ attribute: "nonce-storage-key" })
-], E.prototype, "nonceStorageKey", 1);
-E = C([
-  ye("singlebase-authui-buttons")
-], E);
-var We = Object.defineProperty, Ms = Object.getOwnPropertyDescriptor, Ns = (l, t, e) => t in l ? We(l, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : l[t] = e, g = (l, t, e, s) => {
-  for (var i = s > 1 ? void 0 : s ? Ms(t, e) : t, h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
-  return s && i && We(t, e, i), i;
-}, Is = (l, t, e) => Ns(l, t + "", e);
-const ze = [
+], S.prototype, "nonceStorageKey", 1);
+S = _([
+  Te("singlebase-authui-buttons")
+], S);
+var os = Object.defineProperty, Gs = Object.getOwnPropertyDescriptor, Ws = (a, t, e) => t in a ? os(a, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : a[t] = e, g = (a, t, e, s) => {
+  for (var i = s > 1 ? void 0 : s ? Gs(t, e) : t, h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
+  return s && i && os(t, e, i), i;
+}, Ys = (a, t, e) => Ws(a, t + "", e);
+const Ie = "oauth_denied", Re = "oauth_error", zs = /^[A-Z][A-Z0-9_]{0,63}$/, ls = [
   "signin",
   "signup",
   "forgot",
@@ -1666,82 +1725,81 @@ const ze = [
   "otp",
   "newpass",
   "invite"
-], Je = ["account"], Fs = [...ze, ...Je, "oauth-callback"];
-function De(l) {
-  return ze.includes(l);
+], hs = ["account"], Js = [...ls, ...hs, "oauth-callback"];
+function We(a) {
+  return ls.includes(a);
 }
-function Ds(l) {
-  return Je.includes(l);
+function Zs(a) {
+  return hs.includes(a);
 }
-function Be(l) {
-  return Fs.includes(l);
+function Ye(a) {
+  return Js.includes(a);
 }
-const P = {
+const N = {
   // An absent attribute must mean "default" (true), not false. Lit calls
   // fromAttribute(null) when an attribute is *removed*, so returning false
   // there would make removing `allow-oauth="false"` leave the flag off
   // forever instead of restoring the default.
-  fromAttribute: (l) => l === null ? !0 : l !== "false",
-  toAttribute: (l) => l ? null : "false"
+  fromAttribute: (a) => a === null ? !0 : a !== "false",
+  toAttribute: (a) => a ? null : "false"
 };
-var vt, wt, $t, yt, Et, St, Ct, Pt, kt, _t, Ot, xt, Tt, Ut, Lt, At, Mt, Nt, It, Ft, Dt, Bt, Rt, jt, Ht, qt, Vt, Gt, Kt, Yt, Wt, zt, Jt, Qt, Xt, Zt, te, ee, se, ie, ae, re, ne, oe, le, he, de, ce, ue, He;
-let u = (He = class extends $ {
+var _t, kt, Tt, Ot, Nt, At, Lt, xt, Ut, Mt, It, Rt, Ft, Dt, Bt, Ht, qt, jt, Kt, Vt, Gt, Wt, Yt, zt, Jt, Zt, Qt, Xt, te, ee, se, ie, ae, re, ne, oe, le, he, de, ce, ue, pe, ge, me, be, fe, ve, we, Ze;
+let u = (Ze = class extends y {
   constructor() {
     super(...arguments);
-    n(this, vt, "signin");
-    n(this, wt, "");
-    n(this, $t, !1);
-    n(this, yt, null);
-    n(this, Et, !0);
-    n(this, St, !0);
-    n(this, Ct, !0);
-    n(this, Pt, !0);
-    n(this, kt, !0);
-    n(this, _t, !0);
-    n(this, Ot, "card");
-    n(this, xt, "bottom");
-    n(this, Tt, !1);
-    n(this, Ut, "");
-    n(this, Lt, "");
-    n(this, At, "");
-    n(this, Mt, "");
-    n(this, Nt, "");
-    n(this, It, !0);
-    n(this, Ft, "");
-    n(this, Dt, "");
-    n(this, Bt, "");
-    n(this, Rt, "");
-    n(this, jt, "");
-    n(this, Ht, "singlebase-oauth-nonce");
-    n(this, qt, "");
-    n(this, Vt, "");
-    n(this, Gt, "");
-    n(this, Kt, 0);
-    n(this, Yt, "");
-    n(this, Wt, "");
-    n(this, zt, "");
-    n(this, Jt, "");
-    n(this, Qt, "");
-    n(this, Xt, "");
-    n(this, Zt, "");
-    n(this, te, "");
-    n(this, ee, "");
-    n(this, se, ["", "", "", "", "", ""]);
-    n(this, ie, "signin_code");
-    n(this, ae, !1);
-    n(this, re, "");
-    n(this, ne, "");
-    n(this, oe, "");
-    n(this, le, "");
-    n(this, he, "");
-    n(this, de, 0);
-    n(this, ce, !1);
-    b(this, "settingsCtl", new ke(this));
-    b(this, "bridge", new Ps(this));
+    o(this, _t, "signin");
+    o(this, kt, "");
+    o(this, Tt, !1);
+    o(this, Ot, null);
+    o(this, Nt, !0);
+    o(this, At, !0);
+    o(this, Lt, !0);
+    o(this, xt, !0);
+    o(this, Ut, !0);
+    o(this, Mt, !0);
+    o(this, It, "card");
+    o(this, Rt, "bottom");
+    o(this, Ft, !1);
+    o(this, Dt, "");
+    o(this, Bt, "");
+    o(this, Ht, "");
+    o(this, qt, "");
+    o(this, jt, "");
+    o(this, Kt, !0);
+    o(this, Vt, "");
+    o(this, Gt, "");
+    o(this, Wt, "");
+    o(this, Yt, "singlebase-oauth-nonce");
+    o(this, zt, "");
+    o(this, Jt, "");
+    o(this, Zt, "");
+    o(this, Qt, 0);
+    o(this, Xt, "");
+    o(this, te, "");
+    o(this, ee, "");
+    o(this, se, "");
+    o(this, ie, "");
+    o(this, ae, "");
+    o(this, re, "");
+    o(this, ne, "");
+    o(this, oe, "");
+    o(this, le, ["", "", "", "", "", ""]);
+    o(this, he, "signin_code");
+    o(this, de, !1);
+    o(this, ce, "");
+    o(this, ue, "");
+    o(this, pe, "");
+    o(this, ge, "");
+    o(this, me, "");
+    o(this, be, !1);
+    b(this, "settingsCtl", new De(this));
+    b(this, "bridge", new Us(this));
     b(this, "uidBase", `sb-${Math.random().toString(36).slice(2, 8)}`);
     b(this, "gotoUnsubscribe");
     b(this, "gotoClient", null);
-    n(this, ue, !1);
+    o(this, fe, !1);
+    o(this, ve, "");
+    o(this, we, "");
     b(this, "abortController", null);
     b(this, "onContinue", () => {
       this.followRedirect() || (this.dispatchEvent(
@@ -1758,292 +1816,274 @@ let u = (He = class extends $ {
     });
   }
   get initialScreen() {
-    return r(this, vt);
+    return n(this, _t);
   }
   set initialScreen(t) {
-    o(this, vt, t);
+    l(this, _t, t);
   }
   get screen() {
-    return r(this, wt);
+    return n(this, kt);
   }
   set screen(t) {
-    o(this, wt, t);
+    l(this, kt, t);
   }
   get noAccountView() {
-    return r(this, $t);
+    return n(this, Tt);
   }
   set noAccountView(t) {
-    o(this, $t, t);
+    l(this, Tt, t);
   }
   get settings() {
-    return r(this, yt);
+    return n(this, Ot);
   }
   set settings(t) {
-    o(this, yt, t);
+    l(this, Ot, t);
   }
   get authEnabled() {
-    return r(this, Et);
+    return n(this, Nt);
   }
   set authEnabled(t) {
-    o(this, Et, t);
+    l(this, Nt, t);
   }
   get allowEmailSignin() {
-    return r(this, St);
+    return n(this, At);
   }
   set allowEmailSignin(t) {
-    o(this, St, t);
+    l(this, At, t);
   }
   get allowEmailSignup() {
-    return r(this, Ct);
+    return n(this, Lt);
   }
   set allowEmailSignup(t) {
-    o(this, Ct, t);
+    l(this, Lt, t);
   }
   get allowEmailOtp() {
-    return r(this, Pt);
+    return n(this, xt);
   }
   set allowEmailOtp(t) {
-    o(this, Pt, t);
+    l(this, xt, t);
   }
   get allowOauth() {
-    return r(this, kt);
+    return n(this, Ut);
   }
   set allowOauth(t) {
-    o(this, kt, t);
+    l(this, Ut, t);
   }
   get allowAccountCreation() {
-    return r(this, _t);
+    return n(this, Mt);
   }
   set allowAccountCreation(t) {
-    o(this, _t, t);
+    l(this, Mt, t);
   }
   get layout() {
-    return r(this, Ot);
+    return n(this, It);
   }
   set layout(t) {
-    o(this, Ot, t);
+    l(this, It, t);
   }
