@tinyrack/issuary-server 0.22.0 → 0.23.0

package/public/assets/{passkey-UL_cNRnQ.js.map → passkey-C5vUVgr_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"passkey-UL_cNRnQ.js","names":["RouteErrorFallback","SetupStep","SplitErrorComponent","errorComponent"],"sources":["../../../frontend/src/routes/setup/passkey/index.tsx?tsr-split=errorComponent"],"sourcesContent":["import { standardSchemaResolver } from '@hookform/resolvers/standard-schema';\nimport {\n  useMutation,\n  useQueryClient,\n  useSuspenseQuery,\n} from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLinkButton } from '@tinyrack/ui/components/link-button';\nimport { TRText } from '@tinyrack/ui/components/text';\nimport {\n  CircleAlertIcon,\n  FingerprintIcon,\n  ShieldCheckIcon,\n  TagIcon,\n} from 'lucide-react';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport { useForm } from 'react-hook-form';\nimport { useTranslation } from 'react-i18next';\nimport { z } from 'zod';\nimport { AuthField } from '#frontend/components/auth/auth-field.tsx';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { Alert } from '#frontend/components/ui/alert.tsx';\nimport { RouteErrorFallback } from '#frontend/components/ui/route-error-fallback.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  isOAuthFlow,\n  OAuthSearchSchema,\n} from '#frontend/libs/oauth-search.ts';\nimport { classifyPasskeyError } from '#frontend/libs/passkey-error.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { appConfigQueryOptions } from '#frontend/queries/config.ts';\nimport { registerPasskeyMutationOptions } from '#frontend/queries/passkey.ts';\nimport { getSessionQueryOptions } from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema.extend({\n  passkey_name: z.string().optional(),\n});\n\nexport const Route = createFileRoute('/setup/passkey/')({\n  component: SetupPasskey,\n  errorComponent: RouteErrorFallback,\n  loader: async ({ context }) => {\n    await context.queryClient.ensureQueryData(appConfigQueryOptions);\n  },\n  validateSearch: SearchSchema,\n});\n\ntype SetupStep = 'form' | 'registering' | 'error';\n\nfunction SetupPasskey() {\n  const { t } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const { data: appConfig } = useSuspenseQuery(appConfigQueryOptions);\n\n  const [step, setStep] = useState<SetupStep>(\n    search.passkey_name ? 'registering' : 'form',\n  );\n  const [errorMessage, setErrorMessage] = useState<string>('');\n  const autoRegisterCalledRef = useRef(false);\n  const canUseTotpSetup =\n    appConfig.auth.password.enabled &&\n    appConfig.auth.password.two_factor.enrollment_required &&\n    appConfig.auth.password.totp.enabled;\n\n  const formSchema = useMemo(\n    () =>\n      z.object({\n        name: z.string().max(100, t('validation.passkey.name.max')),\n      }),\n    [t],\n  );\n\n  type FormValues = z.infer<typeof formSchema>;\n\n  const {\n    register,\n    handleSubmit,\n    formState: { errors },\n  } = useForm<FormValues>({\n    defaultValues: { name: '' },\n    resolver: standardSchemaResolver(formSchema),\n  });\n\n  const registerMutation = useMutation({\n    ...registerPasskeyMutationOptions,\n    onSuccess: async (data) => {\n      if (data.second_factor_setup_completed && data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n          user: data.user,\n        });\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href = buildAuthenticatedAuthorizeUrl(search);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      } else {\n        queryClient.invalidateQueries({\n          queryKey: getSessionQueryOptions.queryKey,\n        });\n        router.navigate({ to: '/profile' });\n      }\n    },\n    onError: (error) => {\n      setStep('error');\n      const reason = classifyPasskeyError(error);\n\n      switch (reason) {\n        case 'unsupported':\n          setErrorMessage(t('setupPasskey.error.unsupported'));\n          return;\n        case 'not_allowed':\n          setErrorMessage(t('setupPasskey.error.notAllowed'));\n          return;\n        case 'expired':\n          setErrorMessage(t('setupPasskey.error.expired'));\n          return;\n        case 'user_mismatch':\n        case 'verification_failed':\n          setErrorMessage(t('setupPasskey.error.failed'));\n          return;\n      }\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  useEffect(() => {\n    if (search.passkey_name && !autoRegisterCalledRef.current) {\n      autoRegisterCalledRef.current = true;\n      registerMutation.mutate({ name: search.passkey_name });\n    }\n  }, [registerMutation, search.passkey_name]);\n\n  const onSubmit = (values: FormValues) => {\n    setStep('registering');\n    setErrorMessage('');\n    registerMutation.mutate({ name: values.name || undefined });\n  };\n\n  // Registering state - waiting for WebAuthn\n  if (step === 'registering') {\n    return (\n      <AuthLayout>\n        <AuthPageHeader\n          subtitle={t('setupPasskey.subtitle')}\n          title={t('setupPasskey.title')}\n        />\n        <div className=\"flex flex-col items-center gap-tinyrack-lg py-tinyrack-xl\">\n          <FingerprintIcon\n            aria-hidden\n            className=\"size-tinyrack-3xl animate-pulse text-tinyrack-primary\"\n          />\n          <TRText align=\"center\" as=\"p\" color=\"muted\" variant=\"body\">\n            {t('setupPasskey.waiting')}\n          </TRText>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  // Error state\n  if (step === 'error') {\n    return (\n      <AuthLayout>\n        <AuthPageHeader\n          subtitle={t('setupPasskey.subtitle')}\n          title={t('setupPasskey.title')}\n        />\n        <Alert icon={CircleAlertIcon} type=\"error\">\n          {errorMessage}\n        </Alert>\n\n        <div className=\"flex flex-col gap-tinyrack-sm\">\n          {canUseTotpSetup && (\n            <TRLinkButton\n              className=\"w-full gap-tinyrack-sm\"\n              intent=\"primary\"\n              render={\n                <Link search={extractOAuthParams(search)} to=\"/setup/totp\" />\n              }\n              uiSize=\"lg\"\n            >\n              <ShieldCheckIcon aria-hidden className=\"size-tinyrack-xl\" />\n              {t('setupPasskey.useTotp')}\n            </TRLinkButton>\n          )}\n          <TRButton\n            appearance={canUseTotpSetup ? 'outline' : 'solid'}\n            className=\"w-full\"\n            intent={canUseTotpSetup ? 'neutral' : 'primary'}\n            onClick={() => {\n              if (search.passkey_name) {\n                setStep('registering');\n                setErrorMessage('');\n                registerMutation.mutate({ name: search.passkey_name });\n              } else {\n                setStep('form');\n              }\n            }}\n            type=\"button\"\n            uiSize=\"lg\"\n          >\n            {t('setupPasskey.retry')}\n          </TRButton>\n        </div>\n\n        <AuthFooter>\n          <AuthFooterLink\n            link={\n              <Link search={extractOAuthParams(search)} to=\"/login\">\n                {t('setupPasskey.backToLogin')}\n              </Link>\n            }\n          />\n        </AuthFooter>\n      </AuthLayout>\n    );\n  }\n\n  // Form state\n  return (\n    <AuthLayout>\n      <AuthPageHeader\n        subtitle={t('setupPasskey.subtitle')}\n        title={t('setupPasskey.title')}\n      />\n\n      <Alert icon={ShieldCheckIcon} type=\"info\">\n        {t('setupPasskey.required')}\n      </Alert>\n\n      <TRText align=\"center\" as=\"p\" color=\"muted\" variant=\"bodySm\">\n        {t('setupPasskey.description')}\n      </TRText>\n\n      <form\n        className=\"flex flex-col gap-tinyrack-lg\"\n        onSubmit={handleSubmit(onSubmit)}\n      >\n        <AuthField\n          error={errors.name}\n          hint={t('setupPasskey.name.hint')}\n          icon={TagIcon}\n          id=\"passkey-name\"\n          label={t('setupPasskey.name.label')}\n          placeholder={t('setupPasskey.name.placeholder')}\n          {...register('name')}\n          type=\"text\"\n        />\n\n        <TRButton\n          className=\"w-full\"\n          intent=\"primary\"\n          loading={registerMutation.isPending}\n          loadingLabel={t('setupPasskey.registering')}\n          type=\"submit\"\n          uiSize=\"lg\"\n        >\n          {t('setupPasskey.continue')}\n        </TRButton>\n      </form>\n\n      <AuthFooter>\n        <AuthFooterLink\n          link={\n            <Link search={extractOAuthParams(search)} to=\"/login\">\n              {t('setupPasskey.backToLogin')}\n            </Link>\n          }\n        />\n      </AuthFooter>\n    </AuthLayout>\n  );\n}\n"],"mappings":"wCAsDkD,IAAAE,EA3BzCF"}
+{"version":3,"file":"passkey-C5vUVgr_.js","names":["RouteErrorFallback","SetupStep","SplitErrorComponent","errorComponent"],"sources":["../../../frontend/src/routes/setup/passkey/index.tsx?tsr-split=errorComponent"],"sourcesContent":["import { standardSchemaResolver } from '@hookform/resolvers/standard-schema';\nimport {\n  useMutation,\n  useQueryClient,\n  useSuspenseQuery,\n} from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLinkButton } from '@tinyrack/ui/components/link-button';\nimport { TRText } from '@tinyrack/ui/components/text';\nimport {\n  CircleAlertIcon,\n  FingerprintIcon,\n  ShieldCheckIcon,\n  TagIcon,\n} from 'lucide-react';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport { useForm } from 'react-hook-form';\nimport { useTranslation } from 'react-i18next';\nimport { z } from 'zod';\nimport { AuthField } from '#frontend/components/auth/auth-field.tsx';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { Alert } from '#frontend/components/ui/alert.tsx';\nimport { RouteErrorFallback } from '#frontend/components/ui/route-error-fallback.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  isOAuthFlow,\n  OAuthSearchSchema,\n} from '#frontend/libs/oauth-search.ts';\nimport { classifyPasskeyError } from '#frontend/libs/passkey-error.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { appConfigQueryOptions } from '#frontend/queries/config.ts';\nimport { registerPasskeyMutationOptions } from '#frontend/queries/passkey.ts';\nimport { getSessionQueryOptions } from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema.extend({\n  passkey_name: z.string().optional(),\n});\n\nexport const Route = createFileRoute('/setup/passkey/')({\n  component: SetupPasskey,\n  errorComponent: RouteErrorFallback,\n  loader: async ({ context }) => {\n    await context.queryClient.ensureQueryData(appConfigQueryOptions);\n  },\n  validateSearch: SearchSchema,\n});\n\ntype SetupStep = 'form' | 'registering' | 'error';\n\nfunction SetupPasskey() {\n  const { t } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const { data: appConfig } = useSuspenseQuery(appConfigQueryOptions);\n\n  const [step, setStep] = useState<SetupStep>(\n    search.passkey_name ? 'registering' : 'form',\n  );\n  const [errorMessage, setErrorMessage] = useState<string>('');\n  const autoRegisterCalledRef = useRef(false);\n  const canUseTotpSetup =\n    appConfig.auth.password.enabled &&\n    appConfig.auth.password.two_factor.enrollment_required &&\n    appConfig.auth.password.totp.enabled;\n\n  const formSchema = useMemo(\n    () =>\n      z.object({\n        name: z.string().max(100, t('validation.passkey.name.max')),\n      }),\n    [t],\n  );\n\n  type FormValues = z.infer<typeof formSchema>;\n\n  const {\n    register,\n    handleSubmit,\n    formState: { errors },\n  } = useForm<FormValues>({\n    defaultValues: { name: '' },\n    resolver: standardSchemaResolver(formSchema),\n  });\n\n  const registerMutation = useMutation({\n    ...registerPasskeyMutationOptions,\n    onSuccess: async (data) => {\n      if (data.second_factor_setup_completed && data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n          user: data.user,\n        });\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href = buildAuthenticatedAuthorizeUrl(search);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      } else {\n        queryClient.invalidateQueries({\n          queryKey: getSessionQueryOptions.queryKey,\n        });\n        router.navigate({ to: '/profile' });\n      }\n    },\n    onError: (error) => {\n      setStep('error');\n      const reason = classifyPasskeyError(error);\n\n      switch (reason) {\n        case 'unsupported':\n          setErrorMessage(t('setupPasskey.error.unsupported'));\n          return;\n        case 'not_allowed':\n          setErrorMessage(t('setupPasskey.error.notAllowed'));\n          return;\n        case 'expired':\n          setErrorMessage(t('setupPasskey.error.expired'));\n          return;\n        case 'user_mismatch':\n        case 'verification_failed':\n          setErrorMessage(t('setupPasskey.error.failed'));\n          return;\n      }\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  useEffect(() => {\n    if (search.passkey_name && !autoRegisterCalledRef.current) {\n      autoRegisterCalledRef.current = true;\n      registerMutation.mutate({ name: search.passkey_name });\n    }\n  }, [registerMutation, search.passkey_name]);\n\n  const onSubmit = (values: FormValues) => {\n    setStep('registering');\n    setErrorMessage('');\n    registerMutation.mutate({ name: values.name || undefined });\n  };\n\n  // Registering state - waiting for WebAuthn\n  if (step === 'registering') {\n    return (\n      <AuthLayout>\n        <AuthPageHeader\n          subtitle={t('setupPasskey.subtitle')}\n          title={t('setupPasskey.title')}\n        />\n        <div className=\"flex flex-col items-center gap-tinyrack-lg py-tinyrack-xl\">\n          <FingerprintIcon\n            aria-hidden\n            className=\"size-tinyrack-3xl animate-pulse text-tinyrack-primary\"\n          />\n          <TRText align=\"center\" as=\"p\" color=\"muted\" variant=\"body\">\n            {t('setupPasskey.waiting')}\n          </TRText>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  // Error state\n  if (step === 'error') {\n    return (\n      <AuthLayout>\n        <AuthPageHeader\n          subtitle={t('setupPasskey.subtitle')}\n          title={t('setupPasskey.title')}\n        />\n        <Alert icon={CircleAlertIcon} type=\"error\">\n          {errorMessage}\n        </Alert>\n\n        <div className=\"flex flex-col gap-tinyrack-sm\">\n          {canUseTotpSetup && (\n            <TRLinkButton\n              className=\"w-full gap-tinyrack-sm\"\n              intent=\"primary\"\n              render={\n                <Link search={extractOAuthParams(search)} to=\"/setup/totp\" />\n              }\n              uiSize=\"lg\"\n            >\n              <ShieldCheckIcon aria-hidden className=\"size-tinyrack-xl\" />\n              {t('setupPasskey.useTotp')}\n            </TRLinkButton>\n          )}\n          <TRButton\n            appearance={canUseTotpSetup ? 'outline' : 'solid'}\n            className=\"w-full\"\n            intent={canUseTotpSetup ? 'neutral' : 'primary'}\n            onClick={() => {\n              if (search.passkey_name) {\n                setStep('registering');\n                setErrorMessage('');\n                registerMutation.mutate({ name: search.passkey_name });\n              } else {\n                setStep('form');\n              }\n            }}\n            type=\"button\"\n            uiSize=\"lg\"\n          >\n            {t('setupPasskey.retry')}\n          </TRButton>\n        </div>\n\n        <AuthFooter>\n          <AuthFooterLink\n            link={\n              <Link search={extractOAuthParams(search)} to=\"/login\">\n                {t('setupPasskey.backToLogin')}\n              </Link>\n            }\n          />\n        </AuthFooter>\n      </AuthLayout>\n    );\n  }\n\n  // Form state\n  return (\n    <AuthLayout>\n      <AuthPageHeader\n        subtitle={t('setupPasskey.subtitle')}\n        title={t('setupPasskey.title')}\n      />\n\n      <Alert icon={ShieldCheckIcon} type=\"info\">\n        {t('setupPasskey.required')}\n      </Alert>\n\n      <TRText align=\"center\" as=\"p\" color=\"muted\" variant=\"bodySm\">\n        {t('setupPasskey.description')}\n      </TRText>\n\n      <form\n        className=\"flex flex-col gap-tinyrack-lg\"\n        onSubmit={handleSubmit(onSubmit)}\n      >\n        <AuthField\n          error={errors.name}\n          hint={t('setupPasskey.name.hint')}\n          icon={TagIcon}\n          id=\"passkey-name\"\n          label={t('setupPasskey.name.label')}\n          placeholder={t('setupPasskey.name.placeholder')}\n          {...register('name')}\n          type=\"text\"\n        />\n\n        <TRButton\n          className=\"w-full\"\n          intent=\"primary\"\n          loading={registerMutation.isPending}\n          loadingLabel={t('setupPasskey.registering')}\n          type=\"submit\"\n          uiSize=\"lg\"\n        >\n          {t('setupPasskey.continue')}\n        </TRButton>\n      </form>\n\n      <AuthFooter>\n        <AuthFooterLink\n          link={\n            <Link search={extractOAuthParams(search)} to=\"/login\">\n              {t('setupPasskey.backToLogin')}\n            </Link>\n          }\n        />\n      </AuthFooter>\n    </AuthLayout>\n  );\n}\n"],"mappings":"wCAsDkD,IAAAE,EA3BzCF"}

package/public/assets/passkey-CynCz1Dt.js

@@ -0,0 +1,2 @@
+import{J as e,U as t,Z as n,i as r,q as i,s as a}from"./createLucideIcon-BPpAIXR_.js";import{On as o,Sn as s,Sr as c,i as l,n as u,r as d,ur as f}from"./config-DTQCUlfZ.js";import{t as p}from"./useMutation-BWZ0G4Td.js";import{t as m}from"./useQuery-Ckxjmvtl.js";import{t as h}from"./fingerprint-pattern-DP62Vk8x.js";import{F as g,N as _,R as v,S as y,j as b,m as x,z as S}from"./index-CS23Ozt6.js";import{t as C}from"./auth-page-header-CIn2E4zI.js";import{t as w}from"./alert-leqyvHOp.js";import{t as T}from"./auth-layout-VtpryDof.js";import{t as E}from"./promise-OpBtq8tG.js";import{n as D,t as O}from"./auth-footer-Cz5ivsDc.js";import{t as k}from"./passkey-error-ZqqPQUta.js";import{t as A}from"./passkey-J1qnYp9A.js";var j=n(e()),M=f({queryKey:u.pendingSecondFactorMethods(),queryFn:async()=>l(await d.api.auth[`2fa`].methods.$get()),retry:!1}),N=i();function P(){let{t:e}=r(),n=o(),i=c(),l=x.useSearch(),[u,d]=(0,j.useState)(null),f=(0,j.useRef)(!1),P=m({...M,enabled:u!==null}).data?.methods.includes(`totp`)??!1,F=t=>{switch(t){case`unsupported`:return e(`verifyPasskey.error.unsupported`);case`not_allowed`:return e(`verifyPasskey.error.notAllowed`);case`expired`:return e(`verifyPasskey.error.expired`);case`user_mismatch`:return e(`verifyPasskey.error.userMismatch`);case`verification_failed`:return e(`verifyPasskey.error.failed`)}},I=p({...A,onSuccess:async e=>{e.user&&(i.setQueryData(y.queryKey,{user:e.user}),await E(),g(l)?window.location.href=b(l):n.navigate({to:`/profile`}))},onError:async e=>{let t=k(e);d({message:F(t),reason:t})},onSettled:()=>{i.invalidateQueries({queryKey:y.queryKey})}});return(0,j.useEffect)(()=>{f.current||(f.current=!0,I.mutate())},[I]),(0,N.jsxs)(T,{children:[(0,N.jsx)(C,{align:`center`,subtitle:e(`verifyPasskey.subtitle`),title:e(`verifyPasskey.title`)}),(0,N.jsxs)(`div`,{className:`flex flex-col items-center gap-tinyrack-lg`,children:[(0,N.jsx)(`div`,{className:`flex size-tinyrack-3xl items-center justify-center rounded-tinyrack-full bg-tinyrack-surface-muted`,children:(0,N.jsx)(h,{"aria-hidden":!0,className:`size-tinyrack-2xl text-tinyrack-text-muted`})}),I.isPending&&(0,N.jsxs)(`div`,{className:`flex flex-col items-center gap-tinyrack-sm`,children:[(0,N.jsx)(t,{uiSize:`md`}),(0,N.jsx)(`p`,{className:`text-center text-tinyrack-sm text-tinyrack-text-muted`,children:e(`verifyPasskey.waiting`)})]}),u&&(0,N.jsxs)(`div`,{className:`flex w-full flex-col items-center gap-tinyrack-md`,children:[(0,N.jsx)(w,{className:`w-full`,icon:v,type:`error`,children:u.message}),P&&(0,N.jsx)(S,{className:`w-full`,intent:`primary`,render:(0,N.jsx)(s,{search:_(l),to:`/verify/totp`}),uiSize:`lg`,children:e(`verifyPasskey.useTotp`)}),(0,N.jsx)(a,{appearance:P?`outline`:`solid`,className:`w-full`,intent:P?`neutral`:`primary`,onClick:()=>{d(null),I.mutate()},type:`button`,uiSize:`lg`,children:e(`verifyPasskey.retry`)})]})]}),(0,N.jsx)(O,{children:(0,N.jsx)(D,{link:(0,N.jsx)(s,{search:l,to:`/login`,children:e(`verifyPasskey.backToLogin`)})})})]})}export{P as component};
+//# sourceMappingURL=passkey-CynCz1Dt.js.map