   get oauthPlacement() {
-    return r(this, xt);
+    return n(this, Rt);
   }
   set oauthPlacement(t) {
-    o(this, xt, t);
+    l(this, Rt, t);
   }
   get stepped() {
-    return r(this, Tt);
+    return n(this, Ft);
   }
   set stepped(t) {
-    o(this, Tt, t);
+    l(this, Ft, t);
   }
   get logoText() {
-    return r(this, Ut);
+    return n(this, Dt);
   }
   set logoText(t) {
-    o(this, Ut, t);
+    l(this, Dt, t);
   }
   get logoUrl() {
-    return r(this, Lt);
+    return n(this, Bt);
   }
   set logoUrl(t) {
-    o(this, Lt, t);
+    l(this, Bt, t);
   }
   get brandLine() {
-    return r(this, At);
+    return n(this, Ht);
   }
   set brandLine(t) {
-    o(this, At, t);
+    l(this, Ht, t);
   }
   get brandFoot() {
-    return r(this, Mt);
+    return n(this, qt);
   }
   set brandFoot(t) {
-    o(this, Mt, t);
+    l(this, qt, t);
   }
   get signInTitle() {
-    return r(this, Nt);
+    return n(this, jt);
   }
   set signInTitle(t) {
-    o(this, Nt, t);
+    l(this, jt, t);
   }
   get branding() {
-    return r(this, It);
+    return n(this, Kt);
   }
   set branding(t) {
-    o(this, It, t);
-  }
-  get brandingText() {
-    return r(this, Ft);
-  }
-  set brandingText(t) {
-    o(this, Ft, t);
-  }
-  get brandingUrl() {
-    return r(this, Dt);
-  }
-  set brandingUrl(t) {
-    o(this, Dt, t);
+    l(this, Kt, t);
   }
   get redirectUrl() {
-    return r(this, Bt);
+    return n(this, Vt);
   }
   set redirectUrl(t) {
-    o(this, Bt, t);
+    l(this, Vt, t);
   }
   get tosUrl() {
-    return r(this, Rt);
+    return n(this, Gt);
   }
   set tosUrl(t) {
-    o(this, Rt, t);
+    l(this, Gt, t);
   }
   get privacyUrl() {
-    return r(this, jt);
+    return n(this, Wt);
   }
   set privacyUrl(t) {
-    o(this, jt, t);
+    l(this, Wt, t);
   }
   get nonceStorageKey() {
-    return r(this, Ht);
+    return n(this, Yt);
   }
   set nonceStorageKey(t) {
-    o(this, Ht, t);
+    l(this, Yt, t);
   }
   get inviteEmail() {
-    return r(this, qt);
+    return n(this, zt);
   }
   set inviteEmail(t) {
-    o(this, qt, t);
+    l(this, zt, t);
   }
   get inviteOrg() {
-    return r(this, Vt);
+    return n(this, Jt);
   }
   set inviteOrg(t) {
-    o(this, Vt, t);
+    l(this, Jt, t);
   }
   get inviteCode() {
-    return r(this, Gt);
+    return n(this, Zt);
   }
   set inviteCode(t) {
-    o(this, Gt, t);
+    l(this, Zt, t);
   }
   get step() {
-    return r(this, Kt);
+    return n(this, Qt);
   }
   set step(t) {
-    o(this, Kt, t);
+    l(this, Qt, t);
   }
   get method() {
-    return r(this, Yt);
+    return n(this, Xt);
   }
   set method(t) {
-    o(this, Yt, t);
+    l(this, Xt, t);
   }
   get email() {
-    return r(this, Wt);
+    return n(this, te);
   }
   set email(t) {
-    o(this, Wt, t);
+    l(this, te, t);
   }
   get password() {
-    return r(this, zt);
+    return n(this, ee);
   }
   set password(t) {
-    o(this, zt, t);
+    l(this, ee, t);
   }
   get name() {
-    return r(this, Jt);
+    return n(this, se);
   }
   set name(t) {
-    o(this, Jt, t);
+    l(this, se, t);
   }
   get firstName() {
-    return r(this, Qt);
+    return n(this, ie);
   }
   set firstName(t) {
-    o(this, Qt, t);
+    l(this, ie, t);
   }
   get lastName() {
-    return r(this, Xt);
+    return n(this, ae);
   }
   set lastName(t) {
-    o(this, Xt, t);
+    l(this, ae, t);
   }
   get phone() {
-    return r(this, Zt);
+    return n(this, re);
   }
   set phone(t) {
-    o(this, Zt, t);
+    l(this, re, t);
   }
   get newPass() {
-    return r(this, te);
+    return n(this, ne);
   }
   set newPass(t) {
-    o(this, te, t);
+    l(this, ne, t);
   }
   get confirmPass() {
-    return r(this, ee);
+    return n(this, oe);
   }
   set confirmPass(t) {
-    o(this, ee, t);
+    l(this, oe, t);
   }
   get code() {
-    return r(this, se);
+    return n(this, le);
   }
   set code(t) {
-    o(this, se, t);
+    l(this, le, t);
   }
   get verifyNext() {
-    return r(this, ie);
+    return n(this, he);
   }
   set verifyNext(t) {
-    o(this, ie, t);
+    l(this, he, t);
   }
   get loading() {
-    return r(this, ae);
+    return n(this, de);
   }
   set loading(t) {
-    o(this, ae, t);
+    l(this, de, t);
   }
   get banner() {
-    return r(this, re);
+    return n(this, ce);
   }
   set banner(t) {
-    o(this, re, t);
+    l(this, ce, t);
   }
   get notice() {
-    return r(this, ne);
+    return n(this, ue);
   }
   set notice(t) {
-    o(this, ne, t);
+    l(this, ue, t);
   }
   get emailError() {
-    return r(this, oe);
+    return n(this, pe);
   }
   set emailError(t) {
-    o(this, oe, t);
+    l(this, pe, t);
   }
   get passError() {
-    return r(this, le);
+    return n(this, ge);
   }
   set passError(t) {
-    o(this, le, t);
+    l(this, ge, t);
   }
   get newPassError() {
-    return r(this, he);
+    return n(this, me);
   }
   set newPassError(t) {
-    o(this, he, t);
-  }
-  get attempts() {
-    return r(this, de);
-  }
-  set attempts(t) {
-    o(this, de, t);
+    l(this, me, t);
   }
   get needsMfaCode() {
-    return r(this, ce);
+    return n(this, be);
   }
   set needsMfaCode(t) {
-    o(this, ce, t);
+    l(this, be, t);
   }
   uid(t) {
     return `${this.uidBase}-${t}`;
@@ -2065,7 +2105,7 @@ let u = (He = class extends $ {
     var i;
     if (t === this.gotoClient || ((i = this.gotoUnsubscribe) == null || i.call(this), this.gotoUnsubscribe = void 0, this.gotoClient = t, !t)) return;
     const e = t.on("goto", ({ screen: h }) => {
-      Be(h) && this.goto(h);
+      Ye(h) && this.goto(h);
     }), s = t.on("signin", () => {
       this.followRedirect();
     });
@@ -2093,6 +2133,7 @@ let u = (He = class extends $ {
         allowEmailSignup: this.allowEmailSignup && this.allowAccountCreation,
         allowEmailOtp: this.allowEmailOtp,
         allowOauth: this.allowOauth,
+        allowRecovery: this.allowEmailSignin,
         mfa: !1
       };
     const e = t.auth_settings, s = e.second_factor === "email_otp";
@@ -2101,14 +2142,16 @@ let u = (He = class extends $ {
       allowEmailSignin: e.allow_signin && this.allowEmailSignin,
       allowEmailSignup: e.allow_signup && this.allowEmailSignup && this.allowAccountCreation,
       allowEmailOtp: this.allowEmailOtp && e.allow_signin && !s,
-      allowOauth: t.oauth_settings.enabled && this.allowOauth,
+      allowOauth: es(t) && this.allowOauth,
+      // Email recovery is offered only when the project verifies it by code.
+      allowRecovery: e.allow_signin && this.allowEmailSignin && e.password_recovery_verification === "email_otp",
       mfa: s
     };
   }
   /** The screen the host asked for, before any guarding is applied. */
   get requestedScreen() {
     const t = this.screen || this.initialScreen || "signin";
-    return Be(t) ? t : "signin";
+    return Ye(t) ? t : "signin";
   }
   /**
    * Resolves the screen actually rendered.
@@ -2119,19 +2162,20 @@ let u = (He = class extends $ {
    * fallbacks below additionally reflect what the project has enabled.
    */
   get activeScreen() {
-    if (this.isOAuthCallback) return "oauth-callback";
-    const t = this.auth.state.status === "authenticated", e = this.requestedScreen;
-    if (Ds(e))
+    const t = this.auth.state.status === "authenticated";
+    if (this.isOAuthCallback || this.callbackPhase === "working" || this.callbackPhase === "failed" && !t) return "oauth-callback";
+    const e = this.requestedScreen;
+    if (Zs(e))
       return t ? e : "signin";
     if (t)
       return this.screen !== "" || this.initialScreen !== "signin" ? e : "account";
     const s = this.cfg;
     let i = e;
-    return i === "signup" && !s.allowEmailSignup && (i = "signin"), (i === "forgot" || i === "newpass") && !s.allowEmailSignin && (i = "signin"), i === "otp" && !s.allowEmailOtp && (i = "signin"), i === "signin" && !s.allowEmailSignin && s.allowEmailOtp && (i = "otp"), i;
+    return i === "signup" && !s.allowEmailSignup && (i = "signin"), (i === "forgot" || i === "newpass") && !s.allowRecovery && (i = "signin"), i === "otp" && !s.allowEmailOtp && (i = "signin"), i === "signin" && !s.allowEmailSignin && s.allowEmailOtp && (i = "otp"), i;
   }
   /** True when a signed-in user is sitting on a guest screen (spec: offer continue/sign out). */
   get showsSignedInInterstitial() {
-    return this.auth.state.status === "authenticated" && De(this.activeScreen);
+    return this.auth.state.status === "authenticated" && We(this.activeScreen);
   }
   // ── redirect ──────────────────────────────────────────────
   /**
@@ -2144,7 +2188,7 @@ let u = (He = class extends $ {
    */
   get redirectTarget() {
     var t;
-    return ds(
+    return ws(
       this.redirectUrl || this.redirectParam,
       (t = globalThis.location) == null ? void 0 : t.href,
       (e) => console.warn(`[singlebase] ${e}`)
@@ -2161,16 +2205,32 @@ let u = (He = class extends $ {
     const t = this.redirectTarget;
     return t ? ((e = globalThis.location) == null || e.assign(t), !0) : !1;
   }
+  /**
+   * Only the OAuth return counts: `?access_code=`, `?error=oauth_denied` or
+   * `?oauth_error=<CODE>`. Any other `?error=` belongs to the host page.
+   */
   get isOAuthCallback() {
     var e;
     const t = new URLSearchParams(((e = globalThis.location) == null ? void 0 : e.search) ?? "");
-    return t.has("access_code") || t.has("error");
+    return t.has("access_code") || t.get("error") === Ie || t.has(Re);
   }
   get callbackDone() {
-    return r(this, ue);
+    return n(this, fe);
   }
   set callbackDone(t) {
-    o(this, ue, t);
+    l(this, fe, t);
+  }
+  get callbackPhase() {
+    return n(this, ve);
+  }
+  set callbackPhase(t) {
+    l(this, ve, t);
+  }
+  get linkNotice() {
+    return n(this, we);
+  }
+  set linkNotice(t) {
+    l(this, we, t);
   }
   /** Strips the provider's parameters so a reload cannot replay the exchange. */
   cleanCallbackUrl() {
@@ -2178,64 +2238,67 @@ let u = (He = class extends $ {
     const t = (s = globalThis.location) == null ? void 0 : s.href;
     if (!t || !globalThis.history) return;
     const e = new URL(t);
-    e.searchParams.delete("access_code"), e.searchParams.delete("error"), globalThis.history.replaceState({}, "", e.toString());
+    e.searchParams.delete("access_code"), e.searchParams.delete(Re), e.searchParams.get("error") === Ie && e.searchParams.delete("error"), globalThis.history.replaceState({}, "", e.toString());
   }
   /**
    * Completes the provider round trip. Runs once per landing: the URL is
    * cleaned immediately so a refresh cannot resend a single-use access code.
    */
   async handleOAuthCallback() {
-    var c, w;
+    var E, C, k, T, U, M;
     if (this.callbackDone) return;
-    this.callbackDone = !0;
-    const t = new URLSearchParams(((c = globalThis.location) == null ? void 0 : c.search) ?? ""), e = t.get("access_code"), s = t.get("error"), i = this.resolvedClient;
-    if (s) {
-      this.cleanCallbackUrl(), this.banner = this.msg.oauthDenied;
+    const t = new URLSearchParams(((E = globalThis.location) == null ? void 0 : E.search) ?? ""), e = t.get("access_code"), s = t.get("error") === Ie, i = t.get(Re), h = this.resolvedClient;
+    if (e && !h) return;
+    if (this.callbackDone = !0, s || i || !e || !h) {
+      (C = globalThis.sessionStorage) == null || C.removeItem(this.nonceStorageKey), (k = globalThis.sessionStorage) == null || k.removeItem(Ae(this.nonceStorageKey)), this.cleanCallbackUrl(), this.banner = s ? this.msg.oauthDenied : this.describeOAuthError(i ?? ""), this.callbackPhase = "failed";
       return;
     }
-    if (!e || !i) return;
-    const h = (w = globalThis.sessionStorage) == null ? void 0 : w.getItem(this.nonceStorageKey);
-    if (this.cleanCallbackUrl(), !h) {
-      this.banner = this.msg.genericErrorMessage;
+    const c = (T = globalThis.sessionStorage) == null ? void 0 : T.getItem(this.nonceStorageKey), f = Ae(this.nonceStorageKey), $ = (U = globalThis.sessionStorage) == null ? void 0 : U.getItem(f);
+    if ((M = globalThis.sessionStorage) == null || M.removeItem(f), this.cleanCallbackUrl(), !c) {
+      this.banner = this.msg.genericErrorMessage, this.callbackPhase = "failed";
       return;
     }
-    await this.withLoading(async () => {
-      var y;
-      await i.completeOAuth({ access_code: e, nonce: h }, this.signal()), (y = globalThis.sessionStorage) == null || y.removeItem(this.nonceStorageKey);
-    });
+    this.callbackPhase = "working", await this.withLoading(async () => {
+      var I, O;
+      if (await h.completeOAuth({ access_code: e, nonce: c }, this.signal()), (I = globalThis.sessionStorage) == null || I.removeItem(this.nonceStorageKey), $) {
+        const xe = this.settings ?? this.settingsCtl.settings, Ue = ((O = R(xe, "link").find((Me) => Me.id === $)) == null ? void 0 : O.name) ?? $;
+        this.linkNotice = this.msg.providerConnectedNotice.replace("{name}", Ue);
+      }
+    }), this.callbackPhase = this.banner ? "failed" : "";
   }
   /** The small logo above a screen title: image when given one, else text. */
   renderLogo() {
-    return this.logoUrl ? a`<img class="logo-img" part="logo" src=${this.logoUrl} alt=${this.logoText} />` : this.logoText ? a`<div class="logo-dot" part="logo">${this.logoText}</div>` : d;
+    return this.logoUrl ? r`<img class="logo-img" part="logo" src=${this.logoUrl} alt=${this.logoText} />` : this.logoText ? r`<div class="logo-dot" part="logo">${this.logoText}</div>` : d;
   }
   /** The larger logo in the split layout's brand panel. */
   renderBrandMark() {
-    return this.logoUrl ? a`<img class="brand-img" part="logo" src=${this.logoUrl} alt=${this.logoText} />` : this.logoText ? a`<div class="brand-mark" part="logo">${this.logoText}</div>` : d;
+    return this.logoUrl ? r`<img class="brand-img" part="logo" src=${this.logoUrl} alt=${this.logoText} />` : this.logoText ? r`<div class="brand-mark" part="logo">${this.logoText}</div>` : d;
   }
   renderBranding() {
-    return ps(
-      this.branding,
-      this.brandingText,
-      this.msg.brandingLabel,
-      this.brandingUrl
-    );
+    return Es(this.branding, "Auth");
   }
   /** Every screen renders inside this, so the credit appears once and only once. */
   panel(t) {
-    return a`<div class="panel">${t}${this.renderBranding()}</div>`;
+    return r`<div class="panel">${t}${this.renderBranding()}</div>`;
   }
   renderOAuthCallback() {
-    return a`
+    return r`
       <div class="stack">
         <div class="head">
           ${this.renderLogo()}
           <h2 class="title" part="title">${this.msg.oauthCallbackTitle}</h2>
           <p class="sub">${this.msg.oauthCallbackSub}</p>
         </div>
-        ${this.banner ? a`<div class="banner" part="banner" role="alert">${this.banner}</div>` : a`<div class="stack" style="align-items:center;">
+        ${this.banner ? r`<div class="banner" part="banner" role="alert">${this.banner}</div>` : r`<div class="stack" style="align-items:center;">
                 <span class="spinner" part="spinner"></span>
               </div>`}
-        ${this.banner ? a`<button type="button" class="ghost" @click=${() => this.goto("signin")}>
+        ${this.banner ? r`<button
+                type="button"
+                class="ghost"
+                @click=${() => {
+      this.callbackPhase = "", this.goto("signin");
+    }}
+              >
                 <span>${this.msg.backCta}</span>
               </button>` : d}
       </div>
@@ -2263,11 +2326,32 @@ let u = (He = class extends $ {
     }
   }
   describeError(t) {
-    if (t instanceof Ce) {
-      if (t.code === "AUTH_RATE_LIMITED") return this.msg.rateLimitedMessage;
-      if (t.code === "INVALID_TOKEN") return "That code is not valid. Check it and try again.";
-    }
-    return this.msg.genericErrorMessage;
+    return Fe(t, this.msg);
+  }
+  /**
+   * The message for a code the backend sent back on the redirect. The code is
+   * only ever looked up, never shown, so a crafted URL can't put text on the page.