package/public/assets/{passkey-CEx1VZ5R.js.map → passkey-CynCz1Dt.js.map}

@@ -1 +1 @@
-{"version":3,"file":"passkey-CEx1VZ5R.js","names":["useMutation","useQuery","useQueryClient","Link","useRouter","TRButton","TRLinkButton","TRSpinner","CircleAlertIcon","FingerprintIcon","useEffect","useRef","useState","useTranslation","AuthFooter","AuthFooterLink","AuthPageHeader","Alert","AuthLayout","buildAuthenticatedAuthorizeUrl","extractOAuthParams","isOAuthFlow","classifyPasskeyError","tick","authenticateWithPasskeyMutationOptions","getPendingSecondFactorMethodsQueryOptions","getSessionQueryOptions","Route","VerifyPasskey","t","router","queryClient","search","useSearch","error","setError","message","reason","PasskeyErrorReason","hasStarted","pendingMethodsQuery","enabled","canUseTotp","data","methods","includes","getErrorMessage","verifyMutation","onSuccess","user","setQueryData","queryKey","window","location","href","navigate","to","onError","err","onSettled","invalidateQueries","current","mutate","isPending","component"],"sources":["../../../frontend/src/queries/second-factor.ts","../../../frontend/src/routes/verify/passkey/index.tsx?tsr-split=component"],"sourcesContent":["import { queryOptions } from '@tanstack/react-query';\nimport type { InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\nimport { queryKeys } from './keys';\n\nexport type PendingSecondFactorMethodsResponse = InferResponseType<\n  (typeof client.api.auth)['2fa']['methods']['$get'],\n  200\n>;\n\nexport const getPendingSecondFactorMethodsQueryOptions = queryOptions({\n  queryKey: queryKeys.pendingSecondFactorMethods(),\n  queryFn: async () => {\n    const res = await client.api.auth['2fa'].methods.$get();\n    return jsonOk(res);\n  },\n  retry: false,\n});\n","import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLinkButton } from '@tinyrack/ui/components/link-button';\nimport { TRSpinner } from '@tinyrack/ui/components/spinner';\nimport { CircleAlertIcon, FingerprintIcon } from 'lucide-react';\nimport { useEffect, useRef, useState } from 'react';\nimport { useTranslation } from 'react-i18next';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { Alert } from '#frontend/components/ui/alert.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  isOAuthFlow,\n  OAuthSearchSchema,\n} from '#frontend/libs/oauth-search.ts';\nimport {\n  classifyPasskeyError,\n  type PasskeyErrorReason,\n} from '#frontend/libs/passkey-error.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { authenticateWithPasskeyMutationOptions } from '#frontend/queries/passkey.ts';\nimport { getPendingSecondFactorMethodsQueryOptions } from '#frontend/queries/second-factor.ts';\nimport { getSessionQueryOptions } from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema;\n\nexport const Route = createFileRoute('/verify/passkey/')({\n  component: VerifyPasskey,\n  validateSearch: SearchSchema,\n});\n\nfunction VerifyPasskey() {\n  const { t } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const [error, setError] = useState<{\n    message: string;\n    reason: PasskeyErrorReason;\n  } | null>(null);\n  const hasStarted = useRef(false);\n  const pendingMethodsQuery = useQuery({\n    ...getPendingSecondFactorMethodsQueryOptions,\n    enabled: error !== null,\n  });\n  const canUseTotp =\n    pendingMethodsQuery.data?.methods.includes('totp') ?? false;\n\n  const getErrorMessage = (reason: PasskeyErrorReason) => {\n    switch (reason) {\n      case 'unsupported':\n        return t('verifyPasskey.error.unsupported');\n      case 'not_allowed':\n        return t('verifyPasskey.error.notAllowed');\n      case 'expired':\n        return t('verifyPasskey.error.expired');\n      case 'user_mismatch':\n        return t('verifyPasskey.error.userMismatch');\n      case 'verification_failed':\n        return t('verifyPasskey.error.failed');\n    }\n  };\n\n  const verifyMutation = useMutation({\n    ...authenticateWithPasskeyMutationOptions,\n    onSuccess: async (data) => {\n      if (data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n          user: data.user,\n        });\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href = buildAuthenticatedAuthorizeUrl(search);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      }\n    },\n    onError: async (err) => {\n      const reason = classifyPasskeyError(err);\n      setError({\n        message: getErrorMessage(reason),\n        reason,\n      });\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  // Auto-start passkey authentication on mount (with guard for StrictMode)\n  useEffect(() => {\n    if (hasStarted.current) return;\n    hasStarted.current = true;\n    verifyMutation.mutate();\n  }, [verifyMutation]);\n\n  return (\n    <AuthLayout>\n      {/*\n        Centred: this screen has no form to scan, only a device prompt to wait\n        on, so the eye has nothing to follow down a left edge.\n      */}\n      <AuthPageHeader\n        align=\"center\"\n        subtitle={t('verifyPasskey.subtitle')}\n        title={t('verifyPasskey.title')}\n      />\n\n      <div className=\"flex flex-col items-center gap-tinyrack-lg\">\n        <div className=\"flex size-tinyrack-3xl items-center justify-center rounded-tinyrack-full bg-tinyrack-surface-muted\">\n          <FingerprintIcon\n            aria-hidden\n            className=\"size-tinyrack-2xl text-tinyrack-text-muted\"\n          />\n        </div>\n\n        {verifyMutation.isPending && (\n          <div className=\"flex flex-col items-center gap-tinyrack-sm\">\n            <TRSpinner uiSize=\"md\" />\n            <p className=\"text-center text-tinyrack-sm text-tinyrack-text-muted\">\n              {t('verifyPasskey.waiting')}\n            </p>\n          </div>\n        )}\n\n        {error && (\n          <div className=\"flex w-full flex-col items-center gap-tinyrack-md\">\n            <Alert className=\"w-full\" icon={CircleAlertIcon} type=\"error\">\n              {error.message}\n            </Alert>\n            {canUseTotp && (\n              <TRLinkButton\n                className=\"w-full\"\n                intent=\"primary\"\n                render={\n                  <Link search={extractOAuthParams(search)} to=\"/verify/totp\" />\n                }\n                uiSize=\"lg\"\n              >\n                {t('verifyPasskey.useTotp')}\n              </TRLinkButton>\n            )}\n            <TRButton\n              appearance={canUseTotp ? 'outline' : 'solid'}\n              className=\"w-full\"\n              intent={canUseTotp ? 'neutral' : 'primary'}\n              onClick={() => {\n                setError(null);\n                verifyMutation.mutate();\n              }}\n              type=\"button\"\n              uiSize=\"lg\"\n            >\n              {t('verifyPasskey.retry')}\n            </TRButton>\n          </div>\n        )}\n      </div>\n\n      <AuthFooter>\n        <AuthFooterLink\n          link={\n            <Link search={search} to=\"/login\">\n              {t('verifyPasskey.backToLogin')}\n            </Link>\n          }\n        />\n      </AuthFooter>\n    </AuthLayout>\n  );\n}\n"],"mappings":"4vBAUA,EAAA,EAAA,4GAOA,CAAA,QCoBA,SAAS4B,GAAgB,CACvB,GAAM,CAAEC,KAAMhB,EAAe,EACvBiB,EAAS1B,EAAU,EACnB2B,EAAc7B,EAAe,EAC7B8B,EAASL,EAAMM,UAAU,EACzB,CAACC,EAAOC,IAAAA,EAAAA,EAAAA,SAAAA,CAGJ,IAAI,EACRI,GAAAA,EAAAA,EAAAA,OAAAA,CAAoB,EAAK,EAKzBG,EAJsBzC,EAAS,CACnC,GAAGwB,EACHgB,QAASP,IAAU,IACrB,CAEEM,CAAAA,CAAoBG,MAAMC,QAAQC,SAAS,MAAM,GAAK,GAElDC,EAAmBT,GAA+B,CACtD,OAAQA,EAAR,CACE,IAAK,cACH,OAAOR,EAAE,iCAAiC,EAC5C,IAAK,cACH,OAAOA,EAAE,gCAAgC,EAC3C,IAAK,UACH,OAAOA,EAAE,6BAA6B,EACxC,IAAK,gBACH,OAAOA,EAAE,kCAAkC,EAC7C,IAAK,sBACH,OAAOA,EAAE,4BAA4B,CACzC,CACF,EAEMkB,EAAiB/C,EAAY,CACjC,GAAGwB,EACHwB,UAAW,KAAOL,IAAS,CACrBA,EAAKM,OACPlB,EAAYmB,aAAaxB,EAAuByB,SAAU,CACxDF,KAAMN,EAAKM,IACb,CAAC,EACD,MAAM1B,EAAK,EAEPF,EAAYW,CAAM,EACpBoB,OAAOC,SAASC,KAAOnC,EAA+Ba,CAAM,EAE5DF,EAAOyB,SAAS,CAAEC,GAAI,UAAW,CAAC,EAGxC,EACAC,QAAS,KAAOC,IAAQ,CACtB,IAAMrB,EAASf,EAAqBoC,CAAG,EACvCvB,EAAS,CACPC,QAASU,EAAgBT,CAAM,EAC/BA,QACF,CAAC,CACH,EACAsB,cAAiB,CACf5B,EAAY6B,kBAAkB,CAC5BT,SAAUzB,EAAuByB,QACnC,CAAC,CACH,CACF,CAAC,EASD,OANAzC,EAAAA,EAAAA,UAAAA,KAAgB,CACV6B,EAAWsB,UACftB,EAAWsB,QAAU,GACrBd,EAAee,OAAO,EACxB,EAAG,CAACf,CAAc,CAAC,GAGjB,EAAA,EAAA,KAAA,CAAC,EAAD,CAAA,SAAA,EAKE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MAAM,SACN,SAAUlB,EAAE,wBAAwB,EACpC,MAAOA,EAAE,qBAAqB,CAAE,CAAA,GAGlC,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,sDAAf,EACE,EAAA,EAAA,IAAA,CAAC,MAAD,CAAK,UAAU,+GACb,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,cAAA,GACA,UAAU,4CAA4C,CAAA,CAErD,CAAA,EAEJkB,EAAegB,YACd,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,sDAAf,EACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAW,OAAO,IAAI,CAAA,GACtB,EAAA,EAAA,IAAA,CAAC,IAAD,CAAG,UAAU,iEACVlC,EAAE,uBAAuB,CACzB,CAAA,CACA,IAGNK,IACC,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,6DAAf,EACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAO,UAAU,SAAS,KAAM1B,EAAiB,KAAK,iBACnD0B,EAAME,OACF,CAAA,EACNM,IACC,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,UAAU,SACV,OAAO,UACP,QACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAM,OAAQtB,EAAmBY,CAAM,EAAG,GAAG,cAAc,CAAA,EAE7D,OAAO,cAENH,EAAE,uBAAuB,CACd,CAAA,GAEhB,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,WAAYa,EAAa,UAAY,QACrC,UAAU,SACV,OAAQA,EAAa,UAAY,UACjC,YAAe,CACbP,EAAS,IAAI,EACbY,EAAee,OAAO,CACxB,EACA,KAAK,SACL,OAAO,cAENjC,EAAE,qBAAqB,CAChB,CAAA,CACP,GAEJ,KAEL,EAAA,EAAA,IAAA,CAAC,EAAD,CAAA,UACE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAcG,SAAQ,GAAG,kBACtBH,EAAE,2BAA2B,CAC1B,CAAA,CACP,CAAA,CAEO,CAAA,CACF,CAAA,CAAA,CAEhB"}
+{"version":3,"file":"passkey-CynCz1Dt.js","names":["useMutation","useQuery","useQueryClient","Link","useRouter","TRButton","TRLinkButton","TRSpinner","CircleAlertIcon","FingerprintIcon","useEffect","useRef","useState","useTranslation","AuthFooter","AuthFooterLink","AuthPageHeader","Alert","AuthLayout","buildAuthenticatedAuthorizeUrl","extractOAuthParams","isOAuthFlow","classifyPasskeyError","tick","authenticateWithPasskeyMutationOptions","getPendingSecondFactorMethodsQueryOptions","getSessionQueryOptions","Route","VerifyPasskey","t","router","queryClient","search","useSearch","error","setError","message","reason","PasskeyErrorReason","hasStarted","pendingMethodsQuery","enabled","canUseTotp","data","methods","includes","getErrorMessage","verifyMutation","onSuccess","user","setQueryData","queryKey","window","location","href","navigate","to","onError","err","onSettled","invalidateQueries","current","mutate","isPending","component"],"sources":["../../../frontend/src/queries/second-factor.ts","../../../frontend/src/routes/verify/passkey/index.tsx?tsr-split=component"],"sourcesContent":["import { queryOptions } from '@tanstack/react-query';\nimport type { InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\nimport { queryKeys } from './keys';\n\nexport type PendingSecondFactorMethodsResponse = InferResponseType<\n  (typeof client.api.auth)['2fa']['methods']['$get'],\n  200\n>;\n\nexport const getPendingSecondFactorMethodsQueryOptions = queryOptions({\n  queryKey: queryKeys.pendingSecondFactorMethods(),\n  queryFn: async () => {\n    const res = await client.api.auth['2fa'].methods.$get();\n    return jsonOk(res);\n  },\n  retry: false,\n});\n","import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLinkButton } from '@tinyrack/ui/components/link-button';\nimport { TRSpinner } from '@tinyrack/ui/components/spinner';\nimport { CircleAlertIcon, FingerprintIcon } from 'lucide-react';\nimport { useEffect, useRef, useState } from 'react';\nimport { useTranslation } from 'react-i18next';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { Alert } from '#frontend/components/ui/alert.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  isOAuthFlow,\n  OAuthSearchSchema,\n} from '#frontend/libs/oauth-search.ts';\nimport {\n  classifyPasskeyError,\n  type PasskeyErrorReason,\n} from '#frontend/libs/passkey-error.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { authenticateWithPasskeyMutationOptions } from '#frontend/queries/passkey.ts';\nimport { getPendingSecondFactorMethodsQueryOptions } from '#frontend/queries/second-factor.ts';\nimport { getSessionQueryOptions } from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema;\n\nexport const Route = createFileRoute('/verify/passkey/')({\n  component: VerifyPasskey,\n  validateSearch: SearchSchema,\n});\n\nfunction VerifyPasskey() {\n  const { t } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const [error, setError] = useState<{\n    message: string;\n    reason: PasskeyErrorReason;\n  } | null>(null);\n  const hasStarted = useRef(false);\n  const pendingMethodsQuery = useQuery({\n    ...getPendingSecondFactorMethodsQueryOptions,\n    enabled: error !== null,\n  });\n  const canUseTotp =\n    pendingMethodsQuery.data?.methods.includes('totp') ?? false;\n\n  const getErrorMessage = (reason: PasskeyErrorReason) => {\n    switch (reason) {\n      case 'unsupported':\n        return t('verifyPasskey.error.unsupported');\n      case 'not_allowed':\n        return t('verifyPasskey.error.notAllowed');\n      case 'expired':\n        return t('verifyPasskey.error.expired');\n      case 'user_mismatch':\n        return t('verifyPasskey.error.userMismatch');\n      case 'verification_failed':\n        return t('verifyPasskey.error.failed');\n    }\n  };\n\n  const verifyMutation = useMutation({\n    ...authenticateWithPasskeyMutationOptions,\n    onSuccess: async (data) => {\n      if (data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n          user: data.user,\n        });\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href = buildAuthenticatedAuthorizeUrl(search);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      }\n    },\n    onError: async (err) => {\n      const reason = classifyPasskeyError(err);\n      setError({\n        message: getErrorMessage(reason),\n        reason,\n      });\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  // Auto-start passkey authentication on mount (with guard for StrictMode)\n  useEffect(() => {\n    if (hasStarted.current) return;\n    hasStarted.current = true;\n    verifyMutation.mutate();\n  }, [verifyMutation]);\n\n  return (\n    <AuthLayout>\n      {/*\n        Centred: this screen has no form to scan, only a device prompt to wait\n        on, so the eye has nothing to follow down a left edge.\n      */}\n      <AuthPageHeader\n        align=\"center\"\n        subtitle={t('verifyPasskey.subtitle')}\n        title={t('verifyPasskey.title')}\n      />\n\n      <div className=\"flex flex-col items-center gap-tinyrack-lg\">\n        <div className=\"flex size-tinyrack-3xl items-center justify-center rounded-tinyrack-full bg-tinyrack-surface-muted\">\n          <FingerprintIcon\n            aria-hidden\n            className=\"size-tinyrack-2xl text-tinyrack-text-muted\"\n          />\n        </div>\n\n        {verifyMutation.isPending && (\n          <div className=\"flex flex-col items-center gap-tinyrack-sm\">\n            <TRSpinner uiSize=\"md\" />\n            <p className=\"text-center text-tinyrack-sm text-tinyrack-text-muted\">\n              {t('verifyPasskey.waiting')}\n            </p>\n          </div>\n        )}\n\n        {error && (\n          <div className=\"flex w-full flex-col items-center gap-tinyrack-md\">\n            <Alert className=\"w-full\" icon={CircleAlertIcon} type=\"error\">\n              {error.message}\n            </Alert>\n            {canUseTotp && (\n              <TRLinkButton\n                className=\"w-full\"\n                intent=\"primary\"\n                render={\n                  <Link search={extractOAuthParams(search)} to=\"/verify/totp\" />\n                }\n                uiSize=\"lg\"\n              >\n                {t('verifyPasskey.useTotp')}\n              </TRLinkButton>\n            )}\n            <TRButton\n              appearance={canUseTotp ? 'outline' : 'solid'}\n              className=\"w-full\"\n              intent={canUseTotp ? 'neutral' : 'primary'}\n              onClick={() => {\n                setError(null);\n                verifyMutation.mutate();\n              }}\n              type=\"button\"\n              uiSize=\"lg\"\n            >\n              {t('verifyPasskey.retry')}\n            </TRButton>\n          </div>\n        )}\n      </div>\n\n      <AuthFooter>\n        <AuthFooterLink\n          link={\n            <Link search={search} to=\"/login\">\n              {t('verifyPasskey.backToLogin')}\n            </Link>\n          }\n        />\n      </AuthFooter>\n    </AuthLayout>\n  );\n}\n"],"mappings":"6tBAUA,EAAA,EAAA,4GAOA,CAAA,QCoBA,SAAS4B,GAAgB,CACvB,GAAM,CAAEC,KAAMhB,EAAe,EACvBiB,EAAS1B,EAAU,EACnB2B,EAAc7B,EAAe,EAC7B8B,EAASL,EAAMM,UAAU,EACzB,CAACC,EAAOC,IAAAA,EAAAA,EAAAA,SAAAA,CAGJ,IAAI,EACRI,GAAAA,EAAAA,EAAAA,OAAAA,CAAoB,EAAK,EAKzBG,EAJsBzC,EAAS,CACnC,GAAGwB,EACHgB,QAASP,IAAU,IACrB,CAEEM,CAAAA,CAAoBG,MAAMC,QAAQC,SAAS,MAAM,GAAK,GAElDC,EAAmBT,GAA+B,CACtD,OAAQA,EAAR,CACE,IAAK,cACH,OAAOR,EAAE,iCAAiC,EAC5C,IAAK,cACH,OAAOA,EAAE,gCAAgC,EAC3C,IAAK,UACH,OAAOA,EAAE,6BAA6B,EACxC,IAAK,gBACH,OAAOA,EAAE,kCAAkC,EAC7C,IAAK,sBACH,OAAOA,EAAE,4BAA4B,CACzC,CACF,EAEMkB,EAAiB/C,EAAY,CACjC,GAAGwB,EACHwB,UAAW,KAAOL,IAAS,CACrBA,EAAKM,OACPlB,EAAYmB,aAAaxB,EAAuByB,SAAU,CACxDF,KAAMN,EAAKM,IACb,CAAC,EACD,MAAM1B,EAAK,EAEPF,EAAYW,CAAM,EACpBoB,OAAOC,SAASC,KAAOnC,EAA+Ba,CAAM,EAE5DF,EAAOyB,SAAS,CAAEC,GAAI,UAAW,CAAC,EAGxC,EACAC,QAAS,KAAOC,IAAQ,CACtB,IAAMrB,EAASf,EAAqBoC,CAAG,EACvCvB,EAAS,CACPC,QAASU,EAAgBT,CAAM,EAC/BA,QACF,CAAC,CACH,EACAsB,cAAiB,CACf5B,EAAY6B,kBAAkB,CAC5BT,SAAUzB,EAAuByB,QACnC,CAAC,CACH,CACF,CAAC,EASD,OANAzC,EAAAA,EAAAA,UAAAA,KAAgB,CACV6B,EAAWsB,UACftB,EAAWsB,QAAU,GACrBd,EAAee,OAAO,EACxB,EAAG,CAACf,CAAc,CAAC,GAGjB,EAAA,EAAA,KAAA,CAAC,EAAD,CAAA,SAAA,EAKE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MAAM,SACN,SAAUlB,EAAE,wBAAwB,EACpC,MAAOA,EAAE,qBAAqB,CAAE,CAAA,GAGlC,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,sDAAf,EACE,EAAA,EAAA,IAAA,CAAC,MAAD,CAAK,UAAU,+GACb,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,cAAA,GACA,UAAU,4CAA4C,CAAA,CAErD,CAAA,EAEJkB,EAAegB,YACd,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,sDAAf,EACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAW,OAAO,IAAI,CAAA,GACtB,EAAA,EAAA,IAAA,CAAC,IAAD,CAAG,UAAU,iEACVlC,EAAE,uBAAuB,CACzB,CAAA,CACA,IAGNK,IACC,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAU,6DAAf,EACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAO,UAAU,SAAS,KAAM1B,EAAiB,KAAK,iBACnD0B,EAAME,OACF,CAAA,EACNM,IACC,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,UAAU,SACV,OAAO,UACP,QACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAM,OAAQtB,EAAmBY,CAAM,EAAG,GAAG,cAAc,CAAA,EAE7D,OAAO,cAENH,EAAE,uBAAuB,CACd,CAAA,GAEhB,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,WAAYa,EAAa,UAAY,QACrC,UAAU,SACV,OAAQA,EAAa,UAAY,UACjC,YAAe,CACbP,EAAS,IAAI,EACbY,EAAee,OAAO,CACxB,EACA,KAAK,SACL,OAAO,cAENjC,EAAE,qBAAqB,CAChB,CAAA,CACP,GAEJ,KAEL,EAAA,EAAA,IAAA,CAAC,EAAD,CAAA,UACE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAcG,SAAQ,GAAG,kBACtBH,EAAE,2BAA2B,CAC1B,CAAA,CACP,CAAA,CAEO,CAAA,CACF,CAAA,CAAA,CAEhB"}