+   */
+  describeOAuthError(t) {
+    return zs.test(t) ? t === "INVALID_CREDENTIALS" ? this.msg.oauthNoAccountMessage : Fe(
+      new Ne({ type: "AUTH_ERROR", status: 400, message: t }),
+      this.msg
+    ) : this.msg.genericErrorMessage;
+  }
+  /** The requirements hint under a field that creates a password. */
+  get passwordHint() {
+    const t = this.settings ?? this.settingsCtl.settings;
+    return as(t == null ? void 0 : t.auth_settings.password_policy, this.msg);
+  }
+  /** The placeholder for a field that creates a password. */
+  get newPasswordHint() {
+    const t = this.settings ?? this.settingsCtl.settings;
+    return ss(t == null ? void 0 : t.auth_settings.password_policy, this.msg);
+  }
+  /** The project's password rules, checked wherever a password is created. */
+  checkNewPassword(t) {
+    const e = this.settings ?? this.settingsCtl.settings;
+    return is(t, e == null ? void 0 : e.auth_settings.password_policy, this.msg);
   }
   get codeValue() {
     return this.code.join("");
@@ -2306,8 +2390,9 @@ let u = (He = class extends $ {
       return;
     }
     if (s === "newpass") {
-      if (this.newPass.length < 10) {
-        this.newPassError = this.msg.passwordMinError;
+      const i = this.checkNewPassword(this.newPass);
+      if (i) {
+        this.newPassError = i;
         return;
       }
       if (this.newPass !== this.confirmPass) {
@@ -2323,20 +2408,18 @@ let u = (He = class extends $ {
       return;
     }
     if (s === "invite") {
-      if (!this.firstName.trim() || !this.lastName.trim()) {
-        this.banner = "Enter your first and last name.";
-        return;
-      }
-      if (this.phone.replace(/\D/g, "").length < 7) {
+      const i = this.phone.trim();
+      if (i && i.replace(/\D/g, "").length < 7) {
         this.banner = this.msg.invalidPhoneError;
         return;
       }
-      if (this.password.length < 10) {
-        this.passError = this.msg.passwordMinError;
+      const h = this.checkNewPassword(this.password);
+      if (h) {
+        this.passError = h;
         return;
       }
-      const i = this.inviteCode || this.codeValue;
-      if (i.length < 6) {
+      const c = this.inviteCode || this.codeValue;
+      if (c.length < 6) {
         this.banner = this.msg.codeIncompleteError;
         return;
       }
@@ -2346,21 +2429,32 @@ let u = (He = class extends $ {
             email: this.inviteEmail,
             grant_type: "code",
             purpose: "invite",
-            code: i,
+            code: c,
             password: this.password,
-            phone: this.phone
+            ...i ? { phone: i } : {}
           },
           this.signal()
         );
+        const f = this.firstName.trim(), $ = this.lastName.trim();
+        (f || $) && await e.updateAccount(
+          { ...f ? { first_name: f } : {}, ...$ ? { last_name: $ } : {} },
+          this.signal()
+        ).catch(() => {
+        });
       });
       return;
     }
     if (this.stepped && (s === "signup" && this.step < 2 || s === "signin" && this.step < 1)) {
-      if (!this.email.includes("@")) {
+      if (s === "signup" && this.step === 0) {
+        if (!this.name.trim()) {
+          this.banner = this.msg.firstNameRequiredError;
+          return;
+        }
+      } else if (!this.email.includes("@")) {
         this.emailError = this.msg.invalidEmailError;
         return;
       }
-      this.step += 1;
+      this.banner = "", this.step += 1;
       return;
     }
     if (!this.email.includes("@")) {
@@ -2368,35 +2462,41 @@ let u = (He = class extends $ {
       return;
     }
     if (s === "signup") {
-      if (this.password.length < 8) {
-        this.passError = "Password must be at least 8 characters.";
+      const [i = "", ...h] = this.name.trim().split(/\s+/);
+      if (!i) {
+        this.banner = this.msg.firstNameRequiredError;
+        return;
+      }
+      const c = this.checkNewPassword(this.password);
+      if (c) {
+        this.passError = c;
         return;
       }
-      const [i, ...h] = this.name.trim().split(/\s+/);
+      const f = h.join(" ");
       await this.withLoading(async () => {
-        const c = await e.signUp(
+        const $ = await e.signUp(
           {
             email: this.email,
             password: this.password,
-            first_name: i || this.name,
-            last_name: h.join(" ") || "—"
+            first_name: i,
+            ...f ? { last_name: f } : {}
           },
           this.signal()
-        ), w = ls({
-          next_action: c.next_action,
-          next_operation: c.next_operation
+        ), E = fs({
+          next_action: $.next_action,
+          next_operation: $.next_operation
         });
         this.setScreen("signin", {
-          notice: "Account created. Sign in to continue.",
+          notice: this.msg.accountCreatedNotice,
           step: 0,
           password: "",
-          needsMfaCode: w === "signin_with_code"
+          needsMfaCode: E === "signin_with_code"
         });
       });
       return;
     }
-    if (this.password.length < 8) {
-      this.attempts += 1, this.passError = "Password must be at least 8 characters.", this.banner = this.attempts >= 3 ? this.msg.rateLimitedMessage : "";
+    if (!this.password) {
+      this.passError = this.msg.requiredError;
       return;
     }
     await this.withLoading(async () => {
@@ -2410,12 +2510,12 @@ let u = (He = class extends $ {
           this.signal()
         ), this.step = 0;
       } catch (i) {
-        if (i instanceof Ce && i.code === "CODE_REQUIRED") {
+        if (i instanceof Ne && i.code === "CODE_REQUIRED") {
           this.needsMfaCode = !0, await e.requestCode({ email: this.email, purpose: "signin" }, this.signal()), this.notice = this.msg.codeSentNeutral;
           return;
         }
-        if (i instanceof Ce && i.code === "INVALID_CREDENTIALS") {
-          this.attempts += 1, this.banner = this.attempts >= 3 ? this.msg.rateLimitedMessage : "That email and password do not match.";
+        if (i instanceof Ne && i.code === "INVALID_CREDENTIALS") {
+          this.banner = this.msg.invalidCredentialsError;
           return;
         }
         throw i;
@@ -2427,16 +2527,16 @@ let u = (He = class extends $ {
     return (t = this.abortController) == null || t.abort(), this.abortController = new AbortController(), this.abortController.signal;
   }
   onCodeInput(t, e) {
-    var w;
+    var f;
     const i = e.target.value.replace(/\D/g, "");
     if (i.length > 1) {
       this.fillCode(t, i);
       return;
     }
     const h = i.slice(-1), c = this.code.slice();
-    c[t] = h, this.code = c, this.banner = "", h && ((w = this.renderRoot.querySelectorAll(
+    c[t] = h, this.code = c, this.banner = "", h && ((f = this.renderRoot.querySelectorAll(
       ".code-row input, .code-row-sm input"
-    )[t + 1]) == null || w.focus());
+    )[t + 1]) == null || f.focus());
   }
   onCodePaste(t, e) {
     var i;
@@ -2461,7 +2561,7 @@ let u = (He = class extends $ {
     if (!t || this.loading) return;
     const e = this.verifyNext === "newpass" ? "password_reset" : "signin";
     await this.withLoading(async () => {
-      await t.requestCode({ email: this.email, purpose: e }, this.signal()), this.notice = "New code sent.", this.code = ["", "", "", "", "", ""];
+      await t.requestCode({ email: this.email, purpose: e }, this.signal()), this.notice = this.msg.codeResentNotice, this.code = ["", "", "", "", "", ""];
     });
   }
   goBack() {
@@ -2538,15 +2638,15 @@ let u = (He = class extends $ {
   }
   // ── render pieces ─────────────────────────────────────────
   renderPrimary(t) {
-    return a`
+    return r`
       <button type="submit" class="primary" part="button-primary" ?disabled=${this.loading}>
-        ${this.loading ? a`<span class="spinner" part="spinner"></span>` : d}
+        ${this.loading ? r`<span class="spinner" part="spinner"></span>` : d}
         <span>${t}</span>
       </button>
     `;
   }
   renderEmailField(t) {
-    return a`
+    return r`