package/public/assets/passkey-J1qnYp9A.js

@@ -0,0 +1,2 @@
+import{i as e,n as t,r as n,ur as r}from"./config-DTQCUlfZ.js";import{t as i}from"./mutationOptions-DyYFUbyn.js";function a(e){let t=new Uint8Array(e),n=``;for(let e of t)n+=String.fromCharCode(e);return btoa(n).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function o(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4,r=t.padEnd(t.length+n,`=`),i=atob(r),a=new ArrayBuffer(i.length),o=new Uint8Array(a);for(let e=0;e<i.length;e++)o[e]=i.charCodeAt(e);return a}function s(){return c.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential==`function`)}var c={stubThis:e=>e};function l(e){let{id:t}=e;return{...e,id:o(t),transports:e.transports}}function u(e){return e===`localhost`||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var d=class extends Error{constructor({message:e,code:t,cause:n,name:r}){super(e,{cause:n}),Object.defineProperty(this,"code",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.name=r??n.name,this.code=t}};function f({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error(`options was missing required publicKey property`);if(e.name===`AbortError`){if(t.signal instanceof AbortSignal)return new d({message:`Registration ceremony was sent an abort signal`,code:`ERROR_CEREMONY_ABORTED`,cause:e})}else if(e.name===`ConstraintError`){if(n.authenticatorSelection?.requireResidentKey===!0)return new d({message:`Discoverable credentials were required but no available authenticator supported it`,code:`ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT`,cause:e});if(t.mediation===`conditional`&&n.authenticatorSelection?.userVerification===`required`)return new d({message:`User verification was required during automatic registration but it could not be performed`,code:`ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE`,cause:e});if(n.authenticatorSelection?.userVerification===`required`)return new d({message:`User verification was required but no available authenticator supported it`,code:`ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT`,cause:e})}else if(e.name===`InvalidStateError`)return new d({message:`The authenticator was previously registered`,code:`ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED`,cause:e});else if(e.name===`NotAllowedError`)return new d({message:e.message,code:`ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY`,cause:e});else if(e.name===`NotSupportedError`)return n.pubKeyCredParams.filter(e=>e.type===`public-key`).length===0?new d({message:`No entry in pubKeyCredParams was of type "public-key"`,code:`ERROR_MALFORMED_PUBKEYCREDPARAMS`,cause:e}):new d({message:`No available authenticator supported any of the specified pubKeyCredParams algorithms`,code:`ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG`,cause:e});else if(e.name===`SecurityError`){let t=globalThis.location.hostname;if(!u(t))return new d({message:`${globalThis.location.hostname} is an invalid domain`,code:`ERROR_INVALID_DOMAIN`,cause:e});if(n.rp.id!==t)return new d({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:`ERROR_INVALID_RP_ID`,cause:e})}else if(e.name===`TypeError`){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new d({message:`User ID was not between 1 and 64 characters`,code:`ERROR_INVALID_USER_ID_LENGTH`,cause:e})}else if(e.name===`UnknownError`)return new d({message:`The authenticator was unable to process the specified options, or could not create a new credential`,code:`ERROR_AUTHENTICATOR_GENERAL_ERROR`,cause:e});return e}var p=new class{constructor(){Object.defineProperty(this,"controller",{enumerable:!0,configurable:!0,writable:!0,value:void 0})}createNewAbortSignal(){if(this.controller){let e=Error(`Cancelling existing WebAuthn API call for new one`);e.name=`AbortError`,this.controller.abort(e)}let e=new AbortController;return this.controller=e,e.signal}cancelCeremony(){if(this.controller){let e=Error(`Manually cancelling existing WebAuthn API call`);e.name=`AbortError`,this.controller.abort(e),this.controller=void 0}}},m=[`cross-platform`,`platform`];function h(e){if(e&&!(m.indexOf(e)<0))return e}async function g(e){!e.optionsJSON&&e.challenge&&(console.warn(`startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.`),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=!1}=e;if(!s())throw Error(`WebAuthn is not supported in this browser`);let r={...t,challenge:o(t.challenge),user:{...t.user,id:o(t.user.id)},excludeCredentials:t.excludeCredentials?.map(l)},i={};n&&(i.mediation=`conditional`),i.publicKey=r,i.signal=p.createNewAbortSignal();let c;try{c=await navigator.credentials.create(i)}catch(e){throw f({error:e,options:i})}if(!c)throw Error(`Registration was not completed`);let{id:u,rawId:d,response:m,type:g}=c,v;typeof m.getTransports==`function`&&(v=m.getTransports());let y;if(typeof m.getPublicKeyAlgorithm==`function`)try{y=m.getPublicKeyAlgorithm()}catch(e){_(`getPublicKeyAlgorithm()`,e)}let b;if(typeof m.getPublicKey==`function`)try{let e=m.getPublicKey();e!==null&&(b=a(e))}catch(e){_(`getPublicKey()`,e)}let x;if(typeof m.getAuthenticatorData==`function`)try{x=a(m.getAuthenticatorData())}catch(e){_(`getAuthenticatorData()`,e)}return{id:u,rawId:a(d),response:{attestationObject:a(m.attestationObject),clientDataJSON:a(m.clientDataJSON),transports:v,publicKeyAlgorithm:y,publicKey:b,authenticatorData:x},type:g,clientExtensionResults:c.getClientExtensionResults(),authenticatorAttachment:h(c.authenticatorAttachment)}}function _(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.\n`,t)}function v(){if(!s())return y.stubThis(new Promise(e=>e(!1)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?y.stubThis(new Promise(e=>e(!1))):y.stubThis(e.isConditionalMediationAvailable())}var y={stubThis:e=>e};function b({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error(`options was missing required publicKey property`);if(e.name===`AbortError`){if(t.signal instanceof AbortSignal)return new d({message:`Authentication ceremony was sent an abort signal`,code:`ERROR_CEREMONY_ABORTED`,cause:e})}else if(e.name===`NotAllowedError`)return new d({message:e.message,code:`ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY`,cause:e});else if(e.name===`SecurityError`){let t=globalThis.location.hostname;if(!u(t))return new d({message:`${globalThis.location.hostname} is an invalid domain`,code:`ERROR_INVALID_DOMAIN`,cause:e});if(n.rpId!==t)return new d({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:`ERROR_INVALID_RP_ID`,cause:e})}else if(e.name===`UnknownError`)return new d({message:`The authenticator was unable to process the specified options, or could not create a new assertion signature`,code:`ERROR_AUTHENTICATOR_GENERAL_ERROR`,cause:e});return e}async function x(e){!e.optionsJSON&&e.challenge&&(console.warn(`startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.`),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=!1,verifyBrowserAutofillInput:r=!0}=e;if(!s())throw Error(`WebAuthn is not supported in this browser`);let i;t.allowCredentials?.length!==0&&(i=t.allowCredentials?.map(l));let c={...t,challenge:o(t.challenge),allowCredentials:i},u={};if(n){if(!await v())throw Error(`Browser does not support WebAuthn autofill`);if(document.querySelectorAll(`input[autocomplete$='webauthn']`).length<1&&r)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');u.mediation=`conditional`,c.allowCredentials=[]}u.publicKey=c,u.signal=p.createNewAbortSignal();let d;try{d=await navigator.credentials.get(u)}catch(e){throw b({error:e,options:u})}if(!d)throw Error(`Authentication was not completed`);let{id:f,rawId:m,response:g,type:_}=d,y;return g.userHandle&&(y=a(g.userHandle)),{id:f,rawId:a(m),response:{authenticatorData:a(g.authenticatorData),clientDataJSON:a(g.clientDataJSON),signature:a(g.signature),userHandle:y},type:_,clientExtensionResults:d.getClientExtensionResults(),authenticatorAttachment:h(d.authenticatorAttachment)}}var S=r({queryKey:t.passkeys(),queryFn:async()=>e(await n.api.user.passkeys.$get())}),C=i({mutationFn:async t=>{let{options:r}=await e(await n.api.user.passkeys.register.options.$post()),i=await g({optionsJSON:r});return e(await n.api.user.passkeys.register.verify.$post({json:{response:i,name:t.name}}))}}),w=i({mutationFn:async t=>e(await n.api.user.passkeys[`:id`].$delete({param:{id:t.id}}))}),T=i({mutationFn:async t=>e(await n.api.user.passkeys[`:id`].$patch({param:{id:t.id},json:{name:t.name}}))}),E=i({mutationFn:async()=>{let{options:t}=await e(await n.api.auth.passkey.options.$post()),r=await x({optionsJSON:t});return e(await n.api.auth.passkey.verify.$post({json:{response:{...r,clientExtensionResults:{...r.clientExtensionResults}}}}))}}),D=async(t,r)=>{try{let{options:i}=await e(await n.api.auth.passkey.options.$post({},{init:{signal:r}})),a=await x({optionsJSON:i,useBrowserAutofill:!0});t(await e(await n.api.auth.passkey.verify.$post({json:{response:{...a,clientExtensionResults:{...a.clientExtensionResults}}}},{init:{signal:r}})))}catch(e){e instanceof Error&&e.name}};export{T as a,C as i,w as n,D as o,S as r,E as t};
+//# sourceMappingURL=passkey-J1qnYp9A.js.map

package/public/assets/{passkey-B2Blw47e.js.map → passkey-J1qnYp9A.js.map}

@@ -1 +1 @@
-{"version":3,"file":"passkey-B2Blw47e.js","names":[],"sources":["../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js","../../../frontend/src/queries/passkey.ts"],"sourcesContent":["/**\n * Convert the given array buffer into a Base64URL-encoded string. Ideal for converting various\n * credential response ArrayBuffers to string for sending back to the server as JSON.\n *\n * Helper method to compliment `base64URLStringToBuffer`\n */\nexport function bufferToBase64URLString(buffer) {\n    const bytes = new Uint8Array(buffer);\n    let str = '';\n    for (const charCode of bytes) {\n        str += String.fromCharCode(charCode);\n    }\n    const base64String = btoa(str);\n    return base64String.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n","/**\n * Convert from a Base64URL-encoded string to an Array Buffer. Best used when converting a\n * credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or\n * excludeCredentials\n *\n * Helper method to compliment `bufferToBase64URLString`\n */\nexport function base64URLStringToBuffer(base64URLString) {\n    // Convert from Base64URL to Base64\n    const base64 = base64URLString.replace(/-/g, '+').replace(/_/g, '/');\n    /**\n     * Pad with '=' until it's a multiple of four\n     * (4 - (85 % 4 = 1) = 3) % 4 = 3 padding\n     * (4 - (86 % 4 = 2) = 2) % 4 = 2 padding\n     * (4 - (87 % 4 = 3) = 1) % 4 = 1 padding\n     * (4 - (88 % 4 = 0) = 4) % 4 = 0 padding\n     */\n    const padLength = (4 - (base64.length % 4)) % 4;\n    const padded = base64.padEnd(base64.length + padLength, '=');\n    // Convert to a binary string\n    const binary = atob(padded);\n    // Convert binary string to buffer\n    const buffer = new ArrayBuffer(binary.length);\n    const bytes = new Uint8Array(buffer);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return buffer;\n}\n","/**\n * Determine if the browser is capable of Webauthn\n */\nexport function browserSupportsWebAuthn() {\n    return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== undefined &&\n        typeof globalThis.PublicKeyCredential === 'function');\n}\n/**\n * Make it possible to stub the return value during testing\n * @ignore Don't include this in docs output\n */\nexport const _browserSupportsWebAuthnInternals = {\n    stubThis: (value) => value,\n};\n","import { base64URLStringToBuffer } from './base64URLStringToBuffer.js';\nexport function toPublicKeyCredentialDescriptor(descriptor) {\n    const { id } = descriptor;\n    return {\n        ...descriptor,\n        id: base64URLStringToBuffer(id),\n        /**\n         * `descriptor.transports` is an array of our `AuthenticatorTransportFuture` that includes newer\n         * transports that TypeScript's DOM lib is ignorant of. Convince TS that our list of transports\n         * are fine to pass to WebAuthn since browsers will recognize the new value.\n         */\n        transports: descriptor.transports,\n    };\n}\n","/**\n * A simple test to determine if a hostname is a properly-formatted domain name\n *\n * A \"valid domain\" is defined here: https://url.spec.whatwg.org/#valid-domain\n *\n * Regex was originally sourced from here, then remixed to add punycode support:\n * https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html\n */\nexport function isValidDomain(hostname) {\n    return (\n    // Consider localhost valid as well since it's okay wrt Secure Contexts\n    hostname === 'localhost' ||\n        // Support punycode (ACE) or ascii labels and domains\n        /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname));\n}\n","/**\n * A custom Error used to return a more nuanced error detailing _why_ one of the eight documented\n * errors in the spec was raised after calling `navigator.credentials.create()` or\n * `navigator.credentials.get()`:\n *\n * - `AbortError`\n * - `ConstraintError`\n * - `InvalidStateError`\n * - `NotAllowedError`\n * - `NotSupportedError`\n * - `SecurityError`\n * - `TypeError`\n * - `UnknownError`\n *\n * Error messages were determined through investigation of the spec to determine under which\n * scenarios a given error would be raised.\n */\nexport class WebAuthnError extends Error {\n    constructor({ message, code, cause, name, }) {\n        // @ts-ignore: help Rollup understand that `cause` is okay to set\n        super(message, { cause });\n        Object.defineProperty(this, \"code\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n        this.name = name ?? cause.name;\n        this.code = code;\n    }\n}\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.create()`\n */\nexport function identifyRegistrationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Registration ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'ConstraintError') {\n        if (publicKey.authenticatorSelection?.requireResidentKey === true) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 4)\n            return new WebAuthnError({\n                message: 'Discoverable credentials were required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT',\n                cause: error,\n            });\n        }\n        else if (\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        options.mediation === 'conditional' &&\n            publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://w3c.github.io/webauthn/#sctn-createCredential (Step 22.4)\n            return new WebAuthnError({\n                message: 'User verification was required during automatic registration but it could not be performed',\n                code: 'ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE',\n                cause: error,\n            });\n        }\n        else if (publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 5)\n            return new WebAuthnError({\n                message: 'User verification was required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'InvalidStateError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 20)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 3)\n        return new WebAuthnError({\n            message: 'The authenticator was previously registered',\n            code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotSupportedError') {\n        const validPubKeyCredParams = publicKey.pubKeyCredParams.filter((param) => param.type === 'public-key');\n        if (validPubKeyCredParams.length === 0) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 10)\n            return new WebAuthnError({\n                message: 'No entry in pubKeyCredParams was of type \"public-key\"',\n                code: 'ERROR_MALFORMED_PUBKEYCREDPARAMS',\n                cause: error,\n            });\n        }\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 2)\n        return new WebAuthnError({\n            message: 'No available authenticator supported any of the specified pubKeyCredParams algorithms',\n            code: 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 7)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rp.id !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 8)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rp.id}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'TypeError') {\n        if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 5)\n            return new WebAuthnError({\n                message: 'User ID was not between 1 and 64 characters',\n                code: 'ERROR_INVALID_USER_ID_LENGTH',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 8)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new credential',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","class BaseWebAuthnAbortService {\n    constructor() {\n        Object.defineProperty(this, \"controller\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n    }\n    createNewAbortSignal() {\n        // Abort any existing calls to navigator.credentials.create() or navigator.credentials.get()\n        if (this.controller) {\n            const abortError = new Error('Cancelling existing WebAuthn API call for new one');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n        }\n        const newController = new AbortController();\n        this.controller = newController;\n        return newController.signal;\n    }\n    cancelCeremony() {\n        if (this.controller) {\n            const abortError = new Error('Manually cancelling existing WebAuthn API call');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n            this.controller = undefined;\n        }\n    }\n}\n/**\n * A service singleton to help ensure that only a single WebAuthn ceremony is active at a time.\n *\n * Users of **@simplewebauthn/browser** shouldn't typically need to use this, but it can help e.g.\n * developers building projects that use client-side routing to better control the behavior of\n * their UX in response to router navigation events.\n */\nexport const WebAuthnAbortService = new BaseWebAuthnAbortService();\n","const attachments = ['cross-platform', 'platform'];\n/**\n * If possible coerce a `string` value into a known `AuthenticatorAttachment`\n */\nexport function toAuthenticatorAttachment(attachment) {\n    if (!attachment) {\n        return;\n    }\n    if (attachments.indexOf(attachment) < 0) {\n        return;\n    }\n    return attachment;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyRegistrationError } from '../helpers/identifyRegistrationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"registration\" via WebAuthn attestation\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateRegistrationOptions()`\n * @param useAutoRegister (Optional) Try to silently create a passkey with the password manager that the user just signed in with. Defaults to `false`.\n */\nexport async function startRegistration(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useAutoRegister = false } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        user: {\n            ...optionsJSON.user,\n            id: base64URLStringToBuffer(optionsJSON.user.id),\n        },\n        excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor),\n    };\n    // Prepare options for `.create()`\n    const createOptions = {};\n    /**\n     * Try to use conditional create to register a passkey for the user with the password manager\n     * the user just used to authenticate with. The user won't be shown any prominent UI by the\n     * browser.\n     */\n    if (useAutoRegister) {\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        createOptions.mediation = 'conditional';\n    }\n    // Finalize options\n    createOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    createOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete attestation\n    let credential;\n    try {\n        credential = (await navigator.credentials.create(createOptions));\n    }\n    catch (err) {\n        throw identifyRegistrationError({ error: err, options: createOptions });\n    }\n    if (!credential) {\n        throw new Error('Registration was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    // Continue to play it safe with `getTransports()` for now, even when L3 types say it's required\n    let transports = undefined;\n    if (typeof response.getTransports === 'function') {\n        transports = response.getTransports();\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responsePublicKeyAlgorithm = undefined;\n    if (typeof response.getPublicKeyAlgorithm === 'function') {\n        try {\n            responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKeyAlgorithm()', error);\n        }\n    }\n    let responsePublicKey = undefined;\n    if (typeof response.getPublicKey === 'function') {\n        try {\n            const _publicKey = response.getPublicKey();\n            if (_publicKey !== null) {\n                responsePublicKey = bufferToBase64URLString(_publicKey);\n            }\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKey()', error);\n        }\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responseAuthenticatorData;\n    if (typeof response.getAuthenticatorData === 'function') {\n        try {\n            responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getAuthenticatorData()', error);\n        }\n    }\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            attestationObject: bufferToBase64URLString(response.attestationObject),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            transports,\n            publicKeyAlgorithm: responsePublicKeyAlgorithm,\n            publicKey: responsePublicKey,\n            authenticatorData: responseAuthenticatorData,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n/**\n * Visibly warn when we detect an issue related to a passkey provider intercepting WebAuthn API\n * calls\n */\nfunction warnOnBrokenImplementation(methodName, cause) {\n    console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\\n`, cause);\n}\n","import { browserSupportsWebAuthn } from './browserSupportsWebAuthn.js';\n/**\n * Determine if the browser supports conditional UI, so that WebAuthn credentials can\n * be shown to the user in the browser's typical password autofill popup.\n */\nexport function browserSupportsWebAuthnAutofill() {\n    if (!browserSupportsWebAuthn()) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    /**\n     * I don't like the `as unknown` here but there's a `declare var PublicKeyCredential` in\n     * TS' DOM lib that's making it difficult for me to just go `as PublicKeyCredentialFuture` as I\n     * want. I think I'm fine with this for now since it's _supposed_ to be temporary, until TS types\n     * have a chance to catch up.\n     */\n    const globalPublicKeyCredential = globalThis\n        .PublicKeyCredential;\n    if (globalPublicKeyCredential?.isConditionalMediationAvailable === undefined) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());\n}\n// Make it possible to stub the return value during testing\nexport const _browserSupportsWebAuthnAutofillInternals = {\n    stubThis: (value) => value,\n};\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.get()`\n */\nexport function identifyAuthenticationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Authentication ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 5)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rpId !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 6)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rpId}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 12)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new assertion signature',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { browserSupportsWebAuthnAutofill } from '../helpers/browserSupportsWebAuthnAutofill.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyAuthenticationError } from '../helpers/identifyAuthenticationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"login\" via WebAuthn assertion\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateAuthenticationOptions()`\n * @param useBrowserAutofill (Optional) Initialize conditional UI to enable logging in via browser autofill prompts. Defaults to `false`.\n * @param verifyBrowserAutofillInput (Optional) Ensure a suitable `<input>` element is present when `useBrowserAutofill` is `true`. Defaults to `true`.\n */\nexport async function startAuthentication(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true, } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to avoid passing empty array to avoid blocking retrieval\n    // of public key\n    let allowCredentials;\n    if (optionsJSON.allowCredentials?.length !== 0) {\n        allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        allowCredentials,\n    };\n    // Prepare options for `.get()`\n    const getOptions = {};\n    /**\n     * Set up the page to prompt the user to select a credential for authentication via the browser's\n     * input autofill mechanism.\n     */\n    if (useBrowserAutofill) {\n        if (!(await browserSupportsWebAuthnAutofill())) {\n            throw Error('Browser does not support WebAuthn autofill');\n        }\n        // Check for an <input> with \"webauthn\" in its `autocomplete` attribute\n        const eligibleInputs = document.querySelectorAll(\"input[autocomplete$='webauthn']\");\n        // WebAuthn autofill requires at least one valid input\n        if (eligibleInputs.length < 1 && verifyBrowserAutofillInput) {\n            throw Error('No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected');\n        }\n        // `CredentialMediationRequirement` doesn't know about \"conditional\" yet as of\n        // typescript@4.6.3\n        getOptions.mediation = 'conditional';\n        // Conditional UI requires an empty allow list\n        publicKey.allowCredentials = [];\n    }\n    // Finalize options\n    getOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    getOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete assertion\n    let credential;\n    try {\n        credential = (await navigator.credentials.get(getOptions));\n    }\n    catch (err) {\n        throw identifyAuthenticationError({ error: err, options: getOptions });\n    }\n    if (!credential) {\n        throw new Error('Authentication was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    let userHandle = undefined;\n    if (response.userHandle) {\n        userHandle = bufferToBase64URLString(response.userHandle);\n    }\n    // Convert values to base64 to make it easier to send back to the server\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            authenticatorData: bufferToBase64URLString(response.authenticatorData),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            signature: bufferToBase64URLString(response.signature),\n            userHandle,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n","import {\n  startAuthentication,\n  startRegistration,\n} from '@simplewebauthn/browser';\nimport { mutationOptions, queryOptions } from '@tanstack/react-query';\nimport type { InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\nimport { queryKeys } from './keys';\n\nexport type PasskeyAuthenticationResponse = InferResponseType<\n  (typeof client.api.auth.passkey.verify)['$post'],\n  200\n>;\n\nexport type PasskeysResponse = InferResponseType<\n  (typeof client.api.user.passkeys)['$get'],\n  200\n>;\n\nexport type PasskeyInfo = PasskeysResponse['passkeys'][number];\n\nexport type PasskeySetupVerifyResponse = InferResponseType<\n  (typeof client.api.user.passkeys.register.verify)['$post'],\n  200\n>;\n\n/**\n * Get all passkeys for current user\n */\nexport const getPasskeysQueryOptions = queryOptions({\n  queryKey: queryKeys.passkeys(),\n  queryFn: async () => {\n    const res = await client.api.user.passkeys.$get();\n    return jsonOk(res);\n  },\n});\n\n/**\n * Register a new passkey\n */\nexport type RegisterPasskeyParams = {\n  name?: string;\n};\n\nexport const registerPasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: RegisterPasskeyParams) => {\n    // Step 1: Get registration options from server\n    const optionsRes = await client.api.user.passkeys.register.options.$post();\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn registration in browser\n    const registrationResponse = await startRegistration({\n      optionsJSON: options,\n    });\n\n    // Step 3: Send registration response to server\n    const verifyRes = await client.api.user.passkeys.register.verify.$post({\n      json: {\n        response: registrationResponse,\n        name: params.name,\n      },\n    });\n    return jsonOk(verifyRes);\n  },\n});\n\n/**\n * Delete a passkey\n */\nexport type DeletePasskeyParams = {\n  id: string;\n};\n\nexport const deletePasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: DeletePasskeyParams) => {\n    const res = await client.api.user.passkeys[':id'].$delete({\n      param: { id: params.id },\n    });\n    return jsonOk(res);\n  },\n});\n\n/**\n * Rename a passkey\n */\nexport type RenamePasskeyParams = {\n  id: string;\n  name: string;\n};\n\nexport const renamePasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: RenamePasskeyParams) => {\n    const res = await client.api.user.passkeys[':id'].$patch({\n      param: { id: params.id },\n      json: { name: params.name },\n    });\n    return jsonOk(res);\n  },\n});\n\n/**\n * Authenticate with passkey (supports both passwordless\n * and 2FA)\n *\n * The server automatically determines the mode based on\n * session state:\n * - If pending2FAUser session exists: 2FA mode\n * - Otherwise: Passwordless mode (discoverable\n *   credentials)\n */\nexport const authenticateWithPasskeyMutationOptions = mutationOptions({\n  mutationFn: async () => {\n    // Step 1: Get authentication options from server\n    const optionsRes = await client.api.auth.passkey.options.$post();\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn authentication in browser\n    const authenticationResponse = await startAuthentication({\n      optionsJSON: options,\n    });\n\n    // Step 3: Send authentication response to server\n    const verifyRes = await client.api.auth.passkey.verify.$post({\n      json: {\n        response: {\n          ...authenticationResponse,\n          clientExtensionResults: {\n            ...authenticationResponse.clientExtensionResults,\n          },\n        },\n      },\n    });\n    return jsonOk(verifyRes);\n  },\n});\n\n/**\n * Start conditional passkey authentication (browser\n * autofill / Conditional UI)\n *\n * This enables the browser to suggest passkeys in the\n * autofill dropdown when the user focuses on an input\n * with autocomplete=\"username webauthn\".\n *\n * Should be called on page load and runs in the background\n * until:\n * - User selects a passkey from the autofill dropdown\n * - The AbortController is aborted (e.g., on component\n *   unmount)\n *\n * @param onSuccess - Callback when passkey authentication\n *   succeeds\n * @param abortSignal - AbortSignal to cancel the\n *   conditional authentication\n */\nexport const startConditionalPasskeyAuth = async (\n  onSuccess: (data: PasskeyAuthenticationResponse) => void,\n  abortSignal: AbortSignal,\n): Promise<void> => {\n  try {\n    // Step 1: Get authentication options from server\n    const optionsRes = await client.api.auth.passkey.options.$post(\n      {},\n      { init: { signal: abortSignal } },\n    );\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn with conditional mediation\n    const authenticationResponse = await startAuthentication({\n      optionsJSON: options,\n      useBrowserAutofill: true,\n    });\n\n    // Step 3: Send authentication response to server\n    const verifyRes = await client.api.auth.passkey.verify.$post(\n      {\n        json: {\n          response: {\n            ...authenticationResponse,\n            clientExtensionResults: {\n              ...authenticationResponse.clientExtensionResults,\n            },\n          },\n        },\n      },\n      { init: { signal: abortSignal } },\n    );\n    const data = await jsonOk(verifyRes);\n    onSuccess(data);\n  } catch (error) {\n    // AbortError is expected when component unmounts\n    if (error instanceof Error && error.name !== 'AbortError') {\n      // Non-abort error - could be handled here in the future\n    }\n  }\n};\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12],"mappings":"uGAMA,SAAgB,EAAwB,EAAQ,CAC5C,IAAM,EAAQ,IAAI,WAAW,CAAM,EAC/B,EAAM,GACV,IAAK,IAAM,KAAY,EACnB,GAAO,OAAO,aAAa,CAAQ,EAGvC,OADqB,KAAK,CACR,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,KAAM,EAAE,CAChF,CCPA,SAAgB,EAAwB,EAAiB,CAErD,IAAM,EAAS,EAAgB,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EAQ7D,GAAa,EAAK,EAAO,OAAS,GAAM,EACxC,EAAS,EAAO,OAAO,EAAO,OAAS,EAAW,GAAG,EAErD,EAAS,KAAK,CAAM,EAEpB,EAAS,IAAI,YAAY,EAAO,MAAM,EACtC,EAAQ,IAAI,WAAW,CAAM,EACnC,IAAK,IAAI,EAAI,EAAG,EAAI,EAAO,OAAQ,IAC/B,EAAM,GAAK,EAAO,WAAW,CAAC,EAElC,OAAO,CACX,CCzBA,SAAgB,GAA0B,CACtC,OAAO,EAAkC,SAAS,YAAY,sBAAwB,IAAA,IAClF,OAAO,WAAW,qBAAwB,UAAU,CAC5D,CAKA,IAAa,EAAoC,CAC7C,SAAW,GAAU,CACzB,ECZA,SAAgB,EAAgC,EAAY,CACxD,GAAM,CAAE,MAAO,EACf,MAAO,CACH,GAAG,EACH,GAAI,EAAwB,CAAE,EAM9B,WAAY,EAAW,UAC3B,CACJ,CCLA,SAAgB,EAAc,EAAU,CACpC,OAEA,IAAa,aAET,4EAA4E,KAAK,CAAQ,CACjG,CCGA,IAAa,EAAb,cAAmC,KAAM,CACrC,YAAY,CAAE,UAAS,OAAM,QAAO,QAAS,CAEzC,MAAM,EAAS,CAAE,OAAM,CAAC,EACxB,OAAO,eAAe,KAAM,OAAQ,CAChC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,EACD,KAAK,KAAO,GAAQ,EAAM,KAC1B,KAAK,KAAO,CAChB,CACJ,ECzBA,SAAgB,EAA0B,CAAE,QAAO,WAAY,CAC3D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,iBACX,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,iDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBACpB,IAAI,EAAU,wBAAwB,qBAAuB,GAEzD,OAAO,IAAI,EAAc,CACrB,QAAS,qFACT,KAAM,8DACN,MAAO,CACX,CAAC,EAEA,GAEL,EAAQ,YAAc,eAClB,EAAU,wBAAwB,mBAAqB,WAEvD,OAAO,IAAI,EAAc,CACrB,QAAS,6FACT,KAAM,gDACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,wBAAwB,mBAAqB,WAE5D,OAAO,IAAI,EAAc,CACrB,QAAS,6EACT,KAAM,wDACN,MAAO,CACX,CAAC,CACL,MAEC,GAAI,EAAM,OAAS,oBAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,4CACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,oBAWpB,OAV8B,EAAU,iBAAiB,OAAQ,GAAU,EAAM,OAAS,YAClE,CAAC,CAAC,SAAW,EAE1B,IAAI,EAAc,CACrB,QAAS,wDACT,KAAM,mCACN,MAAO,CACX,CAAC,EAGE,IAAI,EAAc,CACrB,QAAS,wFACT,KAAM,wDACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,GAAG,KAAO,EAEzB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,GAAG,GAAG,8BACvC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,gBAChB,EAAU,KAAK,GAAG,WAAa,GAAK,EAAU,KAAK,GAAG,WAAa,GAEnE,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,+BACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,sGACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CCzFA,IAAa,EAAuB,IAAI,KApCT,CAC3B,aAAc,CACV,OAAO,eAAe,KAAM,aAAc,CACtC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,CACL,CACA,sBAAuB,CAEnB,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,mDAAmD,EAChF,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,CACpC,CACA,IAAM,EAAgB,IAAI,gBAE1B,MADA,MAAK,WAAa,EACX,EAAc,MACzB,CACA,gBAAiB,CACb,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,gDAAgD,EAC7E,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,EAChC,KAAK,WAAa,IAAA,EACtB,CACJ,CACJ,EC5BM,EAAc,CAAC,iBAAkB,UAAU,EAIjD,SAAgB,EAA0B,EAAY,CAC7C,MAGD,IAAY,QAAQ,CAAU,EAAI,GAGtC,OAAO,CACX,CCCA,eAAsB,EAAkB,EAAS,CAEzC,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,4TAA4T,EAEzU,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,kBAAkB,IAAU,EACjD,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAG/D,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,KAAM,CACF,GAAG,EAAY,KACf,GAAI,EAAwB,EAAY,KAAK,EAAE,CACnD,EACA,mBAAoB,EAAY,oBAAoB,IAAI,CAA+B,CAC3F,EAEM,EAAgB,CAAC,EAMnB,IAEA,EAAc,UAAY,eAG9B,EAAc,UAAY,EAE1B,EAAc,OAAS,EAAqB,qBAAqB,EAEjE,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,OAAO,CAAa,CAClE,OACO,EAAK,CACR,MAAM,EAA0B,CAAE,MAAO,EAAK,QAAS,CAAc,CAAC,CAC1E,CACA,GAAI,CAAC,EACD,MAAU,MAAM,gCAAgC,EAEpD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAElC,EACA,OAAO,EAAS,eAAkB,aAClC,EAAa,EAAS,cAAc,GAGxC,IAAI,EACJ,GAAI,OAAO,EAAS,uBAA0B,WAC1C,GAAI,CACA,EAA6B,EAAS,sBAAsB,CAChE,OACO,EAAO,CACV,EAA2B,0BAA2B,CAAK,CAC/D,CAEJ,IAAI,EACJ,GAAI,OAAO,EAAS,cAAiB,WACjC,GAAI,CACA,IAAM,EAAa,EAAS,aAAa,EACrC,IAAe,OACf,EAAoB,EAAwB,CAAU,EAE9D,OACO,EAAO,CACV,EAA2B,iBAAkB,CAAK,CACtD,CAGJ,IAAI,EACJ,GAAI,OAAO,EAAS,sBAAyB,WACzC,GAAI,CACA,EAA4B,EAAwB,EAAS,qBAAqB,CAAC,CACvF,OACO,EAAO,CACV,EAA2B,yBAA0B,CAAK,CAC9D,CAEJ,MAAO,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,aACA,mBAAoB,EACpB,UAAW,EACX,kBAAmB,CACvB,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CAKA,SAAS,EAA2B,EAAY,EAAO,CACnD,QAAQ,KAAK,yFAAyF,EAAW,2CAA4C,CAAK,CACtK,CCnHA,SAAgB,GAAkC,CAC9C,GAAI,CAAC,EAAwB,EACzB,OAAO,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAQtG,IAAM,EAA4B,WAC7B,oBAIL,OAHI,GAA2B,kCAAoC,IAAA,GACxD,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAE/F,EAA0C,SAAS,EAA0B,gCAAgC,CAAC,CACzH,CAEA,IAAa,EAA4C,CACrD,SAAW,GAAU,CACzB,ECpBA,SAAgB,EAA4B,CAAE,QAAO,WAAY,CAC7D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,iBACX,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,mDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,OAAS,EAExB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,KAAK,8BACtC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,+GACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CC7CA,eAAsB,EAAoB,EAAS,CAE3C,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,8TAA8T,EAE3U,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,qBAAqB,GAAO,6BAA6B,IAAU,EACxF,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAI/D,IAAI,EACA,EAAY,kBAAkB,SAAW,IACzC,EAAmB,EAAY,kBAAkB,IAAI,CAA+B,GAGxF,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,kBACJ,EAEM,EAAa,CAAC,EAKpB,GAAI,EAAoB,CACpB,GAAI,CAAE,MAAM,EAAgC,EACxC,MAAM,MAAM,4CAA4C,EAK5D,GAFuB,SAAS,iBAAiB,iCAEhC,CAAC,CAAC,OAAS,GAAK,EAC7B,MAAM,MAAM,mGAAmG,EAInH,EAAW,UAAY,cAEvB,EAAU,iBAAmB,CAAC,CAClC,CAEA,EAAW,UAAY,EAEvB,EAAW,OAAS,EAAqB,qBAAqB,EAE9D,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,IAAI,CAAU,CAC5D,OACO,EAAK,CACR,MAAM,EAA4B,CAAE,MAAO,EAAK,QAAS,CAAW,CAAC,CACzE,CACA,GAAI,CAAC,EACD,MAAU,MAAM,kCAAkC,EAEtD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAClC,EAKJ,OAJI,EAAS,aACT,EAAa,EAAwB,EAAS,UAAU,GAGrD,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,UAAW,EAAwB,EAAS,SAAS,EACrD,YACJ,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CCjEA,IAAa,EAA0B,EAAa,CAClD,SAAU,EAAU,SAAS,EAC7B,QAAS,SAEA,EAAO,MADI,EAAO,IAAI,KAAK,SAAS,KAAK,CAC/B,CAErB,CAAC,EASY,EAAiC,EAAgB,CAC5D,WAAY,KAAO,IAAkC,CAGnD,GAAM,CAAE,WAAY,MAAM,EAAO,MADR,EAAO,IAAI,KAAK,SAAS,SAAS,QAAQ,MAAM,CAC9B,EAGrC,EAAuB,MAAM,EAAkB,CACnD,YAAa,CACf,CAAC,EASD,OAAO,EAAO,MANU,EAAO,IAAI,KAAK,SAAS,SAAS,OAAO,MAAM,CACrE,KAAM,CACJ,SAAU,EACV,KAAM,EAAO,IACf,CACF,CAAC,CACsB,CACzB,CACF,CAAC,EASY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAIV,EAAO,MAHI,EAAO,IAAI,KAAK,SAAS,MAAM,CAAC,QAAQ,CACxD,MAAO,CAAE,GAAI,EAAO,EAAG,CACzB,CAAC,CACgB,CAErB,CAAC,EAUY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAKV,EAAO,MAJI,EAAO,IAAI,KAAK,SAAS,MAAM,CAAC,OAAO,CACvD,MAAO,CAAE,GAAI,EAAO,EAAG,EACvB,KAAM,CAAE,KAAM,EAAO,IAAK,CAC5B,CAAC,CACgB,CAErB,CAAC,EAYY,EAAyC,EAAgB,CACpE,WAAY,SAAY,CAGtB,GAAM,CAAE,WAAY,MAAM,EAAO,MADR,EAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,CACpB,EAGrC,EAAyB,MAAM,EAAoB,CACvD,YAAa,CACf,CAAC,EAaD,OAAO,EAAO,MAVU,EAAO,IAAI,KAAK,QAAQ,OAAO,MAAM,CAC3D,KAAM,CACJ,SAAU,CACR,GAAG,EACH,uBAAwB,CACtB,GAAG,EAAuB,sBAC5B,CACF,CACF,CACF,CAAC,CACsB,CACzB,CACF,CAAC,EAqBY,EAA8B,MACzC,EACA,IACkB,CAClB,GAAI,CAMF,GAAM,CAAE,WAAY,MAAM,EAAO,MAJR,EAAO,IAAI,KAAK,QAAQ,QAAQ,MACvD,CAAC,EACD,CAAE,KAAM,CAAE,OAAQ,CAAY,CAAE,CAClC,CAC2C,EAGrC,EAAyB,MAAM,EAAoB,CACvD,YAAa,EACb,mBAAoB,EACtB,CAAC,EAiBD,EAAU,MADS,EAAO,MAbF,EAAO,IAAI,KAAK,QAAQ,OAAO,MACrD,CACE,KAAM,CACJ,SAAU,CACR,GAAG,EACH,uBAAwB,CACtB,GAAG,EAAuB,sBAC5B,CACF,CACF,CACF,EACA,CAAE,KAAM,CAAE,OAAQ,CAAY,CAAE,CAClC,CACmC,CACrB,CAChB,OAAS,EAAO,CAEV,aAAiB,OAAS,EAAM,IAGtC,CACF"}