       <div class="field">
         <label for=${t}>${this.msg.emailLabel}</label>
         <input
@@ -2561,16 +2661,16 @@ let u = (He = class extends $ {
       this.email = e.target.value, this.emailError = "", this.banner = "";
     }}
         />
-        ${this.emailError ? a`<p class="err">${this.emailError}</p>` : d}
+        ${this.emailError ? r`<p class="err">${this.emailError}</p>` : d}
       </div>
     `;
   }
-  renderPasswordField(t, e) {
-    return a`
+  renderPasswordField(t, e, s = !1) {
+    return r`
       <div class="field">
         <div class="label-row">
           <label for=${t}>${this.msg.passwordLabel}</label>
-          ${e ? a`<button
+          ${e ? r`<button
                   type="button"
                   class="link-sm"
                   @click=${() => this.setScreen("forgot", { step: 0 })}
@@ -2583,28 +2683,33 @@ let u = (He = class extends $ {
           type="password"
           part="input"
           .value=${this.password}
-          placeholder=${this.msg.passwordPlaceholder}
+          placeholder=${s ? this.newPasswordHint : this.msg.passwordPlaceholder}
           aria-invalid=${this.passError ? "true" : "false"}
           ?disabled=${this.loading}
-          @input=${(s) => {
-      this.password = s.target.value, this.passError = "", this.banner = "";
+          @input=${(i) => {
+      this.password = i.target.value, this.passError = "", this.banner = "";
     }}
         />
-        ${this.passError ? a`<p class="err">${this.passError}</p>` : d}
+        ${s ? this.passwordHint : d}
+        ${this.passError ? r`<p class="err">${this.passError}</p>` : d}
       </div>
     `;
   }
   renderCodeRow(t = !1) {
-    return a`
-      <div class=${t ? "code-row-sm" : "code-row"} role="group" aria-label="Verification code">
+    return r`
+      <div
+        class=${t ? "code-row-sm" : "code-row"}
+        role="group"
+        aria-label=${this.msg.codeLabel}
+      >
         ${this.code.map(
-      (e, s) => a`
+      (e, s) => r`
             <input
               type="text"
               inputmode="numeric"
               maxlength="1"
               part="code-box"
-              aria-label=${`Digit ${s + 1}`}
+              aria-label=${this.msg.digitLabel.replace("{n}", String(s + 1))}
               autocomplete=${s === 0 ? "one-time-code" : "off"}
               .value=${e}
               ?disabled=${this.loading}
@@ -2618,9 +2723,9 @@ let u = (He = class extends $ {
   }
   /** The email/password method accordion body for signin, signup and otp. */
   renderEmailMethodBody(t) {
-    const e = this.cfg, s = this.stepped, i = t === "signup" && (!s || this.step === 0), h = t === "signup" && (!s || this.step === 1) || t === "signin" && (!s || this.step === 0) || t === "otp", c = t === "signup" && (!s || this.step === 2) || t === "signin" && (!s || this.step === 1), w = t === "signin" && e.allowEmailSignin && e.allowEmailOtp && (!s || this.step === 0);
-    return a`
-      ${i ? a`
+    const e = this.cfg, s = this.stepped, i = t === "signup" && (!s || this.step === 0), h = t === "signup" && (!s || this.step === 1) || t === "signin" && (!s || this.step === 0) || t === "otp", c = t === "signup" && (!s || this.step === 2) || t === "signin" && (!s || this.step === 1), f = t === "signin" && e.allowEmailSignin && e.allowEmailOtp && (!s || this.step === 0);
+    return r`
+      ${i ? r`
               <div class="field">
                 <label for=${this.uid("name")}>${this.msg.fullNameLabel}</label>
                 <input
@@ -2630,20 +2735,24 @@ let u = (He = class extends $ {
                   .value=${this.name}
                   placeholder=${this.msg.fullNamePlaceholder}
                   ?disabled=${this.loading}
-                  @input=${(y) => this.name = y.target.value}
+                  @input=${($) => this.name = $.target.value}
                 />
               </div>
             ` : d}
       ${h ? this.renderEmailField(this.uid("email")) : d}
-      ${c ? this.renderPasswordField(this.uid("pass"), e.allowEmailSignin && t === "signin") : d}
-      ${this.needsMfaCode && t === "signin" ? a`
+      ${c ? this.renderPasswordField(
+      this.uid("pass"),
+      e.allowRecovery && t === "signin",
+      t === "signup"
+    ) : d}
+      ${this.needsMfaCode && t === "signin" ? r`
               <div class="field">
-                <span class="label">Verification code</span>
+                <span class="label">${this.msg.codeLabel}</span>
                 ${this.renderCodeRow(!0)}
               </div>
             ` : d}
       ${this.renderPrimary(this.ctaFor(t))}
-      ${w ? a`<button
+      ${f ? r`<button
               type="button"
               class="edit-link"
               @click=${() => this.setScreen("otp", { step: 0 })}
@@ -2653,62 +2762,62 @@ let u = (He = class extends $ {
     `;
   }
   renderAccordion(t) {
-    const e = this.cfg, s = t === "signin" && e.allowEmailSignin || t === "signup" && e.allowEmailSignup || t === "otp" && e.allowEmailOtp, i = e.allowOauth;
-    if (!s && !i) return d;
-    const h = s && i, c = s ? i && this.method || "email" : "oauth", w = c === "email", y = c === "oauth", Se = t === "signup" ? this.msg.emailMethodTitleSignUp : this.msg.emailMethodTitle, Xe = t === "otp" ? this.msg.emailMethodMetaOtp : t === "signup" ? this.msg.emailMethodMetaSignUp : this.msg.emailMethodMeta, Oe = (Ue, Ze, ts, es, ss, Le) => a`
-      <div class="acc-item ${Ue ? "open" : ""} ${h ? "" : "bare"}" part="acc-item">
-        ${h ? a`
+    const e = this.cfg, s = t === "signin" && e.allowEmailSignin || t === "signup" && e.allowEmailSignup || t === "otp" && e.allowEmailOtp, i = this.settings ?? this.settingsCtl.settings, h = R(i, t === "signup" ? "signup" : "signin"), c = e.allowOauth && (!i || h.length > 0);
+    if (!s && !c) return d;
+    const f = s && c, $ = s ? c && this.method || "email" : "oauth", E = $ === "email", C = $ === "oauth", k = t === "signup" ? this.msg.emailMethodTitleSignUp : this.msg.emailMethodTitle, T = t === "otp" ? this.msg.emailMethodMetaOtp : t === "signup" ? this.msg.emailMethodMetaSignUp : this.msg.emailMethodMeta, U = (O, xe, Ue, Me, cs, He) => r`
+      <div class="acc-item ${O ? "open" : ""} ${f ? "" : "bare"}" part="acc-item">
+        ${f ? r`
                 <button
                   type="button"
                   class="acc-head"
-                  aria-expanded=${Ue ? "true" : "false"}
-                  aria-controls=${this.uid(`acc-${Le}`)}
-                  @click=${ss}
+                  aria-expanded=${O ? "true" : "false"}
+                  aria-controls=${this.uid(`acc-${He}`)}
+                  @click=${cs}
                 >
                   <span class="chev" aria-hidden="true">›</span>
-                  <span class="acc-title">${Ze}</span>
-                  <span class="acc-meta">${ts}</span>
+                  <span class="acc-title">${xe}</span>
+                  <span class="acc-meta">${Ue}</span>
                 </button>
               ` : d}
-        <div class="acc-body" id=${this.uid(`acc-${Le}`)}>
+        <div class="acc-body" id=${this.uid(`acc-${He}`)}>
           <div class="acc-clip">
-            <div class="acc-inner">${es}</div>
+            <div class="acc-inner">${Me}</div>
           </div>
         </div>
       </div>
-    `, xe = s ? Oe(
-      w,
-      Se,
-      Xe,
+    `, M = s ? U(
+      E,
+      k,
+      T,
       this.renderEmailMethodBody(t),
-      () => this.method = w ? "" : "email",
+      () => this.method = E ? "" : "email",
       "email"
-    ) : d, Te = i ? Oe(
-      y,
+    ) : d, I = c ? U(
+      C,
       this.msg.oauthMethodTitle,
-      this.msg.oauthMethodMeta,
-      a`<singlebase-authui-buttons
+      h.length ? h.map((O) => O.name).join(", ") : this.msg.oauthMethodMeta,
+      r`<singlebase-authui-buttons
             type="oauth"
             embedded
-            theme=${k(this.theme)}
-            density=${k(this.density)}
-            field-style=${k(this.fieldStyle)}
+            theme=${A(this.theme)}