+{"version":3,"file":"passkey-J1qnYp9A.js","names":[],"sources":["../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js","../../../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js","../../../frontend/src/queries/passkey.ts"],"sourcesContent":["/**\n * Convert the given array buffer into a Base64URL-encoded string. Ideal for converting various\n * credential response ArrayBuffers to string for sending back to the server as JSON.\n *\n * Helper method to compliment `base64URLStringToBuffer`\n */\nexport function bufferToBase64URLString(buffer) {\n    const bytes = new Uint8Array(buffer);\n    let str = '';\n    for (const charCode of bytes) {\n        str += String.fromCharCode(charCode);\n    }\n    const base64String = btoa(str);\n    return base64String.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n","/**\n * Convert from a Base64URL-encoded string to an Array Buffer. Best used when converting a\n * credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or\n * excludeCredentials\n *\n * Helper method to compliment `bufferToBase64URLString`\n */\nexport function base64URLStringToBuffer(base64URLString) {\n    // Convert from Base64URL to Base64\n    const base64 = base64URLString.replace(/-/g, '+').replace(/_/g, '/');\n    /**\n     * Pad with '=' until it's a multiple of four\n     * (4 - (85 % 4 = 1) = 3) % 4 = 3 padding\n     * (4 - (86 % 4 = 2) = 2) % 4 = 2 padding\n     * (4 - (87 % 4 = 3) = 1) % 4 = 1 padding\n     * (4 - (88 % 4 = 0) = 4) % 4 = 0 padding\n     */\n    const padLength = (4 - (base64.length % 4)) % 4;\n    const padded = base64.padEnd(base64.length + padLength, '=');\n    // Convert to a binary string\n    const binary = atob(padded);\n    // Convert binary string to buffer\n    const buffer = new ArrayBuffer(binary.length);\n    const bytes = new Uint8Array(buffer);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return buffer;\n}\n","/**\n * Determine if the browser is capable of Webauthn\n */\nexport function browserSupportsWebAuthn() {\n    return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== undefined &&\n        typeof globalThis.PublicKeyCredential === 'function');\n}\n/**\n * Make it possible to stub the return value during testing\n * @ignore Don't include this in docs output\n */\nexport const _browserSupportsWebAuthnInternals = {\n    stubThis: (value) => value,\n};\n","import { base64URLStringToBuffer } from './base64URLStringToBuffer.js';\nexport function toPublicKeyCredentialDescriptor(descriptor) {\n    const { id } = descriptor;\n    return {\n        ...descriptor,\n        id: base64URLStringToBuffer(id),\n        /**\n         * `descriptor.transports` is an array of our `AuthenticatorTransportFuture` that includes newer\n         * transports that TypeScript's DOM lib is ignorant of. Convince TS that our list of transports\n         * are fine to pass to WebAuthn since browsers will recognize the new value.\n         */\n        transports: descriptor.transports,\n    };\n}\n","/**\n * A simple test to determine if a hostname is a properly-formatted domain name\n *\n * A \"valid domain\" is defined here: https://url.spec.whatwg.org/#valid-domain\n *\n * Regex was originally sourced from here, then remixed to add punycode support:\n * https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html\n */\nexport function isValidDomain(hostname) {\n    return (\n    // Consider localhost valid as well since it's okay wrt Secure Contexts\n    hostname === 'localhost' ||\n        // Support punycode (ACE) or ascii labels and domains\n        /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname));\n}\n","/**\n * A custom Error used to return a more nuanced error detailing _why_ one of the eight documented\n * errors in the spec was raised after calling `navigator.credentials.create()` or\n * `navigator.credentials.get()`:\n *\n * - `AbortError`\n * - `ConstraintError`\n * - `InvalidStateError`\n * - `NotAllowedError`\n * - `NotSupportedError`\n * - `SecurityError`\n * - `TypeError`\n * - `UnknownError`\n *\n * Error messages were determined through investigation of the spec to determine under which\n * scenarios a given error would be raised.\n */\nexport class WebAuthnError extends Error {\n    constructor({ message, code, cause, name, }) {\n        // @ts-ignore: help Rollup understand that `cause` is okay to set\n        super(message, { cause });\n        Object.defineProperty(this, \"code\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n        this.name = name ?? cause.name;\n        this.code = code;\n    }\n}\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.create()`\n */\nexport function identifyRegistrationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Registration ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'ConstraintError') {\n        if (publicKey.authenticatorSelection?.requireResidentKey === true) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 4)\n            return new WebAuthnError({\n                message: 'Discoverable credentials were required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT',\n                cause: error,\n            });\n        }\n        else if (\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        options.mediation === 'conditional' &&\n            publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://w3c.github.io/webauthn/#sctn-createCredential (Step 22.4)\n            return new WebAuthnError({\n                message: 'User verification was required during automatic registration but it could not be performed',\n                code: 'ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE',\n                cause: error,\n            });\n        }\n        else if (publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 5)\n            return new WebAuthnError({\n                message: 'User verification was required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'InvalidStateError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 20)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 3)\n        return new WebAuthnError({\n            message: 'The authenticator was previously registered',\n            code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotSupportedError') {\n        const validPubKeyCredParams = publicKey.pubKeyCredParams.filter((param) => param.type === 'public-key');\n        if (validPubKeyCredParams.length === 0) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 10)\n            return new WebAuthnError({\n                message: 'No entry in pubKeyCredParams was of type \"public-key\"',\n                code: 'ERROR_MALFORMED_PUBKEYCREDPARAMS',\n                cause: error,\n            });\n        }\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 2)\n        return new WebAuthnError({\n            message: 'No available authenticator supported any of the specified pubKeyCredParams algorithms',\n            code: 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 7)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rp.id !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 8)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rp.id}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'TypeError') {\n        if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 5)\n            return new WebAuthnError({\n                message: 'User ID was not between 1 and 64 characters',\n                code: 'ERROR_INVALID_USER_ID_LENGTH',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 8)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new credential',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","class BaseWebAuthnAbortService {\n    constructor() {\n        Object.defineProperty(this, \"controller\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n    }\n    createNewAbortSignal() {\n        // Abort any existing calls to navigator.credentials.create() or navigator.credentials.get()\n        if (this.controller) {\n            const abortError = new Error('Cancelling existing WebAuthn API call for new one');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n        }\n        const newController = new AbortController();\n        this.controller = newController;\n        return newController.signal;\n    }\n    cancelCeremony() {\n        if (this.controller) {\n            const abortError = new Error('Manually cancelling existing WebAuthn API call');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n            this.controller = undefined;\n        }\n    }\n}\n/**\n * A service singleton to help ensure that only a single WebAuthn ceremony is active at a time.\n *\n * Users of **@simplewebauthn/browser** shouldn't typically need to use this, but it can help e.g.\n * developers building projects that use client-side routing to better control the behavior of\n * their UX in response to router navigation events.\n */\nexport const WebAuthnAbortService = new BaseWebAuthnAbortService();\n","const attachments = ['cross-platform', 'platform'];\n/**\n * If possible coerce a `string` value into a known `AuthenticatorAttachment`\n */\nexport function toAuthenticatorAttachment(attachment) {\n    if (!attachment) {\n        return;\n    }\n    if (attachments.indexOf(attachment) < 0) {\n        return;\n    }\n    return attachment;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyRegistrationError } from '../helpers/identifyRegistrationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"registration\" via WebAuthn attestation\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateRegistrationOptions()`\n * @param useAutoRegister (Optional) Try to silently create a passkey with the password manager that the user just signed in with. Defaults to `false`.\n */\nexport async function startRegistration(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useAutoRegister = false } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        user: {\n            ...optionsJSON.user,\n            id: base64URLStringToBuffer(optionsJSON.user.id),\n        },\n        excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor),\n    };\n    // Prepare options for `.create()`\n    const createOptions = {};\n    /**\n     * Try to use conditional create to register a passkey for the user with the password manager\n     * the user just used to authenticate with. The user won't be shown any prominent UI by the\n     * browser.\n     */\n    if (useAutoRegister) {\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        createOptions.mediation = 'conditional';\n    }\n    // Finalize options\n    createOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    createOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete attestation\n    let credential;\n    try {\n        credential = (await navigator.credentials.create(createOptions));\n    }\n    catch (err) {\n        throw identifyRegistrationError({ error: err, options: createOptions });\n    }\n    if (!credential) {\n        throw new Error('Registration was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    // Continue to play it safe with `getTransports()` for now, even when L3 types say it's required\n    let transports = undefined;\n    if (typeof response.getTransports === 'function') {\n        transports = response.getTransports();\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responsePublicKeyAlgorithm = undefined;\n    if (typeof response.getPublicKeyAlgorithm === 'function') {\n        try {\n            responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKeyAlgorithm()', error);\n        }\n    }\n    let responsePublicKey = undefined;\n    if (typeof response.getPublicKey === 'function') {\n        try {\n            const _publicKey = response.getPublicKey();\n            if (_publicKey !== null) {\n                responsePublicKey = bufferToBase64URLString(_publicKey);\n            }\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKey()', error);\n        }\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responseAuthenticatorData;\n    if (typeof response.getAuthenticatorData === 'function') {\n        try {\n            responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getAuthenticatorData()', error);\n        }\n    }\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            attestationObject: bufferToBase64URLString(response.attestationObject),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            transports,\n            publicKeyAlgorithm: responsePublicKeyAlgorithm,\n            publicKey: responsePublicKey,\n            authenticatorData: responseAuthenticatorData,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n/**\n * Visibly warn when we detect an issue related to a passkey provider intercepting WebAuthn API\n * calls\n */\nfunction warnOnBrokenImplementation(methodName, cause) {\n    console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\\n`, cause);\n}\n","import { browserSupportsWebAuthn } from './browserSupportsWebAuthn.js';\n/**\n * Determine if the browser supports conditional UI, so that WebAuthn credentials can\n * be shown to the user in the browser's typical password autofill popup.\n */\nexport function browserSupportsWebAuthnAutofill() {\n    if (!browserSupportsWebAuthn()) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    /**\n     * I don't like the `as unknown` here but there's a `declare var PublicKeyCredential` in\n     * TS' DOM lib that's making it difficult for me to just go `as PublicKeyCredentialFuture` as I\n     * want. I think I'm fine with this for now since it's _supposed_ to be temporary, until TS types\n     * have a chance to catch up.\n     */\n    const globalPublicKeyCredential = globalThis\n        .PublicKeyCredential;\n    if (globalPublicKeyCredential?.isConditionalMediationAvailable === undefined) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());\n}\n// Make it possible to stub the return value during testing\nexport const _browserSupportsWebAuthnAutofillInternals = {\n    stubThis: (value) => value,\n};\n","import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.get()`\n */\nexport function identifyAuthenticationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Authentication ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 5)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rpId !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 6)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rpId}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 12)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new assertion signature',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n","import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { browserSupportsWebAuthnAutofill } from '../helpers/browserSupportsWebAuthnAutofill.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyAuthenticationError } from '../helpers/identifyAuthenticationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"login\" via WebAuthn assertion\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateAuthenticationOptions()`\n * @param useBrowserAutofill (Optional) Initialize conditional UI to enable logging in via browser autofill prompts. Defaults to `false`.\n * @param verifyBrowserAutofillInput (Optional) Ensure a suitable `<input>` element is present when `useBrowserAutofill` is `true`. Defaults to `true`.\n */\nexport async function startAuthentication(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true, } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to avoid passing empty array to avoid blocking retrieval\n    // of public key\n    let allowCredentials;\n    if (optionsJSON.allowCredentials?.length !== 0) {\n        allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        allowCredentials,\n    };\n    // Prepare options for `.get()`\n    const getOptions = {};\n    /**\n     * Set up the page to prompt the user to select a credential for authentication via the browser's\n     * input autofill mechanism.\n     */\n    if (useBrowserAutofill) {\n        if (!(await browserSupportsWebAuthnAutofill())) {\n            throw Error('Browser does not support WebAuthn autofill');\n        }\n        // Check for an <input> with \"webauthn\" in its `autocomplete` attribute\n        const eligibleInputs = document.querySelectorAll(\"input[autocomplete$='webauthn']\");\n        // WebAuthn autofill requires at least one valid input\n        if (eligibleInputs.length < 1 && verifyBrowserAutofillInput) {\n            throw Error('No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected');\n        }\n        // `CredentialMediationRequirement` doesn't know about \"conditional\" yet as of\n        // typescript@4.6.3\n        getOptions.mediation = 'conditional';\n        // Conditional UI requires an empty allow list\n        publicKey.allowCredentials = [];\n    }\n    // Finalize options\n    getOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    getOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete assertion\n    let credential;\n    try {\n        credential = (await navigator.credentials.get(getOptions));\n    }\n    catch (err) {\n        throw identifyAuthenticationError({ error: err, options: getOptions });\n    }\n    if (!credential) {\n        throw new Error('Authentication was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    let userHandle = undefined;\n    if (response.userHandle) {\n        userHandle = bufferToBase64URLString(response.userHandle);\n    }\n    // Convert values to base64 to make it easier to send back to the server\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            authenticatorData: bufferToBase64URLString(response.authenticatorData),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            signature: bufferToBase64URLString(response.signature),\n            userHandle,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n","import {\n  startAuthentication,\n  startRegistration,\n} from '@simplewebauthn/browser';\nimport { mutationOptions, queryOptions } from '@tanstack/react-query';\nimport type { InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\nimport { queryKeys } from './keys';\nimport type { AuthResponse } from './session';\n\nexport type PasskeysResponse = InferResponseType<\n  (typeof client.api.user.passkeys)['$get'],\n  200\n>;\n\nexport type PasskeyInfo = PasskeysResponse['passkeys'][number];\n\nexport type PasskeySetupVerifyResponse = InferResponseType<\n  (typeof client.api.user.passkeys.register.verify)['$post'],\n  200\n>;\n\n/**\n * Get all passkeys for current user\n */\nexport const getPasskeysQueryOptions = queryOptions({\n  queryKey: queryKeys.passkeys(),\n  queryFn: async () => {\n    const res = await client.api.user.passkeys.$get();\n    return jsonOk(res);\n  },\n});\n\n/**\n * Register a new passkey\n */\nexport type RegisterPasskeyParams = {\n  name?: string;\n};\n\nexport const registerPasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: RegisterPasskeyParams) => {\n    // Step 1: Get registration options from server\n    const optionsRes = await client.api.user.passkeys.register.options.$post();\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn registration in browser\n    const registrationResponse = await startRegistration({\n      optionsJSON: options,\n    });\n\n    // Step 3: Send registration response to server\n    const verifyRes = await client.api.user.passkeys.register.verify.$post({\n      json: {\n        response: registrationResponse,\n        name: params.name,\n      },\n    });\n    return jsonOk(verifyRes);\n  },\n});\n\n/**\n * Delete a passkey\n */\nexport type DeletePasskeyParams = {\n  id: string;\n};\n\nexport const deletePasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: DeletePasskeyParams) => {\n    const res = await client.api.user.passkeys[':id'].$delete({\n      param: { id: params.id },\n    });\n    return jsonOk(res);\n  },\n});\n\n/**\n * Rename a passkey\n */\nexport type RenamePasskeyParams = {\n  id: string;\n  name: string;\n};\n\nexport const renamePasskeyMutationOptions = mutationOptions({\n  mutationFn: async (params: RenamePasskeyParams) => {\n    const res = await client.api.user.passkeys[':id'].$patch({\n      param: { id: params.id },\n      json: { name: params.name },\n    });\n    return jsonOk(res);\n  },\n});\n\n/**\n * Authenticate with passkey (supports both passwordless\n * and 2FA)\n *\n * The server automatically determines the mode based on\n * session state:\n * - If pending2FAUser session exists: 2FA mode\n * - Otherwise: Passwordless mode (discoverable\n *   credentials)\n */\nexport const authenticateWithPasskeyMutationOptions = mutationOptions({\n  mutationFn: async () => {\n    // Step 1: Get authentication options from server\n    const optionsRes = await client.api.auth.passkey.options.$post();\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn authentication in browser\n    const authenticationResponse = await startAuthentication({\n      optionsJSON: options,\n    });\n\n    // Step 3: Send authentication response to server\n    const verifyRes = await client.api.auth.passkey.verify.$post({\n      json: {\n        response: {\n          ...authenticationResponse,\n          clientExtensionResults: {\n            ...authenticationResponse.clientExtensionResults,\n          },\n        },\n      },\n    });\n    return jsonOk(verifyRes);\n  },\n});\n\n/**\n * Start conditional passkey authentication (browser\n * autofill / Conditional UI)\n *\n * This enables the browser to suggest passkeys in the\n * autofill dropdown when the user focuses on an input\n * with autocomplete=\"username webauthn\".\n *\n * Should be called on page load and runs in the background\n * until:\n * - User selects a passkey from the autofill dropdown\n * - The AbortController is aborted (e.g., on component\n *   unmount)\n *\n * @param onSuccess - Callback when passkey authentication\n *   succeeds\n * @param abortSignal - AbortSignal to cancel the\n *   conditional authentication\n */\nexport const startConditionalPasskeyAuth = async (\n  onSuccess: (data: AuthResponse) => void,\n  abortSignal: AbortSignal,\n): Promise<void> => {\n  try {\n    // Step 1: Get authentication options from server\n    const optionsRes = await client.api.auth.passkey.options.$post(\n      {},\n      { init: { signal: abortSignal } },\n    );\n    const { options } = await jsonOk(optionsRes);\n\n    // Step 2: Start WebAuthn with conditional mediation\n    const authenticationResponse = await startAuthentication({\n      optionsJSON: options,\n      useBrowserAutofill: true,\n    });\n\n    // Step 3: Send authentication response to server\n    const verifyRes = await client.api.auth.passkey.verify.$post(\n      {\n        json: {\n          response: {\n            ...authenticationResponse,\n            clientExtensionResults: {\n              ...authenticationResponse.clientExtensionResults,\n            },\n          },\n        },\n      },\n      { init: { signal: abortSignal } },\n    );\n    const data = await jsonOk(verifyRes);\n    onSuccess(data);\n  } catch (error) {\n    // AbortError is expected when component unmounts\n    if (error instanceof Error && error.name !== 'AbortError') {\n      // Non-abort error - could be handled here in the future\n    }\n  }\n};\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12],"mappings":"iHAMA,SAAgB,EAAwB,EAAQ,CAC5C,IAAM,EAAQ,IAAI,WAAW,CAAM,EAC/B,EAAM,GACV,IAAK,IAAM,KAAY,EACnB,GAAO,OAAO,aAAa,CAAQ,EAGvC,OADqB,KAAK,CACR,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,MAAO,GAAG,CAAC,CAAC,QAAQ,KAAM,EAAE,CAChF,CCPA,SAAgB,EAAwB,EAAiB,CAErD,IAAM,EAAS,EAAgB,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EAQ7D,GAAa,EAAK,EAAO,OAAS,GAAM,EACxC,EAAS,EAAO,OAAO,EAAO,OAAS,EAAW,GAAG,EAErD,EAAS,KAAK,CAAM,EAEpB,EAAS,IAAI,YAAY,EAAO,MAAM,EACtC,EAAQ,IAAI,WAAW,CAAM,EACnC,IAAK,IAAI,EAAI,EAAG,EAAI,EAAO,OAAQ,IAC/B,EAAM,GAAK,EAAO,WAAW,CAAC,EAElC,OAAO,CACX,CCzBA,SAAgB,GAA0B,CACtC,OAAO,EAAkC,SAAS,YAAY,sBAAwB,IAAA,IAClF,OAAO,WAAW,qBAAwB,UAAU,CAC5D,CAKA,IAAa,EAAoC,CAC7C,SAAW,GAAU,CACzB,ECZA,SAAgB,EAAgC,EAAY,CACxD,GAAM,CAAE,MAAO,EACf,MAAO,CACH,GAAG,EACH,GAAI,EAAwB,CAAE,EAM9B,WAAY,EAAW,UAC3B,CACJ,CCLA,SAAgB,EAAc,EAAU,CACpC,OAEA,IAAa,aAET,4EAA4E,KAAK,CAAQ,CACjG,CCGA,IAAa,EAAb,cAAmC,KAAM,CACrC,YAAY,CAAE,UAAS,OAAM,QAAO,QAAS,CAEzC,MAAM,EAAS,CAAE,OAAM,CAAC,EACxB,OAAO,eAAe,KAAM,OAAQ,CAChC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,EACD,KAAK,KAAO,GAAQ,EAAM,KAC1B,KAAK,KAAO,CAChB,CACJ,ECzBA,SAAgB,EAA0B,CAAE,QAAO,WAAY,CAC3D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,iBACX,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,iDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBACpB,IAAI,EAAU,wBAAwB,qBAAuB,GAEzD,OAAO,IAAI,EAAc,CACrB,QAAS,qFACT,KAAM,8DACN,MAAO,CACX,CAAC,EAEA,GAEL,EAAQ,YAAc,eAClB,EAAU,wBAAwB,mBAAqB,WAEvD,OAAO,IAAI,EAAc,CACrB,QAAS,6FACT,KAAM,gDACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,wBAAwB,mBAAqB,WAE5D,OAAO,IAAI,EAAc,CACrB,QAAS,6EACT,KAAM,wDACN,MAAO,CACX,CAAC,CACL,MAEC,GAAI,EAAM,OAAS,oBAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,4CACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,oBAWpB,OAV8B,EAAU,iBAAiB,OAAQ,GAAU,EAAM,OAAS,YAClE,CAAC,CAAC,SAAW,EAE1B,IAAI,EAAc,CACrB,QAAS,wDACT,KAAM,mCACN,MAAO,CACX,CAAC,EAGE,IAAI,EAAc,CACrB,QAAS,wFACT,KAAM,wDACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,GAAG,KAAO,EAEzB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,GAAG,GAAG,8BACvC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,gBAChB,EAAU,KAAK,GAAG,WAAa,GAAK,EAAU,KAAK,GAAG,WAAa,GAEnE,OAAO,IAAI,EAAc,CACrB,QAAS,8CACT,KAAM,+BACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,sGACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CCzFA,IAAa,EAAuB,IAAI,KApCT,CAC3B,aAAc,CACV,OAAO,eAAe,KAAM,aAAc,CACtC,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAK,EAChB,CAAC,CACL,CACA,sBAAuB,CAEnB,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,mDAAmD,EAChF,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,CACpC,CACA,IAAM,EAAgB,IAAI,gBAE1B,MADA,MAAK,WAAa,EACX,EAAc,MACzB,CACA,gBAAiB,CACb,GAAI,KAAK,WAAY,CACjB,IAAM,EAAiB,MAAM,gDAAgD,EAC7E,EAAW,KAAO,aAClB,KAAK,WAAW,MAAM,CAAU,EAChC,KAAK,WAAa,IAAA,EACtB,CACJ,CACJ,EC5BM,EAAc,CAAC,iBAAkB,UAAU,EAIjD,SAAgB,EAA0B,EAAY,CAC7C,MAGD,IAAY,QAAQ,CAAU,EAAI,GAGtC,OAAO,CACX,CCCA,eAAsB,EAAkB,EAAS,CAEzC,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,4TAA4T,EAEzU,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,kBAAkB,IAAU,EACjD,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAG/D,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,KAAM,CACF,GAAG,EAAY,KACf,GAAI,EAAwB,EAAY,KAAK,EAAE,CACnD,EACA,mBAAoB,EAAY,oBAAoB,IAAI,CAA+B,CAC3F,EAEM,EAAgB,CAAC,EAMnB,IAEA,EAAc,UAAY,eAG9B,EAAc,UAAY,EAE1B,EAAc,OAAS,EAAqB,qBAAqB,EAEjE,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,OAAO,CAAa,CAClE,OACO,EAAK,CACR,MAAM,EAA0B,CAAE,MAAO,EAAK,QAAS,CAAc,CAAC,CAC1E,CACA,GAAI,CAAC,EACD,MAAU,MAAM,gCAAgC,EAEpD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAElC,EACA,OAAO,EAAS,eAAkB,aAClC,EAAa,EAAS,cAAc,GAGxC,IAAI,EACJ,GAAI,OAAO,EAAS,uBAA0B,WAC1C,GAAI,CACA,EAA6B,EAAS,sBAAsB,CAChE,OACO,EAAO,CACV,EAA2B,0BAA2B,CAAK,CAC/D,CAEJ,IAAI,EACJ,GAAI,OAAO,EAAS,cAAiB,WACjC,GAAI,CACA,IAAM,EAAa,EAAS,aAAa,EACrC,IAAe,OACf,EAAoB,EAAwB,CAAU,EAE9D,OACO,EAAO,CACV,EAA2B,iBAAkB,CAAK,CACtD,CAGJ,IAAI,EACJ,GAAI,OAAO,EAAS,sBAAyB,WACzC,GAAI,CACA,EAA4B,EAAwB,EAAS,qBAAqB,CAAC,CACvF,OACO,EAAO,CACV,EAA2B,yBAA0B,CAAK,CAC9D,CAEJ,MAAO,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,aACA,mBAAoB,EACpB,UAAW,EACX,kBAAmB,CACvB,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CAKA,SAAS,EAA2B,EAAY,EAAO,CACnD,QAAQ,KAAK,yFAAyF,EAAW,2CAA4C,CAAK,CACtK,CCnHA,SAAgB,GAAkC,CAC9C,GAAI,CAAC,EAAwB,EACzB,OAAO,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAQtG,IAAM,EAA4B,WAC7B,oBAIL,OAHI,GAA2B,kCAAoC,IAAA,GACxD,EAA0C,SAAS,IAAI,QAAS,GAAY,EAAQ,EAAK,CAAC,CAAC,EAE/F,EAA0C,SAAS,EAA0B,gCAAgC,CAAC,CACzH,CAEA,IAAa,EAA4C,CACrD,SAAW,GAAU,CACzB,ECpBA,SAAgB,EAA4B,CAAE,QAAO,WAAY,CAC7D,GAAM,CAAE,aAAc,EACtB,GAAI,CAAC,EACD,MAAM,MAAM,iDAAiD,EAEjE,GAAI,EAAM,OAAS,iBACX,EAAQ,kBAAkB,YAE1B,OAAO,IAAI,EAAc,CACrB,QAAS,mDACT,KAAM,yBACN,MAAO,CACX,CAAC,CAAA,MAGJ,GAAI,EAAM,OAAS,kBAKpB,OAAO,IAAI,EAAc,CACrB,QAAS,EAAM,QACf,KAAM,uCACN,MAAO,CACX,CAAC,OAEA,GAAI,EAAM,OAAS,gBAAiB,CACrC,IAAM,EAAkB,WAAW,SAAS,SAC5C,GAAI,CAAC,EAAc,CAAe,EAE9B,OAAO,IAAI,EAAc,CACrB,QAAS,GAAG,WAAW,SAAS,SAAS,uBACzC,KAAM,uBACN,MAAO,CACX,CAAC,EAEA,GAAI,EAAU,OAAS,EAExB,OAAO,IAAI,EAAc,CACrB,QAAS,cAAc,EAAU,KAAK,8BACtC,KAAM,sBACN,MAAO,CACX,CAAC,CAET,MACK,GAAI,EAAM,OAAS,eAGpB,OAAO,IAAI,EAAc,CACrB,QAAS,+GACT,KAAM,oCACN,MAAO,CACX,CAAC,EAEL,OAAO,CACX,CC7CA,eAAsB,EAAoB,EAAS,CAE3C,CAAC,EAAQ,aAAe,EAAQ,YAChC,QAAQ,KAAK,8TAA8T,EAE3U,EAAU,CAAE,YAAa,CAAQ,GAErC,GAAM,CAAE,cAAa,qBAAqB,GAAO,6BAA6B,IAAU,EACxF,GAAI,CAAC,EAAwB,EACzB,MAAU,MAAM,2CAA2C,EAI/D,IAAI,EACA,EAAY,kBAAkB,SAAW,IACzC,EAAmB,EAAY,kBAAkB,IAAI,CAA+B,GAGxF,IAAM,EAAY,CACd,GAAG,EACH,UAAW,EAAwB,EAAY,SAAS,EACxD,kBACJ,EAEM,EAAa,CAAC,EAKpB,GAAI,EAAoB,CACpB,GAAI,CAAE,MAAM,EAAgC,EACxC,MAAM,MAAM,4CAA4C,EAK5D,GAFuB,SAAS,iBAAiB,iCAEhC,CAAC,CAAC,OAAS,GAAK,EAC7B,MAAM,MAAM,mGAAmG,EAInH,EAAW,UAAY,cAEvB,EAAU,iBAAmB,CAAC,CAClC,CAEA,EAAW,UAAY,EAEvB,EAAW,OAAS,EAAqB,qBAAqB,EAE9D,IAAI,EACJ,GAAI,CACA,EAAc,MAAM,UAAU,YAAY,IAAI,CAAU,CAC5D,OACO,EAAK,CACR,MAAM,EAA4B,CAAE,MAAO,EAAK,QAAS,CAAW,CAAC,CACzE,CACA,GAAI,CAAC,EACD,MAAU,MAAM,kCAAkC,EAEtD,GAAM,CAAE,KAAI,QAAO,WAAU,QAAS,EAClC,EAKJ,OAJI,EAAS,aACT,EAAa,EAAwB,EAAS,UAAU,GAGrD,CACH,KACA,MAAO,EAAwB,CAAK,EACpC,SAAU,CACN,kBAAmB,EAAwB,EAAS,iBAAiB,EACrE,eAAgB,EAAwB,EAAS,cAAc,EAC/D,UAAW,EAAwB,EAAS,SAAS,EACrD,YACJ,EACA,OACA,uBAAwB,EAAW,0BAA0B,EAC7D,wBAAyB,EAA0B,EAAW,uBAAuB,CACzF,CACJ,CCrEA,IAAa,EAA0B,EAAa,CAClD,SAAU,EAAU,SAAS,EAC7B,QAAS,SAEA,EAAO,MADI,EAAO,IAAI,KAAK,SAAS,KAAK,CAC/B,CAErB,CAAC,EASY,EAAiC,EAAgB,CAC5D,WAAY,KAAO,IAAkC,CAGnD,GAAM,CAAE,WAAY,MAAM,EAAO,MADR,EAAO,IAAI,KAAK,SAAS,SAAS,QAAQ,MAAM,CAC9B,EAGrC,EAAuB,MAAM,EAAkB,CACnD,YAAa,CACf,CAAC,EASD,OAAO,EAAO,MANU,EAAO,IAAI,KAAK,SAAS,SAAS,OAAO,MAAM,CACrE,KAAM,CACJ,SAAU,EACV,KAAM,EAAO,IACf,CACF,CAAC,CACsB,CACzB,CACF,CAAC,EASY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAIV,EAAO,MAHI,EAAO,IAAI,KAAK,SAAS,MAAM,CAAC,QAAQ,CACxD,MAAO,CAAE,GAAI,EAAO,EAAG,CACzB,CAAC,CACgB,CAErB,CAAC,EAUY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAKV,EAAO,MAJI,EAAO,IAAI,KAAK,SAAS,MAAM,CAAC,OAAO,CACvD,MAAO,CAAE,GAAI,EAAO,EAAG,EACvB,KAAM,CAAE,KAAM,EAAO,IAAK,CAC5B,CAAC,CACgB,CAErB,CAAC,EAYY,EAAyC,EAAgB,CACpE,WAAY,SAAY,CAGtB,GAAM,CAAE,WAAY,MAAM,EAAO,MADR,EAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,CACpB,EAGrC,EAAyB,MAAM,EAAoB,CACvD,YAAa,CACf,CAAC,EAaD,OAAO,EAAO,MAVU,EAAO,IAAI,KAAK,QAAQ,OAAO,MAAM,CAC3D,KAAM,CACJ,SAAU,CACR,GAAG,EACH,uBAAwB,CACtB,GAAG,EAAuB,sBAC5B,CACF,CACF,CACF,CAAC,CACsB,CACzB,CACF,CAAC,EAqBY,EAA8B,MACzC,EACA,IACkB,CAClB,GAAI,CAMF,GAAM,CAAE,WAAY,MAAM,EAAO,MAJR,EAAO,IAAI,KAAK,QAAQ,QAAQ,MACvD,CAAC,EACD,CAAE,KAAM,CAAE,OAAQ,CAAY,CAAE,CAClC,CAC2C,EAGrC,EAAyB,MAAM,EAAoB,CACvD,YAAa,EACb,mBAAoB,EACtB,CAAC,EAiBD,EAAU,MADS,EAAO,MAbF,EAAO,IAAI,KAAK,QAAQ,OAAO,MACrD,CACE,KAAM,CACJ,SAAU,CACR,GAAG,EACH,uBAAwB,CACtB,GAAG,EAAuB,sBAC5B,CACF,CACF,CACF,EACA,CAAE,KAAM,CAAE,OAAQ,CAAY,CAAE,CAClC,CACmC,CACrB,CAChB,OAAS,EAAO,CAEV,aAAiB,OAAS,EAAM,IAGtC,CACF"}

package/public/assets/password-C5vUVgr_.js

@@ -0,0 +1,2 @@
+import{I as e}from"./index-CS23Ozt6.js";var t=e;export{t as errorComponent};
+//# sourceMappingURL=password-C5vUVgr_.js.map

package/public/assets/password-C5vUVgr_.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-C5vUVgr_.js","names":["RouteErrorFallback","SplitErrorComponent","errorComponent"],"sources":["../../../frontend/src/routes/login/password/index.tsx?tsr-split=errorComponent"],"sourcesContent":["import { standardSchemaResolver } from '@hookform/resolvers/standard-schema';\nimport {\n  useMutation,\n  useQueryClient,\n  useSuspenseQuery,\n} from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLink } from '@tinyrack/ui/components/link';\nimport { LockIcon, MailIcon } from 'lucide-react';\nimport { useCallback, useEffect, useMemo, useRef } from 'react';\nimport { useForm } from 'react-hook-form';\nimport { useTranslation } from 'react-i18next';\nimport { z } from 'zod';\nimport { AuthField } from '#frontend/components/auth/auth-field.tsx';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { AuthorizationContextBanner } from '#frontend/components/auth/authorization-context-banner.tsx';\nimport { RouteErrorFallback } from '#frontend/components/ui/route-error-fallback.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  hasAuthorizationContext,\n  isOAuthFlow,\n  type OAuthSearch,\n  OAuthSearchSchema,\n  type SecondFactorMethod,\n} from '#frontend/libs/oauth-search.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { getAuthorizationContextQueryOptions } from '#frontend/queries/authorization-context.ts';\nimport { appConfigQueryOptions } from '#frontend/queries/config.ts';\nimport { loginMutationOptions } from '#frontend/queries/login.ts';\nimport { startConditionalPasskeyAuth } from '#frontend/queries/passkey.ts';\nimport {\n  type AuthResponse,\n  getSessionQueryOptions,\n} from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema;\n\nexport const Route = createFileRoute('/login/password/')({\n  component: LoginPassword,\n  errorComponent: RouteErrorFallback,\n  validateSearch: SearchSchema,\n  loaderDeps: ({ search }) => ({\n    search,\n  }),\n  loader: async ({ context, deps }) => {\n    await context.queryClient.ensureQueryData(appConfigQueryOptions);\n    if (hasAuthorizationContext(deps.search)) {\n      await context.queryClient.ensureQueryData(\n        getAuthorizationContextQueryOptions(deps.search),\n      );\n    }\n  },\n});\n\nfunction LoginPassword() {\n  const { t, i18n } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const authorizeSearch: OAuthSearch =\n    search.account_selection_state &&\n    search.prompt?.split(' ').includes('login')\n      ? { ...search, account_selected: 1 }\n      : search;\n  const lang = search.lang ?? i18n.language;\n\n  const { data: configData } = useSuspenseQuery(appConfigQueryOptions);\n\n  const implicitNotice =\n    configData.registration.signup_notice?.[lang] ??\n    configData.registration.signup_notice?.[configData.i18n.fallback_language];\n  const isPasswordAuthEnabled = configData.auth.password.enabled;\n  const isPasskeyEnabled = configData.auth.passkey.enabled;\n  const hasMultipleLoginMethods =\n    configData.identity_providers.length +\n      (isPasswordAuthEnabled ? 1 : 0) +\n      (isPasskeyEnabled ? 1 : 0) >\n    1;\n\n  const loginSchema = useMemo(\n    () =>\n      z.object({\n        email: z\n          .string()\n          .min(1, t('validation.email.required'))\n          .pipe(z.email(t('validation.email.invalid'))),\n        password: z.string().min(1, t('validation.password.required')),\n      }),\n    [t],\n  );\n\n  const loginMutation = useMutation({\n    ...loginMutationOptions,\n    onSuccess: async (data, params) => {\n      const user = data.user;\n\n      if (user.email_verification_required && !user.email_verified) {\n        router.navigate({\n          to: '/verify/email',\n          search: {\n            email: params.email,\n            ...extractOAuthParams(search),\n          },\n        });\n        return;\n      }\n\n      queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n        user: user,\n      });\n      await tick();\n\n      const registered_2fa_methods: SecondFactorMethod[] = [];\n      if (configData.auth.password.totp.enabled && user.totp_registered) {\n        registered_2fa_methods.push('totp');\n      }\n      if (configData.auth.passkey.enabled && user.passkey_count > 0) {\n        registered_2fa_methods.push('passkey');\n      }\n\n      if (user.second_factor_required && registered_2fa_methods.length === 0) {\n        if (configData.available_2fa_setup_methods.length > 1) {\n          return router.navigate({\n            to: '/setup/2fa',\n            search: extractOAuthParams(search),\n          });\n        } else if (configData.available_2fa_setup_methods.length === 1) {\n          const method = configData.available_2fa_setup_methods[0];\n          if (method === 'totp') {\n            return router.navigate({\n              to: '/setup/totp',\n              search: extractOAuthParams(search),\n            });\n          } else {\n            return router.navigate({\n              to: '/setup/passkey',\n              search: {\n                ...extractOAuthParams(search),\n                passkey_name: 'default',\n              },\n            });\n          }\n        }\n      }\n\n      if (registered_2fa_methods.length > 1) {\n        return router.navigate({\n          to: '/verify/2fa',\n          search: extractOAuthParams(search),\n        });\n      } else if (registered_2fa_methods.length === 1) {\n        const method = registered_2fa_methods[0];\n        if (method === 'totp') {\n          return router.navigate({\n            to: '/verify/totp',\n            search: extractOAuthParams(search),\n          });\n        } else {\n          return router.navigate({\n            to: '/verify/passkey',\n            search: extractOAuthParams(search),\n          });\n        }\n      } else {\n        if (isOAuthFlow(search)) {\n          window.location.href =\n            buildAuthenticatedAuthorizeUrl(authorizeSearch);\n        } else {\n          return router.navigate({ to: '/profile' });\n        }\n      }\n    },\n    onError: (_error) => {\n      setError('email', {\n        type: 'manual',\n        message: t('login.error.failed'),\n      });\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  const handlePasskeySuccess = useCallback(\n    async (data: AuthResponse) => {\n      if (data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, data);\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href =\n            buildAuthenticatedAuthorizeUrl(authorizeSearch);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      }\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n    [queryClient, router, search, authorizeSearch],\n  );\n\n  // Conditional UI: Start passkey autofill on page load\n  const abortControllerRef = useRef<AbortController | null>(null);\n\n  useEffect(() => {\n    if (!isPasskeyEnabled || !isPasswordAuthEnabled) {\n      return;\n    }\n\n    abortControllerRef.current = new AbortController();\n    startConditionalPasskeyAuth(\n      handlePasskeySuccess,\n      abortControllerRef.current.signal,\n    );\n\n    return () => {\n      abortControllerRef.current?.abort();\n    };\n  }, [isPasskeyEnabled, isPasswordAuthEnabled, handlePasskeySuccess]);\n\n  const {\n    register,\n    setError,\n    handleSubmit,\n    formState: { errors },\n  } = useForm({\n    defaultValues: {\n      email: '',\n      password: '',\n    },\n    resolver: standardSchemaResolver(loginSchema),\n  });\n\n  const onSubmit = async (values: z.infer<typeof loginSchema>) => {\n    loginMutation.mutate(values);\n  };\n\n  return (\n    <AuthLayout>\n      {/* Branding lives in the layout's brand panel — see /login. */}\n      <AuthPageHeader\n        subtitle={t('login.selectMethod.subtitle') || undefined}\n        title={t('login.title')}\n      />\n\n      <AuthorizationContextBanner search={search} />\n\n      {isPasswordAuthEnabled && (\n        <form\n          className=\"flex flex-col gap-tinyrack-lg\"\n          onSubmit={handleSubmit(onSubmit)}\n        >\n          <AuthField\n            autoComplete=\"username webauthn\"\n            error={errors.email}\n            icon={MailIcon}\n            label={t('login.email.label')}\n            placeholder={t('login.email.placeholder')}\n            {...register('email')}\n            type=\"email\"\n          />\n\n          <AuthField\n            autoComplete=\"current-password\"\n            error={errors.password}\n            icon={LockIcon}\n            label={t('login.password.label')}\n            /*\n             * On the label row rather than under the field: it belongs to the\n             * password, and putting it between the field and the submit button\n             * separated the two things the user is actually trying to do.\n             */\n            labelAction={\n              configData.email.enabled ? (\n                <TRLink\n                  className=\"text-tinyrack-xs\"\n                  render={<Link to=\"/password/forgot\" />}\n                >\n                  {t('login.link.forgotPassword')}\n                </TRLink>\n              ) : undefined\n            }\n            placeholder={t('login.password.placeholder')}\n            {...register('password')}\n            type=\"password\"\n          />\n\n          <TRButton\n            className=\"w-full\"\n            intent=\"primary\"\n            loading={loginMutation.isPending}\n            loadingLabel={t('login.submitting')}\n            type=\"submit\"\n            uiSize=\"lg\"\n          >\n            {t('login.submit')}\n          </TRButton>\n        </form>\n      )}\n\n      {implicitNotice && (\n        <div\n          className=\"prose prose-sm text-center text-tinyrack-text-muted text-tinyrack-xs! **:text-tinyrack-xs!\"\n          dangerouslySetInnerHTML={{ __html: implicitNotice }}\n        />\n      )}\n\n      {(configData.registration.public_registration ||\n        hasMultipleLoginMethods) && (\n        <AuthFooter>\n          {configData.registration.public_registration && (\n            <AuthFooterLink\n              link={\n                <Link search={extractOAuthParams(search)} to=\"/register\">\n                  {t('login.link.register')}\n                </Link>\n              }\n              text={t('login.footer.noAccount')}\n            />\n          )}\n          {hasMultipleLoginMethods && (\n            <AuthFooterLink\n              link={\n                <Link search={extractOAuthParams(search)} to=\"/login\">\n                  {t('login.password.backToMethods')}\n                </Link>\n              }\n            />\n          )}\n        </AuthFooter>\n      )}\n    </AuthLayout>\n  );\n}\n"],"mappings":"wCAqBsF,IAAAC,EAA7ED"}