+            density=${A(this.density)}
+            field-style=${A(this.fieldStyle)}
             .client=${this.resolvedClient}
             .messages=${this.messages}
             .settings=${this.settings ?? this.settingsCtl.settings}
             intent=${t === "signup" ? "signup" : "signin"}
           ></singlebase-authui-buttons>`,
-      () => this.method = y ? "" : "oauth",
+      () => this.method = C ? "" : "oauth",
       "oauth"
     ) : d;
-    return a`
+    return r`
       <div class="acc-wrap">
-        ${this.oauthPlacement === "top" ? a`${Te}${xe}` : a`${xe}${Te}`}
+        ${this.oauthPlacement === "top" ? r`${I}${M}` : r`${M}${I}`}
       </div>
     `;
   }
   renderScreenBody(t) {
-    return this.cfg, ["signin", "signup", "otp"].indexOf(t) >= 0 ? this.renderAccordion(t) : t === "forgot" ? a`<div class="fields">${this.renderEmailField(this.uid("reset"))}</div>` : t === "verify" ? a`
+    return this.cfg, ["signin", "signup", "otp"].indexOf(t) >= 0 ? this.renderAccordion(t) : t === "forgot" ? r`<div class="fields">${this.renderEmailField(this.uid("reset"))}</div>` : t === "verify" ? r`
         ${this.renderCodeRow()}
         <div class="resend-row">
           <span class="hint">${this.msg.resendQuestion}</span>
@@ -2716,7 +2825,7 @@ let u = (He = class extends $ {
             ${this.msg.resendCta}
           </button>
         </div>
-      ` : t === "newpass" ? a`
+      ` : t === "newpass" ? r`
         <div class="fields">
           <div class="field">
             <label for=${this.uid("newpass")}>${this.msg.newPasswordLabel}</label>
@@ -2725,7 +2834,7 @@ let u = (He = class extends $ {
               type="password"
               part="input"
               .value=${this.newPass}
-              placeholder=${this.msg.newPasswordPlaceholder}
+              placeholder=${this.newPasswordHint}
               aria-invalid=${this.newPassError ? "true" : "false"}
               ?disabled=${this.loading}
               @input=${(s) => {
@@ -2747,17 +2856,18 @@ let u = (He = class extends $ {
       this.confirmPass = s.target.value, this.newPassError = "";
     }}
             />
-            ${this.newPassError ? a`<p class="err">${this.newPassError}</p>` : d}
+            ${this.passwordHint}
+            ${this.newPassError ? r`<p class="err">${this.newPassError}</p>` : d}
           </div>
         </div>
-      ` : t === "invite" ? a`
+      ` : t === "invite" ? r`
         <div class="fields">
           <div class="invite-box">
             <span class="invite-label">${this.msg.invitedEmailLabel}</span>
             <span class="invite-email">${this.inviteEmail}</span>
           </div>
-          ${this.inviteCode ? d : a`<div class="field">
-                  <span class="label">Invite code</span>
+          ${this.inviteCode ? d : r`<div class="field">
+                  <span class="label">${this.msg.inviteCodeLabel}</span>
                   ${this.renderCodeRow(!0)}
                 </div>`}
           <div class="two-up">
@@ -2805,21 +2915,22 @@ let u = (He = class extends $ {
               type="password"
               part="input"
               .value=${this.password}
-              placeholder=${this.msg.newPasswordPlaceholder}
+              placeholder=${this.newPasswordHint}
               aria-invalid=${this.passError ? "true" : "false"}
               ?disabled=${this.loading}
               @input=${(s) => {
       this.password = s.target.value, this.passError = "";
     }}
             />
-            ${this.passError ? a`<p class="err">${this.passError}</p>` : d}
+            ${this.passwordHint}
+            ${this.passError ? r`<p class="err">${this.passError}</p>` : d}
           </div>
         </div>
       ` : d;
   }
   renderGuest(t) {
     const e = this.cfg, s = ["forgot", "verify", "newpass", "invite"].indexOf(t) >= 0, i = this.stepped && this.step > 0 || ["forgot", "verify", "otp", "newpass"].indexOf(t) >= 0, h = t === "signin" && e.allowEmailSignup || t === "signup" && e.allowEmailSignin, c = this.stepped && (t === "signin" || t === "signup");
-    return a`
+    return r`
       <form class="stack" @submit=${this.onSubmit} novalidate>
         <div class="head">
           ${this.layout !== "split" ? this.renderLogo() : d}
@@ -2827,21 +2938,21 @@ let u = (He = class extends $ {
           <p class="sub">${this.subFor(t)}</p>
         </div>
 
-        ${c ? a`<div class="step-bar">
+        ${c ? r`<div class="step-bar">
                 <div class="step-fill" style="width:${this.stepPct()}%"></div>
               </div>` : d}
-        ${this.banner ? a`<div class="banner" part="banner" role="alert">${this.banner}</div>` : d}
-        ${this.notice ? a`<div class="notice" part="notice" role="status">${this.notice}</div>` : d}
+        ${this.banner ? r`<div class="banner" part="banner" role="alert">${this.banner}</div>` : d}
+        ${this.notice ? r`<div class="notice" part="notice" role="status">${this.notice}</div>` : d}
         ${this.renderScreenBody(t)}
-        ${s || i ? a`
+        ${s || i ? r`
                 <div class="actions">
                   ${s ? this.renderPrimary(this.ctaFor(t)) : d}
-                  ${i ? a`<button type="button" class="ghost" @click=${this.goBack}>
+                  ${i ? r`<button type="button" class="ghost" @click=${this.goBack}>
                           ${this.msg.backCta}
                         </button>` : d}
                 </div>
               ` : d}
-        ${h ? a`
+        ${h ? r`
                 <p class="foot">
                   <span
                     >${t === "signup" ? this.msg.footTextSignUp : this.msg.footTextSignIn}</span
@@ -2861,14 +2972,14 @@ let u = (He = class extends $ {
         ${this.renderConsent()}
 
         <span class="sr-only" role="status" aria-live="polite">
-          ${this.loading ? "Submitting…" : ""}
+          ${this.loading ? this.msg.submittingStatus : ""}
         </span>
       </form>
     `;
   }
   renderBlocked() {
     const e = !this.cfg.authEnabled;
-    return a`
+    return r`
       <div class="stack">
         <div class="head">
           ${this.layout !== "split" ? this.renderLogo() : d}
@@ -2890,7 +3001,7 @@ let u = (He = class extends $ {
    */
   renderSignedIn() {
     const t = this.auth.state.status === "authenticated" ? this.auth.state.user : null, e = this.redirectTarget;
-    return a`
+    return r`
       <div class="stack">
         <div class="head">
           ${this.renderLogo()}
@@ -2909,60 +3020,73 @@ let u = (He = class extends $ {
           </button>
         </div>
 
-        ${e ? d : a`<p class="hint">${this.msg.continueHint}</p>`}
+        ${e ? d : r`<p class="hint">${this.msg.continueHint}</p>`}
       </div>
     `;
   }
   /** The Terms/Privacy consent line, rendered only when the host supplies a link. */
   renderConsent() {
     if (!this.tosUrl && !this.privacyUrl) return d;
-    const t = this.tosUrl ? a`<a class="link-sm" href=${this.tosUrl} target="_blank" rel="noopener noreferrer"
+    const t = this.tosUrl ? r`<a class="link-sm" href=${this.tosUrl} target="_blank" rel="noopener noreferrer"
           >${this.msg.termsLabel}</a
-        >` : d, e = this.privacyUrl ? a`<a class="link-sm" href=${this.privacyUrl} target="_blank" rel="noopener noreferrer"
+        >` : d, e = this.privacyUrl ? r`<a class="link-sm" href=${this.privacyUrl} target="_blank" rel="noopener noreferrer"
           >${this.msg.privacyLabel}</a
         >` : d;
-    return a`
-      <p class="hint" part="consent">
+    return r`
+      <p class="hint consent" part="consent">
         ${this.msg.consentPrefix}
-        ${t}${this.tosUrl && this.privacyUrl ? a` ${this.msg.consentJoin} ` : d}${e}.
+        ${t}${this.tosUrl && this.privacyUrl ? r` ${this.msg.consentJoin} ` : d}${e}.
       </p>
     `;
   }
+  /**
+   * The OAuth return is handled after the first render, not during it: state
+   * set while rendering is dropped, so the widget wouldn't leave the callback
+   * screen once the URL is cleaned.
+   */
+  updated(t) {
+    super.updated(t), this.activeScreen === "oauth-callback" && this.handleOAuthCallback();
+  }
   render() {
     const t = this.activeScreen;
     if (t === "oauth-callback")
-      return this.handleOAuthCallback(), this.panel(this.renderOAuthCallback());
-    if (t === "account")
-      return this.noAccountView ? d : this.panel(a`
+      return this.panel(this.renderOAuthCallback());
+    if (t === "account") {
+      if (this.noAccountView) return d;
+      const h = this.callbackPhase === "failed" && this.banner;
+      return this.panel(r`
+        ${h ? r`<div class="banner" part="banner" role="alert">${this.banner}</div>` : d}
+        ${this.linkNotice ? r`<div class="notice" part="notice" role="status">${this.linkNotice}</div>` : d}
         <singlebase-authui-account
-          theme=${k(this.theme)}
-          density=${k(this.density)}
-          field-style=${k(this.fieldStyle)}
+          theme=${A(this.theme)}
+          density=${A(this.density)}
+          field-style=${A(this.fieldStyle)}
           .client=${this.resolvedClient}
           .messages=${this.messages}
           logo-text=${this.logoText}
           logo-url=${this.logoUrl}
         ></singlebase-authui-account>
       `);
+    }
     if (this.showsSignedInInterstitial)
       return this.noAccountView ? d : this.panel(this.renderSignedIn());
-    const e = this.cfg, s = !e.allowEmailSignin && !e.allowEmailOtp && !e.allowOauth, i = !e.authEnabled || s && De(t);
-    return a`
-      ${this.layout === "split" ? a`
+    const e = this.cfg, s = !e.allowEmailSignin && !e.allowEmailOtp && !e.allowOauth, i = !e.authEnabled || s && We(t);
+    return r`
+      ${this.layout === "split" ? r`
               <div class="brand-panel">
                 ${this.renderBrandMark()}
-                ${this.brandLine ? a`<div class="brand-copy">${this.brandLine}</div>` : d}
-                ${this.brandFoot ? a`<div class="brand-foot">${this.brandFoot}</div>` : d}
+                ${this.brandLine ? r`<div class="brand-copy">${this.brandLine}</div>` : d}
+                ${this.brandFoot ? r`<div class="brand-foot">${this.brandFoot}</div>` : d}
               </div>
             ` : d}
       ${this.panel(i ? this.renderBlocked() : this.renderGuest(t))}
     `;
   }
-}, vt = new WeakMap(), wt = new WeakMap(), $t = new WeakMap(), yt = new WeakMap(), Et = new WeakMap(), St = new WeakMap(), Ct = new WeakMap(), Pt = new WeakMap(), kt = new WeakMap(), _t = new WeakMap(), Ot = new WeakMap(), xt = new WeakMap(), Tt = new WeakMap(), Ut = new WeakMap(), Lt = new WeakMap(), At = new WeakMap(), Mt = new WeakMap(), Nt = new WeakMap(), It = new WeakMap(), Ft = new WeakMap(), Dt = new WeakMap(), Bt = new WeakMap(), Rt = new WeakMap(), jt = new WeakMap(), Ht = new WeakMap(), qt = new WeakMap(), Vt = new WeakMap(), Gt = new WeakMap(), Kt = new WeakMap(), Yt = new WeakMap(), Wt = new WeakMap(), zt = new WeakMap(), Jt = new WeakMap(), Qt = new WeakMap(), Xt = new WeakMap(), Zt = new WeakMap(), te = new WeakMap(), ee = new WeakMap(), se = new WeakMap(), ie = new WeakMap(), ae = new WeakMap(), re = new WeakMap(), ne = new WeakMap(), oe = new WeakMap(), le = new WeakMap(), he = new WeakMap(), de = new WeakMap(), ce = new WeakMap(), ue = new WeakMap(), He);
-Is(u, "styles", [
-  ...$.styles,
-  us,
-  Ge`
+}, _t = new WeakMap(), kt = new WeakMap(), Tt = new WeakMap(), Ot = new WeakMap(), Nt = new WeakMap(), At = new WeakMap(), Lt = new WeakMap(), xt = new WeakMap(), Ut = new WeakMap(), Mt = new WeakMap(), It = new WeakMap(), Rt = new WeakMap(), Ft = new WeakMap(), Dt = new WeakMap(), Bt = new WeakMap(), Ht = new WeakMap(), qt = new WeakMap(), jt = new WeakMap(), Kt = new WeakMap(), Vt = new WeakMap(), Gt = new WeakMap(), Wt = new WeakMap(), Yt = new WeakMap(), zt = new WeakMap(), Jt = new WeakMap(), Zt = new WeakMap(), Qt = new WeakMap(), Xt = new WeakMap(), te = new WeakMap(), ee = new WeakMap(), se = new WeakMap(), ie = new WeakMap(), ae = new WeakMap(), re = new WeakMap(), ne = new WeakMap(), oe = new WeakMap(), le = new WeakMap(), he = new WeakMap(), de = new WeakMap(), ce = new WeakMap(), ue = new WeakMap(), pe = new WeakMap(), ge = new WeakMap(), me = new WeakMap(), be = new WeakMap(), fe = new WeakMap(), ve = new WeakMap(), we = new WeakMap(), Ze);
+Ys(u, "styles", [
+  ...y.styles,
+  ys,
+  ts`
       /* the mock's root */
       :host {
         display: flex;
@@ -3063,22 +3187,22 @@ g([
   p({ attribute: !1 })
 ], u.prototype, "settings", 1);
 g([
-  p({ converter: P, attribute: "auth-enabled" })
+  p({ converter: N, attribute: "auth-enabled" })
 ], u.prototype, "authEnabled", 1);
 g([
-  p({ converter: P, attribute: "allow-email-signin" })
+  p({ converter: N, attribute: "allow-email-signin" })
 ], u.prototype, "allowEmailSignin", 1);
 g([
-  p({ converter: P, attribute: "allow-email-signup" })
+  p({ converter: N, attribute: "allow-email-signup" })
 ], u.prototype, "allowEmailSignup", 1);
 g([
-  p({ converter: P, attribute: "allow-email-otp" })
+  p({ converter: N, attribute: "allow-email-otp" })
 ], u.prototype, "allowEmailOtp", 1);
 g([
-  p({ converter: P, attribute: "allow-oauth" })
+  p({ converter: N, attribute: "allow-oauth" })
 ], u.prototype, "allowOauth", 1);
 g([
-  p({ converter: P, attribute: "allow-account-creation" })
+  p({ converter: N, attribute: "allow-account-creation" })
 ], u.prototype, "allowAccountCreation", 1);
 g([
   p()
@@ -3105,14 +3229,8 @@ g([
   p({ attribute: "sign-in-title" })
 ], u.prototype, "signInTitle", 1);
 g([
-  p({ converter: P, attribute: "branding" })
+  p({ converter: N, attribute: "branding" })
 ], u.prototype, "branding", 1);
-g([
-  p({ attribute: "branding-text" })
-], u.prototype, "brandingText", 1);
-g([
-  p({ attribute: "branding-url" })
-], u.prototype, "brandingUrl", 1);
 g([
   p({ attribute: "redirect-url" })
 ], u.prototype, "redirectUrl", 1);
@@ -3188,50 +3306,53 @@ g([
 g([
   m()
 ], u.prototype, "newPassError", 1);
-g([
-  m()
-], u.prototype, "attempts", 1);
 g([
   m()
 ], u.prototype, "needsMfaCode", 1);
 g([
   m()
 ], u.prototype, "callbackDone", 1);
+g([
+  m()
+], u.prototype, "callbackPhase", 1);
+g([
+  m()
+], u.prototype, "linkNotice", 1);
 u = g([
-  ye("singlebase-authui")
+  Te("singlebase-authui")
 ], u);
-var Bs = Object.defineProperty, Rs = Object.getOwnPropertyDescriptor, Pe = (l, t, e, s) => {
-  for (var i = s > 1 ? void 0 : s ? Rs(t, e) : t, h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
-  return s && i && Bs(t, e, i), i;
+var Qs = Object.defineProperty, Xs = Object.getOwnPropertyDescriptor, Le = (a, t, e, s) => {
+  for (var i = s > 1 ? void 0 : s ? Xs(t, e) : t, h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
+  return s && i && Qs(t, e, i), i;
 };
-const js = ["loading", "authenticated", "unauthenticated"];
-var pe, ge, me, qe;
-let x = (qe = class extends $ {
+const ti = ["loading", "authenticated", "unauthenticated"];
+var $e, ye, Ee, Qe;
+let F = (Qe = class extends y {
   constructor() {
     super(...arguments);
-    n(this, pe, "");
-    n(this, ge, null);
-    n(this, me, "unauthenticated");
+    o(this, $e, "");
+    o(this, ye, null);
+    o(this, Ee, "unauthenticated");
     b(this, "warnedFor", null);
   }
   get slot() {
-    return r(this, pe);
+    return n(this, $e);
   }
   set slot(t) {
-    o(this, pe, t);
+    l(this, $e, t);
   }
   get predicate() {
-    return r(this, ge);
+    return n(this, ye);
   }
   set predicate(t) {
-    o(this, ge, t);
+    l(this, ye, t);
   }
   get onMismatch() {
-    return r(this, me);