package/public/assets/password-RkUttbhD.js

@@ -0,0 +1,2 @@
+import{J as e,Z as t,i as n,q as r,s as i}from"./createLucideIcon-BPpAIXR_.js";import{On as a,Sn as o,Sr as s,i as c,r as l,t as u}from"./config-DTQCUlfZ.js";import{t as d}from"./mutationOptions-DyYFUbyn.js";import{t as f}from"./useMutation-BWZ0G4Td.js";import{tt as p}from"./shell-header-bar-CjG5qvPg.js";import{t as m}from"./auth-field-DD8kvl--.js";import{t as h}from"./authorization-context-banner-SOuBHWIb.js";import{t as g}from"./lock-7NRyvXBS.js";import{t as _}from"./mail-D0B_1Dzd.js";import{c as v,i as y,o as b}from"./zod-C87S6Tec.js";import{F as x,N as S,S as C,j as w,s as T}from"./index-CS23Ozt6.js";import{t as E}from"./auth-page-header-CIn2E4zI.js";import{t as D}from"./auth-layout-VtpryDof.js";import{t as O}from"./promise-OpBtq8tG.js";import{t as k}from"./link-C-WdTj3F.js";import{n as A,t as j}from"./auth-footer-Cz5ivsDc.js";import{o as M}from"./passkey-J1qnYp9A.js";import{r as N,t as P}from"./standard-schema-e8gtSzGE.js";var F=t(e()),I=d({mutationFn:async e=>c(await l.api.auth.login.$post({json:e}))}),L=r();function R(){let{t:e,i18n:t}=n(),r=a(),c=s(),l=T.useSearch(),d=l.account_selection_state&&l.prompt?.split(` `).includes(`login`)?{...l,account_selected:1}:l,R=l.lang??t.language,{data:z}=p(u),B=z.registration.signup_notice?.[R]??z.registration.signup_notice?.[z.i18n.fallback_language],V=z.auth.password.enabled,H=z.auth.passkey.enabled,U=z.identity_providers.length+ +!!V+ +!!H>1,W=(0,F.useMemo)(()=>b({email:v().min(1,e(`validation.email.required`)).pipe(y(e(`validation.email.invalid`))),password:v().min(1,e(`validation.password.required`))}),[e]),G=f({...I,onSuccess:async(e,t)=>{let n=e.user;if(n.email_verification_required&&!n.email_verified){r.navigate({to:`/verify/email`,search:{email:t.email,...S(l)}});return}c.setQueryData(C.queryKey,{user:n}),await O();let i=[];if(z.auth.password.totp.enabled&&n.totp_registered&&i.push(`totp`),z.auth.passkey.enabled&&n.passkey_count>0&&i.push(`passkey`),n.second_factor_required&&i.length===0){if(z.available_2fa_setup_methods.length>1)return r.navigate({to:`/setup/2fa`,search:S(l)});if(z.available_2fa_setup_methods.length===1)return z.available_2fa_setup_methods[0]===`totp`?r.navigate({to:`/setup/totp`,search:S(l)}):r.navigate({to:`/setup/passkey`,search:{...S(l),passkey_name:`default`}})}if(i.length>1)return r.navigate({to:`/verify/2fa`,search:S(l)});if(i.length===1)return i[0]===`totp`?r.navigate({to:`/verify/totp`,search:S(l)}):r.navigate({to:`/verify/passkey`,search:S(l)});if(x(l))window.location.href=w(d);else return r.navigate({to:`/profile`})},onError:t=>{Y(`email`,{type:`manual`,message:e(`login.error.failed`)})},onSettled:()=>{c.invalidateQueries({queryKey:C.queryKey})}}),K=(0,F.useCallback)(async e=>{e.user&&(c.setQueryData(C.queryKey,e),await O(),x(l)?window.location.href=w(d):r.navigate({to:`/profile`})),c.invalidateQueries({queryKey:C.queryKey})},[c,r,l,d]),q=(0,F.useRef)(null);(0,F.useEffect)(()=>{if(!(!H||!V))return q.current=new AbortController,M(K,q.current.signal),()=>{q.current?.abort()}},[H,V,K]);let{register:J,setError:Y,handleSubmit:X,formState:{errors:Z}}=N({defaultValues:{email:``,password:``},resolver:P(W)});return(0,L.jsxs)(D,{children:[(0,L.jsx)(E,{subtitle:e(`login.selectMethod.subtitle`)||void 0,title:e(`login.title`)}),(0,L.jsx)(h,{search:l}),V&&(0,L.jsxs)(`form`,{className:`flex flex-col gap-tinyrack-lg`,onSubmit:X(async e=>{G.mutate(e)}),children:[(0,L.jsx)(m,{autoComplete:`username webauthn`,error:Z.email,icon:_,label:e(`login.email.label`),placeholder:e(`login.email.placeholder`),...J(`email`),type:`email`}),(0,L.jsx)(m,{autoComplete:`current-password`,error:Z.password,icon:g,label:e(`login.password.label`),labelAction:z.email.enabled?(0,L.jsx)(k,{className:`text-tinyrack-xs`,render:(0,L.jsx)(o,{to:`/password/forgot`}),children:e(`login.link.forgotPassword`)}):void 0,placeholder:e(`login.password.placeholder`),...J(`password`),type:`password`}),(0,L.jsx)(i,{className:`w-full`,intent:`primary`,loading:G.isPending,loadingLabel:e(`login.submitting`),type:`submit`,uiSize:`lg`,children:e(`login.submit`)})]}),B&&(0,L.jsx)(`div`,{className:`prose prose-sm text-center text-tinyrack-text-muted text-tinyrack-xs! **:text-tinyrack-xs!`,dangerouslySetInnerHTML:{__html:B}}),(z.registration.public_registration||U)&&(0,L.jsxs)(j,{children:[z.registration.public_registration&&(0,L.jsx)(A,{link:(0,L.jsx)(o,{search:S(l),to:`/register`,children:e(`login.link.register`)}),text:e(`login.footer.noAccount`)}),U&&(0,L.jsx)(A,{link:(0,L.jsx)(o,{search:S(l),to:`/login`,children:e(`login.password.backToMethods`)})})]})]})}export{R as component};
+//# sourceMappingURL=password-RkUttbhD.js.map

package/public/assets/password-RkUttbhD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-RkUttbhD.js","names":["standardSchemaResolver","useMutation","useQueryClient","useSuspenseQuery","Link","useRouter","TRButton","TRLink","LockIcon","MailIcon","useCallback","useEffect","useMemo","useRef","useForm","useTranslation","z","AuthField","AuthFooter","AuthFooterLink","AuthPageHeader","AuthorizationContextBanner","AuthLayout","buildAuthenticatedAuthorizeUrl","extractOAuthParams","isOAuthFlow","tick","appConfigQueryOptions","loginMutationOptions","startConditionalPasskeyAuth","getSessionQueryOptions","Route","LoginPassword","t","i18n","router","queryClient","search","useSearch","authorizeSearch","OAuthSearch","account_selection_state","prompt","split","includes","account_selected","lang","language","data","configData","implicitNotice","registration","signup_notice","fallback_language","isPasswordAuthEnabled","auth","password","enabled","isPasskeyEnabled","passkey","hasMultipleLoginMethods","identity_providers","length","loginSchema","object","email","string","min","pipe","loginMutation","onSuccess","params","user","email_verification_required","email_verified","navigate","to","setQueryData","queryKey","registered_2fa_methods","SecondFactorMethod","totp","totp_registered","push","passkey_count","second_factor_required","available_2fa_setup_methods","method","passkey_name","window","location","href","onError","_error","setError","type","message","onSettled","invalidateQueries","handlePasskeySuccess","AuthResponse","abortControllerRef","AbortController","current","signal","abort","register","handleSubmit","formState","errors","defaultValues","resolver","onSubmit","values","infer","mutate","undefined","isPending","__html","public_registration","component"],"sources":["../../../frontend/src/queries/login.ts","../../../frontend/src/routes/login/password/index.tsx?tsr-split=component"],"sourcesContent":["import { mutationOptions } from '@tanstack/react-query';\nimport type { InferRequestType, InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\n\nexport type LoginParams = InferRequestType<\n  (typeof client.api.auth.login)['$post']\n>['json'];\n\nexport type LoginResponse = InferResponseType<\n  (typeof client.api.auth.login)['$post'],\n  200\n>;\n\nexport const loginMutationOptions = mutationOptions({\n  mutationFn: async (values: LoginParams) => {\n    const res = await client.api.auth.login.$post({\n      json: values,\n    });\n    return jsonOk(res);\n  },\n});\n","import { standardSchemaResolver } from '@hookform/resolvers/standard-schema';\nimport {\n  useMutation,\n  useQueryClient,\n  useSuspenseQuery,\n} from '@tanstack/react-query';\nimport { createFileRoute, Link, useRouter } from '@tanstack/react-router';\nimport { TRButton } from '@tinyrack/ui/components/button';\nimport { TRLink } from '@tinyrack/ui/components/link';\nimport { LockIcon, MailIcon } from 'lucide-react';\nimport { useCallback, useEffect, useMemo, useRef } from 'react';\nimport { useForm } from 'react-hook-form';\nimport { useTranslation } from 'react-i18next';\nimport { z } from 'zod';\nimport { AuthField } from '#frontend/components/auth/auth-field.tsx';\nimport {\n  AuthFooter,\n  AuthFooterLink,\n} from '#frontend/components/auth/auth-footer.tsx';\nimport { AuthPageHeader } from '#frontend/components/auth/auth-page-header.tsx';\nimport { AuthorizationContextBanner } from '#frontend/components/auth/authorization-context-banner.tsx';\nimport { RouteErrorFallback } from '#frontend/components/ui/route-error-fallback.tsx';\nimport { AuthLayout } from '#frontend/features/layout/auth-layout.tsx';\nimport {\n  buildAuthenticatedAuthorizeUrl,\n  extractOAuthParams,\n  hasAuthorizationContext,\n  isOAuthFlow,\n  type OAuthSearch,\n  OAuthSearchSchema,\n  type SecondFactorMethod,\n} from '#frontend/libs/oauth-search.ts';\nimport { tick } from '#frontend/libs/promise.ts';\nimport { getAuthorizationContextQueryOptions } from '#frontend/queries/authorization-context.ts';\nimport { appConfigQueryOptions } from '#frontend/queries/config.ts';\nimport { loginMutationOptions } from '#frontend/queries/login.ts';\nimport { startConditionalPasskeyAuth } from '#frontend/queries/passkey.ts';\nimport {\n  type AuthResponse,\n  getSessionQueryOptions,\n} from '#frontend/queries/session.ts';\n\nconst SearchSchema = OAuthSearchSchema;\n\nexport const Route = createFileRoute('/login/password/')({\n  component: LoginPassword,\n  errorComponent: RouteErrorFallback,\n  validateSearch: SearchSchema,\n  loaderDeps: ({ search }) => ({\n    search,\n  }),\n  loader: async ({ context, deps }) => {\n    await context.queryClient.ensureQueryData(appConfigQueryOptions);\n    if (hasAuthorizationContext(deps.search)) {\n      await context.queryClient.ensureQueryData(\n        getAuthorizationContextQueryOptions(deps.search),\n      );\n    }\n  },\n});\n\nfunction LoginPassword() {\n  const { t, i18n } = useTranslation();\n  const router = useRouter();\n  const queryClient = useQueryClient();\n  const search = Route.useSearch();\n  const authorizeSearch: OAuthSearch =\n    search.account_selection_state &&\n    search.prompt?.split(' ').includes('login')\n      ? { ...search, account_selected: 1 }\n      : search;\n  const lang = search.lang ?? i18n.language;\n\n  const { data: configData } = useSuspenseQuery(appConfigQueryOptions);\n\n  const implicitNotice =\n    configData.registration.signup_notice?.[lang] ??\n    configData.registration.signup_notice?.[configData.i18n.fallback_language];\n  const isPasswordAuthEnabled = configData.auth.password.enabled;\n  const isPasskeyEnabled = configData.auth.passkey.enabled;\n  const hasMultipleLoginMethods =\n    configData.identity_providers.length +\n      (isPasswordAuthEnabled ? 1 : 0) +\n      (isPasskeyEnabled ? 1 : 0) >\n    1;\n\n  const loginSchema = useMemo(\n    () =>\n      z.object({\n        email: z\n          .string()\n          .min(1, t('validation.email.required'))\n          .pipe(z.email(t('validation.email.invalid'))),\n        password: z.string().min(1, t('validation.password.required')),\n      }),\n    [t],\n  );\n\n  const loginMutation = useMutation({\n    ...loginMutationOptions,\n    onSuccess: async (data, params) => {\n      const user = data.user;\n\n      if (user.email_verification_required && !user.email_verified) {\n        router.navigate({\n          to: '/verify/email',\n          search: {\n            email: params.email,\n            ...extractOAuthParams(search),\n          },\n        });\n        return;\n      }\n\n      queryClient.setQueryData(getSessionQueryOptions.queryKey, {\n        user: user,\n      });\n      await tick();\n\n      const registered_2fa_methods: SecondFactorMethod[] = [];\n      if (configData.auth.password.totp.enabled && user.totp_registered) {\n        registered_2fa_methods.push('totp');\n      }\n      if (configData.auth.passkey.enabled && user.passkey_count > 0) {\n        registered_2fa_methods.push('passkey');\n      }\n\n      if (user.second_factor_required && registered_2fa_methods.length === 0) {\n        if (configData.available_2fa_setup_methods.length > 1) {\n          return router.navigate({\n            to: '/setup/2fa',\n            search: extractOAuthParams(search),\n          });\n        } else if (configData.available_2fa_setup_methods.length === 1) {\n          const method = configData.available_2fa_setup_methods[0];\n          if (method === 'totp') {\n            return router.navigate({\n              to: '/setup/totp',\n              search: extractOAuthParams(search),\n            });\n          } else {\n            return router.navigate({\n              to: '/setup/passkey',\n              search: {\n                ...extractOAuthParams(search),\n                passkey_name: 'default',\n              },\n            });\n          }\n        }\n      }\n\n      if (registered_2fa_methods.length > 1) {\n        return router.navigate({\n          to: '/verify/2fa',\n          search: extractOAuthParams(search),\n        });\n      } else if (registered_2fa_methods.length === 1) {\n        const method = registered_2fa_methods[0];\n        if (method === 'totp') {\n          return router.navigate({\n            to: '/verify/totp',\n            search: extractOAuthParams(search),\n          });\n        } else {\n          return router.navigate({\n            to: '/verify/passkey',\n            search: extractOAuthParams(search),\n          });\n        }\n      } else {\n        if (isOAuthFlow(search)) {\n          window.location.href =\n            buildAuthenticatedAuthorizeUrl(authorizeSearch);\n        } else {\n          return router.navigate({ to: '/profile' });\n        }\n      }\n    },\n    onError: (_error) => {\n      setError('email', {\n        type: 'manual',\n        message: t('login.error.failed'),\n      });\n    },\n    onSettled: () => {\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n  });\n\n  const handlePasskeySuccess = useCallback(\n    async (data: AuthResponse) => {\n      if (data.user) {\n        queryClient.setQueryData(getSessionQueryOptions.queryKey, data);\n        await tick();\n\n        if (isOAuthFlow(search)) {\n          window.location.href =\n            buildAuthenticatedAuthorizeUrl(authorizeSearch);\n        } else {\n          router.navigate({ to: '/profile' });\n        }\n      }\n      queryClient.invalidateQueries({\n        queryKey: getSessionQueryOptions.queryKey,\n      });\n    },\n    [queryClient, router, search, authorizeSearch],\n  );\n\n  // Conditional UI: Start passkey autofill on page load\n  const abortControllerRef = useRef<AbortController | null>(null);\n\n  useEffect(() => {\n    if (!isPasskeyEnabled || !isPasswordAuthEnabled) {\n      return;\n    }\n\n    abortControllerRef.current = new AbortController();\n    startConditionalPasskeyAuth(\n      handlePasskeySuccess,\n      abortControllerRef.current.signal,\n    );\n\n    return () => {\n      abortControllerRef.current?.abort();\n    };\n  }, [isPasskeyEnabled, isPasswordAuthEnabled, handlePasskeySuccess]);\n\n  const {\n    register,\n    setError,\n    handleSubmit,\n    formState: { errors },\n  } = useForm({\n    defaultValues: {\n      email: '',\n      password: '',\n    },\n    resolver: standardSchemaResolver(loginSchema),\n  });\n\n  const onSubmit = async (values: z.infer<typeof loginSchema>) => {\n    loginMutation.mutate(values);\n  };\n\n  return (\n    <AuthLayout>\n      {/* Branding lives in the layout's brand panel — see /login. */}\n      <AuthPageHeader\n        subtitle={t('login.selectMethod.subtitle') || undefined}\n        title={t('login.title')}\n      />\n\n      <AuthorizationContextBanner search={search} />\n\n      {isPasswordAuthEnabled && (\n        <form\n          className=\"flex flex-col gap-tinyrack-lg\"\n          onSubmit={handleSubmit(onSubmit)}\n        >\n          <AuthField\n            autoComplete=\"username webauthn\"\n            error={errors.email}\n            icon={MailIcon}\n            label={t('login.email.label')}\n            placeholder={t('login.email.placeholder')}\n            {...register('email')}\n            type=\"email\"\n          />\n\n          <AuthField\n            autoComplete=\"current-password\"\n            error={errors.password}\n            icon={LockIcon}\n            label={t('login.password.label')}\n            /*\n             * On the label row rather than under the field: it belongs to the\n             * password, and putting it between the field and the submit button\n             * separated the two things the user is actually trying to do.\n             */\n            labelAction={\n              configData.email.enabled ? (\n                <TRLink\n                  className=\"text-tinyrack-xs\"\n                  render={<Link to=\"/password/forgot\" />}\n                >\n                  {t('login.link.forgotPassword')}\n                </TRLink>\n              ) : undefined\n            }\n            placeholder={t('login.password.placeholder')}\n            {...register('password')}\n            type=\"password\"\n          />\n\n          <TRButton\n            className=\"w-full\"\n            intent=\"primary\"\n            loading={loginMutation.isPending}\n            loadingLabel={t('login.submitting')}\n            type=\"submit\"\n            uiSize=\"lg\"\n          >\n            {t('login.submit')}\n          </TRButton>\n        </form>\n      )}\n\n      {implicitNotice && (\n        <div\n          className=\"prose prose-sm text-center text-tinyrack-text-muted text-tinyrack-xs! **:text-tinyrack-xs!\"\n          dangerouslySetInnerHTML={{ __html: implicitNotice }}\n        />\n      )}\n\n      {(configData.registration.public_registration ||\n        hasMultipleLoginMethods) && (\n        <AuthFooter>\n          {configData.registration.public_registration && (\n            <AuthFooterLink\n              link={\n                <Link search={extractOAuthParams(search)} to=\"/register\">\n                  {t('login.link.register')}\n                </Link>\n              }\n              text={t('login.footer.noAccount')}\n            />\n          )}\n          {hasMultipleLoginMethods && (\n            <AuthFooterLink\n              link={\n                <Link search={extractOAuthParams(search)} to=\"/login\">\n                  {t('login.password.backToMethods')}\n                </Link>\n              }\n            />\n          )}\n        </AuthFooter>\n      )}\n    </AuthLayout>\n  );\n}\n"],"mappings":"27BAaA,EAAA,EAAA,CAAA,WAAA,KAAA,6CAME,CAAA,QC0CF,SAASgC,GAAgB,CACvB,GAAM,CAAEC,IAAGC,QAASnB,EAAe,EAC7BoB,EAAS9B,EAAU,EACnB+B,EAAclC,EAAe,EAC7BmC,EAASN,EAAMO,UAAU,EACzBC,EACJF,EAAOI,yBACPJ,EAAOK,QAAQC,MAAM,GAAG,CAAC,CAACC,SAAS,OAAO,EACtC,CAAE,GAAGP,EAAQQ,iBAAkB,CAAE,EACjCR,EACAS,EAAOT,EAAOS,MAAQZ,EAAKa,SAE3B,CAAEC,KAAMC,GAAe9C,EAAiBwB,CAAqB,EAE7DuB,EACJD,EAAWE,aAAaC,gBAAgBN,IACxCG,EAAWE,aAAaC,gBAAgBH,EAAWf,KAAKmB,mBACpDC,EAAwBL,EAAWM,KAAKC,SAASC,QACjDC,EAAmBT,EAAWM,KAAKI,QAAQF,QAC3CG,EACJX,EAAWY,mBAAmBC,QAC3BR,MACAI,KACH,EAEIK,GAAAA,EAAAA,EAAAA,QAAAA,KAEF/C,EAAS,CACPiD,MAAOjD,EACG,CAAC,CACRmD,IAAI,EAAGlC,EAAE,2BAA2B,CAAC,CAAC,CACtCmC,KAAKpD,EAAQiB,EAAE,0BAA0B,CAAC,CAAC,EAC9CuB,SAAUxC,EAAS,CAAC,CAACmD,IAAI,EAAGlC,EAAE,8BAA8B,CAAC,CAC/D,CAAC,EACH,CAACA,CAAC,CACJ,EAEMoC,EAAgBpE,EAAY,CAChC,GAAG2B,EACH0C,UAAW,MAAOtB,EAAMuB,IAAW,CACjC,IAAMC,EAAOxB,EAAKwB,KAElB,GAAIA,EAAKC,6BAA+B,CAACD,EAAKE,eAAgB,CAC5DvC,EAAOwC,SAAS,CACdC,GAAI,gBACJvC,OAAQ,CACN4B,MAAOM,EAAON,MACd,GAAGzC,EAAmBa,CAAM,CAC9B,CACF,CAAC,EACD,MACF,CAEAD,EAAYyC,aAAa/C,EAAuBgD,SAAU,CAClDN,MACR,CAAC,EACD,MAAM9C,EAAK,EAEX,IAAMqD,EAA+C,CAAA,EAQrD,GAPI9B,EAAWM,KAAKC,SAASyB,KAAKxB,SAAWe,EAAKU,iBAChDH,EAAuBI,KAAK,MAAM,EAEhClC,EAAWM,KAAKI,QAAQF,SAAWe,EAAKY,cAAgB,GAC1DL,EAAuBI,KAAK,SAAS,EAGnCX,EAAKa,wBAA0BN,EAAuBjB,SAAW,EACnE,IAAIb,EAAWqC,4BAA4BxB,OAAS,EAClD,OAAO3B,EAAOwC,SAAS,CACrBC,GAAI,aACJvC,OAAQb,EAAmBa,CAAM,CACnC,CAAC,EACI,GAAIY,EAAWqC,4BAA4BxB,SAAW,EAQzD,OAPab,EAAWqC,4BAA4B,KACvC,OACNnD,EAAOwC,SAAS,CACrBC,GAAI,cACJvC,OAAQb,EAAmBa,CAAM,CACnC,CAAC,EAEMF,EAAOwC,SAAS,CACrBC,GAAI,iBACJvC,OAAQ,CACN,GAAGb,EAAmBa,CAAM,EAC5BmD,aAAc,SAChB,CACF,CAAC,CAEL,CAGF,GAAIT,EAAuBjB,OAAS,EAClC,OAAO3B,EAAOwC,SAAS,CACrBC,GAAI,cACJvC,OAAQb,EAAmBa,CAAM,CACnC,CAAC,EACI,GAAI0C,EAAuBjB,SAAW,EAQzC,OAPaiB,EAAuB,KACvB,OACN5C,EAAOwC,SAAS,CACrBC,GAAI,eACJvC,OAAQb,EAAmBa,CAAM,CACnC,CAAC,EAEMF,EAAOwC,SAAS,CACrBC,GAAI,kBACJvC,OAAQb,EAAmBa,CAAM,CACnC,CAAC,EAGH,GAAIZ,EAAYY,CAAM,EACpBoD,OAAOC,SAASC,KACdpE,EAA+BgB,CAAe,OAEhD,OAAOJ,EAAOwC,SAAS,CAAEC,GAAI,UAAW,CAAC,CAG/C,EACAgB,QAAUC,GAAW,CACnBC,EAAS,QAAS,CAChBC,KAAM,SACNC,QAAS/D,EAAE,oBAAoB,CACjC,CAAC,CACH,EACAgE,cAAiB,CACf7D,EAAY8D,kBAAkB,CAC5BpB,SAAUhD,EAAuBgD,QACnC,CAAC,CACH,CACF,CAAC,EAEKqB,GAAAA,EAAAA,EAAAA,YAAAA,CACJ,KAAOnD,IAAuB,CACxBA,EAAKwB,OACPpC,EAAYyC,aAAa/C,EAAuBgD,SAAU9B,CAAI,EAC9D,MAAMtB,EAAK,EAEPD,EAAYY,CAAM,EACpBoD,OAAOC,SAASC,KACdpE,EAA+BgB,CAAe,EAEhDJ,EAAOwC,SAAS,CAAEC,GAAI,UAAW,CAAC,GAGtCxC,EAAY8D,kBAAkB,CAC5BpB,SAAUhD,EAAuBgD,QACnC,CAAC,CACH,EACA,CAAC1C,EAAaD,EAAQE,EAAQE,CAAe,CAC/C,EAGM8D,GAAAA,EAAAA,EAAAA,OAAAA,CAAoD,IAAI,GAE9D1F,EAAAA,EAAAA,UAAAA,KAAgB,CACV,MAAC+C,GAAoB,CAACJ,GAU1B,MANA+C,GAAmBE,QAAU,IAAID,gBACjCzE,EACEsE,EACAE,EAAmBE,QAAQC,MAC7B,MAEa,CACXH,EAAmBE,SAASE,MAAM,CACpC,CACF,EAAG,CAAC/C,EAAkBJ,EAAuB6C,CAAoB,CAAC,EAElE,GAAM,CACJO,WACAZ,WACAa,eACAC,UAAW,CAAEC,WACX/F,EAAQ,CACVgG,cAAe,CACb7C,MAAO,GACPT,SAAU,EACZ,EACAuD,SAAU/G,EAAuB+D,CAAW,CAC9C,CAAC,EAMD,OACE,EAAA,EAAA,KAAA,CAAC,EAAD,CAAA,SAAA,EAEE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,SAAU9B,EAAE,6BAA6B,GAAKmF,IAAAA,GAC9C,MAAOnF,EAAE,aAAa,CAAE,CAAA,GAG1B,EAAA,EAAA,IAAA,CAAC,EAAD,CAAoCI,QAAO,CAAA,EAE1CiB,IACC,EAAA,EAAA,KAAA,CAAC,OAAD,CACE,UAAU,gCACV,SAAUqD,EAAaK,KAjBPC,IAAwC,CAC9D5C,EAAc8C,OAAOF,CAAM,CAC7B,CAeuC,WAFjC,EAIE,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,aAAa,oBACb,MAAOJ,EAAO5C,MACd,KAAMxD,EACN,MAAOwB,EAAE,mBAAmB,EAC5B,YAAaA,EAAE,yBAAyB,EACxC,GAAIyE,EAAS,OAAO,EACpB,KAAK,OAAO,CAAA,GAGd,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,aAAa,mBACb,MAAOG,EAAOrD,SACd,KAAMhD,EACN,MAAOyB,EAAE,sBAAsB,EAM/B,YACEgB,EAAWgB,MAAMR,SACf,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,UAAU,mBACV,QAAQ,EAAA,EAAA,IAAA,CAAC,EAAD,CAAM,GAAG,kBAAkB,CAAA,WAElCxB,EAAE,2BAA2B,CACxB,CAAA,EACNmF,IAAAA,GAEN,YAAanF,EAAE,4BAA4B,EAC3C,GAAIyE,EAAS,UAAU,EACvB,KAAK,UAAU,CAAA,GAGjB,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,UAAU,SACV,OAAO,UACP,QAASrC,EAAcgD,UACvB,aAAcpF,EAAE,kBAAkB,EAClC,KAAK,SACL,OAAO,cAENA,EAAE,cAAc,CACT,CAAA,CACN,IAGPiB,IACC,EAAA,EAAA,IAAA,CAAC,MAAD,CACE,UAAU,6FACV,wBAAyB,CAAEoE,OAAQpE,CAAe,CAAE,CAAA,GAItDD,EAAWE,aAAaoE,qBACxB3D,KACA,EAAA,EAAA,KAAA,CAAC,EAAD,CAAA,SAAA,CACGX,EAAWE,aAAaoE,sBACvB,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAM,OAAQ/F,EAAmBa,CAAM,EAAG,GAAG,qBAC1CJ,EAAE,qBAAqB,CACpB,CAAA,EAER,KAAMA,EAAE,wBAAwB,CAAE,CAAA,EAGrC2B,IACC,EAAA,EAAA,IAAA,CAAC,EAAD,CACE,MACE,EAAA,EAAA,IAAA,CAAC,EAAD,CAAM,OAAQpC,EAAmBa,CAAM,EAAG,GAAG,kBAC1CJ,EAAE,8BAA8B,CAC7B,CAAA,CACP,CAAA,CAGK,CAAA,CAAA,CAEJ,CAAA,CAAA,CAEhB"}

package/public/assets/password-reset-sU5KkBKi.js

@@ -0,0 +1,2 @@
+import{i as e,r as t}from"./config-DTQCUlfZ.js";import{t as n}from"./mutationOptions-DyYFUbyn.js";var r=n({mutationFn:async n=>e(await t.api.auth.password.forgot.$post({json:n,header:{}}))}),i=n({mutationFn:async n=>e(await t.api.auth.password.reset.$post({json:n}))});export{i as n,r as t};
+//# sourceMappingURL=password-reset-sU5KkBKi.js.map

package/public/assets/{password-reset-CIacHnvA.js.map → password-reset-sU5KkBKi.js.map}

@@ -1 +1 @@
-{"version":3,"file":"password-reset-CIacHnvA.js","names":[],"sources":["../../../frontend/src/queries/password-reset.ts"],"sourcesContent":["import { mutationOptions } from '@tanstack/react-query';\nimport type { InferRequestType, InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\n\nexport type ForgotPasswordParams = InferRequestType<\n  (typeof client.api.auth.password.forgot)['$post']\n>['json'];\n\nexport type ForgotPasswordResponse = InferResponseType<\n  (typeof client.api.auth.password.forgot)['$post'],\n  200\n>;\n\nexport const forgotPasswordMutationOptions = mutationOptions({\n  mutationFn: async (values: ForgotPasswordParams) => {\n    const res = await client.api.auth.password.forgot.$post({\n      json: values,\n      header: {},\n    });\n    return jsonOk(res);\n  },\n});\n\nexport type ResetPasswordParams = InferRequestType<\n  (typeof client.api.auth.password.reset)['$post']\n>['json'];\n\nexport type ResetPasswordResponse = InferResponseType<\n  (typeof client.api.auth.password.reset)['$post'],\n  200\n>;\n\nexport const resetPasswordMutationOptions = mutationOptions({\n  mutationFn: async (values: ResetPasswordParams) => {\n    const res = await client.api.auth.password.reset.$post({\n      json: values,\n    });\n    return jsonOk(res);\n  },\n});\n\nexport type ResetRequiredPasswordParams = InferRequestType<\n  (typeof client.api.auth.password)['reset-required']['$post']\n>['json'];\n\nexport const resetRequiredPasswordMutationOptions = mutationOptions({\n  mutationFn: async (values: ResetRequiredPasswordParams) => {\n    const res = await client.api.auth.password['reset-required'].$post({\n      json: values,\n    });\n    return jsonOk(res);\n  },\n});\n"],"mappings":"kGAaA,IAAa,EAAgC,EAAgB,CAC3D,WAAY,KAAO,IAKV,EAAO,MAJI,EAAO,IAAI,KAAK,SAAS,OAAO,MAAM,CACtD,KAAM,EACN,OAAQ,CAAC,CACX,CAAC,CACgB,CAErB,CAAC,EAWY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAIV,EAAO,MAHI,EAAO,IAAI,KAAK,SAAS,MAAM,MAAM,CACrD,KAAM,CACR,CAAC,CACgB,CAErB,CAAC,EAMY,EAAuC,EAAgB,CAClE,WAAY,KAAO,IAIV,EAAO,MAHI,EAAO,IAAI,KAAK,SAAS,iBAAiB,CAAC,MAAM,CACjE,KAAM,CACR,CAAC,CACgB,CAErB,CAAC"}
+{"version":3,"file":"password-reset-sU5KkBKi.js","names":[],"sources":["../../../frontend/src/queries/password-reset.ts"],"sourcesContent":["import { mutationOptions } from '@tanstack/react-query';\nimport type { InferRequestType, InferResponseType } from 'hono/client';\nimport { client, jsonOk } from '#frontend/libs/api.ts';\n\nexport type ForgotPasswordParams = InferRequestType<\n  (typeof client.api.auth.password.forgot)['$post']\n>['json'];\n\nexport type ForgotPasswordResponse = InferResponseType<\n  (typeof client.api.auth.password.forgot)['$post'],\n  200\n>;\n\nexport const forgotPasswordMutationOptions = mutationOptions({\n  mutationFn: async (values: ForgotPasswordParams) => {\n    const res = await client.api.auth.password.forgot.$post({\n      json: values,\n      header: {},\n    });\n    return jsonOk(res);\n  },\n});\n\nexport type ResetPasswordParams = InferRequestType<\n  (typeof client.api.auth.password.reset)['$post']\n>['json'];\n\nexport type ResetPasswordResponse = InferResponseType<\n  (typeof client.api.auth.password.reset)['$post'],\n  200\n>;\n\nexport const resetPasswordMutationOptions = mutationOptions({\n  mutationFn: async (values: ResetPasswordParams) => {\n    const res = await client.api.auth.password.reset.$post({\n      json: values,\n    });\n    return jsonOk(res);\n  },\n});\n"],"mappings":"kGAaA,IAAa,EAAgC,EAAgB,CAC3D,WAAY,KAAO,IAKV,EAAO,MAJI,EAAO,IAAI,KAAK,SAAS,OAAO,MAAM,CACtD,KAAM,EACN,OAAQ,CAAC,CACX,CAAC,CACgB,CAErB,CAAC,EAWY,EAA+B,EAAgB,CAC1D,WAAY,KAAO,IAIV,EAAO,MAHI,EAAO,IAAI,KAAK,SAAS,MAAM,MAAM,CACrD,KAAM,CACR,CAAC,CACgB,CAErB,CAAC"}

package/public/assets/{password-strength-C0Zkrrct.js → password-strength-BeSOu_Ga.js}

@@ -1,2 +1,2 @@
-import{G as e,J as t,Z as n,c as r,i,n as a,q as o,v as s}from"./createLucideIcon-BPpAIXR_.js";import{bn as c,bt as l,st as u}from"./config-v3-oy_ef.js";import{f as d}from"./shell-header-bar-C9AB5lT-.js";import{n as f,t as p}from"./valueToPercent-LgbY_prH.js";var m=n(t(),1),h=m.createContext(void 0);function g(){let e=m.useContext(h);if(e===void 0)throw Error(s(38));return e}var _=o(),v=m.forwardRef(function(e,t){let{format:n,getAriaValueText:i,locale:a,max:o=100,min:s=0,value:c,render:d,className:g,children:v,style:y,...b}=e,[x,S]=m.useState(),C=p(c,s,o),w=u(Number.isNaN(C)?0:C,0,100),T=u(Number.isNaN(c)?s:c,s,o),E=n?f(T,a,n):f(w/100,a,{style:`percent`}),D=E;i&&(D=i(E,c));let O={"aria-labelledby":x,"aria-valuemax":o,"aria-valuemin":s,"aria-valuenow":T,"aria-valuetext":D,role:`meter`,children:(0,_.jsxs)(m.Fragment,{children:[v,(0,_.jsx)(`span`,{role:`presentation`,style:l,children:`x`})]})},k=m.useMemo(()=>({formattedValue:E,percentageValue:w,setLabelId:S,value:c}),[E,w,S,c]),A=r(`div`,e,{ref:t,props:[O,b]});return(0,_.jsx)(h.Provider,{value:k,children:A})}),y=m.forwardRef(function(e,t){let{render:n,className:i,style:a,...o}=e;return r(`div`,e,{ref:t,props:o})}),b=m.forwardRef(function(e,t){let{render:n,className:i,style:a,...o}=e,{percentageValue:s}=g();return r(`div`,e,{ref:t,props:[{style:{insetInlineStart:0,height:`inherit`,width:`${s}%`}},o]})}),x=m.forwardRef(function(e,t){let{className:n,render:i,children:a,style:o,...s}=e,{value:c,formattedValue:l}=g();return r(`span`,e,{ref:t,props:[{"aria-hidden":!0,children:typeof a==`function`?a(l,c):l},s]})}),S=m.forwardRef(function(e,t){let{render:n,className:i,style:a,id:o,...s}=e,{setLabelId:c}=g();return r(`span`,e,{ref:t,props:[{id:d(o,c),role:`presentation`},s]})}),C=c(b,`tr-meter-indicator`),w=c(S,`tr-meter-label`);function T({className:t,max:n=100,min:r=0,value:i,variant:a=`neutral`,...o}){let s=Math.min(n,Math.max(r,Number.isNaN(i)?r:i));return(0,_.jsx)(v,{...o,className:e(`tr-meter`,t),"data-variant":a,max:n,min:r,value:s})}var E={Root:T,Track:c(y,`tr-meter-track`),Indicator:C,Value:c(x,`tr-meter-value`),Label:w},D=[`weak`,`fair`,`good`,`strong`],O={weak:`danger`,fair:`warning`,good:`info`,strong:`success`};function k(e,t){if(e.length===0)return 0;if(e.length<t.min_length)return 1;let n=[/[a-z]/,/[A-Z]/,/\d/,/[^a-zA-Z0-9]/].filter(t=>t.test(e)).length,r=e.length>=t.min_length+4;return n>=3&&r?4:n>=2&&r?3:2}function A({password:e,policy:t}){let{t:n}=i(),r=k(e,t);if(r===0)return null;let o=D[r-1];return(0,_.jsxs)(E.Root,{"aria-live":`polite`,className:`flex flex-col gap-tinyrack-xs`,max:4,min:0,value:r,variant:O[o],children:[(0,_.jsxs)(`div`,{className:`flex items-baseline justify-between gap-tinyrack-sm`,children:[(0,_.jsx)(E.Label,{render:(0,_.jsx)(a,{color:`muted`,variant:`caption`,children:n(`validation.password.strength.label`)})}),(0,_.jsx)(E.Value,{render:(0,_.jsx)(a,{color:`muted`,variant:`caption`,children:n(`validation.password.strength.${o}`)})})]}),(0,_.jsx)(E.Track,{children:(0,_.jsx)(E.Indicator,{})})]})}export{A as t};
-//# sourceMappingURL=password-strength-C0Zkrrct.js.map
+import{G as e,J as t,Z as n,c as r,i,n as a,q as o,v as s}from"./createLucideIcon-BPpAIXR_.js";import{bn as c,bt as l,st as u}from"./config-DTQCUlfZ.js";import{f as d}from"./shell-header-bar-CjG5qvPg.js";import{n as f,t as p}from"./valueToPercent-LgbY_prH.js";var m=n(t(),1),h=m.createContext(void 0);function g(){let e=m.useContext(h);if(e===void 0)throw Error(s(38));return e}var _=o(),v=m.forwardRef(function(e,t){let{format:n,getAriaValueText:i,locale:a,max:o=100,min:s=0,value:c,render:d,className:g,children:v,style:y,...b}=e,[x,S]=m.useState(),C=p(c,s,o),w=u(Number.isNaN(C)?0:C,0,100),T=u(Number.isNaN(c)?s:c,s,o),E=n?f(T,a,n):f(w/100,a,{style:`percent`}),D=E;i&&(D=i(E,c));let O={"aria-labelledby":x,"aria-valuemax":o,"aria-valuemin":s,"aria-valuenow":T,"aria-valuetext":D,role:`meter`,children:(0,_.jsxs)(m.Fragment,{children:[v,(0,_.jsx)(`span`,{role:`presentation`,style:l,children:`x`})]})},k=m.useMemo(()=>({formattedValue:E,percentageValue:w,setLabelId:S,value:c}),[E,w,S,c]),A=r(`div`,e,{ref:t,props:[O,b]});return(0,_.jsx)(h.Provider,{value:k,children:A})}),y=m.forwardRef(function(e,t){let{render:n,className:i,style:a,...o}=e;return r(`div`,e,{ref:t,props:o})}),b=m.forwardRef(function(e,t){let{render:n,className:i,style:a,...o}=e,{percentageValue:s}=g();return r(`div`,e,{ref:t,props:[{style:{insetInlineStart:0,height:`inherit`,width:`${s}%`}},o]})}),x=m.forwardRef(function(e,t){let{className:n,render:i,children:a,style:o,...s}=e,{value:c,formattedValue:l}=g();return r(`span`,e,{ref:t,props:[{"aria-hidden":!0,children:typeof a==`function`?a(l,c):l},s]})}),S=m.forwardRef(function(e,t){let{render:n,className:i,style:a,id:o,...s}=e,{setLabelId:c}=g();return r(`span`,e,{ref:t,props:[{id:d(o,c),role:`presentation`},s]})}),C=c(b,`tr-meter-indicator`),w=c(S,`tr-meter-label`);function T({className:t,max:n=100,min:r=0,value:i,variant:a=`neutral`,...o}){let s=Math.min(n,Math.max(r,Number.isNaN(i)?r:i));return(0,_.jsx)(v,{...o,className:e(`tr-meter`,t),"data-variant":a,max:n,min:r,value:s})}var E={Root:T,Track:c(y,`tr-meter-track`),Indicator:C,Value:c(x,`tr-meter-value`),Label:w},D=[`weak`,`fair`,`good`,`strong`],O={weak:`danger`,fair:`warning`,good:`info`,strong:`success`};function k(e,t){if(e.length===0)return 0;if(e.length<t.min_length)return 1;let n=[/[a-z]/,/[A-Z]/,/\d/,/[^a-zA-Z0-9]/].filter(t=>t.test(e)).length,r=e.length>=t.min_length+4;return n>=3&&r?4:n>=2&&r?3:2}function A({password:e,policy:t}){let{t:n}=i(),r=k(e,t);if(r===0)return null;let o=D[r-1];return(0,_.jsxs)(E.Root,{"aria-live":`polite`,className:`flex flex-col gap-tinyrack-xs`,max:4,min:0,value:r,variant:O[o],children:[(0,_.jsxs)(`div`,{className:`flex items-baseline justify-between gap-tinyrack-sm`,children:[(0,_.jsx)(E.Label,{render:(0,_.jsx)(a,{color:`muted`,variant:`caption`,children:n(`validation.password.strength.label`)})}),(0,_.jsx)(E.Value,{render:(0,_.jsx)(a,{color:`muted`,variant:`caption`,children:n(`validation.password.strength.${o}`)})})]}),(0,_.jsx)(E.Track,{children:(0,_.jsx)(E.Indicator,{})})]})}export{A as t};
+//# sourceMappingURL=password-strength-BeSOu_Ga.js.map