+    return n(this, Ee);
   }
   set onMismatch(t) {
-    o(this, me, t);
+    l(this, Ee, t);
   }
   createRenderRoot() {
     return this;
@@ -3244,100 +3365,100 @@ let x = (qe = class extends $ {
     if (!this.predicate) return "authenticated";
     this.warnOnce(this.predicate);
     const e = this.auth.state.user;
-    return fs(e, this.predicate) ? "authenticated" : this.onMismatch === "hidden" ? "hidden" : "unauthenticated";
+    return _s(e, this.predicate) ? "authenticated" : this.onMismatch === "hidden" ? "hidden" : "unauthenticated";
   }
   /** Surfaces a malformed predicate once, rather than silently never matching. */
   warnOnce(t) {
     const e = JSON.stringify(t);
     if (this.warnedFor !== e) {
       this.warnedFor = e;
-      for (const s of vs(t))
+      for (const s of ks(t))
         console.warn(`[singlebase] <singlebase-authui-guard> predicate: ${s}`);
     }
   }
   render() {
     const t = this.activeState;
     if (this.slot) {
-      const e = js.includes(this.slot) && this.slot === t;
-      return this.toggleAttribute("hidden", !e), a`<slot></slot>`;
+      const e = ti.includes(this.slot) && this.slot === t;
+      return this.toggleAttribute("hidden", !e), r`<slot></slot>`;
     }
     this.toggleAttribute("hidden", !1);
     for (const e of Array.from(this.children)) {
       const s = e.getAttribute("slot");
       e.toggleAttribute("hidden", s !== t);
     }
-    return a`<slot></slot>`;
+    return r`<slot></slot>`;
   }
-}, pe = new WeakMap(), ge = new WeakMap(), me = new WeakMap(), qe);
-Pe([
+}, $e = new WeakMap(), ye = new WeakMap(), Ee = new WeakMap(), Qe);
+Le([
   p({ reflect: !0 })
-], x.prototype, "slot", 1);
-Pe([
+], F.prototype, "slot", 1);
+Le([
   p({
     converter: {
-      fromAttribute: (l) => {
-        if (!l) return null;
+      fromAttribute: (a) => {
+        if (!a) return null;
         try {
-          return JSON.parse(l);
+          return JSON.parse(a);
         } catch {
-          return console.error("[singlebase] guard predicate is not valid JSON:", l), null;
+          return console.error("[singlebase] guard predicate is not valid JSON:", a), null;
         }
       },
-      toAttribute: (l) => l ? JSON.stringify(l) : null
+      toAttribute: (a) => a ? JSON.stringify(a) : null
     }
   })
-], x.prototype, "predicate", 1);
-Pe([
+], F.prototype, "predicate", 1);
+Le([
   p({ attribute: "on-mismatch" })
-], x.prototype, "onMismatch", 1);
-x = Pe([
-  ye("singlebase-authui-guard")
-], x);
-var Qe = Object.defineProperty, Hs = Object.getOwnPropertyDescriptor, qs = (l, t, e) => t in l ? Qe(l, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : l[t] = e, O = (l, t, e, s) => {
-  for (var i = s > 1 ? void 0 : s ? Hs(t, e) : t, h = l.length - 1, c; h >= 0; h--)
-    (c = l[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
-  return s && i && Qe(t, e, i), i;
-}, Vs = (l, t, e) => qs(l, t + "", e);
-const Gs = "profile_photo";
-var be, fe, ve, we, $e, Ve;
-let S = (Ve = class extends $ {
+], F.prototype, "onMismatch", 1);
+F = Le([
+  Te("singlebase-authui-guard")
+], F);
+var ds = Object.defineProperty, ei = Object.getOwnPropertyDescriptor, si = (a, t, e) => t in a ? ds(a, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : a[t] = e, x = (a, t, e, s) => {
+  for (var i = s > 1 ? void 0 : s ? ei(t, e) : t, h = a.length - 1, c; h >= 0; h--)
+    (c = a[h]) && (i = (s ? c(t, e, i) : c(i)) || i);
+  return s && i && ds(t, e, i), i;
+}, ii = (a, t, e) => si(a, t + "", e);
+const ai = "profile_photo";
+var Se, Ce, Pe, _e, ke, Xe;
+let P = (Xe = class extends y {
   constructor() {
     super(...arguments);
-    n(this, be, "");
-    n(this, fe, "");
-    n(this, ve, !1);
-    n(this, we, "");
-    n(this, $e, !1);
+    o(this, Se, "");
+    o(this, Ce, "");
+    o(this, Pe, !1);
+    o(this, _e, "");
+    o(this, ke, !1);
   }
   get path() {
-    return r(this, be);
+    return n(this, Se);
   }
   set path(t) {
-    o(this, be, t);
+    l(this, Se, t);
   }
   get fallback() {
-    return r(this, fe);
+    return n(this, Ce);
   }
   set fallback(t) {
-    o(this, fe, t);
+    l(this, Ce, t);
   }
   get avatar() {
-    return r(this, ve);
+    return n(this, Pe);
   }
   set avatar(t) {
-    o(this, ve, t);
+    l(this, Pe, t);
   }
   get alt() {
-    return r(this, we);
+    return n(this, _e);
   }
   set alt(t) {
-    o(this, we, t);
+    l(this, _e, t);
   }
   get imageFailed() {
-    return r(this, $e);
+    return n(this, ke);
   }
   set imageFailed(t) {
-    o(this, $e, t);
+    l(this, ke, t);
   }
   willUpdate(t) {
     super.willUpdate(t), (t.has("path") || t.has("avatar")) && (this.imageFailed = !1);
@@ -3350,41 +3471,41 @@ let S = (Ve = class extends $ {
   get textValue() {
     const t = this.profile;
     if (!t || !this.path) return "";
-    const e = Ne(t, this.path);
+    const e = Ke(t, this.path);
     return e == null || e === "" ? "" : Array.isArray(e) ? e.filter((s) => s != null).join(", ") : typeof e == "object" ? "" : String(e);
   }
   get avatarSrc() {
     const t = this.profile;
     if (!t) return "";
-    const e = Ne(t, this.path || Gs);
+    const e = Ke(t, this.path || ai);
     return typeof e == "string" ? e : "";
   }
   render() {
     if (this.auth.state.status === "loading") return d;
     if (this.avatar) return this.renderAvatar();
     const t = this.textValue;
-    return t ? a`<span part="text">${t}</span>` : this.fallback ? a`<span part="text">${this.fallback}</span>` : d;
+    return t ? r`<span part="text">${t}</span>` : this.fallback ? r`<span part="text">${this.fallback}</span>` : d;
   }
   renderAvatar() {
     const t = this.profile;
     if (!t) return d;
     const e = this.avatarSrc;
-    return e && !this.imageFailed ? a`<img
+    return e && !this.imageFailed ? r`<img
         part="avatar-image"
         src=${e}
         alt=${this.alt}
         @error=${() => this.imageFailed = !0}
-      />` : a`<span
+      />` : r`<span
       part="avatar-initials"
       class="initials"
       aria-hidden=${this.alt ? "false" : "true"}
-      >${Ye(t)}</span
+      >${ns(t)}</span
     >`;
   }
-}, be = new WeakMap(), fe = new WeakMap(), ve = new WeakMap(), we = new WeakMap(), $e = new WeakMap(), Ve);
-Vs(S, "styles", [
-  ...$.styles,
-  Ge`
+}, Se = new WeakMap(), Ce = new WeakMap(), Pe = new WeakMap(), _e = new WeakMap(), ke = new WeakMap(), Xe);
+ii(P, "styles", [
+  ...y.styles,
+  ts`
       /* Text sits in a sentence; an avatar is a box the host sizes. */
       :host {
         display: inline;
@@ -3424,38 +3545,38 @@ Vs(S, "styles", [
       }
     `
 ]);
-O([
+x([
   p()
-], S.prototype, "path", 1);
-O([
+], P.prototype, "path", 1);
+x([
   p()
-], S.prototype, "fallback", 1);
-O([
+], P.prototype, "fallback", 1);
+x([
   p({ type: Boolean, reflect: !0 })
-], S.prototype, "avatar", 1);
-O([
+], P.prototype, "avatar", 1);
+x([
   p()
-], S.prototype, "alt", 1);
-O([
+], P.prototype, "alt", 1);
+x([
   m()
-], S.prototype, "imageFailed", 1);
-S = O([
-  ye("singlebase-authui-display")
-], S);
+], P.prototype, "imageFailed", 1);
+P = x([
+  Te("singlebase-authui-display")
+], P);
 export {
-  ws as A,
-  ke as S,
-  f as a,
-  E as b,
-  S as c,
-  x as d,
+  Ts as A,
+  De as S,
+  v as a,
+  S as b,
+  P as c,
+  F as d,
   u as e,
-  Ie as f,
-  Ke as g,
-  De as h,
-  Ye as i,
-  Ds as j,
-  Be as k,
-  $s as r
+  Ve as f,
+  rs as g,
+  We as h,
+  ns as i,
+  Zs as j,
+  Ye as k,
+  Os as r
 };
-//# sourceMappingURL=authui-display-CKfGK5va.js.map
+//# sourceMappingURL=authui-display-CRUABt43.js.map